diff --git a/recipes-security/selinux/selinux-sandbox/CVE-2026-59677.patch b/recipes-security/selinux/selinux-sandbox/CVE-2026-59677.patch
new file mode 100644
index 0000000..b4ab16f
--- /dev/null
+++ b/recipes-security/selinux/selinux-sandbox/CVE-2026-59677.patch
@@ -0,0 +1,114 @@
+From 572db2fae9157ae620160e0d7b2c3f8b75fe6c1a Mon Sep 17 00:00:00 2001
+From: Stephen Smalley <stephen.smalley.work@gmail.com>
+Date: Thu, 21 May 2026 11:54:44 -0400
+Subject: [PATCH] sandbox/seunshare: drop -k/--kill support
+
+Drop the -k/--kill support; it is fundamentally racy, redundant
+with killall -Z, and seemingly unused by sandbox itself.
+Provide an error message to the user telling them how to achieve
+the same effect via killall.
+
+CVE: CVE-2026-59677
+Upstream-Status: Backport [https://github.com/SELinuxProject/selinux/commit/572db2fae9157ae620160e0d7b2c3f8b75fe6c1a]
+
+Backport Changes:
+- Remove the older 3.10 killall() body, which predates the upstream
+  NULL-context checks, PID-table overflow checks, SELinux type
+  matching and conditional logging.
+
+Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+(cherry picked from commit 572db2fae9157ae620160e0d7b2c3f8b75fe6c1a)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ sandbox/seunshare.c | 69 +----------------------------------------------------
+ 1 file changed, 1 insertion(+), 68 deletions(-)
+
+diff --git a/sandbox/seunshare.c b/sandbox/seunshare.c
+index 4e441b3c..02fdd599 100644
+--- a/sandbox/seunshare.c
++++ b/sandbox/seunshare.c
+@@ -656,73 +656,6 @@ good:
+ 	return tmpdir;
+ }
+ 
+-#define PROC_BASE "/proc"
+-
+-static int
+-killall (const char *execcon)
+-{
+-	DIR *dir;
+-	char *scon;
+-	struct dirent *de;
+-	pid_t *pid_table, pid, self;
+-	int i;
+-	int pids, max_pids;
+-	int running = 0;
+-	self = getpid();
+-	if (!(dir = opendir(PROC_BASE))) {
+-		return -1;
+-	}
+-	max_pids = 256;
+-	pid_table = malloc(max_pids * sizeof (pid_t));
+-	if (!pid_table) {
+-		(void)closedir(dir);
+-		return -1;
+-	}
+-	pids = 0;
+-	context_t con;
+-	con = context_new(execcon);
+-	const char *mcs = context_range_get(con);
+-	printf("mcs=%s\n", mcs);
+-	while ((de = readdir (dir)) != NULL) {
+-		if (!(pid = (pid_t)atoi(de->d_name)) || pid == self)
+-			continue;
+-
+-		if (pids == max_pids) {
+-			pid_t *new_pid_table = realloc(pid_table, 2*pids*sizeof(pid_t));
+-			if (!new_pid_table) {
+-				free(pid_table);
+-				(void)closedir(dir);
+-				return -1;
+-			}
+-			pid_table = new_pid_table;
+-			max_pids *= 2;
+-		}
+-		pid_table[pids++] = pid;
+-	}
+-
+-	(void)closedir(dir);
+-
+-	for (i = 0; i < pids; i++) {
+-		pid_t id = pid_table[i];
+-
+-		if (getpidcon(id, &scon) == 0) {
+-
+-			context_t pidcon = context_new(scon);
+-			/* Attempt to kill remaining processes */
+-			if (strcmp(context_range_get(pidcon), mcs) == 0)
+-				kill(id, SIGKILL);
+-
+-			context_free(pidcon);
+-			freecon(scon);
+-		}
+-		running++;
+-	}
+-
+-	context_free(con);
+-	free(pid_table);
+-	return running;
+-}
+-
+ int main(int argc, char **argv) {
+ 	int status = -1;
+ 	const char *execcon = NULL;
+@@ -1076,7 +1009,7 @@ childerr:
+ 	kill(-child,SIGTERM);
+ 
+ 	if (execcon && kill_all)
+-		killall(execcon);
++		fprintf(stderr, "-k/--kill no longer supported; run killall -Z %s\n", execcon);
+ 
+ 	if (tmpdir_r) cleanup_tmpdir(tmpdir_r, tmpdir_s, pwd, 1);
+ 
+-- 
+2.35.6
diff --git a/recipes-security/selinux/selinux-sandbox_3.10.bb b/recipes-security/selinux/selinux-sandbox_3.10.bb
index f8ffd36..6227daf 100644
--- a/recipes-security/selinux/selinux-sandbox_3.10.bb
+++ b/recipes-security/selinux/selinux-sandbox_3.10.bb
@@ -11,6 +11,7 @@ require selinux_common.inc
 
 SRC_URI += "file://sandbox-de-bashify.patch;patchdir=.. \
             file://CVE-2026-59676.patch;patchdir=.. \
+            file://CVE-2026-59677.patch;patchdir=.. \
            "
 
 S = "${UNPACKDIR}/${BP}/sandbox"