new file mode 100644
@@ -0,0 +1,109 @@
+From 670510d1e190b0f4e47066f24498c04ada1da0f0 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 16 Sep 2026 00:37:07 +0000
+Subject: [PATCH] upstream: Reset GSSAPI client state before authentication
+
+Avoids situation where a partially-completed GSSAPI authentication attempt
+can retain state that is subsequently used by a later attempt.
+
+Report and feedback Moritz Theile, also reported by several others.
+
+ok markus, deraadt
+
+OpenBSD-Commit-ID: 95758f23e358b7c19e6205ac1c979193a9145556
+
+CVE: CVE-2026-106555
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/670510d1e190b0f4e47066f24498c04ada1da0f0]
+
+Backport Changes:
+- Omitted the upstream OpenBSD RCS revision header updates in auth2.c,
+ gss-serv.c, monitor.c and ssh-gss.h because they do not apply to the
+ OpenSSH 9.6p1 source revision.
+
+(cherry picked from commit 670510d1e190b0f4e47066f24498c04ada1da0f0)
+Signed-off-by: Benhur Tessele <benhur.tessele@est.tech>
+---
+ auth2.c | 1 +
+ gss-serv.c | 19 ++++++++++++-------
+ monitor.c | 2 ++
+ ssh-gss.h | 1 +
+ 4 files changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/auth2.c b/auth2.c
+index 271789a7..ba5d9a78 100644
+--- a/auth2.c
++++ b/auth2.c
+@@ -332,6 +332,7 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
+ auth2_challenge_stop(ssh);
+
+ #ifdef GSSAPI
++ ssh_gssapi_cleanup_global_client();
+ /* XXX move to auth2_gssapi_stop() */
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
+diff --git a/gss-serv.c b/gss-serv.c
+index 00e3d118..dc6d0d8e 100644
+--- a/gss-serv.c
++++ b/gss-serv.c
+@@ -354,12 +354,21 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep)
+ }
+ }
+
++void
++ssh_gssapi_cleanup_global_client()
++{
++ OM_uint32 lmin;
++
++ gss_release_buffer(&lmin, &gssapi_client.displayname);
++ gss_release_buffer(&lmin, &gssapi_client.exportedname);
++ gss_release_cred(&lmin, &gssapi_client.creds);
++ explicit_bzero(&gssapi_client, sizeof(ssh_gssapi_client));
++}
++
+ /* Privileged */
+ int
+ ssh_gssapi_userok(char *user)
+ {
+- OM_uint32 lmin;
+-
+ if (gssapi_client.exportedname.length == 0 ||
+ gssapi_client.exportedname.value == NULL) {
+ debug("No suitable client data");
+@@ -370,11 +379,7 @@ ssh_gssapi_userok(char *user)
+ return 1;
+ else {
+ /* Destroy delegated credentials if userok fails */
+- gss_release_buffer(&lmin, &gssapi_client.displayname);
+- gss_release_buffer(&lmin, &gssapi_client.exportedname);
+- gss_release_cred(&lmin, &gssapi_client.creds);
+- explicit_bzero(&gssapi_client,
+- sizeof(ssh_gssapi_client));
++ ssh_gssapi_cleanup_global_client();
+ return 0;
+ }
+ else
+diff --git a/monitor.c b/monitor.c
+index b3ed515e..2d563197 100644
+--- a/monitor.c
++++ b/monitor.c
+@@ -1840,6 +1840,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
+ if (!options.gss_authentication)
+ fatal_f("GSSAPI authentication not enabled");
+
++ ssh_gssapi_cleanup_global_client();
++
+ if ((r = sshbuf_get_string(m, &p, &len)) != 0)
+ fatal_fr(r, "parse");
+ goid.elements = p;
+diff --git a/ssh-gss.h b/ssh-gss.h
+index a8af117d..082c77bc 100644
+--- a/ssh-gss.h
++++ b/ssh-gss.h
+@@ -133,6 +133,7 @@ void ssh_gssapi_do_child(char ***, u_int *);
+ void ssh_gssapi_cleanup_creds(void);
+ void ssh_gssapi_storecreds(void);
+ const char *ssh_gssapi_displayname(void);
++void ssh_gssapi_cleanup_global_client();
+
+ #endif /* GSSAPI */
+
@@ -47,6 +47,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-73283.patch \
file://CVE-2026-73282.patch \
file://CVE-2026-73281.patch \
+ file://CVE-2026-106555.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
This patch applies the upstream fix that makes sshd reset the GSSAPI client state before each authentication attempt, so state from a partially-completed GSSAPIAuthentication attempt cannot be used by a later attempt. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. The vulnerable code is only built when PACKAGECONFIG contains kerberos. [1] https://github.com/openssh/openssh-portable/commit/670510d1e190b0f4e47066f24498c04ada1da0f0 [2] https://www.cve.org/CVERecord?id=CVE-2026-106555 Signed-off-by: Benhur Tessele <benhur.tessele@est.tech> --- .../openssh/openssh/CVE-2026-106555.patch | 109 ++++++++++++++++++ .../openssh/openssh_9.6p1.bb | 1 + 2 files changed, 110 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106555.patch