From 5887e72ff87d3a66a4c3fa91897fbec1545f4d3d Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Fri, 13 Mar 2026 11:10:47 +0000 Subject: [PATCH] udev: fix review mixup The previous version in the PR changed variable and sanitized it in place. The second version switched to skip if CCs are in the string instead, but didn't move back to the original variable. Because it's an existing variable, no CI caught it. Follow-up for 16325b35fa6ecb25f66534a562583ce3b96d52f3 (cherry picked from commit 54f880b02ecf7362e630ffc885d1466df6ee6820) (cherry picked from commit 4425d8523e79f3cc00b3b93a0b5e7c6cdc284a97) (cherry picked from commit 75c585beae60e73208941e6b3f64cf249223f53d) CVE: CVE-2026-40225 Upstream-Status: Backport [https://github.com/systemd/systemd/commit/5887e72ff87d3a66a4c3fa91897fbec1545f4d3d] Signed-off-by: Hitendra Prajapati --- src/udev/scsi_id/scsi_id.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/udev/scsi_id/scsi_id.c b/src/udev/scsi_id/scsi_id.c index 7e18bc755a..b2df8d9f7f 100644 --- a/src/udev/scsi_id/scsi_id.c +++ b/src/udev/scsi_id/scsi_id.c @@ -445,7 +445,7 @@ static int scsi_id(char *maj_min_dev) { if (dev_scsi.tgpt_group[0] != '\0') printf("ID_TARGET_PORT=%s\n", dev_scsi.tgpt_group); if (dev_scsi.unit_serial_number[0] != '\0' && utf8_is_valid(dev_scsi.unit_serial_number) && !string_has_cc(dev_scsi.unit_serial_number, /* ok= */ NULL)) - printf("ID_SCSI_SERIAL=%s\n", serial_str); + printf("ID_SCSI_SERIAL=%s\n", dev_scsi.unit_serial_number); goto out; } -- 2.50.1