Security fixes:
CVE-2026-27456 - mount(8) TOCTOU symlink attack via loop device.
The SUID mount follows symlinks when resolving loop backing file
paths. On systems where non-root users are permitted to mount loop
devices (via 'user' option in fstab), this allows access to
arbitrary files.
CWE-190 - Integer overflow in libblkid parse_dos_extended().
A crafted MBR disk image can cause uint32_t wraparound in EBR
chain processing, causing reported partitions to not match the
on-disk layout. Tools like udisks may then register a partition
at logical sector 0.
Full release notes: https://www.kernel.org/pub/linux/utils/util-linux/v2.41/v2.41.4-ReleaseNotes
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cd52acda14)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This fixes the following vulnerabilities:
- CVE-2026-29111 (fixed in 258.5):
systemd, a system and service manager, (as PID 1) hits an assert and
freezes execution when an unprivileged IPC API call is made with
spurious data. On version v249 and older the effect is not an assert,
but stack overwriting, with the attacker controlled content. From
version v250 and newer this is not possible as the safety check causes
an assert instead. This IPC call was added in v239, so versions older
than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11
contain patches. No known workarounds are available.
https://www.cve.org/CVERecord?id=CVE-2026-29111
- CVE-2026-40226 (fixed in 258.6):
In nspawn in systemd 233 through 259 before 260, an escape-to-host
action can occur via a crafted optional config file.
https://www.cve.org/CVERecord?id=CVE-2026-40226https://github.com/systemd/systemd/security/advisories/GHSA-9mj4-rrc3-gjcx
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Marcus: note which minor versions included the respective security fixes]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit f6e0ad3858)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The host-mkpasswd package needs the <crypt.h> header file installed
on the host. This file was initially provided by the libc headers,
as part of its libcrypt implementation. libcrypt was removed in
glibc 2.39. Most Linux distributions continued to ship a libcrypt
replacement such as libxcrypt in their default installation.
Some mainstream Linux distribution (such as Debian testing) are
now starting to remove this libcrypt and <crypt.h> header from their
default image (of development files).
In that case, host-mkpasswd is failing to build with the error:
/buildroot/output/build/host-mkpasswd/mkpasswd.c:54:10: fatal error: crypt.h: No such file or directory
The issue can be reproduced by adapting the Buildroot Docker file,
by setting "FROM debian:testing-20260316" in [1] and removing
the build of tar.
Note: debian 13 (for example Docker tag trixie-20260316) still
includes the libcrypt-dev package by default, which provides crypt.h.
In Buildroot, there is already the host-heimdal and host-systemd
packages requiring host-libxcrypt. Also, the host-libxcrypt is a
small standalone package. For those reasons, instead of adding
the Buildroot prerequisite on the user host to provide a libcrypt
implementation, this commit simply add the package dependency to
host-libxcrypt, to make sure it will work in all situations.
[1] https://gitlab.com/buildroot.org/buildroot/-/blob/2026.02/support/docker/Dockerfile#L11
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit cf26c77280)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://github.com/libexif/libexif/blob/v0.6.26/NEWS
* Security issues fixed:
* CVE-2026-40386: An unsigned integer underflow in Fuji and Olympus
makernote handling
* CVE-2026-40385: An unsigned integer overflow on 32bit systems in
Nikon makernote handling
* CVE-2026-32775: A buffer overwrite via integer underflow in makernote
handling
Switched to xz tarball and tarball hash provided by upstream.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3f9bcf42c3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The bat 0.26.0 already depends on a newer version of the onig_sys crate,
so the problem that patch is fixing was no already no longer present.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0e2b7e2bee)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Using this defconfig
BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_STRONGSWAN=y
BR2_PACKAGE_STRONGSWAN_WOLFSSL=y
applied after 'git reset 10a70b1af6 --hard'
replicates the build error
http://autobuild.buildroot.net/results/278b3f74c48c858ae368d59069752adb69c05246
which was fixed in 2024 by
89d512729c
Note: The git tree was reset to the commit right before the fix.
Instead of using the fix mentioned above the build error is also fixed
when the buildroot commit 6c18375434 is
cherry-picked onto 10a70b1af6.
This means the build error mentioned above is really fixed by enabling
BR2_PACKAGE_WOLFSSL_ALL. Therefore we can remove the content of commit
89d512729c.
This commit also prevents a build error in strongswan
wolfssl_rsa_private_key.c: In function 'create_empty':
wolfssl_rsa_private_key.c:450:18: error: 'RsaKey' has no member named 'rng'
450 | this->rsa.rng = &this->rng;
caused by the upcoming bump of wolfSSL from 5.7.2 to 5.9.1 due to
upstream commit
cd88a8ae88
which was first included in wolfSSL 5.9.0.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5d6378db9d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://openssl-library.org/post/2026-04-07-release-announcement/
Fixes the following vulnerabilities:
CVE-2026-31790 - Incorrect Failure Handling in RSA KEM RSASVE Encapsulation.
CVE-2026-28386 - Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 Support.
CVE-2026-28387 - Potential Use-after-free in DANE Client Code.
CVE-2026-28388 - NULL Pointer Dereference When Processing a Delta CRL.
CVE-2026-28389 - Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo.
CVE-2026-28390 - Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo.
CVE-2026-31789 - Heap Buffer Overflow in Hexadecimal Conversion.
Removed patch 0004 which is included in this release, merged in:
7936b4c415
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 58d2330b62)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Bug fixes:
- fix buffer over-read bugs when translating uAPI structs to library types
- fix variable and argument types where necessary
- sanitize values returned by the kernel to avoid potential buffer overflows
- fix memory leaks in gpio-tools
- add missing return value checks in gpio-tools
- fix period parsing in gpio-tools
- use correct loop counter in error path in gpio-manager
Improvements:
- make tests work with newer coreutils by removing cases checking tools'
behavior on SIGINT which stopped working due to changes in behavior of the
timeout tool
See: https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/tree/NEWS?h=v2.2.4
Note: this commit is marked as "security" update because it contains
security related bugfixes, but no CVE or advisory are published at
the time of this commit.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Julien: add note in the commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6ac53518a0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
go1.26.2 (released 2026-04-07) includes security fixes to the go command, the
compiler, and the archive/tar, crypto/tls, crypto/x509, html/template, and os
packages, as well as bug fixes to the go command, the go fix command, the
compiler, the linker, the runtime, and the net, net/http, and net/url packages.
CVE-2026-32289: html/template: JS template literal context incorrectly tracked
CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains
CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking
CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination
CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map
CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock
CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG
CVE-2026-32280: crypto/x509: unexpected work during chain building
CVE-2026-32281: crypto/x509: inefficient policy validation
https://go.dev/doc/devel/release#go1.26.2https://github.com/golang/go/issues?q=milestone%3AGo1.26.2+label%3ACherryPickApproved
Signed-off-by: Christian Stewart <christian@aperture.us>
[Julien: add "security" in commit log title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 82518f8cb4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
See the release notes:
https://github.com/redis/redis/blob/8.4.2/00-RELEASENOTES
================================================================================
Redis 8.4.2 Released Mon 23 Feb 2026 10:00:00 IST
================================================================================
SECURITY: There is a security fix in the release
- A user can manipulate data read by a connection by injecting \r\n sequences
into a Redis error reply
================================================================================
Redis 8.4.1 Released Sun 8 Feb 2026 9:00:00 IST
================================================================================
Update urgency: `SECURITY`: There are security fixes in the release.
- #T1837, #J1474 Hide Personally Identifiable Information from server log
- #P936 Cuckoo filter: crash on RDB load on 0 buckets (MOD-11593)
- #P945 Bloom filter: crash on RDB load on large number of filters (MOD-11590)
(And a whole lot of other bugfixes)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 29a4927157)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Those target configurations marked as "secondary" will be tested with a
lower probability in autobuilders. The intent is to focus the Buildroot
development (and bugfixes) on mainstream configurations, while still
keeping some other, less common, configurations.
This commit marks the following CPU architectures as secondary:
BR2_arcle (ARC little endian)
BR2_armeb (ARM big endian)
BR2_aarch64_be (AArch64 big endian)
BR2_hppa (PA-RISC)
BR2_loongarch64
BR2_m68k
BR2_microblazeel (Microblaze AXI, little endian)
BR2_microblazebe (Microblaze non-AXI, big endian)
BR2_mips (MIPS, big endian)
BR2_mipsel (MIPS, little endian)
BR2_mips64 (MIPS64 big endian)
BR2_or1k (OpenRISC)
BR2_powerpc (PowerPC, big endian)
BR2_powerpc64 (PowerPC64, big endian)
BR2_s390x
BR2_sh (SuperH)
BR2_sparc
BR2_sparc64
BR2_xtensa
In the following CPU architecture, only specific configurations are
marked secondary:
In BR2_armeb (ARM little endian),
- armv4 cores (arm920t, arm922t, fa526/626, strongarm sa110/sa1100)
In BR2_riscv:
- all 32-bit configurations
- 64-bit no-MMU
In BR2_i386 (x86 32-bit),
- i486, i586 and X1000 CPU
There was no strict rule established to build this list of secondary
configurations. This list was built mainly from the observation of
which architecture/CPUs are still widely used in the field
(disregarding its age), the quality of their upstream support and
the general relevance in the Buildroot project.
Signed-off-by: Julien Olivain <ju.o@free.fr>
[Arnout: use !BR2_HIDE_SECONDARY_TARGET_OPTIONS instead of
BR2_SHOW_SECONDARY_TARGET_OPTIONS]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit ddce0814a7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The option is currently unused, which leads to a check-symbol warning.
Suggested-by: Arnout Vandecappelle <arnout@rnout.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
[Arnout: squash two patches]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 4642f903cd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes a build error when pod2man is missing on the host:
pod2man ./tools/lsmac.pl >lsmac.1 || { rm -f lsmac.1 ; false ; }
/bin/sh: line 1: pod2man: command not found
Fixes:
https://autobuild.buildroot.net/results/999/9996e81429f90f4615755827ac182094d416c467/
Although the build error only occurs since 2026-03-05 it should be
backported to LTS branches because the last change to the buildroot
package dates back to 2024.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ec62109990)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot commit 0645cb39e0 bumped the
package from 1.7 to 1.8.1.
Upstream included commit
f614f35e73
in version 1.8 to switch from pcre to pcre2 but the buildroot package
was not updated accordingly.
Pcre2 was already selected by pango -> libglib2 -> pcre2 so this bug was
never noticed.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e8466476c4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot commit 00317f0aff switched the
package from pcre to pcre2 but forgot update the Kconfig help text.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 60a95e04d4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
