[meta-arago][scarthgap][PATCH] libyang: Fix CVE-2026-41401

This is an adaptation of a CVE fix posted in meta-openembedded [1].
We have advanced the libyang version to 3.7.8 and one of the patches did
not apply cleanly.

[1] https://git.openembedded.org/meta-openembedded/commit/?h=scarthgap&id=c8dc986a39e74c5611a3e3222d55b0d1239a1119

Signed-off-by: Ryan Eatmon <[email protected]>
---
 .../sysrepo/libyang-arago.inc                 |  2 +
 .../sysrepo/libyang/CVE-2026-41401.patch      | 48 +++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 meta-arago-extras/recipes-extended/sysrepo/libyang/CVE-2026-41401.patch

diff --git a/meta-arago-extras/recipes-extended/sysrepo/libyang-arago.inc b/meta-arago-extras/recipes-extended/sysrepo/libyang-arago.inc
index 9744ea3a..7f20c94f 100644
--- a/meta-arago-extras/recipes-extended/sysrepo/libyang-arago.inc
+++ b/meta-arago-extras/recipes-extended/sysrepo/libyang-arago.inc
@@ -1,3 +1,5 @@
+FILESEXTRAPATHS:prepend := "${THISDIR}/libyang:"
+
 PV = "3.7.8"
 
 LIC_FILES_CHKSUM = "file://LICENSE;md5=9bb3d334294e8719f41c531e28a9a697"
diff --git a/meta-arago-extras/recipes-extended/sysrepo/libyang/CVE-2026-41401.patch b/meta-arago-extras/recipes-extended/sysrepo/libyang/CVE-2026-41401.patch
new file mode 100644
index 00000000..7b2ba37a
--- /dev/null
+++ b/meta-arago-extras/recipes-extended/sysrepo/libyang/CVE-2026-41401.patch
@@ -0,0 +1,48 @@
+From 54c3276d871023da266d4ed3ceaee7e8d71d0b04 Mon Sep 17 00:00:00 2001
+From: Michal Vasko <[email protected]>
+Date: Thu, 26 Mar 2026 08:33:44 +0100
+Subject: [PATCH] parser common BUGFIX invalid metadata removal
+
+Fix incorrect metadata list pointer update in lyd_parse_set_data_flags()
+when freeing the head metadata entry via a separate meta pointer. The
+condition must verify that meta2 is actually the head of *meta before
+updating the list head pointer, and must use meta2->next (which is
+saved before the free) rather than (*meta)->next.
+
+Without this fix, crafted YANG XML documents with specific metadata
+ordering (e.g., operation + default metadata) can trigger invalid
+pointer states in the metadata linked list.
+
+CVE: CVE-2026-41401
+Upstream-Status: Backport [https://github.com/CESNET/libyang/commit/54c3276d871023da266d4ed3ceaee7e8d71d0b04]
+
+Backport Changes:
+- Adapted for v3.7.8: The fix logic is identical: change the else-if
+  condition to also check (meta2 == *meta) and use meta2->next instead of (*meta)->next.
+
+(cherry picked from commit 54c3276d871023da266d4ed3ceaee7e8d71d0b04)
+Signed-off-by: Ryan Eatmon <[email protected]>
+Signed-off-by: Yunseong Kim <[email protected]>
+---
+ src/parser_common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/parser_common.c b/src/parser_common.c
+index 32152759e..f8a3b1c01 100644
+--- a/src/parser_common.c
++++ b/src/parser_common.c
+@@ -411,8 +411,8 @@ lyd_parser_set_data_flags(struct lyd_node *node, struct lyd_meta **meta, struct
+             next_meta = meta2->next;
+ 
+             /* delete the metadata */
+-            if (meta != &node->meta) {
+-                *meta = (*meta)->next;
++            if ((meta != &node->meta) && (meta2 == *meta)) {
++                *meta = meta2->next;
+             }
+             lyd_free_meta_single(meta2);
+             if (prev_meta) {
+ 
+-- 
+2.43.0
+
-- 
2.43.0