linux/poky.git/meta/recipes-core, branch scarthgap

systemd: update musl specific patch to apply

2026-06-10T13:35:20+00:00

It doesn't apply after udev-builtin-path_id.c was also updated by CVE-2026-40225-01.patch in https://git.openembedded.org/openembedded-core/commit/?h=scarthgap&id=fc2d33dbb2d5180b77c10865156db342f9d582da causing do_patch failure for scarthgap builds with musl: Hunk #1 FAILED at 39. 1 out of 1 hunk FAILED -- rejects in file src/udev/udev-builtin-net_id.c patching file src/udev/udev-builtin-path_id.c patching file src/udev/udev-event.c patching file src/udev/udev-rules.c Patch 0003-src-basic-missing.h-check-for-missing-strndupa.patch does not apply (enforce with -f) stderr: ') ERROR: Logfile of failure stored in: /OE/build/oe-core/tmp-musl/work/core2-64-oe-linux-musl/systemd/255.21/temp/log.do_patch.215528 ERROR: Task (/OE/build/oe-core/openembedded-core/meta/recipes-core/systemd/systemd_255.21.bb:do_patch) failed with exit code '1' (From OE-Core rev: 0e66eb22a34e17939cfdaf5cdad84361b7f18e6e) Signed-off-by: Martin Jansa Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

build-appliance-image: Update to scarthgap head revisions

2026-05-15T12:26:28+00:00

(From OE-Core rev: ece80784b493c8b7493478fa2ba0dc1d6d80aa79) Signed-off-by: Paul Barker

build-appliance-image: Update to scarthgap head revisions

2026-05-12T20:57:31+00:00

(From OE-Core rev: 5cac91ecea8720e38a2384a8c5873da3392aabb2) Signed-off-by: Paul Barker

glibc: Fix recipe bug that disabled stack protector

2026-05-12T20:31:34+00:00

Fixes [YOCTO #16265] The glibc recipe is supposed to be building with --enable-stack-protector=strong, but some CACHED_CONFIGVARS values are actually breaking this, causing glibc to be built with no stack protector at all. Remove these CACHED_CONFIGVARS values so that stack protector support is detected properly in do_configure and then enabled properly during do_compile. Full details are here: https://bugzilla.yoctoproject.org/show_bug.cgi?id=16265 (From OE-Core rev: 7952d214393b6c5230ba115f63b6f6d245a728bc) Signed-off-by: Ivan Nestlerode Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 43f0602ede37428f3c35cf665bba934b84355240) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

coreutils: set CVE_PRODUCT

2026-05-12T20:31:34+00:00

This removes rust uutils coreutils CVEs from reports. Comparing sbom-cve-check shows that only CVE-2026-35338..CVE-2026-35381 are removed and all of them contained reference to uutils. (From OE-Core rev: 348391ccf91ac474252f75a5679fc42505faa54d) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (From OE-Core rev: 5c39687f62e5864ea783cbed497c2eb5387dcf96) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

systemd: fix for CVE-2026-40226

2026-05-12T20:31:34+00:00

Backport commit[0] and [1] which fixes this vulnerability as mentioned in Debian report [2]. [0] https://github.com/systemd/systemd/commit/773fd3b6e72e6c83cbb1cfc1cb20f3793db8649a [1] https://github.com/systemd/systemd/commit/bfa0a842822c4f79da9d47f8a773fd128d8f8a0a [2] https://security-tracker.debian.org/tracker/CVE-2026-40226 More details : https://nvd.nist.gov/vuln/detail/CVE-2026-40226 (From OE-Core rev: 84dc87ab504b8b357e7703a911c4f131aa971fe7) Signed-off-by: Hitendra Prajapati Signed-off-by: Fabien Thomas Signed-off-by: Paul Barker

systemd: fix for CVE-2026-40225

2026-05-12T20:31:34+00:00

Backport commit[0] and [1] which fixes this vulnerability as mentioned in Debian report [2]. [0] https://github.com/systemd/systemd/commit/03bb697b8df0339c37f4b845025320b261aeb7cc [1] https://github.com/systemd/systemd/commit/5887e72ff87d3a66a4c3fa91897fbec1545f4d3d [2] https://security-tracker.debian.org/tracker/CVE-2026-40225 More details : https://nvd.nist.gov/vuln/detail/CVE-2026-40225 (From OE-Core rev: fc2d33dbb2d5180b77c10865156db342f9d582da) Signed-off-by: Hitendra Prajapati Signed-off-by: Fabien Thomas Signed-off-by: Paul Barker

ovmf: fix CVE-2024-38798

2026-05-12T20:31:33+00:00

According to [1], EDK2 contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unauthorized Actor” by local access. Successful exploitation of this vulnerability will lead to possible information disclosure or escalation of privilege and impact Confidentiality. Backport a patch [2] from upstream to fix CVE-2024-38798 [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38798 [2] https://github.com/tianocore/edk2/commit/0cad130cb4885961da201bb9b08424b3fd3d2249 (From OE-Core rev: ed444adf325d3a985ed8f9ae0a009ecbaf67c3fd) Signed-off-by: Hongxu Jia Signed-off-by: Fabien Thomas Signed-off-by: Paul Barker

ovmf: fix CVE-2025-2296

2026-05-12T20:31:33+00:00

According to [1], EDK2 contains a vulnerability in BIOS where an attacker may cause “ Improper Input Validation” by local access. Successful exploitation of this vulnerability could alter control flow in unexpected ways, potentially allowing arbitrary command execution and impacting Confidentiality, Integrity, and Availability. Backport patches from upstream [2] to fix CVE-2025-2296 Note: backport 0001-AmdSev-Halt-on-failed-blob-allocation.patch to apply the CVE patches without confliction [1] https://nvd.nist.gov/vuln/detail/CVE-2025-2296 [2] https://github.com/tianocore/edk2/pull/10628 (From OE-Core rev: 09be6658833e7ac4143eeb26bdaf67c6c94e260a) Signed-off-by: Hongxu Jia Signed-off-by: Fabien Thomas Signed-off-by: Paul Barker

expat: patch CVE-2026-32778

2026-05-12T20:31:33+00:00

Pick patches from [1] also mentioned in [2]. [1] https://github.com/libexpat/libexpat/pull/1163 [2] https://security-tracker.debian.org/tracker/CVE-2026-32778 (From OE-Core rev: ea404c36732a4e3882a74707189b10a4a196df07) Signed-off-by: Bruno VERNAY Signed-off-by: Hugo SIMELIERE Signed-off-by: Fabien Thomas Signed-off-by: Paul Barker