linux/poky.git/meta/recipes-bsp, branch kirkstone

u-boot: move CVE patch out of u-boot-common.inc

2026-02-27T15:54:03+00:00

Commit f5b980ad added CVE-2024-42040.patch to the base U-Boot SRC_URI in u-boot-common.inc as opposed to adding it in the u-boot recipe where all the other patch additions are. This breaks at least one downstream BSP that reuses u-boot-common.inc (meta-sifive), so move that patch addition to the recipe file with all the others. (From OE-Core rev: 5db1bffe13ec881b7fa4ebf4ed30493e8714d7f2) Signed-off-by: Scott Murray Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

grub: fix CVE-2025-61661 CVE-2025-61662 CVE-2025-61663 CVE-2025-61664

2026-01-02T15:21:42+00:00

References: https://nvd.nist.gov/vuln/detail/CVE-2025-61661 https://nvd.nist.gov/vuln/detail/CVE-2025-61662 https://nvd.nist.gov/vuln/detail/CVE-2025-61663 https://nvd.nist.gov/vuln/detail/CVE-2025-61664 (From OE-Core rev: f2031f39e423b764ccf4003bdee05f30d66fb7ce) Signed-off-by: Jiaying Song Signed-off-by: Steve Sakoman

efibootmgr: update SRC_URI branch

2025-11-19T16:21:24+00:00

master branch was renamed to main (From OE-Core rev: 2c5b195e974ac54610d7b50c014752875004b0b9) Signed-off-by: Gyorgy Sarvari Signed-off-by: Steve Sakoman

u-boot: fix CVE-2024-42040

2025-11-06T15:14:05+00:00

Backport a patch [1] from upstrem to fix CVE-2024-42040 [2] [1] https://source.denx.de/u-boot/u-boot/-/commit/81e5708cc2c865df606e49aed5415adb2a662171 [2] https://nvd.nist.gov/vuln/detail/CVE-2024-42040 (From OE-Core rev: f5b980ade1e952a181cb51d60268942095627c0d) Signed-off-by: Hongxu Jia Signed-off-by: Steve Sakoman

grub: ignore CVE-2024-2312

2025-10-14T14:20:35+00:00

This CVE is specific to Ubuntu [1]. [1] https://bugs.launchpad.net/ubuntu/+source/grub2-unsigned/+bug/2054127 (From OE-Core rev: dc10bf2f9dd91cbd34af43162b61736fc26aa314) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

grub2: fix CVE-2024-56738

2025-10-03T16:51:17+00:00

Backport an algorithmic change to grub_crypto_memcmp() so that it completes in constant time and thus isn't susceptible to side-channel attacks. reference: https://git.openembedded.org/openembedded-core/commit/?id=30a1cc225a2bd5d044bf608d863a67df3f9c03be Upstream patch: https://cgit.git.savannah.gnu.org/cgit/grub.git/commit/?id=0739d24cd1648531d0708d1079ff6bbfa6140268 (From OE-Core rev: d6572d29892b7da593acafe3af68cf98230acf04) Signed-off-by: Yogita Urade Signed-off-by: Steve Sakoman

libubootenv: backport patch to fix unknown type name 'size_t'

2025-08-22T14:07:19+00:00

Fix: ../recipe-sysroot/usr/include/libuboot.h:29:2: error: unknown type name 'size_t' size_t envsize; ^ This error can be avoided by using CXXFLAGS:append = " -include cstddef" but this way would be needed in all recipes that use libuboot.h. Therefore, Backport the patch to include in C++ builds. (From OE-Core rev: e401a16d8e26d25cec95fcea98d6530036cffca1) Signed-off-by: Youngseok Jeong Signed-off-by: Steve Sakoman

grub: Fix multiple CVEs

2025-03-19T14:13:17+00:00

Backport fixes for : * CVE-2025-0622 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=2123c5bca7e21fbeb0263df4597ddd7054700726 && https://git.savannah.gnu.org/cgit/grub.git/commit/?id=9c16197734ada8d0838407eebe081117799bfe67 && https://git.savannah.gnu.org/cgit/grub.git/commit/?id=7580addfc8c94cedb0cdfd7a1fd65b539215e637 * CVE-2025-0624 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=5eef88152833062a3f7e017535372d64ac8ef7e1 * CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=47b2dfc7953f70f98ddf35dfdd6e7f4f20283b10 * CVE-2025-0678_CVE-2025-1125 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=84bc0a9a68835952ae69165c11709811dae7634e * CVE-2025-0690 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=dad8f502974ed9ad0a70ae6820d17b4b142558fc * CVE-2025-1118 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=34824806ac6302f91e8cabaa41308eaced25725f (From OE-Core rev: 5c4ee702f93f9bb4fcb557fd067242da16d63da2) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman

grub: Fix multiple CVEs

2025-03-19T14:13:17+00:00

Backport fixes for: * CVE-2024-45774 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=2c34af908ebf4856051ed29e46d88abd2b20387f * CVE-2024-45775 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=05be856a8c3aae41f5df90cab7796ab7ee34b872 * CVE-2024-45776 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=09bd6eb58b0f71ec273916070fa1e2de16897a91 * CVE-2024-45777 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=b970a5ed967816bbca8225994cd0ee2557bad515 * CVE-2024-45778_CVE-2024-45779 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=26db6605036bd9e5b16d9068a8cc75be63b8b630 * CVE-2024-45780 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=0087bc6902182fe5cedce2d034c75a79cf6dd4f3 * CVE-2024-45781 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba * CVE-2024-45782_CVE-2024-56737 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=417547c10410b714e43f08f74137c24015f8f4c3 * CVE-2024-45783 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=f7c070a2e28dfab7137db0739fb8db1dc02d8898 (From OE-Core rev: 1bf2e89c932167b677051234d4e0cc4c52b0ee0c) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman

u-boot: fix CVE-2024-57259

2025-02-28T14:51:35+00:00

sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the path separator is not considered in a size calculation. https://nvd.nist.gov/vuln/detail/CVE-2024-57259 (From OE-Core rev: e4b713ff07695487cc9307ffc3576a11775cde4d) Signed-off-by: Hongxu Jia Signed-off-by: Steve Sakoman