Skip to content

Commit d696e90

Browse files
CBL-Mariner-Botazurelinux-securityakhila-guruju
authored
Merge PR "[AUTO-CHERRYPICK] [AutoPR- Security] Patch cmake for CVE-2026-27135 [HIGH] - branch 3.0-dev" #16264
Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: akhila-guruju <v-guakhila@microsoft.com>
1 parent 1a20d46 commit d696e90

4 files changed

Lines changed: 126 additions & 5 deletions

File tree

‎SPECS/cmake/CVE-2026-27135.patch‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
From 5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1 Mon Sep 17 00:00:00 2001
2+
From: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
3+
Date: Wed, 18 Feb 2026 18:04:30 +0900
4+
Subject: [PATCH] Fix missing iframe->state validations to avoid assertion
5+
failure
6+
7+
Upstream Patch reference: https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1.patch
8+
---
9+
Utilities/cmnghttp2/lib/nghttp2_session.c | 40 ++++++++++++++++++++---
10+
1 file changed, 36 insertions(+), 4 deletions(-)
11+
12+
diff --git a/Utilities/cmnghttp2/lib/nghttp2_session.c b/Utilities/cmnghttp2/lib/nghttp2_session.c
13+
index ee839769..c150dff6 100644
14+
--- a/Utilities/cmnghttp2/lib/nghttp2_session.c
15+
+++ b/Utilities/cmnghttp2/lib/nghttp2_session.c
16+
@@ -6120,6 +6120,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
17+
return rv;
18+
}
19+
20+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
21+
+ return (ssize_t)inlen;
22+
+ }
23+
+
24+
on_begin_frame_called = 1;
25+
26+
rv = session_process_headers_frame(session);
27+
@@ -6486,6 +6490,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
28+
if (nghttp2_is_fatal(rv)) {
29+
return rv;
30+
}
31+
+
32+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
33+
+ return (ssize_t)inlen;
34+
+ }
35+
}
36+
}
37+
38+
@@ -6742,6 +6750,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
39+
return rv;
40+
}
41+
42+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
43+
+ return (ssize_t)inlen;
44+
+ }
45+
+
46+
session_inbound_frame_reset(session);
47+
48+
break;
49+
@@ -7045,6 +7057,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
50+
if (nghttp2_is_fatal(rv)) {
51+
return rv;
52+
}
53+
+
54+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
55+
+ return (ssize_t)inlen;
56+
+ }
57+
} else {
58+
iframe->state = NGHTTP2_IB_IGN_HEADER_BLOCK;
59+
}
60+
@@ -7210,13 +7226,17 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
61+
rv = session->callbacks.on_data_chunk_recv_callback(
62+
session, iframe->frame.hd.flags, iframe->frame.hd.stream_id,
63+
in - readlen, (size_t)data_readlen, session->user_data);
64+
- if (rv == NGHTTP2_ERR_PAUSE) {
65+
- return in - first;
66+
- }
67+
-
68+
if (nghttp2_is_fatal(rv)) {
69+
return NGHTTP2_ERR_CALLBACK_FAILURE;
70+
}
71+
+
72+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
73+
+ return (ssize_t)inlen;
74+
+ }
75+
+
76+
+ if (rv == NGHTTP2_ERR_PAUSE) {
77+
+ return in - first;
78+
+ }
79+
}
80+
}
81+
}
82+
@@ -7297,6 +7317,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
83+
return rv;
84+
}
85+
86+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
87+
+ return (ssize_t)inlen;
88+
+ }
89+
+
90+
if (rv != 0) {
91+
busy = 1;
92+
93+
@@ -7315,6 +7339,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
94+
return rv;
95+
}
96+
97+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
98+
+ return (ssize_t)inlen;
99+
+ }
100+
+
101+
session_inbound_frame_reset(session);
102+
103+
break;
104+
@@ -7343,6 +7371,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
105+
return rv;
106+
}
107+
108+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
109+
+ return (ssize_t)inlen;
110+
+ }
111+
+
112+
session_inbound_frame_reset(session);
113+
114+
break;
115+
--
116+
2.43.0
117+

‎SPECS/cmake/cmake.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Cmake
33
Name: cmake
44
Version: 3.30.3
5-
Release: 12%{?dist}
5+
Release: 13%{?dist}
66
License: BSD AND LGPLv2+
77
Vendor: Microsoft Corporation
88
Distribution: Azure Linux
@@ -35,6 +35,7 @@ Patch15: CVE-2025-10148.patch
3535
Patch16: CVE-2025-14017.patch
3636
Patch17: CVE-2025-10966.patch
3737
Patch18: CVE-2025-14524.patch
38+
Patch19: CVE-2026-27135.patch
3839

3940
BuildRequires: bzip2
4041
BuildRequires: bzip2-devel
@@ -115,6 +116,9 @@ bin/ctest --force-new-ctest-process --rerun-failed --output-on-failure
115116
%{_libdir}/rpm/macros.d/macros.cmake
116117

117118
%changelog
119+
* Fri Mar 20 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.30.3-13
120+
- Patch for CVE-2026-27135
121+
118122
* Wed Jan 21 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.30.3-12
119123
- Patch for CVE-2025-10966 & CVE-2025-14524
120124

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,8 @@ check-debuginfo-0.15.2-1.azl3.aarch64.rpm
5151
chkconfig-1.25-1.azl3.aarch64.rpm
5252
chkconfig-debuginfo-1.25-1.azl3.aarch64.rpm
5353
chkconfig-lang-1.25-1.azl3.aarch64.rpm
54-
cmake-3.30.3-12.azl3.aarch64.rpm
55-
cmake-debuginfo-3.30.3-12.azl3.aarch64.rpm
54+
cmake-3.30.3-13.azl3.aarch64.rpm
55+
cmake-debuginfo-3.30.3-13.azl3.aarch64.rpm
5656
coreutils-9.4-6.azl3.aarch64.rpm
5757
coreutils-debuginfo-9.4-6.azl3.aarch64.rpm
5858
coreutils-lang-9.4-6.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,8 @@ check-debuginfo-0.15.2-1.azl3.x86_64.rpm
5454
chkconfig-1.25-1.azl3.x86_64.rpm
5555
chkconfig-debuginfo-1.25-1.azl3.x86_64.rpm
5656
chkconfig-lang-1.25-1.azl3.x86_64.rpm
57-
cmake-3.30.3-12.azl3.x86_64.rpm
58-
cmake-debuginfo-3.30.3-12.azl3.x86_64.rpm
57+
cmake-3.30.3-13.azl3.x86_64.rpm
58+
cmake-debuginfo-3.30.3-13.azl3.x86_64.rpm
5959
coreutils-9.4-6.azl3.x86_64.rpm
6060
coreutils-debuginfo-9.4-6.azl3.x86_64.rpm
6161
coreutils-lang-9.4-6.azl3.x86_64.rpm

0 commit comments

Comments
 (0)