Backport upstream commit 231b1ca3 to fix CVE-2026-11622 by
making dns_slabheaders in the cache reference counted.
Instead of only reference counting the enclosing node, reference
counting is added directly to slabheaders. This allows stale
slabheaders to be reclaimed as soon as their own reference count
reaches zero, rather than waiting for the whole node to become
unreferenced.
The patch (bind-9.18-CVE-2026-11622.patch) was cherry-picked
from upstream and adapted for the bind 9.18.33 codebase, added
as Patch232.
CVE: CVE-2026-11622
Upstream patches:
- 231b1ca3ed.patch
Resolves: RHEL-213384
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
