Backport upstream commit c57695da31 ("Make the dns_slabheaders
in the cache reference counted") to fix CVE-2026-11622, a
use-after-free vulnerability in the DNS cache.
The patch adds reference counting to dns_slabheaders so stale
headers can be safely reclaimed independently of their enclosing
node. It modifies core cache code (rbtdb.c, rdataslab.h) and
updates the reclimit system test. Four hunks required manual
conflict resolution due to downstream PKCS11-related differences.
CVE: CVE-2026-11622
Upstream patches:
- c57695da31.patch
Resolves: RHEL-213396
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
