new file mode 100644
@@ -0,0 +1,97 @@
+From 1d5340fce24526719e32aebc4c721fc228182ace Mon Sep 17 00:00:00 2001
+From: "job@openbsd.org" <job@openbsd.org>
+Date: Tue, 22 Sep 2026 04:38:09 +0000
+Subject: [PATCH] upstream: Disable LZ77 dictionary coder to avoid a potential
+
+side-channel leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+A chosen-plaintext attack method exists which makes use of
+dictionary-based compression to recover secrets from one channel by
+interacting with the SSH session's shared compression dictionary through
+another channel.
+
+Attacker-controlled input can recognizably reflect into the total length
+of transmitted ciphertexts by virtue of LZ77 replacing repeated strings
+with back-references into the SSH session's encoder search buffer,
+which is shared across all channels. For this reason, the documentation
+already recommended against enabling compression for connections that
+share trusted and untrusted traffic.
+
+As an extra precaution, use only Huffman coding when compressing
+plaintexts, as this algorithm does not use a dictionary. But, this
+results in a reduction of compression effectiveness.
+
+Inspired by "Crossing the Streams: SSH Plaintext Recovery via a Common
+Compression Context in Multiplexed Channels." by Fabian Bäumer and
+Marcus Brinkmann, preprint https://arxiv.org/abs/2609.07709 (2026)
+
+OK djm@ dtucker@
+
+OpenBSD-Commit-ID: 839e5e53ad76786d0e90bed530304e4e13acbba0
+
+CVE: CVE-2026-106582
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/1d5340fce24526719e32aebc4c721fc228182ace]
+
+Backport Changes:
+- Omitted the upstream packet.c OpenBSD revision-only hunk and retained
+ the Wrynose OpenSSH 10.3p1 revision.
+
+(cherry picked from commit 1d5340fce24526719e32aebc4c721fc228182ace)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ packet.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/packet.c b/packet.c
+--- a/packet.c
++++ b/packet.c
+@@ -802,13 +802,12 @@ ssh_packet_init_compression(struct ssh *ssh)
+ #ifdef WITH_ZLIB
+ static int
+-start_compression_out(struct ssh *ssh, int level)
++start_compression_out(struct ssh *ssh)
+ {
+- if (level < 1 || level > 9)
+- return SSH_ERR_INVALID_ARGUMENT;
+- debug("Enabling compression at level %d.", level);
++ debug("Enabling compression.");
+ if (ssh->state->compression_out_started == 1)
+ deflateEnd(&ssh->state->compression_out_stream);
+- switch (deflateInit(&ssh->state->compression_out_stream, level)) {
++ switch (deflateInit2(&ssh->state->compression_out_stream,
++ Z_BEST_SPEED, Z_DEFLATED, 15, 8, Z_HUFFMAN_ONLY)) {
+ case Z_OK:
+ ssh->state->compression_out_started = 1;
+ break;
+@@ -934,7 +933,7 @@ uncompress_buffer(struct ssh *ssh, struct sshbuf *in, struct sshbuf *out)
+ #else /* WITH_ZLIB */
+
+ static int
+-start_compression_out(struct ssh *ssh, int level)
++start_compression_out(struct ssh *ssh)
+ {
+ return SSH_ERR_INTERNAL_ERROR;
+ }
+@@ -1040,7 +1039,7 @@ ssh_set_newkeys(struct ssh *ssh, int mode)
+ if ((r = ssh_packet_init_compression(ssh)) < 0)
+ return r;
+ if (mode == MODE_OUT) {
+- if ((r = start_compression_out(ssh, 6)) != 0)
++ if ((r = start_compression_out(ssh)) != 0)
+ return r;
+ } else {
+ if ((r = start_compression_in(ssh)) != 0)
+@@ -1185,7 +1184,7 @@ ssh_packet_enable_delayed_compress(struct ssh *ssh)
+ if ((r = ssh_packet_init_compression(ssh)) != 0)
+ return r;
+ if (mode == MODE_OUT) {
+- if ((r = start_compression_out(ssh, 6)) != 0)
++ if ((r = start_compression_out(ssh)) != 0)
+ return r;
+ } else {
+ if ((r = start_compression_in(ssh)) != 0)
+--
+2.43.0
@@ -39,6 +39,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://CVE-2026-106586_p2.patch \
file://CVE-2026-106586_p3.patch \
file://CVE-2026-106587.patch \
+ file://CVE-2026-106582.patch \
"
SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"