When moving the updated CVE database file to the downloads directory,
ensure that it has a different inode number to the previous version of
this file.
We have seen "sqlite3.DatabaseError: database disk image is malformed"
exceptions on our autobuilder when trying to read the CVE database in
do_cve_check tasks. The context here is that the downloads directory
(where the updated database file is copied to) is shared between workers
as an NFS mount. Different autobuilder workers were seeing different
checksums for the database file, which indicates that a mix of both new
and stale data was being read. Forcing each new version of the database
file to have a different inode number will prevent stale data from being
read from local caches.
This should fix [YOCTO #16086].
(From OE-Core rev: 8aca19cff468c5f15c919c973c46be58e020af46)
Signed-off-by: Paul Barker <paul@pbarker.dev>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f63622bbec1cfaca6d0b3e05e11466e4c10fa86e)
[YC: removed cve-update-db-native part, file was removed in
17eb0788514 (cve-update-db-native: remove, 2023-06-23)]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Release notes are here:
https://dev.gnupg.org/T8233.html
Update contains fix for CVE-2026-41989 and because of building error patch need to be
updated to fix compile flags in new version.
(From OE-Core rev: b06db09b3e8199014b125e3307ba4ae351ad2938)
Signed-off-by: Jakub Szczudlo <jakubszczudlo40@gmail.com>
[YC: upgrades contains
"mpi/ec-inline: refactor i386 assembly to reduce register usage" which
looks like optimisation but it is actually a fix for a build failure.
See: https://dev.gnupg.org/T6892.html]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The openssh commit fd1c7e131f331942d20f42f31e79912d570081fa fixes 2 CVEs:
CVE-2026-35414 and CVE-2026-35387.
CVE-2026-35414:
| OpenSSH before 10.3 mishandles the authorized_keys principals option
| in uncommon scenarios involving a principals list in conjunction
| with a Certificate Authority that makes certain use of comma
| characters.
The match_principals_option() function is fixed. Before this fix:
When matching an authorized_keys principals="" option against a list of
principals in a certificate, an incorrect algorithm was used that could
allow inappropriate matching in cases where a principal name in the
certificate contains a comma character. Exploitation of the condition
requires an authorized_keys principals="" option that lists more than
one principal *and* a CA that will issue a certificate that encodes more
than one of these principal names separated by a comma (typical CAs
strongly constrain which principal names they will place in a
certificate). This condition only applies to user- trusted CA keys in
authorized_keys, the main certificate authentication path
(TrustedUserCAKeys/AuthorizedPrincipalsFile) is not affected.
CVE-2026-35387:
| OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of
| any ECDSA algorithm in PubkeyAcceptedAlgorithms or
| HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA
| algorithms.
The rest of the patch allows to correctly match ECDSA signature algorithms
against algorithm allowlists.
The full explanation can be found on debian repository:
ae190b6440
(From OE-Core rev: c871a726471a37e46ba10afe7d93b5e0e3de8cdb)
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This patch applies the upstream v10.0.9 stable backport for
CVE-2026-2243. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commit links are recorded in the embedded patch headers
when the fix expands to multiple commits.
[1] 37ff880a12
[2] https://access.redhat.com/security/cve/CVE-2026-2243
(From OE-Core rev: 9d20ff0a25cf9822c1164baaf0a319985c5cc88f)
Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This patch applies the upstream v10.0.8 stable backport for
CVE-2026-0665. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commit links are recorded in the embedded patch headers
when the fix expands to multiple commits.
[1] 4ba877461e
[2] https://access.redhat.com/security/cve/CVE-2026-0665
(From OE-Core rev: c66315d7276db8f65794cf514689301b027b13eb)
Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This patch applies the upstream v10.0.8 stable backport for
CVE-2025-14876. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commit links are recorded in the embedded patch headers
when the fix expands to multiple commits.
[1] e649201bb9
[2] https://access.redhat.com/security/cve/CVE-2025-14876
(From OE-Core rev: 2e1f2bbf21f332dd34cff915e06a8545bc974cca)
Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Regenerated to fix this warning:
WARNING: linux-yocto-6.6.142+git-r0 do_cve_check: Kernel CVE status needs updating: generated for 6.6.127 but kernel is 6.6.142
$ ./meta/recipes-kernel/linux/generate-cve-exclusions.py .../cvelistV5/ 6.6.142 > meta/recipes-kernel/linux/cve-exclusion_6.6.inc
Generated at 2026-07-07 17:39:10.952928+00:00 for kernel version 6.6.142
From cvelistV5 cve_2026-07-07_1600Z
(From OE-Core rev: 923038b75d09c0966ec42b1460faf306adecc8c2)
Signed-off-by: Esa Jaaskela <esa.jaaskela@suomi24.fi>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Backport patch to fix CVE-2026-6276.
https://nvd.nist.gov/vuln/detail/CVE-2026-6276
The upstream fix moves cookiehost from the connection-scoped aptr struct
to the per-request SingleRequest struct, preventing cookie data from
leaking across reused handles.
Adapted for curl 8.7.1:
- Use Curl_safefree (renamed to curlx_safefree in later versions)
- Use conn->host.name (changed to data->conn->host.name upstream)
- Keep existing header parsing structure (refactored upstream)
- Dropped tests
Upstream fix:
3a19987a87
Tested with ptest:
Before: PASSED: 857, FAILED: 0, SKIPPED: 0
After: PASSED: 857, FAILED: 0, SKIPPED: 0
(From OE-Core rev: 6459b4629bfd71ab147257f9d257e3e1626b74f3)
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
[YC: copy the backport info from commit message into the patch file itself]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
libcurl's SMB handler marks connections for reuse (connkeep) without
verifying that subsequent requests target the same share. This allows
a second SMB request to the same host to reuse a connection
authenticated for a different share, potentially accessing data
without proper authorization.
The upstream fix removes connection reuse for SMB entirely in
lib/protocol.c, a file introduced in curl 8.20.0. For 8.7.1, the
equivalent fix is changing connkeep() to connclose() in lib/smb.c,
which prevents the connection from being returned to the pool.
Tested with SMBv1 server (Docker dperson/samba):
Without patch: "Re-using existing connection" for different shares
With patch: New connection per request, no reuse
Binary verified: Curl_conncontrol arg changes from 0 (KEEP) to 1 (CLOSE)
Reference: https://curl.se/docs/CVE-2026-5773.html
(From OE-Core rev: 7736f905e78162ac657d7a1c790dfa5701dd6b19)
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
[YOCTO #16321]
In version 1.9.17p2, the line that the recipe uses to add the 'wheel'
group to the sudoers file does not exist. This updates the sed usage to
the actual line in question.
(From OE-Core rev: 55f7bf8cd9516971d6d01c1c890bc4c1df62b008)
Signed-off-by: Nate Kent <nathan@otiv.ai>
Tested-by: Siva Balasubramanian <sivakumar.bs@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 76231f202a437be221c2580d4fa0fc100c453e92)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Fix various broken links found using the linkcheck builder, in various
places of the documentation. For most, the replacing link is the
equivalent new link.
(From yocto-docs rev: 5f708a1bc31ae94dd3513615b0ce079aa7897628)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 358519ca6406a89fee42c45dcaf63a37a374f33c)
[AG: fix conflict in variables.rst, due to changes to new variables in master]
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
VMWare Player has been discontinued in 2024 so remove the link. What
seems to be remaining is VMWare Fusions and Workstation so provide that
link only.
(From yocto-docs rev: f139c98f658e83328169cb90d119855e43a5bc83)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 7c969dcbebf5cccb28ccbf2370dc8b52cbd08974)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
I found this one by looking at the archive of the link on
https://web.archive.org and then locating the thread on
lists.yoctoproject.org by its title.
(From yocto-docs rev: a39ce713ec34964776cb7562c6bd7dad9e4b675d)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 5e792ff01d463a7eca21b7be50124d7c10ff8559)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Fix link that forget to add a leading '/', by looking at the output of
'grep -E -r --no-filename -o 'href="http.://[^/"]+' | sort | uniq' in
the HTML output.
(From yocto-docs rev: 5e1aade33c75ce58bfb20f0118a0c862b03f7b7b)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 12a5d2add529e789480fa782af3803dada982869)
[AG: fix conflicts: only applies to
migration-guides/release-notes-3.4.2.rst]
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Add this variable to the variables glossary, and add links to it and
back to the do_strip() task for completeness.
(From yocto-docs rev: cc4b7ffb3b2558ae796decbd216302e253addf02)
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit f43fc622d2fd6bc832a2993841b2020f86c6475c)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Those are part of the features_check class.
(From yocto-docs rev: 297003a537798e6a4beafdd4ad520ed1c47c355a)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit fb38ef19e67b31f855bddb61ad990020d5cef234)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
It's not clear why the non-existent "kernel_menuconfig" task was
documented in the reference manual, but it does not appear to have
ever existed so delete all references to it and replace with pointers
to rewritten "menuconfig" task.
(From yocto-docs rev: 5bd2aab3ad66bcc9f0b58e1b0643d71697a63da7)
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit fdeabae4ba20e34c428ceb133ad41c4f3fedcf24)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
As discussed in a patch review call, we don't need License-Update tags
in commits where the upstream license has not changed, and we are
instead changing the LICENSE variable to fix incorrect data.
(From yocto-docs rev: d4e19136ffee4fabfdfc5048835da64f0cfbb3eb)
Signed-off-by: Paul Barker <paul@pbarker.dev>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit db04faf56afded6c5f846cc60a9062e0a1ffa741)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Using /git/ in our urls is rather old school and not the preferred format now.
Update the urls to the preferred form even if the other ones still work.
(From OE-Core rev: 50f40609b27c169e9da1f076172daabbf55732d0)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8ac7c0c3493a6141476093bb2c1c79004c55857d)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
