Detecting and Defusing the Ticking Time Bomb: Understanding CVEs and Upstreaming in Yocto
Talkat Open Source Summit India 2026 · on Wednesday, 2026-06-17· at 13:40· Lotus Ballroom 2 (Level 3)·
summary
Claims a semi‑automated scanner that merges CVE feeds from three to five sources into a common database, compares that daily to an SBOM and recipe list, and feeds a counter/UI; it reports zero missed CVEs over 3.5 years in practice. Demonstrates Yocto specifics: using CVE check/CVSTATUS with recipe CVE fields, pitfalls (backports, sonames, false positives) and a workflow to upstream fixes via git‑send‑email and patchwork. Also cites ~19,000 CVEs reported in 2026 to May.
AI-written summary · about
chapters (22)
- 0:00CVEs and upstreaming in Yocto
- 1:04Analyzing CVE descriptions
- 3:13CVSS scores across distros
- 4:57Rising CVE trends
- 5:39Manual vs automated CVE detection
- 6:43Yocto CVE tool limits
- 9:10CVE version mapping pain points
- 10:54False positives and detection systems
- 14:26Fixing CVEs via patching
- 15:07Risks of version upgrades
- 17:35Critical CVE case study
- 18:57Upstreaming in Yocto project
- 19:59Yocto patch submission protocol
- 21:22Patch test for validation
- 22:26Finding Yocto mailing list
- 23:30Master vs stable submissions
- 24:31Final upstreaming checks
- 26:57Why upstreaming matters
- 27:41Hesitations about upstreaming
- 29:25ROI for upstream contributions
- 30:05Security through upstreaming
- 32:13Q&A
related talks
42mComparison and Proposal of Vulnerability Management Approaches in Yocto-Based...
37mTracking Vulnerabilities with Buildroot and Yocto
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm
41mKeeping Up With The Joneses (CVEs)
34mYocto Project/OpenEmbedded Meets Security
53mThe Cyber Resilience Act: Navigating Its Impact on Yocto-Based Products
19mScanning for known vulnerabilities in an embedded distribution- 53mThe Cyber Resilience Act: Navigating Its Impact on Yocto-Based Products