[meta-virtualization][wrynose][PATCH 1/3] containerd: fix CVE-2026-46680

From: Deepak Rathore <[email protected]>

This patch applies the upstream release/2.2 backport for
CVE-2026-46680. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/containerd/containerd/commit/d20c6267b88bfd52277337184916e293c627542a
[2] https://github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w

Signed-off-by: Deepak Rathore <[email protected]>
---
 .../containerd/CVE-2026-46680.patch           | 112 ++++++++++++++++++
 .../containerd/containerd_git.bb              |   1 +
 2 files changed, 113 insertions(+)
 create mode 100644 recipes-containers/containerd/containerd/CVE-2026-46680.patch

diff --git a/recipes-containers/containerd/containerd/CVE-2026-46680.patch b/recipes-containers/containerd/containerd/CVE-2026-46680.patch
new file mode 100644
index 00000000..463412f9
--- /dev/null
+++ b/recipes-containers/containerd/containerd/CVE-2026-46680.patch
@@ -0,0 +1,112 @@
+From 3ad9d7b797ba6190c6fc3e0635786ea611c9fa42 Mon Sep 17 00:00:00 2001
+From: LEI WANG <[email protected]>
+Date: Tue, 17 Mar 2026 17:58:00 +0800
+Subject: [PATCH 1/3] oci: return explicit error for out-of-range USER values
+
+Detect strconv.ErrRange and validate uid/gid bounds to avoid falling back to username/group lookups.
+
+CVE: CVE-2026-46680
+Upstream-Status: Backport [https://github.com/containerd/containerd/commit/d20c6267b88bfd52277337184916e293c627542a]
+
+Signed-off-by: LEI WANG <[email protected]>
+(cherry picked from commit 85706b6d4416d93b47033ba345d7b885a75657b4)
+Signed-off-by: Chris Henzie <[email protected]>
+(cherry picked from commit d20c6267b88bfd52277337184916e293c627542a)
+Signed-off-by: Deepak Rathore <[email protected]>
+---
+ pkg/oci/spec_opts.go            | 29 +++++++++++++++++++++++++----
+ pkg/oci/spec_opts_linux_test.go | 14 +++++++++++---
+ 2 files changed, 36 insertions(+), 7 deletions(-)
+
+diff --git a/pkg/oci/spec_opts.go b/pkg/oci/spec_opts.go
+index c298e4bb2..5cc7187d7 100644
+--- a/pkg/oci/spec_opts.go
++++ b/pkg/oci/spec_opts.go
+@@ -626,14 +626,25 @@ func WithUser(userstr string) SpecOpts {
+ 			return nil
+ 		}
+ 
++		isErrRange := func(err error) bool {
++			var numErr *strconv.NumError
++			return errors.As(err, &numErr) && numErr.Err == strconv.ErrRange
++		}
++
+ 		parts := strings.Split(userstr, ":")
+ 		switch len(parts) {
+ 		case 1:
+ 			v, err := strconv.Atoi(parts[0])
+-			if err != nil || v < minUserID || v > maxUserID {
+-				// if we cannot parse as an int32 then try to see if it is a username
++			if err != nil {
++				if isErrRange(err) {
++					return fmt.Errorf("invalid USER value %q: uid out of range", userstr)
++				}
++				// Non-numeric user value; treat it as a username.
+ 				return WithUsername(userstr)(ctx, client, c, s)
+ 			}
++			if v < minUserID || v > maxUserID {
++				return fmt.Errorf("invalid USER value %q: uid out of range", userstr)
++			}
+ 			return WithUserID(uint32(v))(ctx, client, c, s)
+ 		case 2:
+ 			var (
+@@ -642,14 +653,24 @@ func WithUser(userstr string) SpecOpts {
+ 			)
+ 			var uid, gid uint32
+ 			v, err := strconv.Atoi(parts[0])
+-			if err != nil || v < minUserID || v > maxUserID {
++			if err != nil {
++				if isErrRange(err) {
++					return fmt.Errorf("invalid USER value %q: uid out of range", userstr)
++				}
+ 				username = parts[0]
++			} else if v < minUserID || v > maxUserID {
++				return fmt.Errorf("invalid USER value %q: uid out of range", userstr)
+ 			} else {
+ 				uid = uint32(v)
+ 			}
+ 			v, err = strconv.Atoi(parts[1])
+-			if err != nil || v < minGroupID || v > maxGroupID {
++			if err != nil {
++				if isErrRange(err) {
++					return fmt.Errorf("invalid USER value %q: gid out of range", userstr)
++				}
+ 				groupname = parts[1]
++			} else if v < minGroupID || v > maxGroupID {
++				return fmt.Errorf("invalid USER value %q: gid out of range", userstr)
+ 			} else {
+ 				gid = uint32(v)
+ 			}
+diff --git a/pkg/oci/spec_opts_linux_test.go b/pkg/oci/spec_opts_linux_test.go
+index d30f62570..3f46ca2f4 100644
+--- a/pkg/oci/spec_opts_linux_test.go
++++ b/pkg/oci/spec_opts_linux_test.go
+@@ -94,15 +94,23 @@ guest:x:100:guest
+ 		},
+ 		{
+ 			user: "405:2147483648",
+-			err:  "no groups found",
++			err:  "invalid USER value \"405:2147483648\": gid out of range",
+ 		},
+ 		{
+ 			user: "-1000",
+-			err:  "no users found",
++			err:  "invalid USER value \"-1000\": uid out of range",
+ 		},
+ 		{
+ 			user: "2147483648",
+-			err:  "no users found",
++			err:  "invalid USER value \"2147483648\": uid out of range",
++		},
++		{
++			user: "999999999999999999999999999999999999",
++			err:  "invalid USER value \"999999999999999999999999999999999999\": uid out of range",
++		},
++		{
++			user: "0:999999999999999999999999999999999999",
++			err:  "invalid USER value \"0:999999999999999999999999999999999999\": gid out of range",
+ 		},
+ 	}
+ 	for _, testCase := range testCases {
+-- 
+2.35.6
diff --git a/recipes-containers/containerd/containerd_git.bb b/recipes-containers/containerd/containerd_git.bb
index 51d7c2e2..ad41f248 100644
--- a/recipes-containers/containerd/containerd_git.bb
+++ b/recipes-containers/containerd/containerd_git.bb
@@ -10,6 +10,7 @@ SRC_URI = "git://github.com/containerd/containerd;branch=release/2.2;protocol=ht
            file://0001-Makefile-allow-GO_BUILD_FLAGS-to-be-externally-speci.patch \
            file://0001-build-don-t-use-gcflags-to-define-trimpath.patch \
            file://cni-containerd-net.conflist \
+           file://CVE-2026-46680.patch \
           "
 
 # Apache-2.0 for containerd
-- 
2.35.6