new file mode 100644
@@ -0,0 +1,59 @@
+From b70913c1208eda8494e2d6dd81910e92b8640dcc Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Wed, 20 May 2026 10:22:52 +0200
+Subject: [PATCH] - Fix CVE-2026-44608, Use after free and crash in RPZ code.
+ Thanks to Qifan Zhang, Palo Alto Networks, for the report.
+
+(cherry picked from commit 75b6dba593d4fff000434cd64807c6ebd50bd244)
+
+CVE: CVE-2026-44608
+Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/75b6dba593d4fff000434cd64807c6ebd50bd244]
+
+Dropped changes to the Changelog file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ services/rpz.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/services/rpz.c b/services/rpz.c
+index f45cf6542..27f7de861 100644
+--- a/services/rpz.c
++++ b/services/rpz.c
+@@ -2468,6 +2468,7 @@ rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate*
+ {
+ struct auth_zones* az;
+ struct auth_zone* a;
++ struct dns_msg* ret = NULL;
+ struct clientip_synthesized_rr* raddr = NULL;
+ struct rpz* r = NULL;
+ struct local_zone* z = NULL;
+@@ -2511,13 +2512,11 @@ rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate*
+ z = rpz_delegation_point_zone_lookup(is->dp, r->nsdname_zones,
+ is->qchase.qclass, &match);
+ if(z != NULL) {
+- lock_rw_unlock(&a->lock);
+ break;
+ }
+
+ raddr = rpz_delegation_point_ipbased_trigger_lookup(r, is);
+ if(raddr != NULL) {
+- lock_rw_unlock(&a->lock);
+ break;
+ }
+ lock_rw_unlock(&a->lock);
+@@ -2532,9 +2531,12 @@ rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate*
+ if(z) {
+ lock_rw_unlock(&z->lock);
+ }
+- return rpz_apply_nsip_trigger(ms, &is->qchase, r, raddr, a);
++ ret = rpz_apply_nsip_trigger(ms, &is->qchase, r, raddr, a);
++ } else {
++ ret = rpz_apply_nsdname_trigger(ms, &is->qchase, r, z, &match, a);
+ }
+- return rpz_apply_nsdname_trigger(ms, &is->qchase, r, z, &match, a);
++ lock_rw_unlock(&a->lock);
++ return ret;
+ }
+
+ struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* ms,
@@ -22,6 +22,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
file://CVE-2026-42923.patch \
file://CVE-2026-42960.patch \
file://CVE-2026-44390.patch \
+ file://CVE-2026-44608.patch \
"
SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"