mbox series

[wrynose,00/10] openssh: Security fixes

Message ID 20261016035236.442896-1-hthakar@cisco.com
Headers show
Series openssh: Security fixes | expand

Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) Oct. 16, 2026, 3:52 a.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

This series addresses eleven OpenSSH CVEs in the Wrynose
openssh 10.3p1 recipe. Eight patches backport upstream fixes;
two set CVE_STATUS for issues whose affected platform-specific
code does not apply to the Wrynose Linux build.

The series is based on three OpenSSH patches already submitted
to OE-Core and still under review:

  CVE-2026-73283:
  https://patchwork.yoctoproject.org/project/oe-core/patch/20260929035745.321529-1-hthakar@cisco.com/

  CVE-2026-73282:
  https://patchwork.yoctoproject.org/project/oe-core/patch/20260929035745.321529-2-hthakar@cisco.com/

  CVE-2026-73281:
  https://patchwork.yoctoproject.org/project/oe-core/patch/20260929035745.321529-3-hthakar@cisco.com/

Those three patches are prerequisites; they are not included or
resent in this ten-patch series.

The upstream-fix backports cover CVE-2026-106584,
CVE-2026-106586, CVE-2026-106587, CVE-2026-106582,
CVE-2026-106585, CVE-2026-106583, CVE-2026-106552,
CVE-2026-106553, and CVE-2026-106555. One patch addresses
both CVE-2026-106553 and CVE-2026-106555.

The CVE_STATUS patches address CVE-2026-106588 and
CVE-2026-106589.

Hetvi Thakar (10):
  openssh: Fix CVE-2026-106584
  openssh: Fix CVE-2026-106586
  openssh: Fix CVE-2026-106587
  openssh: Fix CVE-2026-106582
  openssh: Fix CVE-2026-106585
  openssh: Ignore CVE-2026-106588
  openssh: Ignore CVE-2026-106589
  openssh: Fix CVE-2026-106583
  openssh: Fix CVE-2026-106552
  openssh: Fix CVE-2026-106553 and CVE-2026-106555

 .../openssh/openssh/CVE-2026-106552.patch     |  63 +++++++++++
 .../CVE-2026-106553_CVE-2026-106555_p1.patch  | 100 +++++++++++++++++
 .../CVE-2026-106553_CVE-2026-106555_p2.patch  |  80 ++++++++++++++
 .../CVE-2026-106553_CVE-2026-106555_p3.patch  |  42 ++++++++
 .../openssh/openssh/CVE-2026-106582.patch     |  97 +++++++++++++++++
 .../openssh/openssh/CVE-2026-106583.patch     |  35 ++++++
 .../openssh/openssh/CVE-2026-106584.patch     |  39 +++++++
 .../openssh/openssh/CVE-2026-106585.patch     |  44 ++++++++
 .../openssh/openssh/CVE-2026-106586_p1.patch  |  39 +++++++
 .../openssh/openssh/CVE-2026-106586_p2.patch  | 101 ++++++++++++++++++
 .../openssh/openssh/CVE-2026-106586_p3.patch  |  39 +++++++
 .../openssh/openssh/CVE-2026-106587.patch     |  62 +++++++++++
 .../openssh/openssh_10.3p1.bb                 |  14 +++
 13 files changed, 755 insertions(+)
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106552.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p1.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p2.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p3.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106582.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106583.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106584.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106585.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p1.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p2.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p3.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106587.patch