new file mode 100644
@@ -0,0 +1,77 @@
+From 0fa208a25f95603e255211254097dd34a165fed0 Mon Sep 17 00:00:00 2001
+From: "debing.sun" <debing.sun@redis.com>
+Date: Mon, 29 Dec 2025 16:20:41 +0800
+Subject: [PATCH] Fix use-after-free when evicting blocked client during
+ unblock (CVE-2026-23479)
+
+When re-executing a pending command after unblocking, check the return value
+of `processCommandAndResetClient` and exit if needed.
+
+CVE: CVE-2026-23479
+Upstream-Status: Backport [https://github.com/redis/redis/commit/c14e9925e571c3c8ecbeb8632fe834faa32175ea]
+
+(cherry picked from commit c14e9925e571c3c8ecbeb8632fe834faa32175ea)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ src/blocked.c | 8 +++++++-
+ tests/unit/client-eviction.tcl | 29 +++++++++++++++++++++++++++++
+ 2 files changed, 36 insertions(+), 1 deletion(-)
+
+diff --git a/src/blocked.c b/src/blocked.c
+index 86cff0b7f..a35ffb569 100644
+--- a/src/blocked.c
++++ b/src/blocked.c
+@@ -676,7 +676,13 @@ static void unblockClientOnKey(client *c, robj *key) {
+ client *old_client = server.current_client;
+ server.current_client = c;
+ enterExecutionUnit(1, 0);
+- processCommandAndResetClient(c);
++ if (processCommandAndResetClient(c) == C_ERR) {
++ /* Client was freed during command processing, exit immediately */
++ exitExecutionUnit();
++ server.current_client = old_client;
++ return;
++ }
++
+ if (!(c->flags & CLIENT_BLOCKED)) {
+ if (c->flags & CLIENT_MODULE) {
+ moduleCallCommandUnblockedHandler(c);
+diff --git a/tests/unit/client-eviction.tcl b/tests/unit/client-eviction.tcl
+index 3caaf9bd4..62e42580c 100644
+--- a/tests/unit/client-eviction.tcl
++++ b/tests/unit/client-eviction.tcl
+@@ -607,5 +607,34 @@ start_server {} {
+ }
+ }
+
++start_server {} {
++ r flushall
++ r client no-evict on
++ r config set maxmemory-clients 0
++
++ test "Verify blocked client eviction during unblock does not cause use-after-free" {
++ # Create a deferring client that will be blocked on stream
++ # Use a long stream name to make client memory usage exceed 200000 bytes
++ set rd [redis_deferring_client]
++ $rd XREAD BLOCK 0 STREAMS mystream stream_[string repeat x 200000] $ $
++
++ # Wait for the client to be blocked
++ wait_for_condition 50 100 {
++ [s blocked_clients] eq {1}
++ } else {
++ fail "Client was not blocked"
++ }
++
++ # Now lower MAXMEMORY-CLIENTS to a low value and use
++ # XADD to unblock the blocked client, triggering eviction.
++ r MULTI
++ r CONFIG SET MAXMEMORY-CLIENTS 100000 ;# Put in MULTI to defer blocked client eviction until after EXEC
++ r XADD mystream * field val
++ r EXEC
++ r PING
++ $rd close
++ }
++}
++
+ } ;# tags
+
@@ -16,6 +16,7 @@ SRC_URI = "http://download.redis.io/releases/${BP}.tar.gz \
file://0004-src-Do-not-reset-FINAL_LIBS.patch \
file://0005-Define-_GNU_SOURCE-to-get-PTHREAD_MUTEX_INITIALIZER.patch \
file://CVE-2026-81934.patch \
+ file://CVE-2026-23479.patch \
"
SRC_URI[sha256sum] = "6d0a9913887a4972536f9da226f1575859c34d86354129163260a5f9c6bd4229"
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/redis/redis/commit/c14e9925e571c3c8ecbeb8632fe834faa32175ea [2] https://nvd.nist.gov/vuln/detail/CVE-2026-23479 Signed-off-by: Yogita Urade <yurade@cisco.com> --- .../redis/redis-8.0.6/CVE-2026-23479.patch | 77 +++++++++++++++++++ meta-oe/recipes-extended/redis/redis_8.0.6.bb | 1 + 2 files changed, 78 insertions(+) create mode 100644 meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-23479.patch