Hello, I have a few format issues with your patch but the gist of it looks good to me.
On Fri Oct 9, 2026 at 2:02 PM CEST, Roopa via lists.openembedded.org Kalmath wrote: > U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in > nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, > allowing a malicious or compromised NFS server to overflow the 2048-byte > nfs_path_buff buffer by returning multiple relative symlink targets that > are appended without cumulative length validation. Attackers can send > two or more READLINK responses containing relative symlink targets of > approximately 1100 bytes each to corrupt adjacent BSS variables > including nfs_server_ip, nfs_server_mount_port, nfs_server_port, > nfs_our_port, nfs_state, and rpc_id, potentially achieving memory > corruption and control over the NFS client state machine. All this paragraph is the CVE description which is not what reader of these commit messages look for. We want to know what you did to fix the CVE and why. In this case a simple "Backport fix referenced by NVD: https://nvd.nist.gov/vuln/detail/cve-2026-29009"; is enough. Look at https://git.openembedded.org/openembedded-core/log/?h=wrynose&qt=grep&q=CVE to get an idea of what a commit message usually look like. > Reference: > [https://www.cve.org/CVERecord?id=CVE-2026-29009] > > Backport the patch to fix CVE-2026-29009: > [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc] > > Signed-off-by: Roopa Kalmath <[email protected]> > --- > .../u-boot/files/CVE-2026-29009.patch | 34 +++++++++++++++++++ > meta/recipes-bsp/u-boot/u-boot_2026.01.bb | 4 ++- > 2 files changed, 37 insertions(+), 1 deletion(-) > create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch > > diff --git a/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch > b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch > new file mode 100644 > index 0000000000..1e04562ede > --- /dev/null > +++ b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch > @@ -0,0 +1,34 @@ > +From 2b88f08722584cf235f7dacaa190af3d24deb40f Mon Sep 17 00:00:00 2001 > +From: Roopa Kalmath <[email protected]> > +Date: Fri, 9 Oct 2026 08:38:23 +0000 > +Subject: [PATCH] u-boot:Fix CVE-2026-29009 > + > +CVE: CVE-2026-29009 > + > +Upstream-Status: Backport > [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc] > + > +Signed-off-by: Roopa Kalmath <[email protected]> While backporting this patch you complely erased the existing commit message and authorship information. Please keep those, they help checking that we are indeed fixing the vulnerability, not introducing regressions, ... Can you send a v2 with the above fixed? Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#247501): https://lists.openembedded.org/g/openembedded-core/message/247501 Mute This Topic: https://lists.openembedded.org/mt/121670283/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
