linux/poky.git, branch scarthgap-5.0.16

build-appliance-image: Update to scarthgap head revision

2026-02-16T09:52:49+00:00

(From OE-Core rev: a1f4ae4e569bc0e36c27c1e4651e502e54d63b28) Signed-off-by: Richard Purdie

pseudo: Update to include an openat2 fix

2026-02-16T09:52:35+00:00

We're seeing occasional autobuilder failures with tar issues related to openat2. It appears there are definitions missing on debian 11 and opensuse 15.5 systems which mean the openat2 syscall intercept isn't compiled in. This then triggers on systems using the openat2 syscall, such as alma9 where it is used in a tar CVE fix. This updates to include the fix from upstream pseudo (along with a compile warning fix). This was tested by taking sstate for pseudo-native from a debian 11 system and using it in a build of "bitbake nativesdk-git -c install" on a alma9 system where that task failed. After this fix, it completes. (From OE-Core rev: 34b74540ee497e2cc89211d7aa2772097b6fa79b) Signed-off-by: Richard Purdie (cherry picked from commit 2c20c05b324e5d6564c8554381019170839509bb) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

libtheora: set CVE_PRODUCT

2026-02-16T09:52:35+00:00

In the NVD database, the product name of libtheora is theora. This was set to ensure that cve-check works correctly. (From OE-Core rev: e86e50b8c5b16065dcb35ebf4b00eff59c5da78c) Signed-off-by: Ken Kurematsu Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit a8ddda60332e2a3219e905c1545b5da917f855c6) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

pseudo: Update to 1.9.3 release

2026-02-16T09:52:35+00:00

Pulls in the following changes: Makefile.in: Bump version to 1.9.3 configure: Minor code quality changes pseudo: code quality scan - resolved various potential issues makewrappers: improve error handling and robustness Update COPYRIGHT files ports/linux/pseudo_wrappers.c: Call the wrappers where possible ports/linux/pseudo_wrappers.c: Workaround compile error on Debian 11 ports/linux/pseudo_wrappers.c: Reorder the syscall operations ports/unix/guts/realpath.c: Fix indents pseudo_util.c: Skip realpath like expansion for /proc on Linux test/test-proc-pipe.sh: Add test case for proc pipes ports/unix/guts/realpath.c: realpath fails if the resolved path doesn't exist (From OE-Core rev: 7a05347a6418bfb6126e3a601489dc71efb0d2fc) Signed-off-by: Richard Purdie Signed-off-by: Antonin Godard Signed-off-by: Richard Purdie (cherry picked from commit 524f4bbb11f9c7e0126e8bd46af217b452d48f5e) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

docbook-xml-dtd4: fix the fetching failure

2026-02-16T09:52:35+00:00

Updating SRC_URI, the old archive url is deprecated. (From OE-Core rev: 65ead4efec955b1b8877ec39eba44ca4da8cfff3) Signed-off-by: Khai Dang Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit c137d3637b6171fbd3bfd671a56096e7f2b3c318) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

lighttpd: Fix trailing slash on files in mod_dirlisting

2026-02-16T09:52:35+00:00

Fixes [YOCTO #16128] Backport of upstream bug fix from lighttpd-1.4.75. Version 1.4.74 introduced a bug that would append a trailing slash to files in a directory listing. When the user attempts to download one of these files, the web browser could not save the file with a trailing slash. As a consequence, every web browser tested would generate a random character string for the saved file name. (From OE-Core rev: 797f15116901328a9a58868edeea44614dc29043) Signed-off-by: Fred Bacon [Yoann: Fixed Upstream-Status: Backport URL] Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

improve_kernel_cve_report: add script for postprocesing of kernel CVE data

2026-02-16T09:52:35+00:00

Adding postprocessing script to process data from linux CNA that includes more accurate metadata and it is updated directly by the source. Example of enhanced CVE from a report from cve-check: { "id": "CVE-2024-26710", "status": "Ignored", "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-26710", "summary": "In the Linux kernel, the following vulnerability [...]", "scorev2": "0.0", "scorev3": "5.5", "scorev4": "0.0", "modified": "2025-03-17T15:36:11.620", "vector": "LOCAL", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "detail": "not-applicable-config", "description": "Source code not compiled by config. ['arch/powerpc/include/asm/thread_info.h']" }, And same from a report generated with vex: { "id": "CVE-2024-26710", "status": "Ignored", "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-26710", "detail": "not-applicable-config", "description": "Source code not compiled by config. ['arch/powerpc/include/asm/thread_info.h']" }, For unpatched CVEs, provide more context in the description: Tested with 6.12.22 kernel { "id": "CVE-2025-39728", "status": "Unpatched", "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39728", "summary": "In the Linux kernel, the following vulnerability has been [...], "scorev2": "0.0", "scorev3": "0.0", "scorev4": "0.0", "modified": "2025-04-21T14:23:45.950", "vector": "UNKNOWN", "vectorString": "UNKNOWN", "detail": "version-in-range", "description": "Needs backporting (fixed from 6.12.23)" }, CC: Peter Marko CC: Marta Rybczynska (From OE-Core rev: 7637af0a94764ac0c6c4f02f383992bcb4753af0) Signed-off-by: Daniel Turull Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit e60b1759c1aea5b8f5317e46608f0a3e782ecf57) Signed-off-by: Suresh H A [Yoann: Stable policy exception: This change is clearly a new feature and thus should be rejected from stables by policy. But, since this is contrib/ an exception can be made] Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

meta/classes: fix missing vardeps for CVE status variables

2026-02-16T09:52:35+00:00

Several CVE helper functions (get_patched_cves() and decode_cve_status()) implicitly depend on the CVE_STATUS and CVE_CHECK_STATUSMAP variables, but these were not declared in the vardeps of their callers. On Scarthgap, the upstream fix (2cc43c72ff28aa39a417dd8d57cd7c8741c0e541) cannot be cherry-picked cleanly, as it also requires BitBake changes. As a workaround, explicitly add CVE_STATUS and CVE_CHECK_STATUSMAP to the vardeps of all tasks invoking these helpers, ensuring correct task re-execution when CVE status changes. This keeps CVE-related metadata generation consistent without requiring BitBake modifications. (From OE-Core rev: 111e1f2febade3c34649f33676f7f7e7cc8e0bd0) Signed-off-by: Benjamin Robin (Schneider Electric) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

glibc: stable 2.39 branch updates

2026-02-16T09:52:35+00:00

git log --oneline 58cbbd43fe82910cf8ae9008351b0b0665104500..ce65d944e38a20cb70af2a48a4b8aa5d8fabe1cc ce65d944e3 (HEAD -> release/2.39/master, origin/release/2.39/master) posix: Reset wordexp_t fields with WRDE_REUSE (CVE-2025-15281 / BZ 33814) 831f63b94c resolv: Fix NSS DNS backend for getnetbyaddr (CVE-2026-0915) fb22fd3f5b memalign: reinstate alignment overflow check (CVE-2026-0861) 10c0bcb3d3 support: Exit on consistency check failure in resolv_response_add_name f47dd22366 support: Fix FILE * leak in check_for_unshare_hints in test-container 4a53354eaf sprof: fix -Wformat warnings on 32-bit hosts beb8267909 sprof: check pread size and offset for overflow c07002038f getaddrinfo.c: Avoid uninitialized pointer access [BZ #32465] ae5fb93559 nptl: Optimize trylock for high cache contention workloads (BZ #33704) efff7cb659 ppc64le: Power 10 rawmemchr clobbers v20 (bug #33091) f6becd8ae8 ppc64le: Restore optimized strncmp for power10 0daa4e46b8 ppc64le: Restore optimized strcmp for power10 28c1de6580 AArch64: Fix instability in AdvSIMD tan 03d0393343 AArch64: Optimise SVE scalar callbacks 0d05a895f1 aarch64: fix includes in SME tests c1dc4412f8 aarch64: fix cfi directives around __libc_arm_za_disable d60f15dc89 aarch64: tests for SME d1d0d09e9e aarch64: clear ZA state of SME before clone and clone3 syscalls dbe1904b7c aarch64: define macro for calling __libc_arm_za_disable 58cf4aa421 aarch64: update tests for SME 1b3bd9a9a6 aarch64: Disable ZA state of SME in setjmp and sigsetjmp 38942a336b linux: Also check pkey_get for ENOSYS on tst-pkey (BZ 31996) c74d59a656 aarch64: Do not link conform tests with -Wl,-z,force-bti (bug 33601) 323ad087a1 x86: fix wmemset ifunc stray '!' (bug 33542) Testing Results: Before After Diff PASS 4926 4921 -5 XPASS 4 4 0 FAIL 223 229 +6 XFAIL 16 16 0 UNSUPPORTED 224 224 0 Changes in failed testcases: testcase-name before after elf/tst-audit21 PASS FAIL malloc/tst-malloc-too-large PASS FAIL malloc/tst-malloc-too-large-malloc-check PASS FAIL malloc/tst-malloc-too-large-malloc-hugetlb1 PASS FAIL malloc/tst-malloc-too-large-malloc-hugetlb2 PASS FAIL malloc/tst-malloc-too-large-mcheck PASS FAIL (From OE-Core rev: a49b898ed6d571391d90cc3ba150a0421642be23) Signed-off-by: Peter Marko [Yoann: When run on the autobuilder, all those new FAIL tests are PASS: https://valkyrie.yocto.io/pub/non-release/20260209-10/testresults/qemux86-64-tc/testresults.json] Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

ffmpeg: ignore CVE-2025-25469

2026-02-16T09:52:35+00:00

Details https://nvd.nist.gov/vuln/detail/CVE-2025-25469 This vulnerability exists in IAMF (Immersive Audio Model and Formats demuxer) which was introduced in version 7.0 [1] $ git tag --contains 4ee05182b7cccfa6928dcb0a45c2b50b7d9ea39b n7.0 n7.0.1 n7.0.2 n7.0.3 n7.1 n7.1-dev n7.1.1 n7.1.2 n7.1.3 n7.2-dev n8.0 n8.0.1 n8.1-dev [1] https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/4ee05182b7cccfa6928dcb0a45c2b50b7d9ea39b (From OE-Core rev: 935bd46fab333a29a8bf4bb511fb55d5d02b3a71) Signed-off-by: Ankur Tyagi Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie