libpng: set status for CVE-2026-40930

Per [1]:
* The vulnerable code originates from the third-party libpng-apng patch,
which adds APNG support to libpng 1.6.x.
* Upstream libpng 1.6.x (without the apng patch) is not affected.

As Yocto never included libpng-apng patch, we can ignore this CVE.

[1] https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.58.bb b/meta/recipes-multimedia/libpng/libpng_1.6.58.bb
index 630b489d00a0530e28aca444fba119d6e4a19f0d..6e4e5e9f3879ff94091ff3ea75bdb60b58ac3fd9 100644 (file)
--- a/meta/recipes-multimedia/libpng/libpng_1.6.58.bb
+++ b/meta/recipes-multimedia/libpng/libpng_1.6.58.bb
@@ -72,3 +72,4 @@ do_install_ptest() {
 BBCLASSEXTEND = "native nativesdk"
 
 CVE_STATUS[CVE-2026-34757] = "fixed-version: fixed since 1.6.57"
+CVE_STATUS[CVE-2026-40930] = "cpe-incorrect: Yocto never included affected libpng-apng patch"