Hi, A follow-up to my mail mapping upstream commits to these CVEs, which was static only. I have now built and tested them.
Trees: base: upstream tag 1_38_0 patched: 1_38_0 + 89ac827, 339e3c6, 9073c1d, 9f5cbdc, b829bba, c2dec52, 5da2010, 382008b + the minimal d5cc940 backport attached to the previous mail Config: make defconfig, with CONFIG_TC disabled (as Debian does, because of the cbq removal). Built on amd64, gcc, Debian sid. Build: both trees build with no errors and no warnings in the touched files. Testsuite (make check, run as an unprivileged user): base: PASS 1012, FAIL 8, SKIPPED 27 patched: PASS 1013, FAIL 8, SKIPPED 27 The 8 failures are identical in both trees (cpio lists hardlinks; ls -q/-Q/-qQ; three sed NUL/label tests; tar writing into read-only dir), so they are pre-existing or environment-related and not caused by the fixes. The extra PASS is the test that 382008b adds. CVE-2026-108119 (#1150771): I copied upstream's new testsuite/tar.tests, which contains the test "tar Symlink+Hardlink attack: create symlink-to-outside and then create a hardlink in it", into the base tree and ran it against the unpatched 1.38.0 binary: base: FAIL - expected "can't create hardlink 'portal/ESCAPED' to 'seed': Not a directory" / exit 1; got exit 0 and "ESCAPED!", i.e. the file was created outside the extraction directory patched: PASS So 1.38.0 is affected, and 382008b (+5da2010) fixes it on 1.38.0. There are no testsuite cases for the other CVEs (httpd, tls, volume_id, libpwdgrp, dpkg). For those, the result above only shows that the backports build and cause no regressions in the existing tests; I did not exercise the fixed code paths. Regards
