Skip to content

[AutoPR- Security] Patch alsa-lib for CVE-2026-25068 [MEDIUM]#15757

Merged
Kanishk-Bansal merged 3 commits intomicrosoft:3.0-devfrom
azurelinux-security:azure-autosec/alsa-lib/3.0/1045435
Mar 2, 2026
Merged

[AutoPR- Security] Patch alsa-lib for CVE-2026-25068 [MEDIUM]#15757
Kanishk-Bansal merged 3 commits intomicrosoft:3.0-devfrom
azurelinux-security:azure-autosec/alsa-lib/3.0/1045435

Conversation

@azurelinux-security
Copy link
Contributor

@azurelinux-security azurelinux-security commented Feb 9, 2026 •
edited
Loading

Auto Patch alsa-lib for CVE-2026-25068.

Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1045435&view=results

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

  • The toolchain has been rebuilt successfully (or no changes were made to it)
  • The toolchain/worker package manifests are up-to-date
  • Any updated packages successfully build (or no packages were changed)
  • Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
  • Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
  • All package sources are available
  • cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
  • LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
  • All source files have up-to-date hashes in the *.signatures.json files
  • sudo make go-tidy-all and sudo make go-test-coverage pass
  • Documentation has been updated to match any changes to the build system
  • Ready to merge
Summary

What does the PR accomplish, why was it needed?

Change Log
Does this affect the toolchain?

YES/NO

Associated issues
  • N/A
Links to CVEs
Test Methodology

@microsoft-github-policy-service microsoft-github-policy-service bot added Packaging 3.0-dev PRs Destined for AzureLinux 3.0 labels Feb 9, 2026
@v-aaditya
Copy link
Contributor

v-aaditya commented Feb 25, 2026

The patch file has been updated to resolve build failure in Buddy Build.

image

Build logs -
alsa-lib-1.2.9-2.azl3.src.rpm.log

@Kanishk-Bansal Kindly re-trigger the buddy build.

@v-aaditya
Copy link
Contributor

v-aaditya commented Feb 25, 2026

https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1056845&view=results
The Buddy Build has passed !

@Kanishk-Bansal Kanishk-Bansal marked this pull request as ready for review February 25, 2026 11:28
@Kanishk-Bansal Kanishk-Bansal requested a review from a team as a code owner February 25, 2026 11:28
@Kanishk-Bansal
Copy link
Contributor

Kanishk-Bansal commented Feb 25, 2026

CVE Patch Review: CVE-2026-25068 (alsa-lib)

PR: #15757 - [AutoPR- Security] Patch alsa-lib for CVE-2026-25068 [MEDIUM]
Package: alsa-lib 1.2.9
Target Branch: 3.0-dev
CVE: CVE-2026-25068 — Heap-based buffer overflow in topology mixer control decoder (CVSS v4: 4.6 Moderate, CWE-129)

Spec File

  • Patch entry: Patch0: CVE-2026-25068.patch
  • Patch applied: %autosetup -p1 (changed from %setup -q)
  • Release bumped: 1 → 2
  • Changelog updated with CVE reference and correct version-release 1.2.9-2

Patch Verification

Differences from upstream (all expected/correct):

Aspect PR Patch Upstream Verdict
Commit hash 0bb8a3f2 (cherry-pick) 5f7fe33 OK — different commit ID expected
Hunk line offset @@ -1246 @@ -1250 OK — 4-line offset due to version 1.2.9 vs latest
Error macro SNDERR(...) snd_error(TOPOLOGY, ...) OK — correct backport adaptation (see below)
Signed-off-by Added Azure Linux + Upstream-reference trailer Original only OK — standard practice
Index hash dd05424..311dd05 a0c24518..322c461c OK — different source tree

Error macro change: The upstream commit uses the newer snd_error(TOPOLOGY, ...) API introduced after 1.2.9. The PR correctly adapts this to SNDERR(...) which is the equivalent error-logging macro available in version 1.2.9. This is a functionally correct backport — both macros emit an error message to stderr. The core security fix logic (boundary check + return -EINVAL) is identical.

Build Status

  • Buddy build: PASSED
  • CI checks: 17/17 passed on initial commit; updated patch commit pending full checks

PR Description

  • CVE summary provided
  • NVD link included
  • Buddy build link provided
  • Build logs shared confirming successful alsa-lib-1.2.9-2.azl3.src.rpm build

Branch & Severity

  • MEDIUM severity → 3.0-dev branch (appropriate per guidelines)
  • Labels: security, AutoPR-Security, Packaging, 3.0-dev

Additional Notes

  • AZL 2.0 impact: The 2-azurelinux branch ships alsa-lib-1.2.6.1 which is also in the affected range (1.2.2–1.2.15.2). A separate CVE patch PR may be needed for 2.0 if not already filed.
  • Signatures file does not need updating — patch files committed directly to the repo are version-controlled and don't require signature entries (only downloaded sources do).

LGTM — Backport verified against upstream commit. Build passed. Patch applies cleanly with correct adaptation of the error macro for the package version.

Kanishk-Bansal
Kanishk-Bansal approved these changes Feb 25, 2026
View reviewed changes
Copy link
Contributor

@Kanishk-Bansal Kanishk-Bansal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The upstream patch uses the newer snd_error(TOPOLOGY, ...) API introduced after 1.2.9. We have used SNDERR(...) which is the equivalent error-logging macro for our version.

autosetup -p is used to apply patch
LGTM

@Kanishk-Bansal Kanishk-Bansal added the ready-for-stable-review PR has passed initial review and is now ready for a second-level stable maintainer review label Feb 25, 2026
@Kanishk-Bansal Kanishk-Bansal merged commit b203dd8 into microsoft:3.0-dev Mar 2, 2026
32 of 35 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Kanishk-Bansal Kanishk-Bansal Kanishk-Bansal approved these changes

@LeoMar4 LeoMar4 LeoMar4 approved these changes

Assignees

No one assigned

Labels

3.0-dev PRs Destined for AzureLinux 3.0 AutoPR-Security Packaging ready-for-stable-review PR has passed initial review and is now ready for a second-level stable maintainer review security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@azurelinux-security @v-aaditya @Kanishk-Bansal @LeoMar4