From 8ed647830ecbc76bcca805876fe7135c2350e86b Mon Sep 17 00:00:00 2001 From: Daniel Turull Date: Fri, 4 Sep 2026 14:16:00 +0200 Subject: [PATCH] libarchive: mark CVE-2026-14164 as fixed-version The RAR5 double-free in init_unpack() is a regression introduced upstream by commit 620bdafa on 2026-05-16 and existed only on the git master branch until it was fixed by PR #3071 (commit 1c914cdf) on 2026-05-24. It was never part of an upstream release. The upstream release tarballs (3.6.x/3.7.x/3.8.6) use the older init_unpack() with unchecked calloc and no early-return path, so the freed window_buf/filtered_buf pointers are never left dangling and the double-free cannot occur. References: https://nvd.nist.gov/vuln/detail/CVE-2026-14164 https://lore.kernel.org/openembedded-core/0447ebc9d29b0736de8ba0c75f155ed4f880d072.camel@pbarker.dev/ (From OE-Core rev: 6bc3e86bab4af0762400cb86f0b6932d6fa50433) Signed-off-by: Daniel Turull Signed-off-by: Yoann Congal Signed-off-by: Paul Barker --- meta/recipes-extended/libarchive/libarchive_3.7.9.bb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb index b36632cc1f..2eb22e2d61 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb @@ -84,3 +84,8 @@ ALTERNATIVE_LINK_NAME[cpio] = "${base_bindir}/cpio" ALTERNATIVE_TARGET[cpio] = "${bindir}/bsdcpio" BBCLASSEXTEND = "native nativesdk" + +CVE_STATUS[CVE-2026-14164] = "fixed-version: Double-free regression in the RAR5\ + reader's init_unpack() was introduced upstream by commit 620bdafa (2026-05-16) and existed\ + only on the git master branch until the fix in PR #3071 (commit 1c914cdf, 2026-05-24). It was\ + never part of an upstream release tarball."