Control: tags 1142716 + fixed-upstream Control: tags 1148730 + fixed-upstream
Hi, Both CVEs are fixed upstream in rpcbind 1.3.1 (tag rpcbind-1_3_1, 2026-09-12, git:// https://www.google.com/url?q=http://git.linux-nfs.org/projects/steved/rpcbind.git&source=gmail&ust=1793793791452000&sa=E ). #1142716, CVE-2026-16461 (rpcinfo rpcbdump() stack overflow): cb7b787a4997cbc769f62cb4d97a93326791a5a1 "rpcinfo: stack buffer overflow in rpcinfo rpcbdump()" It stops sprintf()ing the server-supplied version list into the fixed buf and prints it directly instead. (Upstream 1.2.9 had an earlier, similar fix for rpcbaddrlist(), bb9bb72. That one is a different function.) #1148730, CVE-2026-94640 (unbounded stats lists, rhbz#2462960): c96fa9a601a5d4f0798d5ae4619ab7aa515356c0 "rpcbind: bound stats lists in rpcbs_getaddr() and rpcbs_rmtcall()" It caps both lists at 4096 entries. A related hardening commit in the same series: 8d8ba19 "rpcbind: restrict RPCBPROC_GETSTAT to loopback callers" (one line in src/security.c). Backport check against 1.2.7-1: I took the upstream rpcbind-1_2_7 tag, applied the Debian 1.2.7-1 patch series (all 6 patches apply), and then the three commits on top: cb7b787 applies (offset +24, because of debian/patches/run-migration) c96fa9a applies cleanly 8d8ba19 applies (offset -2, because of 04-610718-non-linux.patch) They also cherry-pick cleanly onto the plain 1_2_7 tag. I have not built or run the result; this is a patch-application check only. Regards
