diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553.patch
new file mode 100644
index 0000000000..02aea5b04a
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553.patch
@@ -0,0 +1,88 @@
+From 6f9cd19af05aa828d7778cfb047faaed1679e8b7 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 16 Sep 2026 00:37:52 +0000
+Subject: [PATCH] upstream: Only store GSSAPI creds when authn succeeds
+
+Issue report and patch from Moritz Theile
+
+ok markus, deraadt
+
+OpenBSD-Commit-ID: 812bbd22b8dd5a1583094ab2b6ff0045e4088467
+
+CVE: CVE-2026-106553
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/6f9cd19af05aa828d7778cfb047faaed1679e8b7]
+
+Backport Changes:
+- Omitted the upstream OpenBSD RCS revision header updates in gss-serv.c
+  and ssh-gss.h because they do not apply to the OpenSSH 9.6p1 source
+  revision.
+- OpenSSH 9.6p1 does not have the server-side GSSAPIDelegateCredentials
+  check in ssh_gssapi_storecreds() (added upstream in 94bf1154), so the
+  new userok check is added at the start of the function without that
+  surrounding context.
+
+(cherry picked from commit 6f9cd19af05aa828d7778cfb047faaed1679e8b7)
+Signed-off-by: Benhur Tessele <benhur.tessele@est.tech>
+---
+ gss-serv.c | 13 ++++++++++---
+ ssh-gss.h  |  1 +
+ 2 files changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/gss-serv.c b/gss-serv.c
+index dc6d0d8e..817b8fe5 100644
+--- a/gss-serv.c
++++ b/gss-serv.c
+@@ -51,7 +51,7 @@ extern ServerOptions options;
+ 
+ static ssh_gssapi_client gssapi_client =
+     { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER,
+-    GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL, NULL}};
++    GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL, NULL}, 0};
+ 
+ ssh_gssapi_mech gssapi_null_mech =
+     { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL};
+@@ -279,6 +279,7 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
+ 
+ 	gss_buffer_desc ename;
+ 
++	client->userok = 0;
+ 	client->mech = NULL;
+ 
+ 	while (supported_mechs[i]->name != NULL) {
+@@ -331,6 +332,11 @@ ssh_gssapi_cleanup_creds(void)
+ void
+ ssh_gssapi_storecreds(void)
+ {
++	if (!gssapi_client.userok) {
++		debug_f("GSSAPI client was not authorized, doing nothing");
++		return;
++	}
++
+ 	if (gssapi_client.mech && gssapi_client.mech->storecreds) {
+ 		(*gssapi_client.mech->storecreds)(&gssapi_client);
+ 	} else
+@@ -375,9 +381,10 @@ ssh_gssapi_userok(char *user)
+ 		return 0;
+ 	}
+ 	if (gssapi_client.mech && gssapi_client.mech->userok)
+-		if ((*gssapi_client.mech->userok)(&gssapi_client, user))
++		if ((*gssapi_client.mech->userok)(&gssapi_client, user)) {
++			gssapi_client.userok = 1;
+ 			return 1;
+-		else {
++		} else {
+ 			/* Destroy delegated credentials if userok fails */
+ 			ssh_gssapi_cleanup_global_client();
+ 			return 0;
+diff --git a/ssh-gss.h b/ssh-gss.h
+index 082c77bc..9d90fe45 100644
+--- a/ssh-gss.h
++++ b/ssh-gss.h
+@@ -74,6 +74,7 @@ typedef struct {
+ 	gss_cred_id_t creds;
+ 	struct ssh_gssapi_mech_struct *mech;
+ 	ssh_gssapi_ccache store;
++	int userok;
+ } ssh_gssapi_client;
+ 
+ typedef struct ssh_gssapi_mech_struct {
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index c2089f37dc..ac5294c29f 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -48,6 +48,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
            file://CVE-2026-73282.patch \
            file://CVE-2026-73281.patch \
            file://CVE-2026-106555.patch \
+           file://CVE-2026-106553.patch \
            "
 SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"