Release notes for Yocto-6.0.3 (Wrynose)

Security Fixes in Yocto-6.0.3

bind: Fix CVE-2026-11331, CVE-2026-11721, CVE-2026-13321, CVE-2026-10723, CVE-2026-12617 and CVE-2026-10822
binutils: Fix CVE-2026-6846
bzip2: Fix CVE-2026-42250
cargo: Fix CVE-2026-5222 and CVE-2026-5223
cups: Fix CVE-2026-27447 and CVE-2026-41079
curl: Fix CVE-2026-5545, CVE-2026-5773, CVE-2026-6253, CVE-2026-6429 and CVE-2026-7168
curl: Ignore CVE-2026-10536 if nghttp2 not enabled
dhcpcd: Fix CVE-2026-56113, CVE-2026-56114, CVE-2026-56116 and CVE-2026-56117
expat: Fix CVE-2026-41080, CVE-2026-45186, CVE-2026-56132, CVE-2026-56403, CVE-2026-56404, CVE-2026-56405, CVE-2026-56406, CVE-2026-56407, CVE-2026-56408, CVE-2026-56409, CVE-2026-56410 and CVE-2026-56411
gawk: Fix CVE-2026-40467, CVE-2026-40468, CVE-2026-40469 and CVE-2026-40553
glib-2.0: Fix CVE-2026-58010, CVE-2026-58011, CVE-2026-58012, CVE-2026-58013, CVE-2026-58014, CVE-2026-58015 and CVE-2026-58016
gnupg: Fix CVE-2026-57062
gnutls: Fix CVE-2026-3832, CVE-2026-3833, CVE-2026-42009 and CVE-2026-33846
go: Fix CVE-2026-39822 and CVE-2026-42505
gstreamer1.0: Ignore CVE-2026-5056
gzip: Fix CVE-2026-41991 and CVE-2026-41992
libcap: Fix CVE-2026-4878
libgcrypt: Fix CVE-2026-41989 and CVE-2026-41990
libpng: Fix CVE-2026-34757
libpng: Ignore CVE-2026-40930
libsolv: Fix CVE-2026-9149
libssh2: Fix CVE-2025-15661, CVE-2026-55199 and CVE-2026-55200
libxml2: Fix CVE-2026-11979
libxpm: Fix CVE-2026-4367
openssh: Fix CVE-2026-59995, CVE-2026-59996, CVE-2026-59997, CVE-2026-59999, CVE-2026-60000, CVE-2026-60001 and CVE-2026-60002
openssh: Ignore CVE-2026-59998 if kerberos not enabled
openssh: Ignore CVE-2026-3497
perl: Fix CVE-2026-8376
python3: Fix CVE-2026-3276, CVE-2026-7210, CVE-2026-7774, CVE-2026-8328, CVE-2026-9669, CVE-2026-11940 and CVE-2026-11972
python3-setuptools: Fix CVE-2026-59890
python3-urllib3: Fix CVE-2026-44431
qemu: Fix CVE-2025-14876, CVE-2026-0665 and CVE-2026-2243
socat: Fix CVE-2026-56123
sqlite3: Fix CVE-2026-11822 and CVE-2026-11824
tar: Fix CVE-2026-5704
util-linux: Fix CVE-2026-13595 and CVE-2026-27456
vim: Fix CVE-2026-41411, CVE-2026-42307, CVE-2026-43961, CVE-2026-44656, CVE-2026-45130, CVE-2026-46483, CVE-2026-47162, CVE-2026-47167, CVE-2026-52858, CVE-2026-52859, CVE-2026-52860, CVE-2026-55892 and CVE-2026-57452

Fixes in Yocto-6.0.3

bitbake

bitbake-setup: always write newline at end of the README
utils: Add NFS EEXISTS/isdir failure workaround

meta-yocto

README: Add wrynose subject-prefix to git-send-email suggestion
b4-config: add send-prefixes for wrynose
poky.conf: Bump version for 6.0.3 release
yocto-bsps: update to v6.18.39

openembedded-core

baremetal-helloworld: Fix override order
bc: set CVE_PRODUCT
bind: upgrade to 9.20.26
bluez5: Fix sending extra bytes with MGMT_OP_ADD_EXT_ADV_DATA
bluez5: fix gatt cache sync issue
bluez5: fix set volume failure
bluez5: set L2CAP IMTU for OBEX profile listeners
build-appliance-image: Update to wrynose head revisions
clang/llvm: Upgrade to 22.1.8
cmake-native: prevent host libidn2 contamination
common-licenses/PHP-3.0: Correct the license text
cpan_build: disable .packlist and html doc
create-spdx-image-3.0: correct SSTATE_SKIP_CREATION key for do_create_image_sbom_spdx
devtool: provide explicit error for missing “script” command
dmidecode: fix x86-only tools being installed on ARM targets
dropbear: Add missing WTFPL & Unlicense in LICENSE and LIC_FILES_CHKSUM
flac: fix buildpaths with doxygen enabled
flac: make documentation build deterministic
gdb: Upgrade to 17.2
glib-2.0: upgrade to 2.88.2
go: upgrade to 1.26.5
i2c-tools: add LGPL-2.1-or-later license for libi2c
kernel-fit-image.bbclass: Do not include kernel property in DTBO config subnodes
kernel-fit-image.bbclass: Fix operation with KERNEL_DTBVENDORED = “1”
kernel-fit-image: Add KERNEL_DTBVENDORED support for FIT_CONF_DEFAULT_DTB
libjitterentropy: fix license statement
libxpm: upgrade to 3.5.19
linux-yocto/6.18: drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker
linux-yocto/6.18: qat/intel configuration warning fixes
linux-yocto/6.18: update to v6.18.39
nospdx: also drop do_create_recipe_sbom
oe-selftest: fitimage: Add tests for KERNEL_DTBVENDORED
oe-selftest: fitimage: Do not expect kernel property in DTBO config subnodes
opensbi: don’t override ELFFLAGS, silence ldflags QA for bare-metal ELFs
ovmf: fix tpm PACKAGECONFIG to use TPM2_ENABLE
package.bbclass: hardcode emit_pkgdata to run last
ptest-packagelists.inc: disable glib-2.0 for RISCV64
python3: skiptest tracemalloc_track_race
python3: upgrade to 3.14.6
python3-certifi: set CVE_PRODUCT
python3-cryptography: set CVE_PRODUCT
python3-idna: set CVE_PRODUCT
python3-pip: set CVE_PRODUCT
python3-ply: set CVE_PRODUCT
python3-pyasn1: set CVE_PRODUCT
python3-pyopenssl: set CVE_PRODUCT
python3-pyyaml: set CVE_PRODUCT
python3-xmltodict: set CVE_PRODUCT
qemuboot.bbclass: add missing task dependency on kernel deploy
quota: use native rpcgen and a single-word RPCGEN_CPP
rootfs: move tasks using image_list_installed_packages to postuninstall
scripts/install-buildtools: Update to 6.0.2
selftest: uboot: remove duplicated KVM presence test
socat: upgrade to 1.8.1.3
sstate: Reduce native sysroot execution race potential
strace: remove skip-bpf.patch
sudo: fix pam-wheel sed for sudo 1.9.17p2 sudoers
systemd-systemctl-native: disable libpam meson option
tcl: disable the timer tests in run-ptest
texinfo: add missing perl module runtime dependencies
tzdata/tzcode-native: upgrade to 2026c
u-boot: re-enable RISC-V compressed (c) ISA extension
util-linux: upgrade to 2.41.5
vex: remove obsolete semicolon
wic: upgrade to 0.3.1
xmlto: correct srcrev to point to released version
xmlto: update SRC_URI

yocto-docs

brief-yoctoprojectqs/index.rst: fix a replacement typo
brief-yoctoprojectqs/index.rst: refresh bitbake-setup outputs
brief-yoctoprojectqs/index.rst: use pip to install bitbake-setup
bsp-guide/bsp.rst: fix raspberry layer content example
contributor-guide: Note patch complexity requirements for stable branches
dev-manual/creating-fragments.rst: fix typos
dev-manual/wic.rst: add a requirement to use wic from the build system
dev-manual/wic.rst: add where to set IMAGE_FSTYPES/WKS_FILE[S] from
dev-manual/wic.rst: convert code snippet to code-blocks
dev-manual/wic.rst: remove bullet point on host requirements
dev-manual/wic.rst: remove note on wic-tools
dev-manual/wic.rst: replace deprecated wks directories
dev-manual: Fix missing whitespace around ‘=’ operator
dev-manual: update bmaptool section, refer to “bmaptool” package
docs-wide: fix broken path links
docs-wide: fix various broken links
docs-wide: remove CROPS references
migration-guide: 5.1: Fix typo
migration-guide: add release notes for 5.0.19 and 6.0.2
migration-guides/migration-3.4.rst: replace rlbl broken link
migration-guides/migration-6.0.rst: fix wks file move note
migration-guides/release-notes-3.4.2.rst: fix a broken link
migration-guides/release-notes-5.0.rst: remove broken link
migration-guides: add add release notes for 6.0.1
migration-guides: replace broken link with archive links
recipe-style-guide: Clarify when License-Update tag is needed
ref-manual/classes.rst: replace deprecated wks directory
ref-manual/classes.rst: replace obsolete mailing list thread
ref-manual/images.rst: update obsolete VMWare links
ref-manual/kickstart.rst: document the include directive
ref-manual/kickstart.rst: remove note on available commands
ref-manual/kickstart.rst: replace deprecated wks directory
ref-manual/release-process.rst: update LTS supported versions
ref-manual/variables.rst: document missing CONFLICT_*_FEATURES variables
ref-manual/variables.rst: document the CCACHE_NATIVE_RECIPES_ALLOWED variable
ref-manual/variables.rst: document the IMAGE_*_DEBUGFS variables
ref-manual/variables.rst: document the LOCALE_PATHS variable
ref-manual/variables.rst: document the LOCALE_UTF8_IS_DEFAULT variable
ref-manual/variables.rst: document the QB_DEFAULT_BIOS variable
ref-manual/variables.rst: document the TEST_SERIALCONTROL_CONNECT_TIMEOUT variable
ref-manual/variables.rst: document the TEST_SERIALCONTROL_PS1 variable
ref-manual: Fix occurrences of omitted space with :prepend
ref-manual: add “KERNEL_IMAGE_STRIP_EXTRA_SECTIONS” to variables
ref-manual: expand on kernel “do_sizecheck” task
ref-manual: fix incorrect heading level for site.conf section
ref-manual: remove all traces of “kernel_menuconfig” task
ref-manual: under meta/files entry, mention Wic files