p11-kit: Fix CVE-2026-18938

Pick patch according to [2]

[1] https://nvd.nist.gov/vuln/detail/cve-2026-18938
[2] https://ubuntu.com/security/CVE-2026-18938

(From OE-Core rev: 65db9618c3e80ca3fb6d87bea1153de554144165)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>

meta/recipes-support/p11-kit/files/CVE-2026-18938.patch

@@ -0,0 +1,52 @@
+From 3e64244e538550c6a7fcf826fa8c50a4604416dc Mon Sep 17 00:00:00 2001
+From: Zoltan Fridrich <zfridric@redhat.com>
+Date: Thu, 6 Aug 2026 11:39:22 +0200
+Subject: [PATCH] rpc: guard against overflow when decoding nested attributes
+ (CVE-2026-18938)
+
+A local attacker, or one with equivalent access to a reachable RPC channel,
+could exploit an integer overflow vulnerability. By sending specially crafted
+messages, the attacker can cause the system to miscalculate memory allocation
+for nested attributes. This leads to a memory corruption issue, specifically
+a heap out-of-bounds write, which can crash the p11-kit RPC parsing process,
+resulting in a Denial of Service (DoS). This vulnerability is only exploitable
+on 32 bit systems.
+
+Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
+
+Upstream-Status: Backport [https://github.com/p11-glue/p11-kit/commit/3e64244e538550c6a7fcf826fa8c50a4604416dc]
+CVE: CVE-2026-18938
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ p11-kit/rpc-message.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/p11-kit/rpc-message.c b/p11-kit/rpc-message.c
+index d6f0aad..105a4f1 100644
+--- a/p11-kit/rpc-message.c
++++ b/p11-kit/rpc-message.c
+@@ -1160,6 +1160,10 @@ p11_rpc_buffer_get_attribute_array_value (p11_buffer *buffer,
+ 	if (!p11_rpc_buffer_get_uint32 (buffer, offset, &count))
+ 		return false;
+ 
++	/* Guard against overflow */
++	if (count != 0 && (SIZE_MAX / count) < sizeof (CK_ATTRIBUTE))
++		return false;
++
+ 	if (!value) {
+ 		memset (&temp, 0, sizeof (CK_ATTRIBUTE));
+ 		attr = &temp;
+@@ -1191,6 +1195,10 @@ p11_rpc_buffer_get_mechanism_type_array_value (p11_buffer *buffer,
+ 	if (!p11_rpc_buffer_get_uint32 (buffer, offset, &count))
+ 		return false;
+ 
++	/* Guard against overflow */
++	if (count != 0 && (SIZE_MAX / count) < sizeof (CK_MECHANISM_TYPE))
++		return false;
++
+ 	if (!value) {
+ 		memset (&temp, 0, sizeof (CK_MECHANISM_TYPE));
+ 		mech = &temp;
+-- 
+2.43.0
+

meta/recipes-support/p11-kit/p11-kit_0.25.3.bb

@@ -13,6 +13,7 @@ DEPENDS:append = "${@' glib-2.0' if d.getVar('GTKDOC_ENABLED') == 'True' else ''
 SRC_URI = "gitsm://github.com/p11-glue/p11-kit;branch=master;protocol=https \
            file://fix-parallel-build-failures.patch \
            file://CVE-2026-13757.patch \
+           file://CVE-2026-18938.patch \
            "
 SRCREV = "917e02a3211dabbdea4b079cb598581dce84fda1"
 S = "${WORKDIR}/git"