[OE-core][wrynose][PATCH 04/10] openssh: Fix CVE-2026-106582

["Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" <hthakar@cisco.com>]

From: Hetvi Thakar <hthakar@cisco.com>

This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/openssh/openssh-portable/commit/1d5340fce24526719e32aebc4c721fc228182ace
[2] https://ubuntu.com/security/CVE-2026-106582

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 .../openssh/openssh/CVE-2026-106582.patch     | 97 +++++++++++++++++++
 .../openssh/openssh_10.3p1.bb                 |  1 +
 2 files changed, 98 insertions(+)
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106582.patch

diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106582.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106582.patch
new file mode 100644
index 0000000000..53c5cb6f47
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106582.patch
@@ -0,0 +1,97 @@
+From 1d5340fce24526719e32aebc4c721fc228182ace Mon Sep 17 00:00:00 2001
+From: "job@openbsd.org" <job@openbsd.org>
+Date: Tue, 22 Sep 2026 04:38:09 +0000
+Subject: [PATCH] upstream: Disable LZ77 dictionary coder to avoid a potential
+
+side-channel leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+A chosen-plaintext attack method exists which makes use of
+dictionary-based compression to recover secrets from one channel by
+interacting with the SSH session's shared compression dictionary through
+another channel.
+
+Attacker-controlled input can recognizably reflect into the total length
+of transmitted ciphertexts by virtue of LZ77 replacing repeated strings
+with back-references into the SSH session's encoder search buffer,
+which is shared across all channels. For this reason, the documentation
+already recommended against enabling compression for connections that
+share trusted and untrusted traffic.
+
+As an extra precaution, use only Huffman coding when compressing
+plaintexts, as this algorithm does not use a dictionary. But, this
+results in a reduction of compression effectiveness.
+
+Inspired by "Crossing the Streams: SSH Plaintext Recovery via a Common
+Compression Context in Multiplexed Channels." by Fabian Bäumer and
+Marcus Brinkmann, preprint https://arxiv.org/abs/2609.07709 (2026)
+
+OK djm@ dtucker@
+
+OpenBSD-Commit-ID: 839e5e53ad76786d0e90bed530304e4e13acbba0
+
+CVE: CVE-2026-106582
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/1d5340fce24526719e32aebc4c721fc228182ace]
+
+Backport Changes:
+- Omitted the upstream packet.c OpenBSD revision-only hunk and retained
+  the Wrynose OpenSSH 10.3p1 revision.
+
+(cherry picked from commit 1d5340fce24526719e32aebc4c721fc228182ace)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ packet.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/packet.c b/packet.c
+--- a/packet.c
++++ b/packet.c
+@@ -802,13 +802,12 @@ ssh_packet_init_compression(struct ssh *ssh)
+ #ifdef WITH_ZLIB
+ static int
+-start_compression_out(struct ssh *ssh, int level)
++start_compression_out(struct ssh *ssh)
+ {
+-	if (level < 1 || level > 9)
+-		return SSH_ERR_INVALID_ARGUMENT;
+-	debug("Enabling compression at level %d.", level);
++	debug("Enabling compression.");
+ 	if (ssh->state->compression_out_started == 1)
+ 		deflateEnd(&ssh->state->compression_out_stream);
+-	switch (deflateInit(&ssh->state->compression_out_stream, level)) {
++	switch (deflateInit2(&ssh->state->compression_out_stream,
++	    Z_BEST_SPEED, Z_DEFLATED, 15, 8, Z_HUFFMAN_ONLY)) {
+ 	case Z_OK:
+ 		ssh->state->compression_out_started = 1;
+ 		break;
+@@ -934,7 +933,7 @@ uncompress_buffer(struct ssh *ssh, struct sshbuf *in, struct sshbuf *out)
+ #else	/* WITH_ZLIB */
+ 
+ static int
+-start_compression_out(struct ssh *ssh, int level)
++start_compression_out(struct ssh *ssh)
+ {
+ 	return SSH_ERR_INTERNAL_ERROR;
+ }
+@@ -1040,7 +1039,7 @@ ssh_set_newkeys(struct ssh *ssh, int mode)
+ 		if ((r = ssh_packet_init_compression(ssh)) < 0)
+ 			return r;
+ 		if (mode == MODE_OUT) {
+-			if ((r = start_compression_out(ssh, 6)) != 0)
++			if ((r = start_compression_out(ssh)) != 0)
+ 				return r;
+ 		} else {
+ 			if ((r = start_compression_in(ssh)) != 0)
+@@ -1185,7 +1184,7 @@ ssh_packet_enable_delayed_compress(struct ssh *ssh)
+ 			if ((r = ssh_packet_init_compression(ssh)) != 0)
+ 				return r;
+ 			if (mode == MODE_OUT) {
+-				if ((r = start_compression_out(ssh, 6)) != 0)
++				if ((r = start_compression_out(ssh)) != 0)
+ 					return r;
+ 			} else {
+ 				if ((r = start_compression_in(ssh)) != 0)
+-- 
+2.43.0
diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index a70ca30b15..129c62090f 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -39,6 +39,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
            file://CVE-2026-106586_p2.patch \
            file://CVE-2026-106586_p3.patch \
            file://CVE-2026-106587.patch \
+           file://CVE-2026-106582.patch \
            "
 SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"
 
-- 
2.35.6