useradd_base.bbclass: Emulate the groupmems command using usermod
The groupmems command does to support the --prefix option, which is
being used since commit a7b846ba7d6d63a5e59939d75d9c5fe3e4cbb0e9.
However, the groupmems command can easily be emulated using the usermod
command.
[YOCTO#16277]
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The groupmems command will be removed in shadow 4.20. The same
functionality as provided by groupmems can be achieved with the usermod
command. Add support for USERMOD_PARAM variables to specify the options
to use.
The following GROUPMEMS_PARAM:
GROUPMEMS_PARAM:${PN} = "--add user --group group1; \
--add user --group group2"
would be directly converted to the following USERMOD_PARAM:
Add USERMOD_PARAM to PACKAGEVARS similarly to the USERADD_PARAM and
GROUPADD_PARAM variables.
[YOCTO#16277]
Co-authored-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
useradd.bbclass: Some clean-ups and simplifications
* Improve some odd function names, e.g., groupmemsadd_sysroot and
user_group_groupmems_add_sysroot. These were introduced in commit 322ef726132a47d977d2c6ee41de5358f1e85994 (useradd.bbclass: Fix order
of postinst-useradd-*).
* Make common_useradd_sysroot() look for the actually used command
instead of always looking for useradd.
* Simplification of common_useradd_sysroot() by using case/esac.
* A bit of whitespace clean-up.
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ricardo Salveti [Wed, 20 May 2026 00:21:52 +0000 (21:21 -0300)]
u-boot: move DT validation yaml removal patch to SRC_URI
Commit 5e97f3c1e2cf ("u-boot-tools: drop yaml in DT validation") added the
backport through SRC_URI_RISCV, so only RISC-V u-boot builds picked it up.
This issue is because the v1 of the patch was merged instead the v2 (which
is also not fully correct as it is not patching u-boot-tools). Drop the
patch from SRC_URI_RISCV and add it directly to both u-boot_2026.04.bb and
u-boot-tools_2026.04.bb, so it is applied to both recipes without
affecting external recipes including u-boot-common.inc.
Fixes: 5e97f3c1e2cf ("u-boot-tools: drop yaml in DT validation") Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Thu, 21 May 2026 13:50:39 +0000 (14:50 +0100)]
xserver-xorg/xwayland: 'Clarify' xserver license
The Xserver license, https://gitlab.freedesktop.org/xorg/xserver/-/blob/main/COPYING
is a bit of a challenge to decode. Whilst overall thought to be MIT, there
are many other simlar/related licences included in there.
The make our license data more accurate, update to include all the license
variants present.
I have submitted a patch upstream to add identifiers to the COPYING file to
make it clearer where these come from and save others from repeating this painful
exercise:
Upgrade the firmware package to latest release. Add compute package
for shikra. Add packages ${PN}-ath12k-{ipq5424, qcc2072} for ath12k
based chips. Add Texas Instruments PCM6240 firmware, firmware for
tas2783A projects, firmware for Lontium LT7911EXC and LT9611C. Move
lt*_fw.bin firmware to Lontium subdir. Add HP ISH firmware for Intel
Panther Lake systems. Add RDEPENDS on ${PN}-qcom-license for Dell
XPS13 packages as qcom/NOTICE.txt is applicable to those firmwares.
Ross Burton [Tue, 19 May 2026 14:15:07 +0000 (15:15 +0100)]
groff: build less in groff-native
When building groff-native we only really need enough of groff to build
manpages, and don't need documentation or extra tools.
Patch the Makefile to stop building the doc and contrib directories,
which both take time and have incomplete build dependencies that cause
intermittent failures[1][2].
And some tools are removed, which I don't believe are needed by anything
we build:
/usr/bin/chem was removed
/usr/bin/eqn2graph was removed
/usr/bin/gdiffmk was removed
/usr/bin/gperl was removed
/usr/bin/gpinyin was removed
/usr/bin/mmroff was removed
/usr/bin/pic2graph was removed
/usr/share/groff/1.24.1/tmac/chem.pic was removed
/usr/share/groff/1.24.1/tmac/hdmisc.tmac was removed
/usr/share/groff/1.24.1/tmac/hdtbl.tmac was removed
/usr/share/groff/1.24.1/tmac/mm was removed
/usr/share/groff/1.24.1/tmac/mm/0.MT was removed
/usr/share/groff/1.24.1/tmac/mm/4.MT was removed
/usr/share/groff/1.24.1/tmac/mm/5.MT was removed
/usr/share/groff/1.24.1/tmac/mm/ms.cov was removed
/usr/share/groff/1.24.1/tmac/mm/se_ms.cov was removed
/usr/share/groff/1.24.1/tmac/mmse.tmac was removed
/usr/share/groff/1.24.1/tmac/mm.tmac was removed
/usr/share/groff/1.24.1/tmac/mom.tmac was removed
/usr/share/groff/1.24.1/tmac/mse.tmac was removed
/usr/share/groff/1.24.1/tmac/m.tmac was removed
/usr/share/groff/1.24.1/tmac/om.tmac was removed
/usr/share/groff/1.24.1/tmac/refer-mm.tmac was removed
/usr/share/groff/1.24.1/tmac/rfc1345.tmac was removed
/usr/share/groff/1.24.1/tmac/sboxes.tmac was removed
Package libcaf static libraries installed by GCC 16 to
avoid installed-vs-shipped QA errors.
Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
libc-test: add libatomic-staticdev to ptest RDEPENDS
GCC 16 adds libatomic_asneeded.a which is required when statically
linking. The libc-test static tests fail on musl without it. Add
libatomic-staticdev alongside musl-staticdev for the same reason.
Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
GCC 16 adds libatomic_asneeded.so which is referenced by the GCC spec
at link time. Add libatomic-dev to ptest RDEPENDS so it is available
on the target when ptests compile code, following the same pattern as
libgcc-dev.
Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Jamin Lin [Tue, 19 May 2026 09:17:24 +0000 (09:17 +0000)]
kernel-fit-image: Validate key files expected by mkimage for the selected algorithm
The signing key validation in run_mkimage_sign() unconditionally
required <keyname>.key and <keyname>.crt regardless of the signing
algorithm.
However, mkimage handles RSA and ECDSA keys differently. RSA signing
uses separate .key and .crt files, while ECDSA signing uses a single
.pem file.
As a result, OE/fitimage.py required users of ECDSA signing to provide
unused .key and .crt files only to satisfy the validation checks.
Refactor the validation logic into _check_sign_key_files() and validate
the required files according to the selected signing algorithm:
- ECDSA: requires <keyname>.pem
- RSA: requires <keyname>.key and <keyname>.crt
Detect the algorithm by scanning all comma-separated parts of the algo
string so the field order does not matter (e.g. "sha256,ecdsa384").
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Quentin Schulz [Mon, 18 May 2026 16:41:39 +0000 (18:41 +0200)]
squashfs-tools: add another CPE
The NVD has two additional CPEs for squashfs-tools pointing at the same
GitHub git repo, squashfs_project:squashfs-tools[1] and
squashfs-tools_project:squashfs-tools[2].
There are no other matches for squashfs-tools in the NVD except those
two, so don't specify the vendor for now and match both vendors with
only one entry in CVE_PRODUCT.
George Refseth [Mon, 18 May 2026 13:07:30 +0000 (15:07 +0200)]
cargo_common.bbclass: add subdir argument to git dependency to let cargo find crate
When git referenced crate dependency dependens on (root) workspace virtual
manifest, when patching path the path to the folder containing the crate
within the referenced repo need to be added to the patching process.
A subdir argument is added to address this need.
Example usage when repo contains an api crate defining the api for org/repo:
SRC_URI:append = "git://git@github.com/<org>/<repo>.git;name=api;destsuffix=repo-api;subdir=crates/api;type=git-dependency"
Cc: Erik Wierich <erik@riscstar.com> Signed-off-by: George Refseth <george.refseth@remarkable.no> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
python3targetconfig: pull in nativesdk python when building nativesdk recipes
For the class to work, target python needs to be present in the target
sysroot. This was done only for :target builds but not for :nativesdk
ones, and this patch addresses that.
The issue was reported in
https://lists.openembedded.org/g/openembedded-core/message/237188
(but the proposed fix there isn't right).
Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Mon, 18 May 2026 10:36:24 +0000 (11:36 +0100)]
python3-installer: upgrade 0.7.0 -> 1.0.1
v1.0.1 (May 11, 2026)
- Include docs and tests in sdist again (#322)
- Fix long path issue on Windows (#321)
- Fix date in changelog (#324)
- Use `os.path.abspath()` instead of `Path.resolve()` for performance (#326)
v1.0.0 (Mar 28, 2026)
- Drop support for Python 3.9, 3.8, and 3.7 (#305, #242, #206)
- Add support and Python 3.13 and 3.14 (#201, #282)
- Add `--overwrite-existing` CLI option (#216)
- Add `--validate-record` CLI option (#161)
- Support installing multiple wheels (#203)
- Handle invalid hash algorithms (#179)
- Stream-based validation instead of in-memory (#98)
- Add validate_stream methods (#99)
- Consolidate and refine validation APIs (#108, #111)
- Sort entries before writing RECORD (#245)
- Do not install __pycache__ from wheels (#307)
- Fix a path traversal bug (#317)
- Update launcher scripts and Windows behavior (#212, #181)
- Fix Windows relpath bug (#286)
- Migrate to dataclasses (#200)
- Use cached_property for memoization (#243)
- Refactor installer.scripts (#239)
- Decouple test modules (#104)
- Avoid cross-module imports from .utils (#102)
- Lazy imports for performance (#226)
- Complete type annotations and enforce strict mypy (#173)
- Deprecate RecordEntry.validate (#186)
- Fix documentation typos and grammar (#309, #210)
- Improve docstrings and internal documentation (#100)
Remove an upstreamed patch, and rewrite the patch adding an --interpreter
option.
Verified that building everything in oe-core that uses the pep517 class
is identical before and after the upgrade.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Fri, 15 May 2026 15:10:03 +0000 (16:10 +0100)]
librsvg: add PACKAGECONFIGs for avif and gdkpixbuf
The existing gdkpixbuf PACKAGECONFIG is actually for the gdk-pixbuf SVG
loader. Rename this to gdkpixbuf-loader and add another PACKAGECONFIG
that controls whether gdk-pixbuf support is enabled, and enable this by
default to preserve behaviour.
Add a new PACKAGECONFIG to enable support for embedded AVIF[1] files.
This is disabled out of the box as it depends on dav1d, part of meta-oe.
[1] https://en.wikipedia.org/wiki/AVIF
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Fri, 15 May 2026 15:10:02 +0000 (16:10 +0100)]
librsvg: remove dependency on liberation-fonts
librsvg 2.42 onwards[1] from 2018 ship the fonts they need for the test
suite instead of assuming the system has the right fonts, so we don't
need to depend on liberation-fonts for the tests.
[1] librsvg ec3353e89 ("Use a hard-coded font file to render test images,
for predictable font rendering")
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Rebase patches and drop patch included in this release.
Add patches to fix linking with musl libc.
Increase memory needed to successfully run test key-openssl.
Drop code for previous release tarball problem.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
New patch:
0002-Fix-rust-build-failure-with-unstable-options.patch
Fix rust build failure with unstable options.
Remove the check that errors out when -Zunstable-options is not provided
for custom targets.The original upstream change (and its follow-up) mainly
ensured GitHub workflows and tests work correctly by explicitly passing
"-Zunstable-options", along with related testcase updates. Reverting the
entire commit would also undo those unrelated workflow and test adjustments,
so this patch only targets the specific enforcement logic without affecting
the rest of the changes.
https://github.com/rust-lang/rust/issues/155963
Selftest Changes:
Skip two failing tests
src/librustdoc
src/tools/rustdoc
https://github.com/rust-lang/rust/pull/153409
Excluded tests:
+--------+----------+---------+
| Before | After | Skipped |
+---------+---------+---------+
| 37 | 39 | +2 |
+--------+----------+---------+
Li Zhou [Fri, 15 May 2026 02:44:41 +0000 (10:44 +0800)]
xrandr: upgrade 1.5.3 -> 1.5.4
Changelog:
==========
- meson: Add option to build with meson
- COPYING: Add missing copyright notices from source files
- gitlab CI: drop the ci-fairy check-mr job
- set_gamma_info: fix heap-buffer-overflow with empty gamma ramps
- Add more checks for malloc()/calloc() failure
- Strip trailing whitespace from source files
- man page: fix warnings from `mandoc -T lint`
- xrandr man page NAME line doesn't give functionality
- Additional man page formatting fixes
- xrandr.1: some editorial changes for this man page
- Improve man page formatting
- xrandr: Warn when running with Xwayland
License-Update: The COPYING changes in upstream commit d29cb495 add
missing copyright notices from source files. No license change, no
impact on the recipe licensing.
Signed-off-by: Li Zhou <li.zhou@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Instead of removing it, one could just uncomment the line. However,
the final value of HOST_SYS would then be the very same of HOST_SYS as
currently defined in bitbake.conf:
This same gcc (v12) warning was handled upstream a while ago:
22130dcd98b4 ("Basetools: turn off gcc12 warning")
This change is available in the tag we currently use: edk2-stable202511.
In fact, it is available since edk2-stable202205, and the
-Wno-error=stringop-overflow flag [1] was added for the same reason we have
it in ovmf's recipe.
The two append operations call bb.utils.contains, while a single
contains_any() does the trick in a cleaner way.
Regarding the default value, if tpm is not enabled, PACKAGECONFIG ends
up with a couple empty spaces, and this can be avoided by redefining the
default value to the result of contains_any().
Even though this replacement comes with a change in behaviour (at least
in edge cases), we prefer a consistent PACKAGECONFIG (weak) default
assignment across recipes.
Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
GTK+3 UI was disabled [1] by default, and the resulting call to
bb.utils.contains() could be replaced by a bb.utils.filter() as in a
similar change [2].
Better than that, just move 'x11' to the bb.utils.filter() above.
[1] a07763f03d4f ("vim: disable GTK+3 UI by default")
[2] f38320c9646a ("meta: simplify conditional operations with bb.utils.filter")
Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Jinwang Li [Thu, 14 May 2026 12:00:28 +0000 (20:00 +0800)]
bluez5: add patches to fix 8.56 gatt issue
btd_gatt_client_service_removed() can be called reentrantly via
bt_gatt_client_unref() after the services queue has already been freed,
resulting in a use-after-free.
Reset client->ready to false before destroying the services queue to
prevent reentrant calls from dereferencing freed memory.
Upstream-Status: Backport [bluez/bluez@d01616f] Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Joshua Watt [Wed, 13 May 2026 15:00:58 +0000 (09:00 -0600)]
spdx: Add SHA 512 support
Adds support for adding SHA-512 hashes (where possible). This is to
improve compliance with SBoM standards, in particular BSI TR-03181 [1].
SHA 256 hashes are still included for each file, and still used to index
files in the database. Also, while SHA 512 is supported as a hash for
downloads, most recipes are still using SHA 256 and would need to be
upgraded for full compliance with BSI TR-03183
Ross Burton [Wed, 13 May 2026 13:35:56 +0000 (14:35 +0100)]
gcr: remove obsolete packaging
Previously the package contained UI libraries but they were removed
in the 4.0.0 release:
- gcr4 will no longer ship UI libraries, i.e. gcr-gtk3 or gcr-gtk4.
Remove a large amount of packaging metadata that is no longer needed,
and add an optional and disabled PACKAGECONFIG for the viewer tool which
is packaged separately from the libraries.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Wed, 13 May 2026 13:35:55 +0000 (14:35 +0100)]
gcr: remove obsolete DEPENDS
libxslt-native was added back in 2017 to gcr-3.2.0 as a needed
dependency when building with gobject-introspection[1], but this no
longer appears to be the case.
gnupg-native was added in 2020[1] but we now pass the correct paths to
Meson so this is no longer needed.
[1] oe-core 58922a43f93 ("gcr: add missing dependency on xsltproc if introspection is enabled")
[2] oe-core afa5ec0dee8 ("gcr: depends on gnupg-native")
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Wed, 13 May 2026 13:35:54 +0000 (14:35 +0100)]
libportal: split out GTK libraries into sub-packages
We shouldn't package the bare libportal and the GTK3 and GTK4 libraries
into one package. Instead package the UI libraries into separate
packages, so that dependencies are contained.
Add PACKAGECONFIGs for the gtk3 and gtk3 libraries so that they can be
controlled individually. Keep the existing behaviour of enabling both
GTK 3 and 4 as various recipes use both, but this allows building
libportal without any GTK dependencies if required.
The PACKAGECONFIG logic is "fun": if either of wayland or x11 are
enabled then we can enable GTK+3 by default, and if either of those
_and_ opengl are enabled then we can also do GTK 4.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The gdb helper scripts are installed to a path that matches the installed
binary path. Whilst technically correct, we relocate native tools and this
path isn't relocated correctly.
The paths mean the build directory leaks into sstate objects and native
sstate objects can have differing path contents as a result, which causes
problems.
Whilst we could relocate it, gdb would not be searching in these paths for
helpers anyway so the tools aren't needed and we can simply remove them in
the native case.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Wed, 13 May 2026 11:50:22 +0000 (12:50 +0100)]
pseudo: Upgrade 1.9.6 -> 1.9.7
Pulls in fixes to rename/renameat/renameat2:
Changqing Li (1):
renameat2/renameat: only ignore when both old and new path are not in PSEUDO_INCLUDE_PATHS
Mark Hatle (4):
run_tests.sh: Allow the user to specify specific tests to run
tests: Add mv then hardlink testing
rename: only ignore when both old and new path are not in PSEUDO_INCLUDE_PATHS
Makefile.in: Bump version to 1.9.7
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Bruce Ashfield [Mon, 11 May 2026 20:25:12 +0000 (16:25 -0400)]
linux-yocto/6.18: update to v6.18.28
Updating linux-yocto/6.18 to the latest korg -stable release that comprises
the following commits:
c31b94a4231c Linux 6.18.28 71a1d9d985d2 xfrm: esp: avoid in-place decrypt on shared skb frags ce685b6a03dc Linux 6.18.27 97d35052a816 ipmi:ssif: NULL thread on error 52a7c9a2823d ipmi:ssif: Remove unnecessary indention 6f820139d16a netfilter: reject zero shift in nft_bitwise b778b6d09542 net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels a8d95d274be2 mm/slab: return NULL early from kmalloc_nolock() in NMI on UP 05b4ed8bef30 mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UP e9b057a44def vmalloc: fix buffer overflow in vrealloc_node_align() bdd9503c3d22 ALSA: aloop: Fix peer runtime UAF during format-change stop 6153878c5255 ALSA: caiaq: fix usb_dev refcount leak on probe failure 30c000a49094 drm/amdgpu: fix zero-size GDS range init on RDNA4 c261d07a8057 ipv6: rpl: reserve mac_len headroom when recompressed SRH grows 3d46009e2ad4 ALSA: caiaq: Don't abort when no input device is available 1d160e30aa42 ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path b8c5acce56e0 driver core: Add kernel-doc for DEV_FLAG_COUNT enum value b42821c15445 crypto: authencesn - reject short ahash digests during instance creation 5cf6d5e5e3b8 net: qrtr: ns: Limit the total number of nodes 20855cef7e65 net: qrtr: ns: Limit the maximum number of lookups 35fb4a0c077c net: qrtr: ns: Limit the maximum server registration per node 5e9f1bad26df iio: frequency: admv1013: fix NULL pointer dereference on str c772e9efe2b1 iio: frequency: admv1013: add dev variable 0adac0ee2c42 media: rc: igorplugusb: heed coherency rules 7ba734027b2b media: rc: ttusbir: respect DMA coherency rules 7d7863018f40 wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling 0bc155c4ca47 wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor 09e1c96594af phy: qcom: m31-eusb2: clear PLL_EN during init 37ef11ab2cf3 phy: qcom: m31-eusb2: Update init sequence to set PHY_ENABLE da4a33e739dc mei: me: add nova lake point H DID 09033be12a82 mei: me: use PCI_DEVICE_DATA macro 38f113f81d3f lib: test_hmm: evict device pages on file close to avoid use-after-free 1e67c82fb778 arm64: mm: Fix rodata=full block mapping support for realm guests 5e07126d7ab8 arm64: mm: Simplify check in arch_kfence_init_pool() 6f977b0472f7 mm: prevent droppable mappings from being locked bbc4bfae9e43 seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode 13e550fbfccd scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails 9da6e314ea5f sched_ext: Documentation: Clarify ops.dispatch() role in task lifecycle 43222ac484f9 rxgk: Fix potential integer overflow in length check 3fb7394a8377 rtmutex: Use waiter::task instead of current in remove_waiter() f1af27cec07a ntfs3: fix integer overflow in run_unpack() volume boundary check d3012690a706 ntfs3: add buffer boundary checks to run_unpack() 83e31039e0d7 NFSv4.1: Apply session size limits on clone path fc8d81f189f0 ktest: Fix the month in the name of the failure directory 9f4ba5966c78 IB/core: Fix zero dmac race in neighbor resolution 4db061a40543 gtp: disable BH before calling udp_tunnel_xmit_skb() b91e535f208c ceph: only d_add() negative dentries when they are unhashed 87c99a50e0fd dm mirror: fix integer overflow in create_dirty_log() a616126cb080 crypto: nx - Fix packed layout in struct nx842_crypto_header 354a27e28447 crypto: nx - fix context leak in nx842_crypto_free_ctx 5c07962fed66 crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx 2ae365e32998 crypto: atmel-sha204a - Fix uninitialized data access on OTP read error 1193c12126d3 crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path 64ea9dbf4c77 crypto: atmel-sha204a - Fix error codes in OTP reads 863d11b39277 crypto: atmel-tdes - fix DMA sync direction 910f335786a0 crypto: ccree - fix a memory leak in cc_mac_digest() 808685bfd124 crypto: hisilicon - Fix dma_unmap_single() direction 9c032781c2b1 crypto: atmel-ecc - Release client on allocation failure 61516b4a5b26 crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup 4d713333dd32 crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit 343a5bf68a8f crypto: acomp - fix wrong pointer stored by acomp_save_req() c524c124e309 can: ucan: fix devres lifetime 1656698656f6 bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays e08d75753db1 Bluetooth: hci_event: fix potential UAF in SSP passkey handlers b4339521bb43 apparmor: use target task's context in apparmor_getprocattr() b7a953374db9 mfd: core: Preserve OF node when ACPI handle is present e88827bb0399 taskstats: set version in TGID exit notifications 83bb57635d7c tcp: call sk_data_ready() after listener migration 69c4d137b22d wifi: rtl8xxxu: fix potential use of uninitialized value 4f3374c990fb x86/shstk: Prevent deadlock during shstk sigreturn ef7ce8f4a341 x86/cpu: Disable FRED when PTI is forced on fdaa42ca370d inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails 371f4dc80601 HID: apple: ensure the keyboard backlight is off if suspending ea43a34452a6 check-uapi: link into shared objects 73ce72edd113 md/raid5: validate payload size before accessing journal metadata 1985cb3247e8 md/raid5: fix soft lockup in retry_aligned_read() 9142f00a9287 md/md-llbitmap: raise barrier before state machine transition 98623c7e2a51 md/md-llbitmap: skip reading rdevs that are not in_sync f7d9d0e4a64f amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 ac858718219f mtd: spinand: winbond: Declare the QE bit on W25NxxJW 134975be170b mtd: spi-nor: sst: Fix write enable before AAI sequence 1e6b0a69bf2c ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() 537e06597702 ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access 6b4bf6519e50 ring-buffer: Do not double count the reader_page f9c279ffee6b ARM: 9472/1: fix race condition on PG_dcache_clean in __sync_icache_dcache() cd2689d625b0 perf annotate: Use jump__delete when freeing LoongArch jumps 5955e053ff00 KVM: nSVM: Always intercept VMMCALL when L2 is active 009c0f726abe KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 83f7e055c138 KVM: nSVM: Add missing consistency check for nCR3 validity 0d1f3fd2664b KVM: nSVM: Drop the non-architectural consistency check for NP_ENABLE aabd785f9565 KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS d79720fc9959 KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT b6656ba26525 KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT c2fad967e652 KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) d6f6371bbea6 KVM: nSVM: Triple fault if mapping VMCB12 fails on nested #VMEXIT 410ea5575c66 KVM: nSVM: Refactor writing vmcb12 on nested #VMEXIT as a helper 72fe7d04a669 KVM: nSVM: Refactor checking LBRV enablement in vmcb12 into a helper 49c8b2395bac KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN 2b922a42b531 KVM: SVM: Add missing save/restore handling of LBR MSRs 18ff4ab16412 KVM: SVM: Switch svm_copy_lbrs() to a macro a5ea402844f1 KVM: nSVM: Delay setting soft IRQ RIP tracking fields until vCPU run a3f0981a5a0e KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 88572f9d83d7 KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT 3a95eb7c6950 KVM: nSVM: Delay stuffing L2's current RIP into NextRIP until vCPU run 3428ed1529a1 KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN 46b3827abc44 KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode 8302e9be9f9c KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts c15392ed9e49 KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 497f6af9679f KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 076ab13fe321 KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 e07ad47e53e9 KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state c098979293da KVM: x86: Defer non-architectural deliver of exception payload to userspace read 26f01d03775e LoongArch: KVM: Use CSR_CRMD_PLV in kvm_arch_vcpu_in_kernel() fe06ea2f7b7f userfaultfd: allow registration of ranges below mmap_min_addr 0fedd09ef952 mm/damon/core: use time_in_range_open() for damos quota window start b09958e235f2 mm/damon/core: validate damos_quota_goal->nid for node_mem_{used,free}_bp 8a62c58411cb mm/damon/stat: fix memory leak on damon_start() failure in damon_stat_start() c42a7efb9060 mm/mempolicy: fix memory leaks in weighted_interleave_auto_store() 687ccdf58216 mm/vmalloc: take vmap_purge_lock in shrinker 5184e2c065e3 rtc: ntxec: fix OF node reference imbalance b5856e85a1f0 tpm: tpm_tis: stop transmit if retries are exhausted 6503775a5c41 tpm: tpm_tis: add error logging for data transfer 53e6d2d834df tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() 726ce5042359 tpm: Fix auth session leak in tpm2_get_random() error path f8775d9d9062 tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() 82aa32a4d697 pwm: imx-tpm: Count the number of enabled channels in probe dedaa897b9d7 crypto: talitos - rename first/last to first_desc/last_desc 4861d6cd923f crypto: talitos - fix SEC1 32k ahash request limitation 75d40ccf38ca firmware: google: framebuffer: Do not unregister platform device 5c293a1e1ef0 xfs: fix a resource leak in xfs_alloc_buftarg() fe570daa5193 xfs: start gc on zonegc_low_space attribute updates 27f561bf894e crypto: qat - fix IRQ cleanup on 6xxx probe failure 6d8087a7d0f3 arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins 52e1a80bacc6 mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration d73c3a4070dc mmc: block: use single block write in retry d780f24a4939 randomize_kstack: Maintain kstack_offset per task 95d48e37a130 hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() 6b11dfb3c517 ASoC: Intel: avs: replace strcmp with sysfs_streq 77eb3e79a3e7 drm/amd: Fix set but not used warnings b3166d165753 fs: prepare for adding LSM blob to backing_file b69a8729f84a hwmon: (isl28022) Fix integer overflow in power calculation on 32-bit bff7dbfc326a power: supply: axp288_charger: Do not cancel work before initializing it 988eff645be4 LoongArch: Show CPU vulnerabilites correctly c5dfddc57f1b tpm: avoid -Wunused-but-set-variable 80f54d6f9142 extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' 11baa8b24bcb spi: fix resource leaks on device setup failure 016bc6636573 libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() c2178ff1c70e ipv4: icmp: validate reply type before using icmp_pointers 9b924f3a26b2 RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv f344f04e33bf tracing/fprobe: Reject registration of a registered fprobe before init 38387ccc0fbe slub: fix data loss and overflow in krealloc() 9eed57e9defd drm/arcpgu: fix device node leak e9be7d2fb0b1 net: ks8851: Avoid excess softirq scheduling f826f0000100 net: mctp: fix don't require received header reserved bits to be zero 20ba739bd627 netconsole: avoid out-of-bounds access on empty string in trim_newline() 5424e678f9b3 net: bridge: use a stable FDB dst snapshot in RCU readers be8aad558b46 net: ks8851: Reinstate disabling of BHs around IRQ handler ea0b5d0fe963 net/smc: avoid early lgr access in smc_clc_wait_msg 1c2afc4a1dd1 net: txgbe: fix firmware version check 033370ffb3c9 net: rds: fix MR cleanup on copy error 154fc7fe3f62 net: qrtr: ns: Free the node during ctrl_cmd_bye() 7ef5b521785b arm64: dts: marvell: uDPU: add ethernet aliases d29cafc7e4ee net: txgbe: fix RTNL assertion warning when remove module 491344b826a5 tools/accounting: handle truncated taskstats netlink messages ff591df2cd7f EDAC/versalnet: Fix memory leak in remove and probe error paths 761c37b761ed rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets 76cb9a2d2522 rxrpc: Fix re-decryption of RESPONSE packets 293095ef6188 rxrpc: Fix error handling in rxgk_extract_token() f0d3efd03b2a rxrpc: Fix rxkad crypto unalignment handling ca71ac2de389 rxrpc: Fix conn-level packet handling to unshare RESPONSE packets 861b9a0a1823 rxrpc: Fix memory leaks in rxkad_verify_response() 996b0487b3cd rxrpc: Fix potential UAF after skb_unshare() failure d42d5404782f iio: adc: ad7768-1: remove switch to one-shot mode 4ca3746d9492 iio: adc: ad7768-1: fix one-shot mode data acquisition 54af1a51bb8b ALSA: pcmtest: Fix resource leaks in module init error paths 91c8e75ba1f1 ALSA: pcmtest: fix reference leak on failed device registration 89ed38540e6b ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa2xxx 1ac67f49ae2c ALSA: 6fire: Fix input volume change detection e59ecd4ee3a4 ALSA: caiaq: Handle probe errors properly 30bd9ed68c84 ALSA: caiaq: Fix control_put() result and cache rollback 33df74673674 ALSA: core: Fix potential data race at fasync handling 9678e1b7f512 io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE ea0697129807 io_uring/poll: fix signed comparison in io_poll_get_ownership() 23b4b18bac28 iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() 8661370e0865 block: relax pgmap check in bio_add_page for compatible zone device pages dd154d768db5 io_uring/timeout: check unused sqe fields 81880f84cb36 block: fix zone write plugs refcount handling in disk_zone_wplug_schedule_bio_work() ad0126ffcba8 rbd: fix null-ptr-deref when device_add_disk() fails 4d79d0cf6538 selftests/landlock: Skip stale records in audit_match_record() 127ae2e73e61 selftests/landlock: Fix snprintf truncation checks in audit helpers 1e85a1ae1452 selftests/landlock: Fix format warning for __u64 in net_test a496488e1702 selftests/landlock: Drain stale audit records on init 2fcde49092aa landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork() df865a3bb91b selftests/mqueue: Fix incorrectly named file 558aa1e2cd11 sched: Use u64 for bandwidth ratio calculations 961db0b89200 reset: rzv2h-usb2phy: Keep PHY clock enabled for entire device lifetime 06d0bed2552f remoteproc: xlnx: Only access buffer information if IPI is buffered 8ba804869382 RDMA/mana_ib: Disable RX steering on RSS QP destroy dffdcbeabaac PCI: cadence: Use cdns_pcie_read_sz() for byte or word read access 1fe317364cb5 parisc: Drop ip_fast_csum() inline assembly implementation e6e3724c7870 parisc: _llseek syscall is only available for 32-bit userspace c2462d54af3c nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set 8bcc66896e01 nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 d89044889ecd mtd: docg3: fix use-after-free in docg3_release() 2774bcf71473 mm/hugetlb: fix early boot crash on parameters without '=' separator 2691332ad88b mm/damon/core: fix damon_call() vs kdamond_fn() exit race d5b495ba9de0 mm/alloc_tag: clear codetag for pages allocated before page_ext initialization 3c52d0946977 mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused 377f5ad257fb io_uring/register: fix ring resizing with mixed/large SQEs/CQEs cac2106bb9a2 md/raid10: fix deadlock with check operation and nowait requests bdf33ba450af KVM: selftests: Fix reserved value WRMSR testcase for multi-feature MSRs 2b2fee890250 jbd2: fix deadlock in jbd2_journal_cancel_revoke() 858bc8b9edb6 ipmi:ssif: Clean up kthread on errors 8ebb951a284b erofs: fix the out-of-bounds nameoff handling for trailing dirents 33074b1e6c18 ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes 09496158f6eb ALSA: ctxfi: Add fallback to default RSR for S/PDIF 8d3124290a03 ALSA: aoa: Skip devices with no codecs in i2sbus_resume() df462e82e82c ALSA: aoa: i2sbus: fix OF node lifetime handling e79427ee11a8 ALSA: aoa: i2sbus: clear stale prepared state 0ae7d28dda5c mm/zsmalloc: copy KMSAN metadata in zs_page_migrate() 2dde6377ab2e ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() 2e127ceb1c41 net: qrtr: ns: Fix use-after-free in driver remove() da47f8a5958c media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() 4d3a4638e9d2 lib/ts_kmp: fix integer overflow in pattern length calculation dca29d20ab23 PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete 127a1fe59c78 Revert "ALSA: usb: Increase volume range that triggers a warning" 65fc57c8b8f0 PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown 4ca4351d269f crypto: atmel-sha204a - Fix OTP sysfs read and error handling 26506a30e0e2 media: mtk-jpeg: fix use-after-free in release path due to uncancelled work 19ca9475f18f net: strparser: fix skb_head leak in strp_abort_strp() 63d21a3aa010 net: caif: clear client service pointer on teardown 654c818a69c2 ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() fdc150dac1ad media: amphion: Fix race between m2m job_abort and device_run e0a621459c61 PCI: imx6: Skip waiting for L2/L3 Ready on i.MX6SX b6e61356ad24 EDAC/versalnet: Fix device_node leak in mc_probe() b6cb07f02253 hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt 5b6122a67a29 of: unittest: fix use-after-free in testdrv_probe() 7f0f0926f301 of: unittest: fix use-after-free in of_unittest_changeset() 824897e69d7a dt-bindings: display: ti, am65x-dss: Fix AM62L DSS reg and clock constraints 77d55bc8675e crypto: pcrypt - Fix handling of MAY_BACKLOG requests ebc235675f24 crypto: algif_aead - snapshot IV for async AEAD requests efc52947247a mm: call ->free_folio() directly in folio_unmap_invalidate() ff8a7996dc8b spi: ch341: fix memory leaks on probe failures 132e47030b0b spi: imx: fix use-after-free on unbind 75f8f3c3e091 thermal: core: Fix thermal zone governor cleanup issues 2810fc760aaf um: drivers: call kernel_strrchr() explicitly in cow_user.c 5d6c349c9823 vfio/cdx: Fix NULL pointer dereference in interrupt trigger path 7b436ade16cc vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex 08da3594c8ba vfio/virtio: Convert list_lock from spinlock to mutex 7aa27b20e938 vfio: selftests: Fix VLA initialisation in vfio_pci_irq_set() 4e179a60a60c wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() 000134a20bbf wifi: rtw88: check for PCI upstream bridge existence a02363f71a79 zram: do not forget to endio for partial discard requests a516d4388662 Input: edt-ft5x06 - fix use-after-free in debugfs teardown 3c636a3edca9 ocfs2: split transactions in dio completion to avoid credit exhaustion 944a6864aa06 mm: migrate: requeue destination folio on deferred split queue 3f8805b8ca23 arm64/mm: Enable batched TLB flush in unmap_hotplug_range() ecb3e4fa31ff firmware: google: framebuffer: Do not mark framebuffer as busy f51f85c04480 fs: afs: revert mmap_prepare() change d4d0c91a0afc kbuild: rust: allow `clippy::uninlined_format_args` 5447be57b311 rust: dma: remove DMA_ATTR_NO_KERNEL_MAPPING from public attrs 4404d7d2dda4 drm/nouveau: fix nvkm_device leak on aperture removal failure fa9a4c5e69aa device property: Make modifications of fwnode "flags" thread safe 3e8fefd2997c driver core: Don't let a device probe until it's ready c1c2417c60db ibmasm: fix heap over-read in ibmasm_send_i2o_message() ee5737891464 ibmasm: fix OOB reads in command_file_write due to missing size checks 22a16d3eafee misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() b2801647c203 greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames() fb91d4e49fcb greybus: gb-beagleplay: bound bootloader receive buffering 438e357b3cc6 leds: qcom-lpg: Check for array overflow when selecting the high resolution 332884f5eb79 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check 85cbf7fb568a LoongArch: Add spectre boundry for syscall dispatch table c578b48b9fdf ALSA: usb-audio: Evaluate packsize caps at the right place b216de91c0c0 usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change 6f480aa64d4d usb: chipidea: otg: not wait vbus drop if use role_switch 49340680d41f usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() f28a8281792b ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch 9bbbbbd404d3 ALSA: usb-audio: Avoid false E-MU sample-rate notifications 4d7893a137ea ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Bruce Ashfield [Mon, 11 May 2026 20:25:08 +0000 (16:25 -0400)]
linux-yocto/6.18: update to v6.18.25
Updating linux-yocto/6.18 to the latest korg -stable release that comprises
the following commits:
a256b1e6892e7 Linux 6.18.25 ce383ba615339 rxrpc: Fix missing validation of ticket length in non-XDR key preparsing 2937f17bbeefb crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed 051e51aa55fd4 crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed 111dcc6d0f016 crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed 28324a3b62d9c net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() 6473ed16df1fe ALSA: caiaq: take a reference on the USB device in create_card() f8397fc0ff9a4 ALSA: hda/realtek: Add quirk for Legion S7 15IMH 1d30e8d4a07c1 ALSA: usb-audio: apply quirk for MOONDROP JU Jiu c76cf339b8797 f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() 028103656b842 writeback: Fix use after free in inode_switch_wbs_work_fn() feefd5d5b5ee2 ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() 5e7b8f3c539d6 ksmbd: use check_add_overflow() to prevent u16 DACL size overflow 790304c02bf9b ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment 3e5360b422dd7 ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() 299db777ea0cf ksmbd: validate response sizes in ipc_validate_msg() 078fae8f50ade smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path 38a69f08ee82c smb: client: require a full NFS mode SID before reading mode bits 3943e4565aae7 smb: server: fix max_connections off-by-one in tcp accept path 283027aa93380 smb: server: fix active_num_conn leak on transport allocation failure 90089584b2e25 ksmbd: require minimum ACE size in smb_check_perm_dacl() 3fa185e320197 fuse: fuse_dev_ioctl_clone() should wait for device file to be initialized 9ef130452eaf1 fuse: quiet down complaints in fuse_conn_limit_write 1381635aeb7f8 fuse: Check for large folio with SPLICE_F_MOVE 0c7fca880a40a fuse: abort on fatal signal during sync init 7de93abfaae1b fuse: reject oversized dirents in page cache 59970b2586fef f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer 047c0aef6af37 f2fs: fix to avoid memory leak in f2fs_rename() 963d2e24d9d92 f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() 748c5d08f1a92 f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally 0112e6279420d fs/ntfs3: validate rec->used in journal-replay file record check f218fb82877b1 scripts/dtc: Remove unused dts_version in dtc-lexer.l c846ed5ac80fa lib/crypto: tests: Drop the default to CRYPTO_SELFTESTS ca47b87f24571 kunit: configs: Enable all crypto library tests in all_tests.config 95c05443aa34e lib/crypto: tests: Introduce CRYPTO_LIB_ENABLE_ALL_FOR_KUNIT b0ca42c018837 lib/crypto: tests: Add a .kunitconfig file 05f723be4d641 kunit: configs: Enable all CRC tests in all_tests.config 04c61029a3b76 lib/crc: tests: Add a .kunitconfig file 6897bdfa505f9 lib/crc: tests: Add CRC_ENABLE_ALL_FOR_KUNIT e70c01412893c lib/crc: tests: Make crc_kunit test only the enabled CRC variants 28f77fca44497 sched/debug: Fix avg_vruntime() usage c6c87a23de4bd arm64: errata: Work around early CME DVMSync acknowledgement ee5ce483d4280 arm64: cputype: Add C1-Pro definitions 456d6040bb3b2 arm64: tlb: Pass the corresponding mm to __tlbi_sync_s1ish() e785d2751b1db arm64: tlb: Introduce __tlbi_sync_s1ish_{kernel,batch}() for TLB maintenance 243cec136a748 arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI 609624576b6fd arm64: tlb: Allow XZR argument to TLBI ops 00ce8d6789dae ksmbd: validate owner of durable handle on reconnect 3d6682726c2d3 ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger 377bbec04e167 scripts: generate_rust_analyzer.py: define scripts 07cbb1bd42437 crypto: krb5enc - fix async decrypt skipping hash verification 41d151254caa7 crypto: krb5enc - fix sleepable flag handling in encrypt dispatch b7cddf6c01751 drm/amdgpu: replace PASID IDR with XArray e97593f32bd57 net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers c5cedee5d9738 ipv6: add NULL checks for idev in SRv6 paths ecc0eb147806f crypto: authencesn - Fix src offset when decrypting in-place
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Security fixes:
#1216 CVE-2026-45186 -- Fix quadratic runtime from attribute name
collision checks that allowed denial of service attacks
through moderately sized crafted XML input (CWE-407).
Please note that a layer of compression around XML can
significantly reduce the minimum attack payload size.
Other changes:
#1209 #1213 Drop more casts related to `void *` that C99 does not need
#1213 xmlwf: Streamline use of `mmap`
#1214 #1217 Version info bumped from 13:0:12 (libexpat*.so.1.12.0)
to 13:1:12 (libexpat*.so.1.12.1); see https://verbump.de/
for what these numbers do
Infrastructure:
#1210 CI: Cover compilation with Visual Studio 18 2026 on Windows
#1215 CI: Cover compilation for ARM64 on Windows
#1212 CI: Bump WASI SDK from 32 to 33
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There's been a number of attempts at fixing the logic as to when to run
gdk-pixbuf-query-loaders in cross builds. Originally the build failed in
cross so we worked around that, then upstream changed it so that if exe
wrappers are enabled it will run those but our target sysroot doesn't
have binaries so that also fails.
This rework should be upstreamable once it's been shaken out in OE for a
while, and improves the logic so that in cross builds the existance of
gdk-pixbuf-query-loaders is an optional dependency, which is ideal for
our needs as we won't be running it at install-time anyway.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
sbom-cve-check: set PV from upstream tags and ensure version checks are correct
These recipes didn't set PV, which by default is 1.0. This isn't correct:
upstream does provide date-based tags that can be used to perform version upgrades.
Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Quan Sun [Mon, 11 May 2026 20:52:02 +0000 (13:52 -0700)]
qemu: fix iotlb_to_section() for different AddressSpace
Backport upstream commit 854cd16e318e ("accel/tcg: Fix iotlb_to_section()
for different AddressSpace") to qemu 10.2.0.
The bug causes incorrect memory load/store when CPU access goes through
an IOMMUMemoryRegion that returns a different target AddressSpace, and the
fix replaces the section_index lookup with a direct MemoryRegionSection
pointer stored in CPUTLBEntryFull.
Note that the fix primarily targets ARM/RISC-V, but since it eliminates
iotlb_to_section() and performs the lookup based on CPUTLBEntryFull,
it may also help address some currently observed QEMU boot issues
on x86, e.g. the https://bugzilla.yoctoproject.org/show_bug.cgi?id=16259.
AI-Generated: kiro-cli
Signed-off-by: Quan Sun <Quan.Sun@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Paul Barker [Mon, 11 May 2026 13:51:21 +0000 (14:51 +0100)]
oe/lsb: Only read /etc/os-release
Over time, distros have standardised on providing distro name and
version information via /etc/os-release. All of our currently supported
distros contain this file, so we can drop support for gathering distro
name and version information via other methods.
Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Thomas Perrot [Mon, 11 May 2026 10:13:54 +0000 (12:13 +0200)]
oe-pkgdata-util: fix runtime-rprovides handling in lookup_pkg error path
Commit 678c1c207731 applied os.path.isdir() + non-empty check to three
functions, but the error-reporting path in lookup_pkg introduced by
commit 46ff3a8d2c18 was left using os.path.exists() + os.listdir().
This is fragile: it raises NotADirectoryError if the path exists but is
a file, and silently falls through to the generic error on an empty
directory rather than skipping the rprovides block.
Apply the same pattern used elsewhere for consistency.
Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
For details on this new release which fixes various bugs, see:
https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.1
Also, update the LICENSE, which is now GPL-2.0-or-later instead of
GPL-2.0-only, to be compatible with the licence dependencies.
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Peter Marko [Wed, 6 May 2026 21:28:40 +0000 (23:28 +0200)]
ffmpeg: upgrade 8.0.1 -> 8.1.1
Solves CVE-2025-12343, CVE-2025-69693 and CVE-2026-40962.
Remove patches included in this release and refresh remaining patch.
Remove obsolete CVE_STATUS assigments for CVEs no longer reported as
unpatched with this new version.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Peter Marko [Thu, 7 May 2026 19:53:38 +0000 (21:53 +0200)]
go: upgrade 1.26.2 -> 1.26.3
Upgrade to latest 1.26.x release [1]:
$ git --no-pager log --oneline go1.26.2..go1.26.3 2dc996f71b (tag: go1.26.3) [release-branch.go1.26] go1.26.3 8282c628a0 [release-branch.go1.26] cmd/go: reject sumdb response lacking module hash 3baf3eec3b [release-branch.go1.26] all: avoid unsafe StringToUTF16Ptr on Windows 0bec63330d [release-branch.go1.26] net/mail: fix quadratic consumePhrase behavior 7136366ebf [release-branch.go1.26] cmd/go: invalidate test cache when -coverpkg dependencies change 722b68ceca [release-branch.go1.26] cmd/compile: keep blank nodes alive in b.loop 3ae315a8cd [release-branch.go1.26] os: avoid panic when RemoveAll fails to remove a symlink c9f97f50c4 [release-branch.go1.26] html/template: fix escaping of URLs in meta content attributes 40fa774fff [release-branch.go1.26] cmd/pack: refuse to extract files with directory components d9389d318b [release-branch.go1.26] net/mail: fix quadratic complexity in consumeComment dd29b59a2b [release-branch.go1.26] cmd/compile: fix loopvar version detection with line directives 18fa391f45 [release-branch.go1.26] crypto/fips140: add package docs e0f5c054cb [release-branch.go1.26] net: avoid double-free of cgo pointer when handling large DNS response 2992086cf8 [release-branch.go1.26] lib/fips140: add certified pointing to v1.0.0-c2097c7c f43caf8712 [release-branch.go1.26] lib/fips140: update inprocess to v1.26.0 19d2ce3401 [release-branch.go1.26] runtime: fix timespec definition on 32bits systems e9df527f06 [release-branch.go1.26] crypto/tls: wrap ML-KEM hybrids in fips140.WithoutEnforcement 73f417a37c [release-branch.go1.26] go/types, types2: handle unconstrained type parameters correctly in a few places 50856a181c [release-branch.go1.26] cmd/go: use MkdirTemp to create temp directory for "go bug" e137885d68 [release-branch.go1.26] cmd/compile/internal/devirtualize: use pointer identity for type comparison c9712872cc [release-branch.go1.26] crypto/internal/fips140/drbg: build tag out entropy generation on Wasm cb994d85ff [release-branch.go1.26] cmd/fix: change -diff to exit 1 if diffs exist 95470667eb [release-branch.go1.26] net/http/httputil: reencode queries with many parameters in proxy 9b01c04815 [release-branch.go1.26] html/template: fix escaper bypass by treating empty script type as JavaScript be12fe151c [release-branch.go1.26] runtime: use uname version check for 64-bit time on 32-bit arch codepaths ec5ebece41 [release-branch.go1.26] all: update x/net to 705de46f 710f29a758 [release-branch.go1.26] runtime: add sysUnreserve to undo sysReserve efdc0fb354 [release-branch.go1.26] cmd/compile: handle min integer step in loop ba4554f03b [release-branch.go1.26] cmd/go: specify full path to go command when running go tool covdata f4e425d342 [release-branch.go1.26] fix incorrect loop trip counts 0b4d5f85e6 [release-branch.go1.26] cmd/link: use bfd ld 2.36+ on linux/arm64 instead of gold
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
features-check.bbclass: add reference to required TUNE_FEATURES
While commit a8ef7339ecb9eee909224e7cf23ccd48ef105d93 added the
string 'TUNE' to add support for checking required TUNE_FEATURES,
the comment was not adjusted appropriately.
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Fri, 8 May 2026 06:46:05 +0000 (07:46 +0100)]
utils: Handle unexpanded variables in DISTRO_FEATURES
If you have an unset variable in DISTRO_FEATURES, very strange things appear to
happen. Currently, this shows up as seccomp appearing in PACKAGECONFIG for
gnutls-native which isn't what the user configured.
The issue happens if you have a variable in DISTRO_FEATURES which cannot be
expanded.
Add some code to detect, warn and work around such a thing. Create a function to
allow this to be done in one place.
[YOCTO #16275]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changqing Li [Sat, 9 May 2026 05:01:29 +0000 (13:01 +0800)]
gstreamer1.0-plugins-bad: disble vulkan when x11/wayland not enabled
When vulkan is enabled in DISTRO_FEATURES without x11 or wayland,
do_configure will failed with error:
gst-libs/gst/vulkan/meson.build:311:4: ERROR: Problem encountered: No Windowing system found. vulkansink will not work
disable vulkan from PACKAGECONFIG when x11 and wayland is not enabled
Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Pratik Farkase [Fri, 8 May 2026 14:42:19 +0000 (16:42 +0200)]
go: ptest: fix GOROOT detection and improve cleanup/exit handling
Changes:
- Derive GOROOT dynamically from PTEST_DIR instead of hardcoding
/usr/lib/go, which breaks on distros using lib64.
- Track and clean up VERSION and pkg/include files that were copied
into GOROOT, preventing stale artifacts after ptest runs.
- Track failures with RC variable and exit non-zero when tests fail,
consistent with other ptest scripts.
Richard Purdie [Thu, 7 May 2026 12:16:44 +0000 (13:16 +0100)]
kernel: Disable module deploy tarball by default
These module tarballs were once useful for certain development workflows. They
are not that useful when deployed in CI, taking up space as release artefacts.
Not generating them by default saves time/space and users who need/use them can
enable them, this makes more sense as a modern default.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Peter Marko [Sun, 10 May 2026 09:26:34 +0000 (11:26 +0200)]
busybox: patch CVE-2024-58251
Pick patch applied by Debian [1].
I did not find any reference on busybox mailing list that this patch was
submitted. Submitting patch for someone else would be inappropriate,
and busybox is currently known to be very inactive, hence the unwanted
Pending Upstream-Status status.
Also note that the related busybox bugreport [2] is currently not
public, so it is possible that it was submitted there.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel McGregor [Thu, 30 Apr 2026 19:51:20 +0000 (13:51 -0600)]
python3-requests: update to 2.33.1
OE Core includes chardet 6.0, while requests warns for any version
greater than or equal to 6.0. requests > 2.33 support chardet up
to version 8, so import the new release.
Signed-off-by: Daniel McGregor <daniel.mcgregor@vecima.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
An empty runtime-provides directory caused lookup-recipe, package-info
and list-pkg-files to skip the runtime-reverse fallback.
Use os.listdir() to ensure the folder is not empty and use
os.path.isdir( to ensure it is not a file.
Signed-off-by: Sam Kent <sam.john.kent@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Peter Marko [Tue, 5 May 2026 09:46:01 +0000 (11:46 +0200)]
perf: make libraries for install_headers configurable
Older kernels don't support install_headers for all libraries.
For instance kernel 6.1 fails for two (api and symbol) with:
make: *** No rule to make target 'install_headers'. Stop.
Also sort the list when moving to variable.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Andrew Geissler [Tue, 5 May 2026 14:36:54 +0000 (09:36 -0500)]
efivar: Backport patch to fix -march issue for ppc64le
Backport upstream commit 9711b8aa5acc to fix compilation errors on ppc64le
architecture. The issue occurs because GCC on ppc64le does not recognize the
'-march=native' option and suggests using '-mcpu=native' instead.
Ivan Nestlerode [Mon, 4 May 2026 21:28:43 +0000 (17:28 -0400)]
glibc: Fix recipe bug that disabled stack protector
Fixes [YOCTO #16265]
The glibc recipe is supposed to be building with
--enable-stack-protector=strong, but some CACHED_CONFIGVARS values are
actually breaking this, causing glibc to be built with no stack
protector at all.
Remove these CACHED_CONFIGVARS values so that stack protector support is
detected properly in do_configure and then enabled properly during
do_compile.
Full details are here:
https://bugzilla.yoctoproject.org/show_bug.cgi?id=16265
Signed-off-by: Ivan Nestlerode <ivan.nestlerode@sonos.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
projects / thirdparty / openembedded / openembedded-core.git / log
