Analysis:
- The vulnerable code for CVE-2026-51401 is in src/os_vms.c. [1]
- src/os_vms.c is VMS-specific and is not compiled for Linux builds.
- Record the not-applicable-platform status; no source patch is required.
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-51401
(From OE-Core rev: df8f6b0403190429cc424638e26db1bfd7b9f53e)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Analysis:
- The vulnerable code for CVE-2026-51400 is in src/os_vms.c. [1]
- src/os_vms.c is VMS-specific and is not compiled for Linux builds.
- Record the not-applicable-platform status; no source patch is required.
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-51400
(From OE-Core rev: 7851ee1883615e9d8610c44e97eeb51bafbe9f66)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The --initial-rev option had no selftest coverage. Extend
test_devtool_update_recipe to run update-recipe with --initial-rev
set to the recorded initial revision, which should match the default
output, and to a revision partway through the local commits, which
should export only the commits after it.
AI-Generated: Uses Claude (claude-fable-5)
(From OE-Core rev: c2c94a081d812c4712726cb5fc59b878af600cc0)
Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 171af3b2915dd076c8d1b205ff75eac1ebd5a586)
[Adjusted for scarthgap: also takes the cleanup_cmd change to this test
from de635a9bc0 ("mdadm: fetch from git"), which the new steps rely on]
Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Since 900129cbdf ("devtool: add support for git submodules") the
--initial-rev option of update-recipe and finish has been broken: the
parse loop in _get_patchset_revs() deliberately skips the recorded
"# initial_rev ." entry from the workspace bbappend when an override
is passed, but the override value itself is never inserted into the
initial_revs dict. For a recipe without submodules the dict therefore
ends up empty and update-recipe/finish fails in patch mode with:
ERROR: Unable to find initial revision - please specify it with
--initial-rev
i.e. passing --initial-rev produces the very error message that
instructs the user to pass --initial-rev. Before 900129cbdf the passed
value simply took precedence over the one recorded in the bbappend.
Seed initial_revs with the override before parsing so the option
behaves as documented again; recorded values are still used for
submodules and for the main repo when no override is given.
AI-Generated: Uses Claude (claude-fable-5)
(From OE-Core rev: ea008fd0d08e13a408e88f54347aee0f8c23fd9c)
Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 62abb60b899e63ea6db5c745f4b1b6af0d4b40f1)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
libaio has moved to Codeberg as pagure.io will be closed down shortly.
(From OE-Core rev: 30151c54ac1d729e5ec0778861fb3d843a260d99)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit 237c32e181cd47194c3877d220360d6e6fbb2af8)
[YC: dropped the tag= SRC_URI parameter which does not mean the same
thing as in master. In bitbake=2.8/scarthgap, "tag=" conflicts with
SRCREV instead of checking it against the remote tag. ]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The kickstart reference documents "partition" as a synonym for "part".
wic does not accept it: its parser registers only part, bootloader and
include, so a .wks line beginning "partition" fails with an
invalid-choice error.
The synonym was real while wic used a bundled pykickstart, whose command
table mapped both spellings to one handler. Replacing that with a parser
carrying only the options wic uses kept "part" alone, and the manual was
not updated to match.
AI-Generated: codex/claude-opus 5 (xhigh)
(From yocto-docs rev: a34ca7357403feea970d27909e3529cf18e708d5)
Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 3a52e763346647f2edf23dee4ed28ede5ba5c22b)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
When we unpack sstate files, we want to update the mtime+atime of the sstate
object and any sig/siginfo files, both for the files themselves and symlinks.
The logic was getting a bit hard to follow and wasn't entirely consistent with
only a time in some cases.
Clean it up and be consistent for all the files.
(From OE-Core rev: 147004ef60987039372c977e6c2f304a5414f39f)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5213ca88cbec4e86b50d8da1fe4c300ca8f5de17)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: for [YOCTO #15289] ]
Signed-off-by: Paul Barker <paul@pbarker.dev>
If we touch sstatefile, we should also touch any .sig/.siginfo file if we can.
We try and keep them both updated with accesses so one isn't removed without
the other and they stay consistent.
[YOCTO #15289]
(From OE-Core rev: 2bd595a9d95fac64174a25759124a0aa3d0dd001)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit cc07895f951140dbbffcf32d3eabf65788cc4d00)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Unusual upgrade for expat to version 2.8.3
This is because there is a lot of CVEs and some are bigger than 20+ commits
so maintaining them is difficult
In new version there are fixes for CVE-2026-50219, CVE-2026-56131,
CVE-2026-56412, CVE-2026-72522 that was not backported yet
No braking ABI changes only 3 functions was added:
3 Added functions:
[A] 'function XML_Bool XML_SetAllocTrackerActivationThreshold(XML_Parser, long long unsigned int)' {XML_SetAllocTrackerActivationThreshold}
[A] 'function XML_Bool XML_SetAllocTrackerMaximumAmplification(XML_Parser, float)' {XML_SetAllocTrackerMaximumAmplification}
[A] 'function XML_Bool XML_SetHashSalt16Bytes(XML_Parser, const uint8_t*)' {XML_SetHashSalt16Bytes}
SONAME name stays the same as it was before - libexpat.so.1
Build all find package that depends on expat:
python3-xml fontconfig python3-xmltodict apr-util libxml-parser-perl exiv2
graphviz libdbus-c++ libwmf log4c neon poco polkit sdbus-c++ sdbus-c++-tools
wbxml2 apache2 lftp unbound wireshark libmusicbrainz mpd gegl
Tested using ptests for python3-xmltodict apr-util libxml-parser-perl
and expat itself
There is already planned expat 2.8.4 release but CVE fix there are small
and thus maintainable
Changelog notes here:
https://github.com/libexpat/libexpat/blob/R_2_8_3/expat/Changes
(From OE-Core rev: 408425eee8d281188a0f8b8e3e535e7c3af99f12)
Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: CVE-2026-72522 was ignored in the meantime, I removed the
CVE_STATUS line]
Signed-off-by: Paul Barker <paul@pbarker.dev>
Backport six commits from upstream glibc to fix CVE-2026-6238.
4ba0b79b95 resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
a7b60d23bb resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
cd0db208d5 resolv: Check for inet_ntop failure in ns_sprintrrf
d58415eb17 resolv: Improve formatting of unknown records in ns_sprintrrf
f69b7f95e3 resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289)
360f352c9a resolv: Declare __p_class_syms, __p_type_syms for internal use
The upstream patch series [PATCH 0/5] contains five commits:
1/5: Update GLIBC-SA-2026-0012 to mention A6 records (doc only)
2/5: resolv: Check for inet_ntop failure in ns_sprintrrf
3/5: resolv: Remove incorrect parts of TSIG handling from ns_sprintrrf
(CVE-2026-5435)
4/5: resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
5/5: resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
For this backport:
- Patch 1/5 is skipped (documentation-only change to advisories,
upstream glibc itself does not backport this to older releases)
- Patch 3/5 (CVE-2026-5435) is already patched in scarthgap sources
- Patches 2/5, 4/5, and 5/5 are backported as:
0028-CVE-2026-6238-0004.patch (inet_ntop failure check)
0029-CVE-2026-6238-0005.patch (buffer overread fix - CVE-2026-6238)
0030-CVE-2026-6238-0006.patch (test case for bug 34033, bug 34069)
However, the test case (tst-ns_sprintrr) from patch 5/5 failed on
scarthgap's glibc 2.39 due to missing prerequisite commits. Three
additional patches were backported to resolve the test failure:
0025-CVE-2026-6238-0001.patch (Declare __p_class_syms, __p_type_syms for internal)
0026-CVE-2026-6238-0002.patch (Fix ns_sprintrrf formatting of class, type values)
0027-CVE-2026-6238-0003.patch (Improve formatting of unknown records in ns_sprintrrf)
CVE-2026-6238 fixes buffer overreads in ns_sprintrrf affecting A6 and
LOC record handling. The vulnerable LOC record handling was introduced
before glibc 2.0, while A6 record handling was added in glibc 2.7.
Reference:
https://inbox.sourceware.org/libc-alpha/cover.1777546194.git.fweimer@redhat.com/https://nvd.nist.gov/vuln/detail/CVE-2026-6238https://sourceware.org/bugzilla/show_bug.cgi?id=34069
Testing Results:
Before After Diff
PASS 4896 4897 +1
XPASS 4 4 0
FAIL 372 372 0
XFAIL 16 16 0
UNSUPPORTED 224 224 0
Changes in testcases:
testcase-name before after
resolv/tst-ns_sprintrr(new) - PASS
commit - 4ba0b79b95 resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
+PASS: resolv/tst-ns_sprintrr
(From OE-Core rev: 7761a8aaac0703a738a2a4979ddb015157374dcb)
Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: fixed patch format]
Signed-off-by: Paul Barker <paul@pbarker.dev>
Using bash to handle execution parameters isn't a great idea, particularly using
os.system. In theory this could be exploited by injecting shell code through the
placeholders although whether this can be done without security tokens is unclear.
Regardless, we have been cleaning up shell=True and similar calls in the codebase.
Instead use shlex to parse the callback command, then we can iterate the parameters
to perform any expansions needed and avoid the need to call any shell expansion.
Any invalid data will then just become an invalid image target to bitbake.
Reported-by: Lei Zhang <18792670849@163.com>
(Bitbake rev: d3b32587c2314febf96897f97e0172790b4fc1cf)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Paul Barker <paul@pbarker.dev>
When SDKMACHINE is set to i686 or i586, nativesdk binaries are compiled
as 32-bit. Without -D_TIME_BITS=64 and -D_FILE_OFFSET_BITS=64, stat()
and time-related syscalls use 32-bit types, causing EOVERFLOW on
filesystems with large inode numbers (e.g. container overlay filesystems)
and Y2038 issues.
Add SDK_CC_ARCH appends for class-nativesdk:i686 and class-nativesdk:i586
using GLIBC_64BIT_TIME_FLAGS, mirroring how target architectures are
handled.
The existing GLIBC_64BIT_TIME_FLAGS:pn-glibc override only matches the
target recipe, not the class extended nativesdk-glibc, so an additional
pn-nativesdk-glibc override is needed here. This is required on
scarthgap but not on master/wrynose, because scarthgap carries glibc
2.39, which predates glibc commit a4ed0471d717 ("Always define
__USE_TIME_BITS64 when 64 bit time_t is used"). In 2.39 the header
redirect turns sigtimedwait into an alias of __sigtimedwait64, which
then collides with glibc's own weak_alias() and fails to assemble:
Error: symbol '__sigtimedwait64' is already defined
Also exclude nativesdk-mingw-w64-runtime. The MinGW runtime provides the
Windows CRT rather than glibc, and _FILE_OFFSET_BITS=64 changes its
stat declarations. That causes conflicting declarations for wstat when
building the CRT itself.
(From OE-Core rev: 07ca97baad7b182849ee50f0bd629b68dc9f53b3)
Signed-off-by: Peter Tatrai <peter.tatrai.ext@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d9f62a45555673842021d5746437e66c40d3f3cc)
Signed-off-by: Peter Tatrai <peter.tatrai.ext@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Analysis:
- The problem only exists when curl is built with libpsl support enabled.[1]
- The recipe is built with "--without-libpsl" option.
- Hence, ignoring the CVE for this recipe.
Reference:
[1] https://curl.se/docs/CVE-2026-82209.html
(From OE-Core rev: a3804a343732b601c06167ec6414b69850992897)
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
ROOTFS_BOOTSTRAP_INSTALL in image.bbclass unconditionally stages
run-postinsts into every image. When no delayed postinsts remain,
_uninstall_unneeded() is supposed to remove it again, but the removal
call used the bare "run-postinsts" package name without applying
MLPREFIX.
On a multilib image (e.g. lib32-core-image-minimal), the package that
is actually installed is lib32-run-postinsts, so the unprefixed
removal silently matches nothing and run-postinsts leaks into the
final image manifest, along with its now-pointless init script /
systemd unit.
Expand MLPREFIX before removing the package, matching the pattern
already used elsewhere in oe-core (e.g. oe/package.py) for
package-name lookups that need to work across multilib variants.
(From OE-Core rev: 2522a1ad4fb66af0a9ca146ca7a88aece8f471da)
Signed-off-by: Kyungjik Min <dp.min@lge.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit dfa5673907bdc5211671ecdfce8ab1fb332eae48)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Devansh Patel
Hetvi Thakar
Peter Marko
Babanpreet Singh
Rohini Sangam
Jakub Szczudlo (Nokia)
Ross Burton
Trevor Woerner
Paul Barker
Yogita Urade
Richard Purdie
Tim Orling
Deepesh Varatharajan
Peter Tatrai
Siddharth Doshi
Vijay Anusuri
Kyungjik Min