Hi, On Sun, May 03, 2026 at 11:13:59AM -0300, Carlos Henrique Lima Melara wrote: > Hi, > > I'm reviewing Matheus Polkorny's changes for 4.4.15 security update and > found that CVE-2026-6526 might affect 4.4.x. It's not mentioned in the > release notes nor in wnpa-sec-2026-35, but the fix was merged [1] in the > 4.4 stable branch. I've asked for a clarification from upstream [2].
To loop back: |The function is called in fewer places in 4.4.x (the POC doesn't work |on 4.4) and by inspection it appears that all the times that it is |called in 4.4 the prefix is guaranteed to exist via other checks |beforehand. However, out of an abundance of caution it didn't hurt to |cherry pick the fix. So I believe we can keep the tracking as it is now. Regards, Salvatore
