Backport upstream commit 0b72e907d1 to bind-9.11.36 to fix
CVE-2026-11622. The patch adds reference counting to
dns_slabheaders in the cache (rbtdb.c) so that stale headers
can be reclaimed as soon as their own reference count reaches
zero, and adds the required isc/refcount.h include to
rdataslab.h. Three hunks required manual adaptation for the
RHEL 8 codebase which uses mark_header_ancient instead of
upstream's mark_stale_header.
CVE: CVE-2026-11622
Upstream patches:
- 0b72e907d1.patch
Resolves: RHEL-213379
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
