new file mode 100644
@@ -0,0 +1,100 @@
+From 670510d1e190b0f4e47066f24498c04ada1da0f0 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 16 Sep 2026 00:37:07 +0000
+Subject: [PATCH] upstream: Reset GSSAPI client state before authentication
+
+Avoids situation where a partially-completed GSSAPI authentication attempt
+can retain state that is subsequently used by a later attempt.
+
+Report and feedback Moritz Theile, also reported by several others.
+
+ok markus, deraadt
+
+OpenBSD-Commit-ID: 95758f23e358b7c19e6205ac1c979193a9145556
+
+CVE: CVE-2026-106553 CVE-2026-106555
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/670510d1e190b0f4e47066f24498c04ada1da0f0]
+
+Backport Changes:
+- Omit upstream OpenBSD revision-only hunks.
+
+(cherry picked from commit 670510d1e190b0f4e47066f24498c04ada1da0f0)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ auth2.c | 1 +
+ gss-serv.c | 19 ++++++++++++-------
+ monitor.c | 2 ++
+ ssh-gss.h | 1 +
+ 4 files changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/auth2.c b/auth2.c
+--- a/auth2.c
++++ b/auth2.c
+@@ -338,3 +338,4 @@ input_userauth_request(int type, uint32_t seq, struct ssh *ssh)
+ #ifdef GSSAPI
++ ssh_gssapi_cleanup_global_client();
+ /* XXX move to auth2_gssapi_stop() */
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
+diff --git a/gss-serv.c b/gss-serv.c
+--- a/gss-serv.c
++++ b/gss-serv.c
+@@ -361,12 +361,21 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep)
+ }
+ }
+
++void
++ssh_gssapi_cleanup_global_client()
++{
++ OM_uint32 lmin;
++
++ gss_release_buffer(&lmin, &gssapi_client.displayname);
++ gss_release_buffer(&lmin, &gssapi_client.exportedname);
++ gss_release_cred(&lmin, &gssapi_client.creds);
++ explicit_bzero(&gssapi_client, sizeof(ssh_gssapi_client));
++}
++
+ /* Privileged */
+ int
+ ssh_gssapi_userok(char *user)
+ {
+- OM_uint32 lmin;
+-
+ if (gssapi_client.exportedname.length == 0 ||
+ gssapi_client.exportedname.value == NULL) {
+ debug("No suitable client data");
+@@ -377,11 +386,7 @@ ssh_gssapi_userok(char *user)
+ return 1;
+ else {
+ /* Destroy delegated credentials if userok fails */
+- gss_release_buffer(&lmin, &gssapi_client.displayname);
+- gss_release_buffer(&lmin, &gssapi_client.exportedname);
+- gss_release_cred(&lmin, &gssapi_client.creds);
+- explicit_bzero(&gssapi_client,
+- sizeof(ssh_gssapi_client));
++ ssh_gssapi_cleanup_global_client();
+ return 0;
+ }
+ else
+diff --git a/monitor.c b/monitor.c
+--- a/monitor.c
++++ b/monitor.c
+@@ -1990,6 +1990,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
+ if (!options.gss_authentication)
+ fatal_f("GSSAPI authentication not enabled");
+
++ ssh_gssapi_cleanup_global_client();
++
+ if ((r = sshbuf_get_string(m, &p, &len)) != 0)
+ fatal_fr(r, "parse");
+ goid.elements = p;
+diff --git a/ssh-gss.h b/ssh-gss.h
+--- a/ssh-gss.h
++++ b/ssh-gss.h
+@@ -132,4 +132,5 @@ void ssh_gssapi_cleanup_creds(void);
+ void ssh_gssapi_storecreds(void);
+ const char *ssh_gssapi_displayname(void);
++void ssh_gssapi_cleanup_global_client();
+
+ #endif /* GSSAPI */
+--
+2.43.0
new file mode 100644
@@ -0,0 +1,80 @@
+From 6f9cd19af05aa828d7778cfb047faaed1679e8b7 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 16 Sep 2026 00:37:52 +0000
+Subject: [PATCH] upstream: Only store GSSAPI creds when authn succeeds
+
+Issue report and patch from Moritz Theile
+
+ok markus, deraadt
+
+OpenBSD-Commit-ID: 812bbd22b8dd5a1583094ab2b6ff0045e4088467
+
+CVE: CVE-2026-106553 CVE-2026-106555
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/6f9cd19af05aa828d7778cfb047faaed1679e8b7]
+
+Backport Changes:
+- Omit upstream OpenBSD revision-only hunks.
+
+(cherry picked from commit 6f9cd19af05aa828d7778cfb047faaed1679e8b7)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ gss-serv.c | 13 ++++++++++---
+ ssh-gss.h | 1 +
+ 2 files changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/gss-serv.c b/gss-serv.c
+--- a/gss-serv.c
++++ b/gss-serv.c
+@@ -52,7 +52,7 @@ extern ServerOptions options;
+
+ static ssh_gssapi_client gssapi_client =
+ { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER,
+- GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL, NULL}};
++ GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL, NULL}, 0};
+
+ ssh_gssapi_mech gssapi_null_mech =
+ { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL};
+@@ -281,6 +281,7 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
+
+ gss_buffer_desc ename;
+
++ client->userok = 0;
+ client->mech = NULL;
+
+ while (supported_mechs[i]->name != NULL) {
+@@ -332,4 +333,9 @@ ssh_gssapi_storecreds(void)
+ {
++ if (!gssapi_client.userok) {
++ debug_f("GSSAPI client was not authorized, doing nothing");
++ return;
++ }
++
+ if (options.gss_deleg_creds == 0) {
+ debug_f("delegate credential is disabled, doing nothing");
+ return;
+@@ -382,9 +388,10 @@ ssh_gssapi_userok(char *user)
+ }
+ if (gssapi_client.mech && gssapi_client.mech->userok)
+- if ((*gssapi_client.mech->userok)(&gssapi_client, user))
++ if ((*gssapi_client.mech->userok)(&gssapi_client, user)) {
++ gssapi_client.userok = 1;
+ return 1;
+- else {
++ } else {
+ /* Destroy delegated credentials if userok fails */
+ ssh_gssapi_cleanup_global_client();
+ return 0;
+ }
+diff --git a/ssh-gss.h b/ssh-gss.h
+--- a/ssh-gss.h
++++ b/ssh-gss.h
+@@ -72,6 +72,7 @@ typedef struct {
+ gss_cred_id_t creds;
+ struct ssh_gssapi_mech_struct *mech;
+ ssh_gssapi_ccache store;
++ int userok;
+ } ssh_gssapi_client;
+
+ typedef struct ssh_gssapi_mech_struct {
+--
+2.43.0
new file mode 100644
@@ -0,0 +1,42 @@
+From d549f99da344c178c5f632a62a6aa60544d7236e Mon Sep 17 00:00:00 2001
+From: "robert@openbsd.org" <robert@openbsd.org>
+Subject: [PATCH] upstream: ssh_gssapi_cleanup_global_client() needs a prototype
+
+CVE: CVE-2026-106553 CVE-2026-106555
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/d549f99da344c178c5f632a62a6aa60544d7236e]
+
+Backport Changes:
+- Retain the Wrynose 10.3p1 context and omit upstream OpenBSD revision-only
+ hunks.
+
+(cherry picked from commit d549f99da344c178c5f632a62a6aa60544d7236e)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ gss-serv.c | 2 +-
+ ssh-gss.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/gss-serv.c b/gss-serv.c
+--- a/gss-serv.c
++++ b/gss-serv.c
+@@ -368,7 +368,7 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep)
+ }
+
+ void
+-ssh_gssapi_cleanup_global_client()
++ssh_gssapi_cleanup_global_client(void)
+ {
+ OM_uint32 lmin;
+
+diff --git a/ssh-gss.h b/ssh-gss.h
+--- a/ssh-gss.h
++++ b/ssh-gss.h
+@@ -133,5 +133,5 @@ void ssh_gssapi_cleanup_creds(void);
+ void ssh_gssapi_storecreds(void);
+ const char *ssh_gssapi_displayname(void);
+-void ssh_gssapi_cleanup_global_client();
++void ssh_gssapi_cleanup_global_client(void);
+
+ #endif /* GSSAPI */
+--
+2.43.0
@@ -43,6 +43,9 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://CVE-2026-106585.patch \
file://CVE-2026-106583.patch \
file://CVE-2026-106552.patch \
+ file://CVE-2026-106553_CVE-2026-106555_p1.patch \
+ file://CVE-2026-106553_CVE-2026-106555_p2.patch \
+ file://CVE-2026-106553_CVE-2026-106555_p3.patch \
"
SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"