Skip to content

[AutoPR- Security] Patch elixir for CVE-2026-75758 [MEDIUM] - #18660

Merged
kgodara912 merged 2 commits into
microsoft:3.0-devfrom
azurelinux-security:azure-autosec/elixir/3.0/1193959
Sep 14, 2026
Merged

[AutoPR- Security] Patch elixir for CVE-2026-75758 [MEDIUM]#18660
kgodara912 merged 2 commits into
microsoft:3.0-devfrom
azurelinux-security:azure-autosec/elixir/3.0/1193959

Conversation

@azurelinux-security

@azurelinux-security Azure Linux Security Servicing Account (azurelinux-security) commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown

Auto Patch elixir for CVE-2026-75758.

Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1193959&view=results

CVE-2026-75758 : Single Patch Backporter Pipeline Run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1193972&view=results

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

  • The toolchain has been rebuilt successfully (or no changes were made to it)
  • The toolchain/worker package manifests are up-to-date
  • Any updated packages successfully build (or no packages were changed)
  • Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
  • Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
  • All package sources are available
  • cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
  • LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
  • All source files have up-to-date hashes in the *.signatures.json files
  • sudo make go-tidy-all and sudo make go-test-coverage pass
  • Documentation has been updated to match any changes to the build system
  • Ready to merge
Summary

What does the PR accomplish, why was it needed?

  • Auto Patch elixir for CVE-2026-75758 (MEDIUM).
Change Log
  • CVE-2026-75758
Does this affect the toolchain?

YES/NO

Associated issues
  • N/A
Links to CVEs
Test Methodology

@azure-pipelines

azure-pipelines Bot commented Aug 31, 2026

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

@microsoft-github-policy-service microsoft-github-policy-service Bot added Packaging 3.0-dev PRs Destined for AzureLinux 3.0 labels Aug 31, 2026
@Ratiranjan5

Ratiranjan5 commented Sep 1, 2026

Copy link
Copy Markdown

CVE-2026-75758:

  • The CVE-2026-75758 affects elixir as the packaged version 1.16.1 is in the affected range (>= 1.15.0-rc.0 and < 1.18.5). After reviewing the source, I was able to verify that affected files— lib/elixir/lib/inspect.ex, lib/elixir/lib/list.ex, and lib/elixir/lib/inspect/algebra.ex and and the affected functions (Inspect.List.inspect, List.to_string, List.to_charlist) are all present in the source code.

  • Backported: Yes — manually backported from upstream commit 5230d73968f1b4969d2a2646786fa6c71475f5cc and adapted to the 1.16.1 source tree.

    • Added the missing unicode_list? and decrement private helper definitions. The original AI patch called these functions but never defined them, so it would fail to compile (undefined function unicode_list?/2). These definitions were taken from the upstream commit.
image

  • Adjusted context (line numbers, and color/3 vs upstream's color_doc/3) to fit the 1.16.1 source.

  • Now, AI patch completely matches with the upstream patch after modification.

  • Files dropped:

    • lib/elixir/test/elixir/inspect_test.exs
    • lib/elixir/test/elixir/list_test.exs
      These test files were dropped because the spec has no %check section (tests are never run during the build) and they add no functional value to the delivered package.

  • The patch includes the upstream reference in its header:

  • The local build passed.

image
  • Patch applies cleanly.
image

@Ratiranjan5

Ratiranjan5 commented Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Pipeline build id: Buddy Build has passed.

@v-aaditya

Aditya Singh (v-aaditya) commented Sep 1, 2026

Copy link
Copy Markdown

Peer-review analysis -

  1. The Patch has been backported and it has been modified to include the function definitions for unicode_list and decrement which the AI has missed and which resulted in Buddy Build failure.
  2. After modification the patch completely matches with upstream patch, except the changes made in test files lib/elixir/test/elixir/inspect_test.exs and lib/elixir/test/elixir/list_test.exs are not included as there is no %check section in the spec file.
  3. The patch has upstream patch reference.
  4. The Buddy Build is successful.
  5. The patch applies cleanly. (Checked .rpm.log)
  6. The PR has security tag.

Final Verdict - LGTM. PR can be opened for FTE review.

@Kanishk-Bansal
Kanishk Bansal (Kanishk-Bansal) marked this pull request as ready for review September 9, 2026 14:29
Kanishk-Bansal
Kanishk Bansal (Kanishk-Bansal) approved these changes Sep 10, 2026
View reviewed changes

@Kanishk-Bansal Kanishk Bansal (Kanishk-Bansal) left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Patch Analysis (Matches Upstream - three source files
Only upstream's two test files (inspect_test.exs, list_test.exs) are omitted
)

  • Buddy Build 
  • patch applied during the build (check rpm.log)
  • patch include an upstream reference
  • PR has security tag

@Kanishk-Bansal Kanishk Bansal (Kanishk-Bansal) added the ready-for-stable-review PR has passed initial review and is now ready for a second-level stable maintainer review label Sep 10, 2026
kgodara912
kgodara912 approved these changes Sep 14, 2026
View reviewed changes

@kgodara912 kgodara912 left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Patch matches with upstream reference except test files. Without patch, the tests does raise HUNG, EXIT=124 (120s timeout) while with fix, PASS ×12, EXIT=0. Buddy build is successful along with PR checks. LGTM.

@kgodara912
kgodara912 merged commit 74556bb into microsoft:3.0-dev Sep 14, 2026
30 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Kanishk-Bansal Kanishk Bansal (Kanishk-Bansal) Kanishk-Bansal approved these changes
@kgodara912 kgodara912 kgodara912 approved these changes

Assignees

No one assigned

Labels

3.0-dev PRs Destined for AzureLinux 3.0 AI Backport AutoPR-Security Packaging ready-for-stable-review PR has passed initial review and is now ready for a second-level stable maintainer review security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@azurelinux-security @Ratiranjan5 @v-aaditya @Kanishk-Bansal @kgodara912