From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" <hthakar@cisco.com>
To: openembedded-core@lists.openembedded.org
Cc: xe-linux-external@cisco.com
Subject: [OE-core][wrynose][PATCH 02/10] openssh: Fix CVE-2026-106586
Date: Thu, 15 Oct 2026 20:52:28 -0700 [thread overview]
Message-ID: <20261016035236.442896-3-hthakar@cisco.com> (raw)
In-Reply-To: <20261016035236.442896-1-hthakar@cisco.com>
From: Hetvi Thakar <hthakar@cisco.com>
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].
[1] https://github.com/openssh/openssh-portable/commit/991f1f31dde2797416acaf4319dbebe764446c6f
[2] https://ubuntu.com/security/CVE-2026-106586
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
.../openssh/openssh/CVE-2026-106586_p1.patch | 39 +++++++
.../openssh/openssh/CVE-2026-106586_p2.patch | 101 ++++++++++++++++++
.../openssh/openssh/CVE-2026-106586_p3.patch | 39 +++++++
.../openssh/openssh_10.3p1.bb | 3 +
4 files changed, 182 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p1.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p2.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p3.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p1.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p1.patch
new file mode 100644
index 0000000000..a694424cf4
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p1.patch
@@ -0,0 +1,39 @@
+From 991f1f31dde2797416acaf4319dbebe764446c6f Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 16 Sep 2026 00:33:44 +0000
+Subject: [PATCH] upstream: Propagate authorized_keys "resrict" keyword
+
+The "restrict" keyword was not pervasively being applied to TunnelForwarding
+connections (which are administratively disabled by default). This is a
+separate problem to the one fixed in openssh-10.5
+
+reported by several people; ok markus, deraadt
+
+OpenBSD-Commit-ID: 8c36c31dc2bdbc0c432d1056496b2f1ce93198d1
+
+CVE: CVE-2026-106586
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/991f1f31dde2797416acaf4319dbebe764446c6f]
+
+Backport Changes:
+- Omitted the upstream OpenBSD revision-only hunk and retained the
+ Wrynose OpenSSH 10.3p1 revision.
+
+(cherry picked from commit 991f1f31dde2797416acaf4319dbebe764446c6f)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ auth-options.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/auth-options.c b/auth-options.c
+--- a/auth-options.c
++++ b/auth-options.c
+@@ -604,6 +604,7 @@ sshauthopt_merge(const struct sshauthopt *primary,
+ OPTFLAG_AND(no_require_user_presence);
+ /* Restrictive flags are logical-OR (i.e. must be set in either) */
+ OPTFLAG_OR(require_verify);
++ OPTFLAG_OR(restricted);
+ #undef OPTFLAG_AND
+
+ /* Earliest expiry time should win */
+--
+2.43.0
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p2.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p2.patch
new file mode 100644
index 0000000000..10a2abe497
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p2.patch
@@ -0,0 +1,101 @@
+From ded92bffa2e2f2db9b83245c5061812791bfa47f Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 16 Sep 2026 04:51:28 +0000
+Subject: [PATCH] upstream: correctly check sshauthopt->restricted merging
+
+OpenBSD-Regress-ID: e81e9267514338d6cf6bd2f83dcb722538af528e
+
+CVE: CVE-2026-106586
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/ded92bffa2e2f2db9b83245c5061812791bfa47f]
+
+Backport Changes:
+- Omitted the upstream tests.c OpenBSD revision-only hunk and retained
+ the Wrynose OpenSSH 10.3p1 revision.
+
+(cherry picked from commit ded92bffa2e2f2db9b83245c5061812791bfa47f)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ regress/unittests/authopt/tests.c | 41 +++++++++++++++++++++--------------------
+ 1 file changed, 21 insertions(+), 20 deletions(-)
+
+diff --git a/regress/unittests/authopt/tests.c b/regress/unittests/authopt/tests.c
+--- a/regress/unittests/authopt/tests.c
++++ b/regress/unittests/authopt/tests.c
+@@ -418,13 +418,14 @@ test_merge(void)
+ } while (0)
+
+ /* Check a single case of merging of flag options */
+-#define FLAG_CASE(keybase, label, keyname, keywords, mostly_off, var, val) \
++#define FLAG_CASE(keybase, label, keyname, keywords, mostly_off, \
++ rflag, var, val) \
+ do { \
+ PREPARE(keybase " " label, keyname, keywords); \
+- expected = mostly_off ? \
+- sshauthopt_new() : default_authkey_opts(); \
+- expected->var = val; \
++ expected = rflag ? default_authkey_restrict_opts() : \
++ (mostly_off ? sshauthopt_new() : default_authkey_opts()); \
+ ASSERT_PTR_NE(expected, NULL); \
++ expected->var = val; \
+ CHECK_SUCCESS_AND_CLEANUP(); \
+ TEST_DONE(); \
+ } while (0)
+@@ -437,40 +438,40 @@ test_merge(void)
+ #define FLAG_TEST(keybase, keyword, var) \
+ do { \
+ FLAG_CASE(keybase, "keys:default,yes cert:default,no", \
+- "no_" keybase, keyword, 0, var, 0); \
++ "no_" keybase, keyword, 0, 0, var, 0); \
+ FLAG_CASE(keybase,"keys:-*,yes cert:default,no", \
+- "no_" keybase, "restrict," keyword, 1, var, 0); \
++ "no_" keybase, "restrict," keyword, 1, 1, var, 0); \
+ FLAG_CASE(keybase, "keys:default,no cert:default,no", \
+- "no_" keybase, "no-" keyword, 0, var, 0); \
++ "no_" keybase, "no-" keyword, 0, 0, var, 0); \
+ FLAG_CASE(keybase, "keys:-*,no cert:default,no", \
+- "no_" keybase, "restrict,no-" keyword, 1, var, 0); \
++ "no_" keybase, "restrict,no-" keyword, 1, 1, var, 0); \
+ \
+ FLAG_CASE(keybase, "keys:default,yes cert:-*,yes", \
+- "only_" keybase, keyword, 1, var, 1); \
++ "only_" keybase, keyword, 1, 0, var, 1); \
+ FLAG_CASE(keybase,"keys:-*,yes cert:-*,yes", \
+- "only_" keybase, "restrict," keyword, 1, var, 1); \
++ "only_" keybase, "restrict," keyword, 1, 1, var, 1); \
+ FLAG_CASE(keybase, "keys:default,no cert:-*,yes", \
+- "only_" keybase, "no-" keyword, 1, var, 0); \
++ "only_" keybase, "no-" keyword, 1, 0, var, 0); \
+ FLAG_CASE(keybase, "keys:-*,no cert:-*,yes", \
+- "only_" keybase, "restrict,no-" keyword, 1, var, 0); \
++ "only_" keybase, "restrict,no-" keyword, 1, 1, var, 0); \
+ \
+ FLAG_CASE(keybase, "keys:default,yes cert:-*", \
+- "no_permit", keyword, 1, var, 0); \
++ "no_permit", keyword, 1, 0, var, 0); \
+ FLAG_CASE(keybase,"keys:-*,yes cert:-*", \
+- "no_permit", "restrict," keyword, 1, var, 0); \
++ "no_permit", "restrict," keyword, 1, 1, var, 0); \
+ FLAG_CASE(keybase, "keys:default,no cert:-*", \
+- "no_permit", "no-" keyword, 1, var, 0); \
++ "no_permit", "no-" keyword, 1, 0, var, 0); \
+ FLAG_CASE(keybase, "keys:-*,no cert:-*", \
+- "no_permit", "restrict,no-" keyword, 1, var, 0); \
++ "no_permit", "restrict,no-" keyword, 1, 1, var, 0); \
+ \
+ FLAG_CASE(keybase, "keys:default,yes cert:*", \
+- "all_permit", keyword, 0, var, 1); \
++ "all_permit", keyword, 0, 0, var, 1); \
+ FLAG_CASE(keybase,"keys:-*,yes cert:*", \
+- "all_permit", "restrict," keyword, 1, var, 1); \
++ "all_permit", "restrict," keyword, 1, 1, var, 1); \
+ FLAG_CASE(keybase, "keys:default,no cert:*", \
+- "all_permit", "no-" keyword, 0, var, 0); \
++ "all_permit", "no-" keyword, 0, 0, var, 0); \
+ FLAG_CASE(keybase, "keys:-*,no cert:*", \
+- "all_permit", "restrict,no-" keyword, 1, var, 0); \
++ "all_permit", "restrict,no-" keyword, 1, 1, var, 0); \
+ \
+ } while (0)
+ FLAG_TEST("portfwd", "port-forwarding", permit_port_forwarding_flag);
+--
+2.43.0
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p3.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p3.patch
new file mode 100644
index 0000000000..6defa83ec6
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p3.patch
@@ -0,0 +1,39 @@
+From a30bafcbbd44dc4dc91916240c32ecabff899338 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 16 Sep 2026 04:56:12 +0000
+Subject: [PATCH] upstream: simpler
+
+OpenBSD-Regress-ID: c7f30b865abd0b3e0e5514f861509c32e352a760
+
+CVE: CVE-2026-106586
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/a30bafcbbd44dc4dc91916240c32ecabff899338]
+
+Backport Changes:
+- Omitted the upstream tests.c OpenBSD revision-only hunk and retained
+ the Wrynose OpenSSH 10.3p1 revision.
+
+(cherry picked from commit a30bafcbbd44dc4dc91916240c32ecabff899338)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ regress/unittests/authopt/tests.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/regress/unittests/authopt/tests.c b/regress/unittests/authopt/tests.c
+--- a/regress/unittests/authopt/tests.c
++++ b/regress/unittests/authopt/tests.c
+@@ -422,10 +422,11 @@ test_merge(void)
+ rflag, var, val) \
+ do { \
+ PREPARE(keybase " " label, keyname, keywords); \
+- expected = rflag ? default_authkey_restrict_opts() : \
+- (mostly_off ? sshauthopt_new() : default_authkey_opts()); \
++ expected = mostly_off ? \
++ sshauthopt_new() : default_authkey_opts(); \
+ ASSERT_PTR_NE(expected, NULL); \
++ expected->restricted = rflag; \
+ expected->var = val; \
+ CHECK_SUCCESS_AND_CLEANUP(); \
+ TEST_DONE(); \
+ } while (0)
+--
+2.43.0
diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index aceaa6420f..7760dae931 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -35,6 +35,9 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://CVE-2026-73282.patch \
file://CVE-2026-73281.patch \
file://CVE-2026-106584.patch \
+ file://CVE-2026-106586_p1.patch \
+ file://CVE-2026-106586_p2.patch \
+ file://CVE-2026-106586_p3.patch \
"
SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"
--
2.35.6
next prev parent reply other threads:[~2026-10-16 3:52 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-16 3:52 [OE-core][wrynose][PATCH 00/10] openssh: Security fixes Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-16 3:52 ` [OE-core][wrynose][PATCH 01/10] openssh: Fix CVE-2026-106584 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-19 18:44 ` Yoann Congal
2026-11-06 11:00 ` Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-11-09 14:30 ` Yoann Congal
2026-10-16 3:52 ` Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) [this message]
2026-10-16 3:52 ` [OE-core][wrynose][PATCH 03/10] openssh: Fix CVE-2026-106587 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-16 3:52 ` [OE-core][wrynose][PATCH 04/10] openssh: Fix CVE-2026-106582 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-16 3:52 ` [OE-core][wrynose][PATCH 05/10] openssh: Fix CVE-2026-106585 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-16 3:52 ` [OE-core][wrynose][PATCH 06/10] openssh: Ignore CVE-2026-106588 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-16 3:52 ` [OE-core][wrynose][PATCH 07/10] openssh: Ignore CVE-2026-106589 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-16 3:52 ` [OE-core][wrynose][PATCH 08/10] openssh: Fix CVE-2026-106583 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-16 3:52 ` [OE-core][wrynose][PATCH 09/10] openssh: Fix CVE-2026-106552 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-16 3:52 ` [OE-core][wrynose][PATCH 10/10] openssh: Fix CVE-2026-106553 and CVE-2026-106555 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261016035236.442896-3-hthakar@cisco.com \
--to=hthakar@cisco.com \
--cc=openembedded-core@lists.openembedded.org \
--cc=xe-linux-external@cisco.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox