util-linux's README ("Stable Branches") documents stable/v<major>.<minor>
branches whose maintenance releases are bug fixes only, so upgrades
within a major.minor are stable point upgrades per the OE-Core stable
release policy (ref-manual, "Stable Point Release Upgrades").
https://docs.yoctoproject.org/dev/ref-manual/release-process.html#stable-point-release-upgrades
https://github.com/util-linux/util-linux/blob/v2.42.2/README#L95
Checked the last point release for feature creep:
2.42.2 (Jun 16 2026), against 2.42.1 (May 18 2026): 32 commits, all
fixes or hardening -- memory safety (a libblkid use-after-free, two
buffer overflows, a libfdisk GPT fix), privilege tightening
(X-mount.subdir restricted for non-root), diagnostics (fanotify queue
overflow detection) and documentation. No new options or behaviour.
These releases are not picked up on the OE stable branches: util-linux has
had zero point-release bumps on kirkstone, scarthgap or wrynose since each
branch forked from master, leaving them at 2.37.4, 2.39.3 and 2.41.3
respectively. This addresses that gap going forward.
Scarthgap already has v2.39.3, and the 2.39.x stable branch history (mount
API regression fix in 2.39.1, new CPU model support, and libblkid’s bcachefs
handling) demonstrates that util-linux exercises good judgement in managing
stable branches, so we can safely track their stable series there as well.
For the avoidance of doubt it is not a development-series effect either:
util-linux has no development/stable version split, and pre-release work
goes to -rc tags.
AI-Generated: Kiro with Claude Opus 5
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
CVE_PRODUCT = "util-linux"
CVE_STATUS[CVE-2026-3184] = "fixed-version: Fixed since 2.42"
+
+# util-linux publishes bugfix/security-only point releases on its
+# stable/v<major.minor> branches.
+inherit upstream-stable-release-point
projects / thirdparty / openembedded / openembedded-core.git / commitdiff
