Fix out-of-bounds read on on missing right bracket after character class.
The original code checked for a closing bracket before parsing the
bracket expression. When character class support was added, that
closing bracket can now be part of the character class instead.
Add another check for the closing bracket after parsing character
classes and roll back if we don't find one.
Adapted from an OpenSSH bug report. OK djm@
Limit the number of pending L2TP connections. Previously, an
unlimited number of pending connections could exhaust npppd's memory.
From acts1631
ok mvs
Reject short MPPE packets in npppd. Short MPPE frame underflowed the
RC4 length, that caused RC4 to access across memory until it faults.
From acts1631
ok mvs
Update libexpat to version 2.9.0
Relevant for OpenBSD are security fixes #1392 #1393, bug fixes
#1387, new features #1327 #1323, other changes #1394 #1399 #1400
#1401 #1402 #1404 #1405. Minor library bump is necessary for API
extension.
CVE-2026-102633CVE-2026-77214
OK tb@
sys/octeon: span work queue interrupts across CPUs
It was disabled at octciu.c,v 1.20 to allow fixing logic of ncpus which
leads to issues with devices where used cnmac wasn't mapped to CPU0
Now, since the missed splx() was added at clock.c, v1.54 I revert it back.
OK: visa@
rpki-client: sort arrays before handling temp files for ca state
The handling of the tempfiles is placed in the middle of the preparation
of the arrays to print. This commit moves it a bit down.
There is no goto err between the calloc and the qsort, so this is safe.
ok job
drm/amd: Create a device link between APU display and XHCI devices
From Mario Limonciello
b030fde644501d0ed5e604fc01719d1daa9cd472 in linux-6.18.y/6.18.58
75c8746b9d0a0317d8a58aa0efa2ff2f7359908b in mainline linux
Prioritise previously confirmed certification paths
Duplicate SKI might appear because of reuse of a keypair (a poor CA
practise, but not illegal) or because of 'public key stealing', i.e.,
an adversarial CA issues a certificate containing the victim CA's SPKI
and SIA. Because SKI might not be globally unique, certificates have
been tracked by an internal identifier since 2024.
Jacobsen et al., 2026, reported that rpki-client's certification path
loop protection might be exploited if an adversary can race the victim.
This race can happen in the discovery of the logical certification
topology, unrelated to racing repository loading over the network. Any
payload carrying objects (ROAs, ASPAs, etc) discovered through the
adversary's certification path will fail resource containment checks and
the loop guard (entity_process()->filepath_add()) necessarily enforces
each object to be accessed only once. The result is that if the race is
lost, the victim's payloads disappear from view.
Some people incorrectly assert that RPKI resource certificates cannot
[31 lines not shown]
Handle the Emudhra intermediate cert compromise.
See https://emudhra.we-have-a-problem.com/
While likely all of Emudrha will be distrusted soon, currently
a lot of India is using them. 8 intermediates under their CA3
have publicly discoverable keys. the 9 others sign many sites.
For now, remove CA3 from the trust store, thus distrusting all
the intermediates it has signed, then add back the remaining
9 uncompromised intermediates by "promoting" to a root, the
usual intermediate elision technique.
This enables real sites in india using these intermediates
to still work. Assuming Emudhra ends up widely distrusted
soon, we can remove these and the other roots after sites
have had time to get new certificates.
from beck@; OK tb@ sthen@
dbupdate: Be consistent with name in messages.
from dgl@; OK deraadt@
force umask
[45 lines not shown]
Handle the Emudhra intermediate cert compromise.
See https://emudhra.we-have-a-problem.com/
While likely all of Emudrha will be distrusted soon, currently
a lot of India is using them. 8 intermediates under their CA3
have publicly discoverable keys. the 9 others sign many sites.
For now, remove CA3 from the trust store, thus distrusting all
the intermediates it has signed, then add back the remaining
9 uncompromised intermediates by "promoting" to a root, the
usual intermediate elision technique.
This enables real sites in india using these intermediates
to still work. Assuming Emudhra ends up widely distrusted
soon, we can remove these and the other roots after sites
have had time to get new certificates.
from beck@; OK tb@ sthen@
update cert.pem based on newer mozilla ca root store
from sthen@; OK tb@
dbupdate: Be consistent with name in messages.
[48 lines not shown]
