Commit Graph

76161 Commits

Author SHA1 Message Date
Sudhir Dumbhare
247c484238 openssh: set status for CVE-2026-3497
Analysis:
 - CVE-2026-3497 affects downstream OpenSSH GSSAPI Key Exchange patches.
 - The vulnerable code uses sshpkt_disconnect() in the GSSAPI KEX server path.
 - Upstream OpenSSH/OE-Core does not carry the vulnerable GSSAPI key-exchange delta.
 - Hence ignoring the CVE for this version.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-3497
https://github.com/advisories/ghsa-wcpp-3x59-h8vp
https://ubuntu.com/security/CVE-2026-3497
https://security-tracker.debian.org/tracker/CVE-2026-3497
https://www.openwall.com/lists/oss-security/2026/03/12/3

(From OE-Core rev: d8d7b0e9fa678bc67de3da8b7cddbda6c43086b8)

Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c2bd43b373d65d717e606cab3793b8a64facd946)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:55 +01:00
Aleksandar Nikolic
3b4d998c7a wic: Fix updating fstab for nvme devices
In case wks file references nvme, update_fstab() function will not add
prefix 'p' before the partition number, as the if condition only takes
mmcblk into consideration.

In case of nvme0n1 this leads that following entries are added to fstab:

    /dev/nvme0n11
    /dev/nvme0n13

instead of:

    /dev/nvme0n1p1
    /dev/nvme0n1p3

The patch fixes this as it extends the if condition and adds prefix 'p' for
both mmcblk and nvme.

Upstream-Status: Backport [https://git.yoctoproject.org/wic/commit/?id=f20cda73b495b75ef399c331f59b0e2401a3e76a]
(From OE-Core rev: 5dde0ae4c9592091935eca63beacd3af28ac508a)

Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:55 +01:00
Sudhir Dumbhare
a184998193 python3-urllib3: fix CVE-2026-44431
Applies the upstream fix [1] referenced in [2] and addresses the
sensitive-header redirect handling issue in proxied low-level urllib3 requests.

[1] 5ec0de499b
[2] https://ubuntu.com/security/CVE-2026-44431

References:
https://nvd.nist.gov/vuln/detail/CVE-2026-44431

(From OE-Core rev: a7f0523f5ff7a8fef611d30ad41b12d73eecec8c)

Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:55 +01:00
Hugo SIMELIERE (Schneider Electric)
3d80d019e6 libcap: Fix CVE-2026-4878
Pick patch from [1] as mentioned in Debian report in [2].

[1] https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=286ace1259992bd0c5d9016715833f2e148ac596
[2] https://security-tracker.debian.org/tracker/CVE-2026-4878

(From OE-Core rev: f53beec471b04c818db7c3834c9af67956c548ec)

Signed-off-by: Hugo SIMELIERE (Schneider Electric) <hsimeliere.opensource@witekio.com>
Reviewed-by: Bruno VERNAY <bruno.vernay@se.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:55 +01:00
Theo Gaige
8a839ef416 expat: patch CVE-2026-45186
Backport patches from [1] also mentioned in [2].

[1] https://github.com/libexpat/libexpat/pull/1216
[2] https://security-tracker.debian.org/tracker/CVE-2026-45186

(From OE-Core rev: aa81f5c9a7e1243b9467b51388798dc0dd5a7aad)

Signed-off-by: Theo Gaige <tgaige.opensource@witekio.com>
Reviewed-by: Bruno Vernay <bruno.vernay@se.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:55 +01:00
Peter Marko
c5f228145b expat: patch CVE-2026-41080
Pick github PR [1] mentioned in [2].
* 969af8f4654ce50d837bb9199a73d1d02d2c7e16..4ba09dc471b39a78d77e5179d0243186c0c4ff7a
* dropped code which doesn't exist in 2.6.4 yet (github actions, map
  file)
* resolved minor conflicts (formatting)
* picked 2 additional commits to apply the code cleanly

[1] https://github.com/libexpat/libexpat/pull/1183
[2] https://security-tracker.debian.org/tracker/CVE-2026-41080

(From OE-Core rev: 273968c71fbf4a376996df555a8283bf63674ae8)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
[YC: See discussion :
https://lore.kernel.org/openembedded-core/2030b4435c8bc81bb4452637c0517ac33ab94d20.camel@pbarker.dev/T/#m56c5da4033c2f3571027c2745431178064ea1b5d ]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:55 +01:00
Vijay Anusuri
9c72283ec8 tzdata/tzcode-native: upgrade 2026b -> 2026c
This release contains the following changes:

   Briefly:
     Alberta moved to permanent -06 on 2026-06-18.
     Morocco moves to permanent +00 on 2026-09-20.
     More integer overflow bugs have been fixed in zic.

   Changes to future timestamps

     Alberta’s 2026-03-08 spring forward was its last foreseeable clock
     change, as it moved to permanent -06 thereafter.  (Thanks to Roozbeh
     Pournader and others.)  Model this with its traditional abbreviation
     CST.  Although the change to permanent -06 legally took place on
     2026-06-18, temporarily model the change to occur on 2026-11-01 at
     02:00 instead, for the same reason we introduced a similarly
     temporary hack for British Columbia in 2026b.

       Although another TZDB release will likely be needed soon because
       Northwest Territories will likely follow Alberta, the legal
       formalities have not yet taken place.

     Morocco plans to move back to permanent UTC, without daylight
     saving time transitions, on 2026-09-20 at 02:00.  This also
     affects Western Sahara.

   Changes to code

     zic no longer overflows integers when processing outlandish input
     like ‘Zone Ouch 0 - LMT 9223372036854775807’, ‘Zone Ouch 0
     2562047788015215 LMT’, ‘Zone Ouch -2562047788015215:30:08 - LMT’,
     and ‘Zone Ouch -2562047788015215:30:08 - %%z’.  This avoids
     undefined behavior in C.  (Problems reported by Naveed Khan.)

     On platforms that have EFTYPE, tzalloc now fails with errno set to
     EFTYPE, not EINVAL, if it detects that the TZif file has an
     invalid format or is not a regular file.  Formerly it did this
     only on NetBSD, and only when the file was not a regular file.

     Unprivileged programs no longer require TZif files to be regular
     files or reject relative names containing ".." components.  This
     reverts to the more-permissive 2025b behavior, as the stricter
     behavior did not catch on in FreeBSD.

     zic now reports any failure to remove a temporary file when
     cleaning up after a previous failure.  (Problem reported by Tom
     Lane.)

   Changes to commentary

     Northwest Territories is expected to move to permanent -06 prior to
     2026-11-01 02:00, when clocks would otherwise fall back.  (Thanks to
     Tim Parenti and James Bellaire.)  Model this with its traditional
     abbreviation CST.  Unfortunately the change is not yet official, so
     it is currently present only as comments that can be uncommented as
     needed.

   Changes to build procedure

     The undocumented ‘typecheck’ Makefile check rule has been removed.
     It stopped working in 2025a and evidently nobody noticed.
     The rule was superseded by ‘check_time_t_alternatives’ in 2013d.

Ref: https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/NVHSX2PAQIT44U5FCCEVNJJYXQMMTJSA/

(From OE-Core rev: 41f3415d03bf85e9bf18fc960ab6e08c376a4abf)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 33a7e1170b0c8ba83cdb4c7d6d9f83f6c194baed)
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:55 +01:00
Deepak Rathore
fca50b3652 util-linux: fix CVE-2026-13595
This patch applies the upstream stable/v2.41 backport for
CVE-2026-13595. The upstream fix merge or commit is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commit links are recorded in the embedded patch headers
when the fix expands to multiple commits.

[1] 132d9c8aa1
[2] https://access.redhat.com/security/cve/CVE-2026-13595

(From OE-Core rev: 9f4a0789961def89303e6e8a211c944e41c29cab)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:55 +01:00
Jaipaul Cheernam
865d0fd2d6 gzip: fix CVE-2026-41992
Backport upstream fix for a global buffer overflow in the LZH
decompression logic (unlzh.c). The left[] and right[] global arrays
shared across LZW and LZH decompression routines are not reinitialized
between files processed in the same invocation, allowing an
out-of-bounds read in the LZH decoder.

Adapted for gzip 1.13:
- Refreshed NEWS and THANKS hunks to match 1.13 release context.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-41992
(From OE-Core rev: db470c65798b4a90a5c1c333d61f3a531cca75cc)

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit deaaaacabbf8d21fb9271e3f6f83055893510cff)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:54 +01:00
Peter Marko
9a906f991a rootfs: move tasks using image_list_installed_packages to postuninstall
Since some packages can be uninstalled, any task querying installed
packages should be run only after both installation and uninstallation
is completed.

(From OE-Core rev: d79423d3a1b8cabdf7c0383de2b5460a9725d912)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: c3097962ac925538e99b17b771c541950a8b8c26)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:54 +01:00
Peter Marko
46891dba64 vex: remove obsolete semicolon
Usage of semicolon as separator in ROOTFS/IMAGE_*COMMAND was deprecated
long time ago.
Remove it.

(From OE-Core rev: cf0d89407e6b44c8fa4033cc0032dd270351172a)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 311d418d22a609fb54b87bfc909bdd1861892228)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:54 +01:00
Peter Marko
21137ce7bb socat: patch CVE-2026-56123
Pick the only commit in release 1.8.1.2.
This release has a note for this CVE which was added by this commit.

Drop change in VERSION file (as we're not upgrading).
Resolve minor conflicts in CHANGES and test.sh.

Since we're not running tests, it's not worth to pick next commit from
1.8.1.3 which is fixing test on non-bash shell systems.

(From OE-Core rev: 043f99712f596054d54dded6a0f8bb3c77e36566)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
[YC: project git repo seem down. A mirror is here:
https://third-party-mirror.googlesource.com/socat/+/d44cd1cc4fbb70a9ae9e71890024ae8367fcb912%5E%21/ ]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:54 +01:00
Jaipaul Cheernam
515c8e27b7 bzip2: Fix CVE-2026-42250
This patch applies the upstream fix as referenced in [1], using the commit shown in [2].

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-42250
[2] https://sourceware.org/cgit/bzip2/commit/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67

(From OE-Core rev: 2ae360e0f03c70f376226f4cbb5fd7d61b7bae99)

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bf39a3c0497023e96de11444579ffef31f968bcd)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:54 +01:00
Benjamin Robin (Schneider Electric)
0c2fa146c5 python3: fix CVE-2026-9669
bz2.BZ2Decompressor objects could be reused after a decompression error.
If an application caught the resulting OSError and retried with the same
decompressor, crafted input could cause the decompressor to resume from an
invalid internal state and perform out-of-bounds writes to a stack buffer.
This could crash the process when processing untrusted data.

This CVE has a CVSS 4.0 score of 8.2. The patch (5755d0f08394) is
referenced in the CVEList database.

(From OE-Core rev: 226831c16d13133e89d3405b5e2298bb6571bed6)

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:54 +01:00
Benjamin Robin (Schneider Electric)
96f1bb2af7 python3: fix CVE-2026-11972
When using the "tarfile" module with a file opened in "streaming mode"
(mode="r|") the tarfile module did not properly handle EOF, making archive
parsing take exponentially longer.

(From OE-Core rev: 9c066bcd634e7b938a10c64ef1eaf322a99ec434)

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bbd9c82298880ab61b9befea97dfe8a0a4943836)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:54 +01:00
Benjamin Robin (Schneider Electric)
ca405952dc python3: fix CVE-2026-11940
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed
by a crafted archive where a hardlink references a symlink stored at a
deeper name than the hardlink itself.

(From OE-Core rev: a76513212f1830fbda2dc6a243943a3c1a011239)

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:54 +01:00
Kris Gavvala
f55e6c80f1 python3: skiptest tracemalloc_track_race
In python3 ptests, tracemalloc_track_race fails with a segfault.
To avoid ptest failures for now, skip the test.

Fixes [YOCTO #16182]
Upstream Issue: https://github.com/python/cpython/issues/143143

(From OE-Core rev: 09adf3945b681bbc9eaa89cdad8fbb17191fd7d3)

Signed-off-by: Kris Gavvala <kris.gavvala@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 7504490ba5e6ce0317dd12bdb961542062f05830)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:54 +01:00
Mathieu Dubois-Briand
cd6939b8ba python3: Simplify ptest exclusion list
Makes the exclusion list a bit more readable, avoiding very long sed
expression lines.

[Kris Gavvala]:
this commit was modified to fit scarthgap. the original commit expects
to skip test_timerfd_TFD_TIMER_ABSTIME, test_date_locale2 and test_null_dlsym.
These tests were not being skipped on scarthgap so were removed from the
backport.

(From OE-Core rev: 649b6848ccd4aa3842b2b42b03058511e4f07ce3)

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Kris Gavvala <kris.gavvala@windriver.com>
(cherry picked from commit d9a44e7390d7c8f2c2b73572825a6f8ceeb729ac)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:54 +01:00
Roland Kovacs
082c373810 binutils: fix CVE-2025-69645
Binutils objdump contains a denial-of-service vulnerability when processing
a crafted binary with malformed DWARF debug information. A logic error in
the handling of DWARF compilation units can result in an invalid offset_size
value being used inside byte_get_little_endian, leading to an abort (SIGABRT).
A local attacker can trigger the crash by supplying a malicious input file.

(From OE-Core rev: ca101b2ff0b91630df25ee619c809e0621d41b21)

Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
[YC: The patch is referenced on the NVD page:
     https://nvd.nist.gov/vuln/detail/CVE-2025-69645 ]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:54 +01:00
Roland Kovacs
72b30efa58 binutils: fix CVE-2025-69649, and CVE-2025-69652
CVE-2025-69649:
  Null pointer dereference in readelf before 2.46 results in segfault when
  processing a crafted ELF binary with malformed header fields.
  No evidence of memory corruption beyond the null pointer dereference, nor
  any possibility of code execution, was observed.

CVE-2025-69652:
  Null pointer dereference in readelf when processing a crafted ELF binary
  with malformed DWARF abbrev or debug information which leads to SIGABORT.
  No evidence of memory corruption or code execution was observed; the impact
  is limited to denial of service.

(From OE-Core rev: 86dd1306e350c4cd3b36a39254d6f17587960a60)

Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
[YC: patches are referenced in the NVD database:
     https://nvd.nist.gov/vuln/detail/CVE-2025-69649
     https://nvd.nist.gov/vuln/detail/CVE-2025-69652 ]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:54 +01:00
Ashishkumar Parmar
5f7a875f6d bind: Upgrade 9.18.44 -> 9.18.49
This upgrade fixes CVE-2026-1519, CVE-2026-3039, CVE-2026-3592, CVE-2026-5946 and CVE-2026-5950.

Changelog
=========
https://downloads.isc.org/isc/bind9/9.18.49/doc/arm/html/notes.html

The 9.18.45 changelog includes a Python 3.10 requirement change for ISC's
upstream system test suite, but OE-Core's bind recipe does not enable or package
that test suite and does not inherit ptest. This change is therefore not part of
the target build, installed packages, runtime dependencies, or runtime behavior.

(From OE-Core rev: dee1f392d5294bc5a228ff185bd0c105243a26d4)

Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:54 +01:00
Jaipaul Cheernam
74551a4b4b glibc: stable 2.39 branch updates
git log --oneline ce65d944e38a20cb70af2a48a4b8aa5d8fabe1cc..be1e627cd72db31161a3b4ce1c8114674f0895eb
be1e627cd7 Linux: Only define OPEN_TREE_* macros in <sys/mount.h> if undefined (bug 33921)
98bc06a361 include: isolate __O_CLOEXEC flag for sys/mount.h and fcntl.h
3e13579841 Use pending character state in IBM1390, IBM1399 character sets (CVE-2026-4046)
0dc95ae109 elf: parse /proc/self/maps as the last resort to find the gap for tst-link-map-contiguous-ldso
9344c796f7 resolv: Check hostname for validity (CVE-2026-4438)
5663ab0b83 resolv: Count records correctly (CVE-2026-4437)
c53cd6e738 posix: Run tst-wordexp-reuse-mem test
2760e4c5ed iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module
ba29a36aa3 posix: Fix invalid flags test for p{write,read}v2
60b039bf6a socket: Add new test for shutdown

Testing Results:
             Before    After    Diff
PASS         4892      4896     +4
XPASS        4         4         0
FAIL         371       372      +1
XFAIL        16        16        0
UNSUPPORTED  224       224       0

Changes in testcases:

testcase-name                                before  after
posix/tst-wordexp-reuse-mem(new)               -     PASS (native)

[Note: posix/tst-wordexp-reuse-mem is a new test added by this uplift
(c53cd6e738). It fails under QEMU user-mode because the test-wrapper
cannot support LD_PRELOAD and MALLOC_TRACE needed for mtrace. Running
natively with LD_PRELOAD=libc_malloc_debug.so confirms the test passes
with no memory leaks.

nptl/tst-getpid3 is a flaky test under QEMU user-mode (passes 7/10
re-runs). No nptl code was changed in this uplift.]

(From OE-Core rev: 2afc207fb9d2b720912a5eedb0f368e40f5a236e)

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:54 +01:00
Eric Meyers
a8a3e88a5e create-spdx-image-3.0: correct SSTATE_SKIP_CREATION key for do_create_image_sbom_spdx
The override was "task-create-image-sbom" but BitBake derives it as
"task-create-image-sbom-spdx" (do_ stripped, underscores to hyphens), so
the skip was never applied. The task then cached an ${IMAGE_NAME}-stamped
SBOM in sstate, letting a stale spdx.json be restored via setscene. A
later do_sbom_cve_check would compute the current IMAGE_NAME and fail with
"No such file or directory" on the missing timestamped SBOM. Correct the
key so the image SBOM is always regenerated, never restored from sstate.

(From OE-Core rev: 4acdac4caaed1179ff52c4ff3064f014d08a4664)

Signed-off-by: Eric Meyers <eric.meyers@arthrex.com>
Cc: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 45302ff5cfaf91ece74d4065acf710507f27da15)
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-22 21:08:54 +01:00
Paul Barker
6ccffb86e8 cve-update: Avoid NFS caching issues
When moving the updated CVE database file to the downloads directory,
ensure that it has a different inode number to the previous version of
this file.

We have seen "sqlite3.DatabaseError: database disk image is malformed"
exceptions on our autobuilder when trying to read the CVE database in
do_cve_check tasks. The context here is that the downloads directory
(where the updated database file is copied to) is shared between workers
as an NFS mount. Different autobuilder workers were seeing different
checksums for the database file, which indicates that a mix of both new
and stale data was being read. Forcing each new version of the database
file to have a different inode number will prevent stale data from being
read from local caches.

This should fix [YOCTO #16086].

(From OE-Core rev: 8aca19cff468c5f15c919c973c46be58e020af46)

Signed-off-by: Paul Barker <paul@pbarker.dev>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f63622bbec1cfaca6d0b3e05e11466e4c10fa86e)
[YC: removed cve-update-db-native part, file was removed in
17eb0788514 (cve-update-db-native: remove, 2023-06-23)]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:33 +01:00
Jakub Szczudlo
c574139f59 libgcrypt: upgrade 1.10.3 -> 1.10.4
Release notes are here:
https://dev.gnupg.org/T8233.html
Update contains fix for CVE-2026-41989 and because of building error patch need to be
updated to fix compile flags in new version.

(From OE-Core rev: b06db09b3e8199014b125e3307ba4ae351ad2938)

Signed-off-by: Jakub Szczudlo <jakubszczudlo40@gmail.com>
[YC: upgrades contains
"mpi/ec-inline: refactor i386 assembly to reduce register usage" which
looks like optimisation but it is actually a fix for a build failure.
See: https://dev.gnupg.org/T6892.html]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:33 +01:00
Benjamin Robin (Schneider Electric)
95ac28ddfa openssh: CVE-2026-35387 patch also fixes CVE-2026-35414
The openssh commit fd1c7e131f331942d20f42f31e79912d570081fa fixes 2 CVEs:
CVE-2026-35414 and CVE-2026-35387.

CVE-2026-35414:
| OpenSSH before 10.3 mishandles the authorized_keys principals option
| in uncommon scenarios involving a principals list in conjunction
| with a Certificate Authority that makes certain use of comma
| characters.

The match_principals_option() function is fixed. Before this fix:
When matching an authorized_keys principals="" option against a list of
principals in a certificate, an incorrect algorithm was used that could
allow inappropriate matching in cases where a principal name in the
certificate contains a comma character. Exploitation of the condition
requires an authorized_keys principals="" option that lists more than
one principal *and* a CA that will issue a certificate that encodes more
than one of these principal names separated by a comma (typical CAs
strongly constrain which principal names they will place in a
certificate). This condition only applies to user- trusted CA keys in
authorized_keys, the main certificate authentication path
(TrustedUserCAKeys/AuthorizedPrincipalsFile) is not affected.

CVE-2026-35387:
| OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of
| any ECDSA algorithm in PubkeyAcceptedAlgorithms or
| HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA
| algorithms.

The rest of the patch allows to correctly match ECDSA signature algorithms
against algorithm allowlists.

The full explanation can be found on debian repository:
ae190b6440

(From OE-Core rev: c871a726471a37e46ba10afe7d93b5e0e3de8cdb)

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:32 +01:00
Anil Dongare
7aad94e82e cargo: Fix CVE-2026-5223
This patch applies the upstream fix as referenced in [2], using the commit shown in [1].

[1] 285cebf589
[2] https://security-tracker.debian.org/tracker/CVE-2026-5223

(From OE-Core rev: 9a7fa66844042347a01347538c221115eb40856b)

Signed-off-by: Anil Dongare <adongare@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:32 +01:00
Anil Dongare
ae2f076ef7 cargo: Fix CVE-2026-5222
This patch applies the upstream fix as referenced in [2], using the commit shown in [1].

[1] c4d63a4423
[2] https://security-tracker.debian.org/tracker/CVE-2026-5222

(From OE-Core rev: 1f38e3b8ea709fb8e7ef7a13991809ede5d24d09)

Signed-off-by: Anil Dongare <adongare@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:32 +01:00
Ashishkumar Parmar
8cb3e690c5 qemu: Fix CVE-2026-2243
This patch applies the upstream v10.0.9 stable backport for
CVE-2026-2243. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commit links are recorded in the embedded patch headers
when the fix expands to multiple commits.

[1] 37ff880a12
[2] https://access.redhat.com/security/cve/CVE-2026-2243

(From OE-Core rev: 9d20ff0a25cf9822c1164baaf0a319985c5cc88f)

Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:32 +01:00
Ashishkumar Parmar
8f694f00c4 qemu: Fix CVE-2026-0665
This patch applies the upstream v10.0.8 stable backport for
CVE-2026-0665. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commit links are recorded in the embedded patch headers
when the fix expands to multiple commits.

[1] 4ba877461e
[2] https://access.redhat.com/security/cve/CVE-2026-0665

(From OE-Core rev: c66315d7276db8f65794cf514689301b027b13eb)

Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:32 +01:00
Ashishkumar Parmar
de00d925c6 qemu: Fix CVE-2025-14876
This patch applies the upstream v10.0.8 stable backport for
CVE-2025-14876. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commit links are recorded in the embedded patch headers
when the fix expands to multiple commits.

[1] e649201bb9
[2] https://access.redhat.com/security/cve/CVE-2025-14876

(From OE-Core rev: 2e1f2bbf21f332dd34cff915e06a8545bc974cca)

Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:32 +01:00
Shubham Pushpkar
db642a22a1 binutils: Fix CVE-2026-6846
This patch applies the upstream fix as referenced in [2], using the commit shown in [1].

[1] https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=7a089e0302382f4d4e077941156e1eaa68d01393
[2] https://security-tracker.debian.org/tracker/CVE-2026-6846

(From OE-Core rev: c4773d5fb3b9d17c80c0ba717a07d113c3784249)

Signed-off-by: Shubham Pushpkar <spushpka@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:32 +01:00
Esa Jaaskela
dbf61c2308 linux-yocto/6.6: update CVE exclusions (6.6.142)
Regenerated to fix this warning:
WARNING: linux-yocto-6.6.142+git-r0 do_cve_check: Kernel CVE status needs updating: generated for 6.6.127 but kernel is 6.6.142

$ ./meta/recipes-kernel/linux/generate-cve-exclusions.py .../cvelistV5/ 6.6.142 > meta/recipes-kernel/linux/cve-exclusion_6.6.inc

Generated at 2026-07-07 17:39:10.952928+00:00 for kernel version 6.6.142
From cvelistV5 cve_2026-07-07_1600Z

(From OE-Core rev: 923038b75d09c0966ec42b1460faf306adecc8c2)

Signed-off-by: Esa Jaaskela <esa.jaaskela@suomi24.fi>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:32 +01:00
Adarsh Jagadish Kamini
502e6c40a5 curl: fix CVE-2026-6276
Backport patch to fix CVE-2026-6276.
https://nvd.nist.gov/vuln/detail/CVE-2026-6276

The upstream fix moves cookiehost from the connection-scoped aptr struct
to the per-request SingleRequest struct, preventing cookie data from
leaking across reused handles.

Adapted for curl 8.7.1:
- Use Curl_safefree (renamed to curlx_safefree in later versions)
- Use conn->host.name (changed to data->conn->host.name upstream)
- Keep existing header parsing structure (refactored upstream)
- Dropped tests

Upstream fix:
  3a19987a87

Tested with ptest:
Before: PASSED: 857, FAILED: 0, SKIPPED: 0
After: PASSED: 857, FAILED: 0, SKIPPED: 0

(From OE-Core rev: 6459b4629bfd71ab147257f9d257e3e1626b74f3)

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
[YC: copy the backport info from commit message into the patch file itself]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:32 +01:00
Theo Gaige (Schneider Electric)
94181a64fd perl: patch CVE-2026-8376
Backport patches from [1]

[1] https://github.com/Perl/perl5/pull/24433

(From OE-Core rev: 918bf1dd78104c833497f7766cabe9cba4fa35b0)

Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:32 +01:00
Hitendra Prajapati
ca2b19114c vim: Security fix for CVE-2026-28420 & CVE-2026-46483
Pick patch from [1] & [2] also mentioned at NVD report in 3 & 4

[1] bb6de2105b
[2] 3fb5e58fbc
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-28420
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-46483

(From OE-Core rev: ef42f90ce86f9139e6618b351aaa58129813f544)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:32 +01:00
Hitendra Prajapati
bac60a09b6 vim: Fix for CVE-2026-28417, CVE-2026-32249, CVE-2026-45130
Pick patch from [1], [2] & [3] also mentioned at NVD report in [4,5 & 6]

[1] 79348dbbc0
[2] 36d6e87542
[3] 9299332917
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-28417
[5] https://nvd.nist.gov/vuln/detail/CVE-2026-32249
[6] https://nvd.nist.gov/vuln/detail/CVE-2026-45130

(From OE-Core rev: e61095581f25a79964ee426899ee72236118f570)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:32 +01:00
Hitendra Prajapati
ba66043d77 vim: fix for CVE-2026-28421, CVE-2026-41411 & CVE-2026-44656
Pick patch from [1], [2] & [3] also mentioned at NVD report in [4,5 & 6]

[1] 65c1a143c3
[2] c78194e41d
[3] 190cb3c2b9
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-28421
[5] https://nvd.nist.gov/vuln/detail/CVE-2026-41411
[6] https://nvd.nist.gov/vuln/detail/CVE-2026-44656

More info :
CVE-2026-28421 - Validate block tree indices and readfile() line bounds.
CVE-2026-41411 - Disallow backticks before attempting to expand filenames.
CVE-2026-44656 - Prevent shell execution from 'path' backticks via modelines.

(From OE-Core rev: 3fe9e5132aab67f1ee3139c88a89d5c6c94313c1)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:32 +01:00
Hitendra Prajapati
623f85f957 vim: fix for CVE-2026-34982, CVE-2026-34714 & CVE-2026-35177
Pick patch from [1], [2] & [3] also mentioned at NVD report in [4,5 & 6]

[1] 75661a66a1
[2] 664701eb75
[3] 7088926316
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-34982
[5] https://nvd.nist.gov/vuln/detail/CVE-2026-34714
[6] https://nvd.nist.gov/vuln/detail/CVE-2026-35177

More info :
CVE-2026-34982 - vim: arbitrary command execution via modeline sandbox bypass.
CVE-2026-34714 - vim: Arbitrary code execution via crafted file.
CVE-2026-35177 - vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass.

(From OE-Core rev: 1b4ee99b86262ade31b69a2ba9f80791b15ea130)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:32 +01:00
Theo Gaige (Schneider Electric)
d29b27fb31 dhcpcd: patch CVE-2026-56117
Backport patch [1] mentionned in [2]

[1] 78ea09ed16

[2] https://security-tracker.debian.org/tracker/CVE-2026-56117

(From OE-Core rev: 5c94b031f12c8623dc6eb9e05b87a004826345c1)

Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:32 +01:00
Theo Gaige (Schneider Electric)
4e6df49262 dhcpcd: patch CVE-2026-56114
Backport patch [1] mentionned in [2]

[1] 2f00c7bfc4

[2] https://security-tracker.debian.org/tracker/CVE-2026-56114

(From OE-Core rev: daaaedd30aac04f3440e11682b0a9ecbb2b75b1f)

Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:32 +01:00
Theo Gaige (Schneider Electric)
c223541984 dhcpcd: patch CVE-2026-56113
Backport patch [1] mentionned in [2]

[1] 5733d3c59a

[2] https://security-tracker.debian.org/tracker/CVE-2026-56113

(From OE-Core rev: fbfee67ed5d0c799bc1011f8463741c3b0910885)

Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:31 +01:00
Jaipaul Cheernam
37b718ecb9 curl: fix CVE-2026-5773 - wrong reuse of SMB connection
libcurl's SMB handler marks connections for reuse (connkeep) without
verifying that subsequent requests target the same share. This allows
a second SMB request to the same host to reuse a connection
authenticated for a different share, potentially accessing data
without proper authorization.

The upstream fix removes connection reuse for SMB entirely in
lib/protocol.c, a file introduced in curl 8.20.0. For 8.7.1, the
equivalent fix is changing connkeep() to connclose() in lib/smb.c,
which prevents the connection from being returned to the pool.

Tested with SMBv1 server (Docker dperson/samba):
  Without patch: "Re-using existing connection" for different shares
  With patch: New connection per request, no reuse

Binary verified: Curl_conncontrol arg changes from 0 (KEEP) to 1 (CLOSE)

Reference: https://curl.se/docs/CVE-2026-5773.html

(From OE-Core rev: 7736f905e78162ac657d7a1c790dfa5701dd6b19)

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:31 +01:00
Nate Kent
b8085938de sudo: fix pam-wheel sed for sudo 1.9.17p2 sudoers
[YOCTO #16321]

In version 1.9.17p2, the line that the recipe uses to add the 'wheel'
group to the sudoers file does not exist. This updates the sed usage to
the actual line in question.

(From OE-Core rev: 55f7bf8cd9516971d6d01c1c890bc4c1df62b008)

Signed-off-by: Nate Kent <nathan@otiv.ai>
Tested-by: Siva Balasubramanian <sivakumar.bs@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 76231f202a437be221c2580d4fa0fc100c453e92)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:31 +01:00
Himanshu Jadon
75cbb0daa1 tar: Fix CVE-2026-5704
Backport the upstream 3-commit fix chain for CVE-2026-5704.

The final CVE fix is [1], which depends on the earlier cleanup in [2]
and the behavioral change in [3]. Keep this patch order so the final
fix applies cleanly and preserves the upstream logic.

Also include upstream follow-up [4] to fix the --no-overwrite-dir ptest
regression caused by the CVE backport. Without this follow-up, tar can
temporarily chmod an existing directory even when --no-overwrite-dir is
used, which breaks the upstream --no-overwrite-dir ptest.

[1] https://cgit.git.savannah.gnu.org/cgit/tar.git/commit/?id=b8d8a61b25588caca4efaf9bdd2e3f1a49da77e3
[2] https://cgit.git.savannah.gnu.org/cgit/tar.git/commit/?id=112ead79312ea308e58414b74623f101b8c06f0b
[3] https://cgit.git.savannah.gnu.org/cgit/tar.git/commit/?id=b009124ffde415515081db844d7a104e1d1c6c58
[4] https://cgit.git.savannah.gnu.org/cgit/tar.git/commit/?id=4e742fc8674064a9fa00d4483d06aca48d5b0463
[5] https://security-tracker.debian.org/tracker/CVE-2026-5704

(From OE-Core rev: 86360db7d1ea4e5d2bac9889cf8fefe6148a90b4)

Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 872d86b99ad3e77a105b386331a41f7fa40c2b72)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:31 +01:00
Daniel Turull
c70d4a799a libssh2: fix CVE-2026-55199
Backport patch to fix CVE-2026-55199.
https://nvd.nist.gov/vuln/detail/CVE-2026-55199

Upstream fix:
  17626857d2

Tested with ptest:
Before: PASSED: 3, FAILED: 0, SKIPPED: 0
After: PASSED: 3, FAILED: 0, SKIPPED: 0

Reviewed-by: Anders Heimer <anders.heimer@est.tech>
(From OE-Core rev: 2da74d75a8719db63979f132b456afdbd80395ef)

Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
(cherry picked from commit 5b52af4a02849c1ce74491056a2d13e4e3b6ad2d)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:31 +01:00
Daniel Turull
af5ab14071 libssh2: fix CVE-2026-55200
Backport patch to fix CVE-2026-55200.
https://nvd.nist.gov/vuln/detail/CVE-2026-55200

Upstream fix:
  97acf3dfda

Tested with ptest:
Before: PASSED: 3, FAILED: 0, SKIPPED: 0
After: PASSED: 3, FAILED: 0, SKIPPED: 0

Reviewed-by: Anders Heimer <anders.heimer@est.tech>
(From OE-Core rev: a610461f9040644bec9f1b9be23dcfff121df888)

Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
(cherry picked from commit 42c8c6ec3066dc47b9eeeba0247ffa927193abff)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-20 09:04:31 +01:00
Antonin Godard
e146cbbc73 docs-wide: fix various broken links
Fix various broken links found using the linkcheck builder, in various
places of the documentation. For most, the replacing link is the
equivalent new link.

(From yocto-docs rev: 5f708a1bc31ae94dd3513615b0ce079aa7897628)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 358519ca6406a89fee42c45dcaf63a37a374f33c)
[AG: fix conflict in variables.rst, due to changes to new variables in master]
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-15 18:39:01 +01:00
Antonin Godard
cbaaf0dcf7 migration-guides/release-notes-5.0.rst: remove broken link
https://no-color.org seems down, so remove the link.

(From yocto-docs rev: 615ae29b1d00e56b76bc86982848a152392ee691)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 45f54eca0f7ba4a56ce7dd8a1a388eef1eeffc45)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-15 18:39:01 +01:00
Antonin Godard
84db80f823 ref-manual/images.rst: update obsolete VMWare links
VMWare Player has been discontinued in 2024 so remove the link. What
seems to be remaining is VMWare Fusions and Workstation so provide that
link only.

(From yocto-docs rev: f139c98f658e83328169cb90d119855e43a5bc83)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 7c969dcbebf5cccb28ccbf2370dc8b52cbd08974)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-07-15 18:39:01 +01:00