From ba0eb36f09be7dc3fd99cb72f58dcb1759ab8681 Mon Sep 17 00:00:00 2001
From: AlmaLinux RelEng Bot <eabdullin@almalinux.org>
Date: Tue, 4 Aug 2026 14:15:20 -0400
Subject: [PATCH] import UBI libgcrypt-1.11.0-7.el10_2

---
 libgcrypt-1.11.0-montgomery-zeroes.patch | 40 ++++++++++++++++++++++++
 libgcrypt.spec                           | 20 +++++++++++-
 2 files changed, 59 insertions(+), 1 deletion(-)
 create mode 100644 libgcrypt-1.11.0-montgomery-zeroes.patch

diff --git a/libgcrypt-1.11.0-montgomery-zeroes.patch b/libgcrypt-1.11.0-montgomery-zeroes.patch
new file mode 100644
index 0000000..e735100
--- /dev/null
+++ b/libgcrypt-1.11.0-montgomery-zeroes.patch
@@ -0,0 +1,40 @@
+From 5ba63ec41a6e734c9ff82e20e4f84ac94c59ae27 Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Fri, 10 Apr 2026 16:58:57 +0900
+Subject: [PATCH] cipher:ecc: Fix decoding a point on Montgomery curve.
+
+* cipher/ecc-misc.c (_gcry_ecc_mont_decodepoint): Fix the padding
+mistake and add updating RAWMPILEN.
+
+--
+
+Reported by Calif.io in collaboration with Claude and Anthropic
+Research.
+
+GnuPG-bug-id: 8211
+Fixes-commit: bbe15758c893dbf546416c1a6bccdad1ab000ad7
+Suggested-by: Bronson Yen <bronson@calif.io>
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+---
+ cipher/ecc-misc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/cipher/ecc-misc.c b/cipher/ecc-misc.c
+index 0c387c27..be4e2862 100644
+--- a/cipher/ecc-misc.c
++++ b/cipher/ecc-misc.c
+@@ -324,7 +324,10 @@ _gcry_ecc_mont_decodepoint (gcry_mpi_t pk, mpi_ec_t ctx, mpi_point_t result)
+         *--p = *buf++;
+ 
+       if (rawmpilen < nbytes)
+-        memset (rawmpi + nbytes - rawmpilen, 0, nbytes - rawmpilen);
++        {
++          memset (rawmpi + rawmpilen, 0, nbytes - rawmpilen);
++          rawmpilen = nbytes;
++        }
+     }
+   else
+     {
+-- 
+2.54.0
+
diff --git a/libgcrypt.spec b/libgcrypt.spec
index fcb732f..7bca93c 100644
--- a/libgcrypt.spec
+++ b/libgcrypt.spec
@@ -15,7 +15,7 @@ print(string.sub(hash, 0, 16))
 
 Name: libgcrypt
 Version: 1.11.0
-Release: 5%{?dist}
+Release: 7%{?dist}
 URL: https://www.gnupg.org/
 Source0: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2
 Source1: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig
@@ -31,6 +31,8 @@ Patch4: libgcrypt-1.11.0-cf-protection.patch
 Patch5: libgcrypt-1.11.0-pac-bti-protection.patch
 # https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/19/
 Patch6: libgcrypt-1.11.0-marvin.patch
+# https://dev.gnupg.org/T8211.html
+Patch7: libgcrypt-1.11.0-montgomery-zeroes.patch
 
 %global gcrylibdir %{_libdir}
 %global gcrysoname libgcrypt.so.20
@@ -71,6 +73,7 @@ applications using libgcrypt.
 %patch 4 -p1
 %patch 5 -p1
 %patch 6 -p1
+%patch 7 -p1
 
 %build
 # should be all algorithms except SM3 and SM4, aria
@@ -101,7 +104,15 @@ make check
 # try in faked FIPS mode too
 LIBGCRYPT_FORCE_FIPS_MODE=1 make check
 
+# annocheck currently fails on riscv64 with the following error:
+#
+#   MAYB: test: gaps, reason: not all of the .text section is covered by notes
+#   Overall: FAIL (due to MAYB results).
+#
+# Disable it on the architecture until the issue can be sorted out.
+%ifnarch riscv64
 PROFILE=%{?dist} annocheck --ignore-unknown --verbose --profile=${PROFILE:1} $RPM_BUILD_ROOT%{gcrylibdir}/libgcrypt.so.20.5.0
+%endif
 
 
 # Add generation of HMAC checksums of the final stripped binaries 
@@ -185,6 +196,13 @@ mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt
 %license COPYING
 
 %changelog
+* Fri Jun 26 2026 Jakub Jelen <jjelen@redhat.com> - 1.11.0-7
+- Fix CVE-2026-41989: Denial of Service and buffer overflow via crafted ECDH ciphertext
+
+* Tue Apr 29 2025 Andrea Bolognani <abologna@redhat.com> - 1.11.0-6
+- Disable annocheck on riscv64 (fixes build)
+  Resolves: RHEL-88837
+
 * Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1.11.0-5
 - Bump release for October 2024 mass rebuild:
   Resolves: RHEL-64018