OpenSSL 3.0.21 is a security patch release. The most severe CVE fixed in
this release is High.
This release incorporates the following bug fixes and mitigations:
* Fixed heap use-after-free in PKCS7_verify(). (CVE-2026-45447)
* Fixed CMS AuthEnvelopedData processing may accept forged messages.
(CVE-2026-34182)
* Fixed AES-OCB IV ignored on EVP_Cipher() path. (CVE-2026-45445)
* Fixed possible heap buffer overflow in ASN.1 multibyte string
conversion. (CVE-2026-7383)
* Fixed out-of-bounds read in CMS password-based decryption.
(CVE-2026-9076)
* Fixed heap buffer over-read in ASN.1 content parsing.
(CVE-2026-34180)
* Fixed possible NULL dereference in password-dased CMS decryption.
(CVE-2026-42766)
* Fixed FFC-DH peer validation uses attacker-supplied q.
(CVE-2026-42770)
* Fixed incorrect tag processing for empty messages in AES-GCM-SIV and
AES-SIV modes. (CVE-2026-45446)
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
Link: https://github.com/openwrt/openwrt/pull/23843
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 95d0ca014c4ce5e225579f859c066dc74a20763b)
Fix an error while building target/linux x64 on macOS 15.4 host,
due to the PATH_MAX macro being redefined:
mkdir -p /Volumes/test/openwrt/build_dir/target-x86_64_musl/linux-x86_64/linux-6.6.86/tools/objtool && make O=/Volumes/test/openwrt/build_dir/target-x86_64_musl/linux-x86_64/linux-6.6.86 subdir=tools/objtool --no-print-directory -C objtool
exec-cmd.c:15:9: error: 'PATH_MAX' macro redefined [-Werror,-Wmacro-redefined]
15 | #define PATH_MAX 4096
| ^
/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include/sys/syslimits.h:103:9: note: previous definition is here
103 | #define PATH_MAX 1024 /* max bytes in pathname */
| ^
exec-cmd.c is compiled as part of objtool to run on the host, and
therefore host headers are used, where PATH_MAX is already defined.
Using an old OpenWRT snapshot from 2025-02-16, where linux-6.6.77
used to build correctly, does not help. Reverting from Xcode 16.3 to
16.2 does not help either.
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18530
(cherry picked from commit b77e6cd6272d55af7ea64200dd2358666d25b6db)
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23710
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 33a8c1c96c25f870e5d86cbb1a3e66c2d388a83c)
The Extreme Networks AP3935's LAN1 port (gmac0/RGMII to AR8035 at MDIO
addr 1) fails to acquire a link if no Ethernet cable is connected at
power-on; the port stays dead even after a cable is later inserted, and
only a network restart recovers it.
The AR803x family enables hibernation mode by default, this setting
overrides it.
Signed-off-by: Grische <github@grische.xyz>
Link: https://github.com/openwrt/openwrt/pull/23208
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 33ed49c948b0a2cb90ef50ffe7afdcff8bb42c07)
(cherry picked from commit 8c3c253692ec5a97012261225695a2abc8dc3f1c)
This patch is not yet backported to the 6.6.y tree.
It is a prerequisite for kernel 6.6.140 to build for mpc85xx.
drivers/crypto/talitos.c: In function 'ahash_digest':
drivers/crypto/talitos.c:2204:16: error: 'struct talitos_ahash_req_ctx' has no member named 'last'
2204 | req_ctx->last = 1;
| ^~~~~
Link: https://lore.kernel.org/all/DIOA24QU02W5.2RSVK05RE7BJK@bootlin.com/
Signed-off-by: Goetz Goerisch <ggoerisch@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23435
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit bcff9902c3db5e130ccd5f66fdc5c7cfbe71f8e8)
Backport upstream patch fixing offload support in the presence of GDM2
interface.
(cherry picked from commit b7aa0aa9bf603c01500f791df4636b35434c6224)
[ fix conflict error ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit a8382a4821e8b845fe15dc357a86d1a33c5bdc55)
Debian changelog:
* Update Mozilla certificate authority bundle to version 2.82
The following certificate authorities were added (+):
+ TrustAsia TLS ECC Root CA
+ TrustAsia TLS RSA Root CA
+ SwissSign RSA TLS Root CA 2022 - 1
+ OISTE Server Root ECC G1
+ OISTE Server Root RSA G1
The following certificate authorities were removed (-):
- GlobalSign Root CA
- Entrust.net Premium 2048 Secure Server CA
- Baltimore CyberTrust Root (closes: #1121936)
- Comodo AAA Services root
- XRamp Global CA Root
- Go Daddy Class 2 CA
- Starfield Class 2 CA
- CommScope Public Trust ECC Root-01
- CommScope Public Trust ECC Root-02
- CommScope Public Trust RSA Root-01
- CommScope Public Trust RSA Root-02
* Use dh_usrlocal to create /usr/local/share/ca-certificates
(closes: #1127100)
Signed-off-by: Fengyu Wu <saldry@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23155
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 403c52db37c74246469e1cdf532aa576235d69fb)
(cherry picked from commit db8cbe9de8864cd4a362db8e39142ed13149da18)
Changes:
update regulatory database based on preceding
Update regulatory rules for India (IN) on 6GHz
Replace M2Crypto with cryptography package
Fix regulatory.bin signing with new
Signed-off-by: xiao bo <peterwillcn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23101
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit ce7bc7ac22a73df0ab58f325806eff4dfc332a40)
(cherry picked from commit 4d7129790fd6f740618e5cbb584e5a1964742a56)
This version fixes multiple security problems:
CVE-2025-7395: Problem in certificate verification on Apple devices
CVE-2025-7394: Predictable results from RAND_bytes() after fork call in OpenSSL compatibility layer
CVE-2025-7396: Activate Curve25519 blinding support
See Release notes:
https://github.com/wolfSSL/wolfssl/releases/tag/v5.8.0-stablehttps://github.com/wolfSSL/wolfssl/releases/tag/v5.8.2-stable
wolfSSL is now GPLv3 instead of GPLv2, see:
629c5b4cf6
The file size increased a bit:
```
546060 bin/packages/mipsel_24kc/base/libwolfssl5.7.6.e624513f-5.7.6-r1.apk
560684 bin/packages/mipsel_24kc/base/libwolfssl5.8.2.e624513f-5.8.2-r1.apk
```
Link: https://github.com/openwrt/openwrt/pull/20547
(cherry picked from commit 92f07864c1f29b39df73b0f3858c500a8d8fa931)
Link: https://github.com/openwrt/openwrt/pull/23363
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 4c472ca84d9e3ce18fbe052762b2bd235fa35cc7)
This version fixes some security problems:
* Client impersonation while resuming a TLS 1.3 session
(CVE-2026-34873)
* Entropy on Linux can fall back to /dev/urandom (CVE-2026-34871)
* PSA random generator cloning (CVE-2026-25835)
* Compiler-induced constant-time violations (CVE-2025-66442)
* Null pointer dereference when setting a distinguished name
(CVE-2026-34874)
* Buffer overflow in FFDH public key export (CVE-2026-34875)
* FFDH: lack of contributory behaviour due to improper input validation
(CVE-2026-34872)
* Signature Algorithm Injection (CVE-2026-25834)
* CCM multipart finish tag-length validation bypass (CVE-2026-34876)
* Risk of insufficient protection of serialized session or context data
leading to potential memory safety issues (CVE-2026-34877)
* Buffer underflow in x509_inet_pton_ipv6() (CVE-2026-25833)
Changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.6
Size increases by 470 bytes on aarch64:
343995 bin/packages/aarch64_generic/base/libmbedtls21-3.6.5-r1.apk
344465 bin/packages/aarch64_generic/base/libmbedtls21-3.6.6-r1.apk
Link: https://github.com/openwrt/openwrt/pull/22787
(cherry picked from commit f48ef0040b7e4a80283d0775d397b8a3c66b7275)
Link: https://github.com/openwrt/openwrt/pull/23362
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit c334b9a9d59f2d572da006469976f29989eb2565)
It was discovered that the internal PHY interrupt are not always connected
and PHY link up/down is not correctly detected.
This is the case of the Nokia Valyrian board that suffer from this problem.
To handle this, drop the internal PHY interrupt property from DTSI and add
it only to the Gemtek W1700K DTS where it was reported to work correctly.
(cherry picked from commit 89d8dc13d066e5dc44586e3db670cb8daabf7c23)
[ drop Gemtek W1700K ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit af35693db2ec3faa81ef2042135f14308e9b286d)
Backport new field_prep()/get() particularly useful to handle case where a
bitmask is not const and FIELD_PREP can't be used. This permit to replace
manual shift with these macro. (also needed to permit backport of some
patch without modification)
Backport reworked patch that drop the local field_prep()/get() macro in
favor of the global one.
Link: https://github.com/openwrt/openwrt/pull/22479
(cherry picked from commit 25f92aaae1795f992fc288c5c877724249d59296)
[ fix conflict error, drop invalid patch ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 72dbda434454c615979fbd8cc1f25bbd7860f487)
Backport more upstream patch to include all the fixes pushed upstream and
add all the preliminary patch for multi-serdes support.
While at it also move 2 patch in the 6xx numbering to the 000-1xx backport
numbering to keep things tidy.
All the affected patch manually and automatically refreshed.
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
[ add comment, renumber patch, add more patch, fix PCS patch ]
Link: https://github.com/openwrt/openwrt/pull/22479
(cherry picked from commit c5a8ddd0acb3163d3c1a4ef13b9963cc0340557f)
[ fix conflict errors ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 6bbc109633252c04d59c227a6184c47d6637b2f2)
Initialize NPU Block Ack memory region if reserved via DTS.
Block Ack memory region is used by NPU MT7996 (Eagle) offloading.
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://github.com/openwrt/openwrt/pull/22289
(cherry picked from commit 305f685f83fc1332102273cb09bb386ff1561d94)
[ fix conflict error ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit ecb7f66949bc9c52f5dc506c58f49d9c358add7f)
Implement the .get_link_ksettings to get the rate, duplex, and
auto-negotiation status.
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Link: https://github.com/openwrt/openwrt/pull/21530
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 4953db3aeff052223e4588fe892f94a32e917a05)
[ fix conflict error ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 0c77a7d8dd1bdec2e7c1158eadd36ab2743aa227)
Renumber ASoC and PCS patch to 2xx and 3xx numbering to leave space for
more backport patch in the 000-1xx numbering.
Link: https://github.com/openwrt/openwrt/pull/22479
(cherry picked from commit 9b21478d961ae791e93b69ad460a97050ee2544b)
[ fix conflict errors ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit eab260115a1f037786d1cc3f52cd08cababa2835)
Commit 8f1914053b24 ("airoha: replace I2S patch with upstream pending
version") introduced a kernel panic with I2S driver.
Add the fixed patch to fix the kernel panic.
Fixes: 8f1914053b24 ("airoha: replace I2S patch with upstream pending version")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit cc57e155a60891631c5040b9c4a3a2c0d1dbf38f)
(cherry picked from commit 62dc186272e3757d02e9cb43e530158b56e26cd2)
Replace I2S sound patch with upstream pending version. This adds ETDM
support and fix various bug in the downstream implementation.
(cherry picked from commit 8f1914053b24f56c101057390a0a83707864cf71)
[ fix conflict error ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 6f66bee6ba189d014c9fb5f7834161d157037491)
'CONFIG_NET_AIROHA_FLOW_STATS=y' currently breaks NPU
offload for AN7581+MT7996, so disable it for now.
Signed-off-by: Kenneth Kasilag <kenneth@kasilag.me>
Link: https://github.com/openwrt/openwrt/pull/22300
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit d09041eb8a8e791c399ce5c3ec0b517b9655ef23)
(cherry picked from commit 530d3329f4d070162c6cd53d6775edb42183f19e)
Drop airoha,x2-mode related property from the DTSI and enable them only in
the relevant devices that use a PCIe0 line. x2-mode should be enabled only
for the WiFi card that would use it as it might cause problem for WiFi card
that expect 2 single PCIe x1 line instead of a single PCIe x2 line.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 0bf18702459a9de160bb0ee599e4b3c8662fd9a7)
(cherry picked from commit 6bd5ed7254438214830b2d909abcbd83f5474d0b)
Fix two hardware initialization issues in the EN7581 PCIe controller
and add support for x2 (2-lane) link mode.
Fixes:
The upstream EN7581 PCIe initialization writes EQ presets and PIPE
configuration registers before clk_bulk_prepare_enable(). Since the
MAC clocks are not yet running at that point, these register writes
are silently dropped, leaving the hardware with default values. This
can cause link training failures or suboptimal equalization.
Additionally, after link training the MAC may only advertise Gen1-Gen2
capability in the Link Capabilities 2 register despite the PHY being
configured for Gen3. A serdes reset toggle forces the MAC to re-read
PHY capability, recovering Gen3 8GT/s link speed.
Both issues are addressed by separating PERST from the clock callbacks
(patch 911), allowing the PCIe controller driver to properly sequence
PERST, clock enable, and register writes (patch 912).
New feature:
PCIe x2 mode support for EN7581 using the NP_SCU system controller
for serdes mux routing, PERST management, and lane configuration.
Both bonded MACs are configured for x2 operation with proper EQ
presets before link training begins.
Signed-off-by: Ryan Chen <rchen14b@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21978
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 8b9bd686e7c705dca28849882f53cf416559e1df)
[ refresh patch ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit db4a0d5935899ac955a84fc1e9d60d419f4f9c93)
Add specific DTSI for NPU firmware based on the supported WiFi chip and
update the supported device by including the relevant new DTSI.
(cherry picked from commit f075c1148d992aa06d342fc64ac8f15b6b0db920)
[ drop W1700K dts change ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 4699a8ad45d12e3e2577ed87125ca5ff7b673a08)
Introduce the capability to read the firmware binary names from device-tree
using the firmware-name property if available.
This is a preliminary patch to enable NPU offloading for MT7996 (Eagle)
chipset since it requires a different binary with respect to the one
used for MT7992 on the EN7581 SoC.
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://github.com/openwrt/openwrt/pull/22289
(cherry picked from commit 123557f0e293169ca647f07fff527e45fcf8b7dc)
[ refresh patch ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 503ffed6c4c5cc0be35f7566b9f5b98dc2d50f14)
OpenSSL 3.0.20 is a security patch release. The most severe CVE fixed in
this release is Moderate.
This release incorporates the following bug fixes and mitigations:
* Fixed incorrect failure handling in RSA KEM RSASVE encapsulation.
(CVE-2026-31790)
* Fixed potential use-after-free in DANE client code.
(CVE-2026-28387)
* Fixed NULL pointer dereference when processing a delta CRL.
(CVE-2026-28388)
* Fixed possible NULL dereference when processing CMS
KeyAgreeRecipientInfo.
(CVE-2026-28389)
* Fixed possible NULL dereference when processing CMS
KeyTransportRecipientInfo.
(CVE-2026-28390)
* Fixed heap buffer overflow in hexadecimal conversion.
(CVE-2026-31789)
Signed-off-by: Jan Kardell <jan.kardell@telliq.com>
Link: https://github.com/openwrt/openwrt/pull/23346
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 44d98eec231534487cbec4ba8f852c1acf67a32d)
Stop overriding CCACHE_COMPILERCHECK from rules.mk and rely on
ccache's default, which hashes the compiler binary's mtime and
size.
For a local tree that is enough: the toolchain only changes when
it is rebuilt, and a rebuild updates mtime and size. Users who
want a stricter check can still set CCACHE_COMPILERCHECK in their
environment.
CI does not depend on this export either. The workflow writes a
secondary ccache.conf with
compiler_check=string:<toolchain-commit-sha>
so the cache key is tied to the toolchain source revision. That
is both stricter than the previous "%compiler% -v -c" setting
and portable across runners, where compiler mtimes would not
match after restoring a cache archive.
Link: https://github.com/openwrt/openwrt/pull/22995
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 3956287514e5457723070f4b8bc7ed8084019d39)
(cherry picked from commit a6149ff867c92daa1aaa050b27ba8c6053d7cfe0)
Update the compiler check for ccache so we don't
end up with the wrong binaries. Right now the
compiler check will not be able to correctly
distinguish the compiler used for build
ARMv8 binaries from the one used to build
ARMv7 binaries.
Signed-off-by: Markus Gothe <markus.gothe@genexis.eu>
Link: https://github.com/openwrt/openwrt/pull/16290
Signed-off-by: John Crispin <john@phrozen.org>
(cherry picked from commit 3859e8eeb82950d8594f60d40e5ee23fd02207c9)
(cherry picked from commit 71d259b59998a214049c9e456f330cd8f292468f)
This fixes a simple logic error in the macaddr existence check in mac80211.uc.
Signed-off-by: Harin Lee <me@harin.net>
Link: https://github.com/openwrt/openwrt/pull/21277
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 2ebcda1ea6b757864c4700e543a9767752ca766e)
Link: https://github.com/openwrt/openwrt/pull/23100
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit b76c38f9e2316e3ad125f6f2e4c7e27d025fad6e)
Drop HIDDEN option from U-Boot default for Airoha while support for ATF
gets pushed.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit cce81ed05bf944bb8188875757f2ab2ddfbfa4a8)
(cherry picked from commit c5de245171de11c694bb7720f5d30ab4467829ca)
