new file mode 100644
@@ -0,0 +1,78 @@
+From 22526848c6606698d6374c496f36009b9c6787ce Mon Sep 17 00:00:00 2001
+From: Cole Munz <Munzzyy1@proton.me>
+Date: Sun, 13 Sep 2026 15:23:17 +0200
+Subject: [PATCH] options: fix unsigned underflow when clearing
+ domain_search_list
+
+remove_option() and update_option() clear the domain search list with
+
+ while (o->domain_search_list_len-- > 0)
+
+domain_search_list_len is unsigned, and the post-decrement runs on the
+final test too. When the length reaches 0 the condition is false but
+the decrement has already wrapped it to UINT_MAX, so the field is left
+corrupted. The next reset then does
+
+ o->domain_search_list[UINT_MAX] = NULL
+
+and walks far out of bounds, writing NULL through each slot. A server
+can drive this reset path against a client with PUSH_UPDATE, so on
+Windows and Android this is a remotely reachable out-of-bounds write.
+
+v2:
+ Change to the semantics used for all the other lists there - set
+ length to 0 and clear the list with CLEAR().
+
+Change-Id: I3724236d4acc3d05d786274d6baf34a21c570594
+Signed-off-by: Cole Munz <Munzzyy1@proton.me>
+Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
+Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1914
+Github: OpenVPN/openvpn-private-issues#178
+CVE: 2026-88964
+Message-Id: <20260913132322.2283-1-gert@greenie.muc.de>
+URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg39157.html
+Signed-off-by: Gert Doering <gert@greenie.muc.de>
+(cherry picked from commit aa12dd64b74142bbbff9f37cec05959ba115c06d)
+(cherry picked from commit d586f8ad9bfc582cc7984fcd482dc7cfacc940e2)
+
+CVE: CVE-2026-88964
+Upstream-Status: Backport [https://github.com/OpenVPN/openvpn/commit/d586f8ad9bfc582cc7984fcd482dc7cfacc940e2]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/openvpn/options.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/src/openvpn/options.c b/src/openvpn/options.c
+index b7d035b6..847572c2 100644
+--- a/src/openvpn/options.c
++++ b/src/openvpn/options.c
+@@ -5220,12 +5220,12 @@ remove_option(struct context *c, struct options *options, char *p[], bool is_inl
+ memset(o->ntp, 0, sizeof(o->ntp));
+ o->nbdd_len = 0;
+ memset(o->nbdd, 0, sizeof(o->nbdd));
+- while (o->domain_search_list_len-- > 0)
+- {
+- o->domain_search_list[o->domain_search_list_len] = NULL;
+- }
++ o->domain_search_list_len = 0;
++ CLEAR(o->domain_search_list);
+ o->disable_nbt = 0;
+ o->dhcp_options = 0;
++ CLEAR(options->dns_options.from_dhcp);
++
+ #if defined(TARGET_ANDROID)
+ o->http_proxy_port = 0;
+ o->http_proxy = NULL;
+@@ -5524,10 +5524,8 @@ update_option(struct context *c, struct options *options, char *p[], bool is_inl
+ CLEAR(o->ntp);
+ o->nbdd_len = 0;
+ CLEAR(o->nbdd);
+- while (o->domain_search_list_len-- > 0)
+- {
+- o->domain_search_list[o->domain_search_list_len] = NULL;
+- }
++ o->domain_search_list_len = 0;
++ CLEAR(o->domain_search_list);
+ o->disable_nbt = 0;
+ o->dhcp_options = 0;
+
@@ -11,6 +11,7 @@ SRC_URI = "https://github.com/OpenVPN/openvpn/releases/download/v${PV}/${BP}.tar
file://0001-configure.ac-eliminate-build-path-from-openvpn-versi.patch \
file://openvpn \
file://run-ptest \
+ file://CVE-2026-88964.patch \
"
UPSTREAM_CHECK_URI = "https://openvpn.net/community-downloads"