mbox series

[scarthgap,0/2] openssh: fix GSSAPI CVE-2026-106555 and CVE-2026-106553

Message ID 20261029171057.15032-1-benhur.tessele@est.tech
Headers show
Series openssh: fix GSSAPI CVE-2026-106555 and CVE-2026-106553 | expand

Message

Benhur Tessele Oct. 29, 2026, 5:10 p.m. UTC 
Backport two related upstream GSSAPIAuthentication fixes from OpenSSH
10.6p1 to openssh 9.6p1:

- CVE-2026-106555: reset GSSAPI client state before each authentication
  attempt (upstream 670510d1).
- CVE-2026-106553: only store GSSAPI credentials when authentication has
  succeeded (upstream 6f9cd19a).

The patches are ordered as upstream, as the second one applies on top of
the helper function introduced by the first. The vulnerable code is only
built when PACKAGECONFIG contains kerberos.

Tested by building openssh (bitbake openssh -c compile) for qemux86-64
with the default PACKAGECONFIG and with kerberos enabled (krb5 from
meta-oe), confirming that GSSAPI support was compiled in.

Also ran the openssh ptest on qemux86-64 (core-image-ptest-openssh with
PACKAGECONFIG kerberos, bitbake ... -c testimage): 82 PASS, 0 FAIL,
1 SKIP (agent-ptrace, gdb not installed). Note that the openssh
regression suite has no GSSAPI tests, so this checks for general
regressions only.

Benhur Tessele (2):
  openssh: fix CVE-2026-106555
  openssh: fix CVE-2026-106553

 .../openssh/openssh/CVE-2026-106553.patch     |  88 ++++++++++++++
 .../openssh/openssh/CVE-2026-106555.patch     | 109 ++++++++++++++++++
 .../openssh/openssh_9.6p1.bb                  |   2 +
 3 files changed, 199 insertions(+)
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106553.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106555.patch