Date: Mon, Jun 29, 2026 at 3:33 PM
Subject: [yocto] linux-yocto CVEs in need of triage
To: openembedded-core@lists.openembedded.org <
openembedded-core@lists.openembedded.org>, yocto@lists.yoctoproject.org <
yocto@lists.yoctoproject.org>, <linux-yocto@lists.yoctoproject.org>
Hi all,
We would appreciate help triaging the following CVEs filed against the
Linux Kernel, which therefore affect linux-yocto.
Each of these is missing an upstream fix version in the CVE data, so
they show as unresolved in our CVE metrics. However, they may well be
fixed already in the kernel versions that we ship. So we need some help
to determine the appropriate upstream fix versions.
For each CVE, at a minimum we need to know if they are resolved in the
mainline kernel, and if so then which release they were resolved in. A
pointer to the exact upstream commit resolving the issue would be
preferred. This may involve a bit of investigation, so please share the
information you find that proves that a CVE is resolved in a particular
kernel version.
Once you've investigated a particular CVE, if it is resolved upstream
then please send a patch to update the linux-yocto cve-exclusion.inc
file with the appropriate information. See recent commits to this file
for examples of what we need, e.g:
cve-exclusions: set status for 5 CVEs - openembedded-core - OpenEmbedded Core layer
Once we've got patches merged into the master branch, we can look at
backporting to wrynose & scarthgap as appropriate.
The open linux-yocto CVEs lacking an upstream fix version and not
currently tracked in cve-exclusion.inc are:
- CVE-2019-14899
- CVE-2021-3714
- CVE-2021-3864
- CVE-2022-0400
- CVE-2022-1247
- CVE-2022-4543
- CVE-2023-3397
- CVE-2023-3640
- CVE-2023-4010
- CVE-2023-6238
- CVE-2023-6240
Best regards,
--
Paul Barker
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#66616):
https://lists.yoctoproject.org/g/yocto/message/66616
Mute This Topic: Log In
Group Owner: yocto+owner@lists.yoctoproject.org
Unsubscribe: Log In [
philip.balister@gmail.com]
-=-=-=-=-=-=-=-=-=-=-=-