mbox series

[scarthgap,0/1] openssh: Security Fix

Message ID 20261016035448.3083867-1-hthakar@cisco.com
Headers show
Series openssh: Security Fix | expand

Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) Oct. 16, 2026, 3:54 a.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

  This series addresses CVE-2026-106587 in the Scarthgap
  openssh 9.6p1 recipe. The patch backports the upstream
  fix for handling server options set to "none" in a Match block.
 
  The series is based on three OpenSSH patches already submitted
  to OE-Core and still under review:
 
    CVE-2026-73283:
    https://patchwork.yoctoproject.org/project/oe-core/patch/20260930060027.1560262-1-hthakar@cisco.com/
 
    CVE-2026-73282:
    https://patchwork.yoctoproject.org/project/oe-core/patch/20260930060027.1560262-2-hthakar@cisco.com/
 
    CVE-2026-73281:
    https://patchwork.yoctoproject.org/project/oe-core/patch/20260930060027.1560262-3-hthakar@cisco.com/
 
  Those three patches are prerequisites; they are not included or
  resent in this one-patch series.
 
  Validation: BitBake do_patch and do_compile, the image build,
  and OpenSSH ptest completed successfully.

Hetvi Thakar (1):
  openssh: fix CVE-2026-106587

 .../openssh/openssh/CVE-2026-106587.patch     | 76 +++++++++++++++++++
 .../openssh/openssh_9.6p1.bb                  |  1 +
 2 files changed, 77 insertions(+)
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106587.patch