Skip to content

Commit 1056e3e

Browse files
azurelinux-securityakhila-guruju
azurelinux-security
and
akhila-guruju
authored
[AutoPR- Security] Patch cmake for CVE-2026-27135 [HIGH] (#16249)
Co-authored-by: akhila-guruju <v-guakhila@microsoft.com>
1 parent ca31eb4 commit 1056e3e

File tree

4 files changed

+115
-5
lines changed

4 files changed

+115
-5
lines changed

‎SPECS/cmake/CVE-2026-27135.patch‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
From 5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1 Mon Sep 17 00:00:00 2001
2+
From: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
3+
Date: Wed, 18 Feb 2026 18:04:30 +0900
4+
Subject: [PATCH] Fix missing iframe->state validations to avoid assertion
5+
failure
6+
7+
Upstream Patch reference: https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1.patch
8+
---
9+
Utilities/cmnghttp2/lib/nghttp2_session.c | 36 ++++++++++++++++++++---
10+
1 file changed, 32 insertions(+), 4 deletions(-)
11+
12+
diff --git a/Utilities/cmnghttp2/lib/nghttp2_session.c b/Utilities/cmnghttp2/lib/nghttp2_session.c
13+
index f02e3f95..37add2ec 100644
14+
--- a/Utilities/cmnghttp2/lib/nghttp2_session.c
15+
+++ b/Utilities/cmnghttp2/lib/nghttp2_session.c
16+
@@ -5620,6 +5620,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
17+
return rv;
18+
}
19+
20+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
21+
+ return (ssize_t)inlen;
22+
+ }
23+
+
24+
on_begin_frame_called = 1;
25+
26+
rv = session_process_headers_frame(session);
27+
@@ -5927,6 +5931,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
28+
if (nghttp2_is_fatal(rv)) {
29+
return rv;
30+
}
31+
+
32+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
33+
+ return (ssize_t)inlen;
34+
+ }
35+
}
36+
}
37+
38+
@@ -6471,6 +6479,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
39+
if (nghttp2_is_fatal(rv)) {
40+
return rv;
41+
}
42+
+
43+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
44+
+ return (ssize_t)inlen;
45+
+ }
46+
} else {
47+
iframe->state = NGHTTP2_IB_IGN_HEADER_BLOCK;
48+
}
49+
@@ -6635,13 +6647,17 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
50+
rv = session->callbacks.on_data_chunk_recv_callback(
51+
session, iframe->frame.hd.flags, iframe->frame.hd.stream_id,
52+
in - readlen, (size_t)data_readlen, session->user_data);
53+
- if (rv == NGHTTP2_ERR_PAUSE) {
54+
- return in - first;
55+
- }
56+
-
57+
if (nghttp2_is_fatal(rv)) {
58+
return NGHTTP2_ERR_CALLBACK_FAILURE;
59+
}
60+
+
61+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
62+
+ return (ssize_t)inlen;
63+
+ }
64+
+
65+
+ if (rv == NGHTTP2_ERR_PAUSE) {
66+
+ return in - first;
67+
+ }
68+
}
69+
}
70+
}
71+
@@ -6721,6 +6737,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
72+
return rv;
73+
}
74+
75+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
76+
+ return (ssize_t)inlen;
77+
+ }
78+
+
79+
if (rv != 0) {
80+
busy = 1;
81+
82+
@@ -6739,6 +6759,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
83+
return rv;
84+
}
85+
86+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
87+
+ return (ssize_t)inlen;
88+
+ }
89+
+
90+
session_inbound_frame_reset(session);
91+
92+
break;
93+
@@ -6767,6 +6791,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
94+
return rv;
95+
}
96+
97+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
98+
+ return (ssize_t)inlen;
99+
+ }
100+
+
101+
session_inbound_frame_reset(session);
102+
103+
break;
104+
--
105+
2.43.0
106+

‎SPECS/cmake/cmake.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Cmake
33
Name: cmake
44
Version: 3.21.4
5-
Release: 22%{?dist}
5+
Release: 23%{?dist}
66
License: BSD AND LGPLv2+
77
Vendor: Microsoft Corporation
88
Distribution: Mariner
@@ -43,6 +43,7 @@ Patch28: CVE-2025-5918.patch
4343
Patch29: CVE-2025-14017.patch
4444
Patch30: CVE-2025-10966.patch
4545
Patch31: CVE-2025-14524.patch
46+
Patch32: CVE-2026-27135.patch
4647

4748
BuildRequires: bzip2
4849
BuildRequires: bzip2-devel
@@ -109,6 +110,9 @@ bin/ctest --force-new-ctest-process --rerun-failed --output-on-failure
109110
%{_prefix}/doc/%{name}-*/*
110111

111112
%changelog
113+
* Fri Mar 20 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.21.4-23
114+
- Patch for CVE-2026-27135
115+
112116
* Thu Jan 22 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.21.4-22
113117
- Patch for CVE-2025-14524 & CVE-2025-10966
114118

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@ check-debuginfo-0.15.2-1.cm2.aarch64.rpm
3030
chkconfig-1.20-4.cm2.aarch64.rpm
3131
chkconfig-debuginfo-1.20-4.cm2.aarch64.rpm
3232
chkconfig-lang-1.20-4.cm2.aarch64.rpm
33-
cmake-3.21.4-22.cm2.aarch64.rpm
34-
cmake-debuginfo-3.21.4-22.cm2.aarch64.rpm
33+
cmake-3.21.4-23.cm2.aarch64.rpm
34+
cmake-debuginfo-3.21.4-23.cm2.aarch64.rpm
3535
coreutils-8.32-7.cm2.aarch64.rpm
3636
coreutils-debuginfo-8.32-7.cm2.aarch64.rpm
3737
coreutils-lang-8.32-7.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@ check-debuginfo-0.15.2-1.cm2.x86_64.rpm
3131
chkconfig-1.20-4.cm2.x86_64.rpm
3232
chkconfig-debuginfo-1.20-4.cm2.x86_64.rpm
3333
chkconfig-lang-1.20-4.cm2.x86_64.rpm
34-
cmake-3.21.4-22.cm2.x86_64.rpm
35-
cmake-debuginfo-3.21.4-22.cm2.x86_64.rpm
34+
cmake-3.21.4-23.cm2.x86_64.rpm
35+
cmake-debuginfo-3.21.4-23.cm2.x86_64.rpm
3636
coreutils-8.32-7.cm2.x86_64.rpm
3737
coreutils-debuginfo-8.32-7.cm2.x86_64.rpm
3838
coreutils-lang-8.32-7.cm2.x86_64.rpm

0 commit comments

Comments
 (0)