linux/poky.git/meta, branch scarthgap

pseudo: Upgrade 1.9.6 -> 1.9.7

2026-06-10T13:35:21+00:00

Pulls in fixes to rename/renameat/renameat2: Changqing Li (1): renameat2/renameat: only ignore when both old and new path are not in PSEUDO_INCLUDE_PATHS Mark Hatle (4): run_tests.sh: Allow the user to specify specific tests to run tests: Add mv then hardlink testing rename: only ignore when both old and new path are not in PSEUDO_INCLUDE_PATHS Makefile.in: Bump version to 1.9.7 (From OE-Core rev: e2864ea1ac022e43af92badc701fa1e2a9571f46) Signed-off-by: Richard Purdie (cherry picked from commit 17567738711d525d9f2b85e54ace2048901e4c34) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

pseudo: Update 1.9.5 -> 1.9.6

2026-06-10T13:35:21+00:00

Pulls in the changes: * Makefile.in: Bump version to 1.9.6 * pseudo_util.c: Fix symlink processing for symlinkat and related * test: Add test symlinkat and related * ports/unix: realpath: Fix chroot processing * test: Add test cases for canonicalize functions * ports/unix: fts_open: Fix chroot behavior * ports/unix: fts_*: Certain functions were incorrectly returning stat data * test: Add fts test case * test: Add test for linkat chroot path stripping * linkat: Avoid a segmentation fault * Only copy xattrs on a rename if it's cross-filesystem (From OE-Core rev: 1414f3513099a9a956ec4f602354aa00008e2aff) Signed-off-by: Richard Purdie (cherry picked from commit 50e769a598e79ed4600f7362d5f40799a48f9273) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

pseudo: Upgrade to 1.9.5

2026-06-10T13:35:21+00:00

This adds a wrapper for the __open_2 function This was breaking shadow and the real reason for the open() call changes. Add the missing wrapper to properly fix this. (From OE-Core rev: 876e6497f3323d74d9ac8ce303ed5165a7fda283) Signed-off-by: Richard Purdie (cherry picked from commit 8ea63d320aba32d3894cace9e71e850bdff1d6b2) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

pseudo: Upgrade to 1.9.4

2026-06-10T13:35:21+00:00

Update to pull in a full openat2 wrapper which works on Fedora 44. This update includes the commits: * Makefile.in: Bump version to 1.9.4 * test: Add renameat2 test cases * test: Add openat2 test cases * makewrappers/openat2: Add preserve_path option * openat2: Implement openat2 wrapper * ports/linux/guts/renameat2.c: Add comment why this isn't implemented * Add b4 configuration * pseudo_setupenvp: Handle malloc failure safely * pseudo_setupenvp: Allocate space for new env vars if needed (From OE-Core rev: 9075b66e1f9161407056924954b3d5507f6d8384) Signed-off-by: Richard Purdie (cherry picked from commit b2bd1d114fafe1e797149e02e4c08194d529cfde) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

tzdata/tzcode-native: upgrade 2026a -> 2026b

2026-06-10T13:35:21+00:00

The 2026b release contains the following changes: Briefly: British Columbia moved to permanent -07 on 2026-03-09. Some more overflow bugs have been fixed in zic. Changes to future timestamps British Columbia’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -07 thereafter. (Thanks to Arthur David Olson.) Although the change to permanent -07 legally took place on 2026-03-09, temporarily model the change to occur on 2026-11-01 at 02:00 instead. This works around a limitation in CLDR v48.2 (2026-03-17). This temporary hack is planned to be removed after CLDR is fixed. Changes to code zic no longer mishandles a last transition to a new time type. zic no longer overflows a buffer when generating a TZ string like "PST-167:59:58PDT-167:59:59,M11.5.6/-167:59:59,M12.5.6/-167:59:59", which can occur with adversarial input. (Thanks to Naveed Khan.) zic no longer generates a longer TZif file than necessary when an earlier time zone abbreviation is a suffix of a later one. As a nice side effect, zic no longer overflows a buffer when given a long series of abbreviations, each a suffix of the next. (Buffer overflow reported by Arthur Chan.) zic no longer overflows an int when processing input like ‘Zone Ouch 2147483648:00:00 - LMT’. The int overflow can lead to buffer overflow in adversarial cases. (Thanks to Naveed Khan.) zic now checks for signals more often. (From OE-Core rev: 37dab321242e06d2940c4221e4a13e68265d696f) Signed-off-by: Ankur Tyagi Signed-off-by: Mathieu Dubois-Briand (cherry picked from commit dda7d55396e0c5258cba58af7e990ab3813bf108) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

linux-yocto/6.6: update CVE exclusions (6.6.127)

2026-06-10T13:35:21+00:00

Regenerated to fix this warning: WARNING: linux-yocto-6.6.127+git-r0 do_cve_check: Kernel CVE status needs updating: generated for 6.6.123 but kernel is 6.6.127 $ ./meta/recipes-kernel/linux/generate-cve-exclusions.py .../cvelistV5/ 6.6.127 > meta/recipes-kernel/linux/cve-exclusion_6.6.inc Generated at 2026-05-27 12:02:49.732909+00:00 for kernel version 6.6.127 From cvelistV5 cve_2026-05-27_0900Z (From OE-Core rev: d0d02d0f45b4c5108ae648fb16d2a2a0dc1ae0e7) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

classes/base: prefer gnu-prefixed HOSTTOOLS

2026-06-10T13:35:20+00:00

Ubuntu 25.10 has changed the default coreutils implementation from GNU coreutils to uutils/coreutils. Unfortunately this causes build problems: couldn't allocate absolute path for 'null'. tail: cannot open 'standard input' for reading: No such file or directory install: failed to chown '...': Invalid argument (os error 22) Clear build failures happen in 'install' and 'tail', but there may be further breakage. Luckily, Ubuntu also installs GNU coreutils with a binary prefix of 'gnu', so whilst these issues are root-caused and fixed in either pseudo or uutils we can prefer the gnu-prefixed binaries where they are present. [ YOCTO #16028 ] (From OE-Core rev: b797cc729f6e6951baa988e1c04bac9fb8183a1c) Signed-off-by: Ross Burton Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 16f2684ebeffa72b5d90525cf9102751b68c298e) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

libarchive: Fix CVE-2026-4424

2026-06-10T13:35:20+00:00

Pick patches from [1] and [2] as mentioned in Debian report in [3]. [1] https://github.com/libarchive/libarchive/commit/d379dc0b2976b7207d1ad78f5ed3eb99a5b6d375 [2] https://github.com/libarchive/libarchive/commit/e1907c5832b6489c7b4198b0825f857c93a03c10 [3] https://security-tracker.debian.org/tracker/CVE-2026-4424 (From OE-Core rev: 7fa280872275e194152cc2d355ad39c81a477d50) Signed-off-by: Hugo SIMELIERE (Schneider Electric) Reviewed-by: Bruno VERNAY Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

openssh: patch CVE-2026-35388

2026-06-10T13:35:20+00:00

Backport patch from [1] matching CVE description in [2] and change described in release note [3]. [1] https://github.com/openssh/openssh-portable/commit/c805b97b67c774e0bf922ffb29dfbcda9d7b5add [2] https://security-tracker.debian.org/tracker/CVE-2026-35388 [3] https://www.openssh.org/releasenotes.html#10.3p1 (From OE-Core rev: f8786d027cdf04072fb5f716135127c334dbea6e) Signed-off-by: Theo Gaige (Schneider Electric) Reviewed-by: Bruno Vernay Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

openssh: patch CVE-2026-35387

2026-06-10T13:35:20+00:00

Backport patch from [1] matching CVE description in [2] and change described in release note [3]. [1] https://github.com/openssh/openssh-portable/commit/fd1c7e131f331942d20f42f31e79912d570081fa [2] https://security-tracker.debian.org/tracker/CVE-2026-35387 [3] https://www.openssh.org/releasenotes.html#10.3p1 (From OE-Core rev: c8fb33de27b9e2be5aeaa4178ddc7b6e724f45ee) Signed-off-by: Theo Gaige (Schneider Electric) Reviewed-by: Bruno Vernay Signed-off-by: Yoann Congal Signed-off-by: Paul Barker