[OE-core][scarthgap][PATCH 5/6] curl: Fix CVE-2026-9547

["Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" <devanshp@cisco.com>]

From: Devansh Patel <devanshp@cisco.com>

This patch applies the upstream fix as referenced in [2], using
the commit shown in [1]. Backporting it also protects downstream
configurations that enable the libssh backend.

[1] https://github.com/curl/curl/commit/0b8dbbc63c98777e4584cb9fbd71df3464008ad1
[2] https://curl.se/docs/CVE-2026-9547.html

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 .../curl/curl/CVE-2026-9547.patch             | 33 +++++++++++++++++++
 meta/recipes-support/curl/curl_8.7.1.bb       |  1 +
 2 files changed, 34 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-9547.patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-9547.patch b/meta/recipes-support/curl/curl/CVE-2026-9547.patch
new file mode 100644
index 0000000000..992ed21e4c
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-9547.patch
@@ -0,0 +1,33 @@
+From 3f73b2318b9e6358e33519fa49dc3e022aa28c41 Mon Sep 17 00:00:00 2001
+From: Joshua Rogers <MegaManSec@users.noreply.github.com>
+Date: Fri, 22 May 2026 09:48:15 +0200
+Subject: [PATCH] libssh: map SSH_KNOWN_HOSTS_OTHER to CURLKHMATCH_MISMATCH
+
+Host key type mismatch from libssh was incorrectly reported as missing,
+causing key callbacks to accept instead of reject.
+
+Reported by: Joshua Rogers (Aisle Research)
+Closes #21724
+
+CVE: CVE-2026-9547
+Upstream-Status: Backport [https://github.com/curl/curl/commit/0b8dbbc63c98777e4584cb9fbd71df3464008ad1]
+
+(cherry picked from commit 0b8dbbc63c98777e4584cb9fbd71df3464008ad1)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ lib/vssh/libssh.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/vssh/libssh.c b/lib/vssh/libssh.c
+index 39067a1db6..00dae896bb 100644
+--- a/lib/vssh/libssh.c
++++ b/lib/vssh/libssh.c
+@@ -439,6 +439,8 @@ static int myssh_is_known(struct Curl_easy *data)
+       keymatch = CURLKHMATCH_OK;
+       break;
+     case SSH_KNOWN_HOSTS_OTHER:
++      keymatch = CURLKHMATCH_MISMATCH;
++      break;
+     case SSH_KNOWN_HOSTS_NOT_FOUND:
+     case SSH_KNOWN_HOSTS_UNKNOWN:
+     case SSH_KNOWN_HOSTS_ERROR:
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 6a2c44365b..e9ba10cb97 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -46,6 +46,7 @@ SRC_URI = " \
     file://CVE-2026-8927-dependent.patch \
     file://CVE-2026-8927.patch \
     file://CVE-2026-8932.patch \
+    file://CVE-2026-9547.patch \
 "
 
 SRC_URI:append:class-nativesdk = " \
-- 
2.35.6