new file mode 100644
@@ -0,0 +1,88 @@
+From 6f9cd19af05aa828d7778cfb047faaed1679e8b7 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 16 Sep 2026 00:37:52 +0000
+Subject: [PATCH] upstream: Only store GSSAPI creds when authn succeeds
+
+Issue report and patch from Moritz Theile
+
+ok markus, deraadt
+
+OpenBSD-Commit-ID: 812bbd22b8dd5a1583094ab2b6ff0045e4088467
+
+CVE: CVE-2026-106553
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/6f9cd19af05aa828d7778cfb047faaed1679e8b7]
+
+Backport Changes:
+- Omitted the upstream OpenBSD RCS revision header updates in gss-serv.c
+ and ssh-gss.h because they do not apply to the OpenSSH 9.6p1 source
+ revision.
+- OpenSSH 9.6p1 does not have the server-side GSSAPIDelegateCredentials
+ check in ssh_gssapi_storecreds() (added upstream in 94bf1154), so the
+ new userok check is added at the start of the function without that
+ surrounding context.
+
+(cherry picked from commit 6f9cd19af05aa828d7778cfb047faaed1679e8b7)
+Signed-off-by: Benhur Tessele <benhur.tessele@est.tech>
+---
+ gss-serv.c | 13 ++++++++++---
+ ssh-gss.h | 1 +
+ 2 files changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/gss-serv.c b/gss-serv.c
+index dc6d0d8e..817b8fe5 100644
+--- a/gss-serv.c
++++ b/gss-serv.c
+@@ -51,7 +51,7 @@ extern ServerOptions options;
+
+ static ssh_gssapi_client gssapi_client =
+ { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER,
+- GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL, NULL}};
++ GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL, NULL}, 0};
+
+ ssh_gssapi_mech gssapi_null_mech =
+ { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL};
+@@ -279,6 +279,7 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
+
+ gss_buffer_desc ename;
+
++ client->userok = 0;
+ client->mech = NULL;
+
+ while (supported_mechs[i]->name != NULL) {
+@@ -331,6 +332,11 @@ ssh_gssapi_cleanup_creds(void)
+ void
+ ssh_gssapi_storecreds(void)
+ {
++ if (!gssapi_client.userok) {
++ debug_f("GSSAPI client was not authorized, doing nothing");
++ return;
++ }
++
+ if (gssapi_client.mech && gssapi_client.mech->storecreds) {
+ (*gssapi_client.mech->storecreds)(&gssapi_client);
+ } else
+@@ -375,9 +381,10 @@ ssh_gssapi_userok(char *user)
+ return 0;
+ }
+ if (gssapi_client.mech && gssapi_client.mech->userok)
+- if ((*gssapi_client.mech->userok)(&gssapi_client, user))
++ if ((*gssapi_client.mech->userok)(&gssapi_client, user)) {
++ gssapi_client.userok = 1;
+ return 1;
+- else {
++ } else {
+ /* Destroy delegated credentials if userok fails */
+ ssh_gssapi_cleanup_global_client();
+ return 0;
+diff --git a/ssh-gss.h b/ssh-gss.h
+index 082c77bc..9d90fe45 100644
+--- a/ssh-gss.h
++++ b/ssh-gss.h
+@@ -74,6 +74,7 @@ typedef struct {
+ gss_cred_id_t creds;
+ struct ssh_gssapi_mech_struct *mech;
+ ssh_gssapi_ccache store;
++ int userok;
+ } ssh_gssapi_client;
+
+ typedef struct ssh_gssapi_mech_struct {
@@ -48,6 +48,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-73282.patch \
file://CVE-2026-73281.patch \
file://CVE-2026-106555.patch \
+ file://CVE-2026-106553.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
This patch applies the upstream fix that makes sshd only store GSSAPI credentials when authentication has succeeded, so credentials from a failed GSSAPIAuthentication attempt cannot persist and be used after a later authentication succeeds. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. The vulnerable code is only built when PACKAGECONFIG contains kerberos. [1] https://github.com/openssh/openssh-portable/commit/6f9cd19af05aa828d7778cfb047faaed1679e8b7 [2] https://www.cve.org/CVERecord?id=CVE-2026-106553 Signed-off-by: Benhur Tessele <benhur.tessele@est.tech> --- .../openssh/openssh/CVE-2026-106553.patch | 88 +++++++++++++++++++ .../openssh/openssh_9.6p1.bb | 1 + 2 files changed, 89 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106553.patch