Pick patch according to [1] (equivalent to patch from [2]).
This CVE is needed if util-linux >= 2.40 is used which is not the case
in Yocto scarthgap, however it's always possible that users update
packages in their layers.
[1] https://security-tracker.debian.org/tracker/CVE-2026-28372
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-28372
(From OE-Core rev: 2ab4f313ebd2c8f2d801dc3f53df3a0741cf848e)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
[YC: replaced kirkstone by scarthap]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The update from 2.4 to 2.5 was almost something AUH could take care of.
However, we had backported two patches to address CVE-2023-40303 and
that threw off AUH. These changes are confirmed to be in 2.5, so drop
them and update to 2.5.
(From OE-Core rev: e1bffeab27b062884f6366cde24ce1c67e7ec03e)
Signed-off-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
