linux/poky.git/meta/recipes-bsp, branch scarthgap

grub: update search parameter

2026-05-12T20:31:34+00:00

[ Upstream commit 42b530581f7246b3143ee50e3c6f981dcbb1dc74 ] Grub would report an error message in boot stage as below: "error: no such device: ((hd0,gpt1)/EFI/BOOT)/EFI/BOOT/grub.cfg" Consequently, the root variable is not set, and the intended protection against cross-device configuration loading (the purpose of the original 2014 commit) is lost. The most robust fix is to use the --hint parameter. This separates the search target from the device hint, avoiding fragile string concatenation and supporting both prefixed and non-prefixed $cmdpath formats. Fixes: 5ce73b6055ac ("grub: add cmdpath to grub configuration file") (From OE-Core rev: 2f509e353e2fc04923fc742312c81ed69b419643) Signed-off-by: Xiangyu Chen Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie Signed-off-by: Xiangyu Chen Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

u-boot: fix CVE-2025-24857

2026-05-12T20:31:33+00:00

According to [1], Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019, IPQ5018, IPQ5322, IPQ6018, IPQ8064, IPQ8074, and IPQ9574 could allow an attacker to execute arbitrary code. Backport a patch [2] from upstream to fix CVE-2025-24857 [1] https://nvd.nist.gov/vuln/detail/CVE-2025-24857 [2] https://source.denx.de/u-boot/u-boot/-/commit/87d85139a96a39429120cca838e739408ef971a2 (From OE-Core rev: 6f69c878896b536f5f7b16c566d420e188c82c7f) Signed-off-by: Hongxu Jia Signed-off-by: Fabien Thomas Signed-off-by: Paul Barker

u-boot: move CVE patches out of the common .inc file

2026-02-27T17:45:07+00:00

An external layer might use the u-boot*.inc files but have a different base version for which the CVE patches don't apply. Move the CVE patches in the leaf recipe. See related patch in kirkstone: [kirkstone][PATCH] u-boot: move CVE patch out of u-boot-common.inc https://lists.openembedded.org/g/openembedded-core/topic/117385432 (From OE-Core rev: f4ced8ff03147dd532a88cf3ce08d61fab057522) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

grub: fix CVE-2025-54770 CVE-2025-61661 CVE-2025-61662 CVE-2025-61663 CVE-2025-61664

2026-01-02T14:56:54+00:00

References: https://nvd.nist.gov/vuln/detail/CVE-2025-54770 https://nvd.nist.gov/vuln/detail/CVE-2025-61661 https://nvd.nist.gov/vuln/detail/CVE-2025-61662 https://nvd.nist.gov/vuln/detail/CVE-2025-61663 https://nvd.nist.gov/vuln/detail/CVE-2025-61664 (From OE-Core rev: c28fa3e6421257f50d4ae283cca28fadb621f831) Signed-off-by: Jiaying Song Signed-off-by: Steve Sakoman

u-boot: fix CVE-2024-42040

2025-11-03T15:17:02+00:00

Backport a patch [1] from upstrem to fix CVE-2024-42040 [2] [1] https://source.denx.de/u-boot/u-boot/-/commit/81e5708cc2c865df606e49aed5415adb2a662171 [2] https://nvd.nist.gov/vuln/detail/CVE-2024-42040 (From OE-Core rev: 5c086db3f44d44f31e90f95ccb429639a1ff481d) Signed-off-by: Hongxu Jia Signed-off-by: Steve Sakoman

grub2: mark CVE-2024-2312 as not applicable

2025-10-13T19:42:57+00:00

This issue is specific to the peimage module that Ubuntu add, and is not an upstream issue. (From OE-Core rev: 8d2fe3f403e6435e1ffe122a6776381090752d8a) (From OE-Core rev: d005eda88dad37f31bdc59e45e20b209f3771a26) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman

grub2: fix CVE-2024-56738

2025-09-22T20:17:52+00:00

Backport an algorithmic change to grub_crypto_memcmp() so that it completes in constant time and thus isn't susceptible to side-channel attacks. (From OE-Core rev: 319210be147ec57518c237cb705857aeda9943e6) Signed-off-by: Ross Burton Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 30a1cc225a2bd5d044bf608d863a67df3f9c03be) Signed-off-by: Shubham Pushpkar Signed-off-by: Steve Sakoman

uboot: Allow for customizing installed/deployed file names

2025-07-07T14:42:58+00:00

Backport from master: https://git.openembedded.org/openembedded-core/commit/?id=debc691853e2954bd325bad395b8829939afaa08 When assembling all of the various filenames that are installed/deployed from u-boot, we have been including the PV and PR in the filenames. This change introduces a single variable to replace these two in the filenames. This change should not be disruptive since the default value for the new UBOOT_VERSION variable is "${PV}-${PR}". In one case (UBOOT_EXTLINUX_SYMLINK [1]), PR was used without PV, this patch assumes this was a mistake and corrects it as PR would not be of much use alone. [1] https://git.openembedded.org/openembedded-core/commit/?h=master-next&id=33df3a65f3e8e136811da715d0cc247ce66ae0ea (From OE-Core rev: 58ad450e84db35d5b38dab65edbbc33bc6fef750) Signed-off-by: Ryan Eatmon Signed-off-by: Steve Sakoman

grub: patch CVE-2025-0678 and CVE-2025-1125

2025-03-15T13:40:08+00:00

Cherry-pick patch mentioning these CVEs. (From OE-Core rev: d96bf8ec82ed07c006167e15f7aa0d5e81440977) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

grub: patch CVE-2025-0677, CVE-2025-0684, CVE-2025-0685, CVE-2025-0686 and CVE-2025-0689

2025-03-15T13:40:08+00:00

Cherry-pick patch mentioning these CVEs. (From OE-Core rev: f25e1296b8265414061b0b8f12110c6ee22bc7be) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman