From 06d27e63589df1d4a1463d8b66d7d314d4c30888 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 6 May 2026 10:52:09 +0200
Subject: [PATCH] Verify rdlen field in RRSIG packets (CVE-2026-4891)

Resolves-Vulnerability: CVE-2026-4891
Resolves: RHEL-168309
---
 dnsmasq-2.93-CVE-2026-4891.patch | 39 ++++++++++++++++++++++++++++++++
 dnsmasq.spec                     |  2 ++
 2 files changed, 41 insertions(+)
 create mode 100644 dnsmasq-2.93-CVE-2026-4891.patch

diff --git a/dnsmasq-2.93-CVE-2026-4891.patch b/dnsmasq-2.93-CVE-2026-4891.patch
new file mode 100644
index 0000000..3be3dad
--- /dev/null
+++ b/dnsmasq-2.93-CVE-2026-4891.patch
@@ -0,0 +1,39 @@
+From 2efe6d3acaf840fa06d58b6fad21ad73d0865716 Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Wed, 25 Mar 2026 23:04:08 +0000
+Subject: [PATCH 3/5] Verify rdlen field in RRSIG packets. CVE-2026-4891
+
+Bug report from Royce M <royce@xchglabs.com>
+
+This avoids crafted packets which give a value for rdlen _less_
+then the space taken up by the fixed data and the signer's name
+and engender a negative calculated length for the signature.
+---
+ src/dnssec.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/src/dnssec.c b/src/dnssec.c
+index 68f1b5d..d32db5b 100644
+--- a/src/dnssec.c
++++ b/src/dnssec.c
+@@ -546,10 +546,14 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in
+ 
+ 	   *ttl_out = ttl;
+ 	 }
+-       
++
++      /* Don't trust rdlen not to be too small and give us a negative sig_len
++	 It has already been checked that it doesn't run us off the end
++	 of the packet. */
++      if ((sig_len = rdlen - (p - psav)) <= 0)
++	return STAT_BOGUS;
++
+       sig = p;
+-      sig_len = rdlen - (p - psav);
+-              
+       nsigttl = htonl(orig_ttl);
+       
+       hash->update(ctx, 18, psav);
+-- 
+2.54.0
+
diff --git a/dnsmasq.spec b/dnsmasq.spec
index fdb3137..78d38c8 100644
--- a/dnsmasq.spec
+++ b/dnsmasq.spec
@@ -81,6 +81,7 @@ Patch18:        dnsmasq-2.87-filter-AAAA.patch
 Patch19:        dnsmasq-2.89-filter-AAAA-improve.patch
 Patch20:        dnsmasq-2.93-CVE-2026-2291.patch
 Patch21:        dnsmasq-2.93-CVE-2026-4890.patch
+Patch22:        dnsmasq-2.93-CVE-2026-4891.patch
 
 # This is workaround to nettle bug #1549190
 # https://bugzilla.redhat.com/show_bug.cgi?id=1549190
@@ -231,6 +232,7 @@ install -Dpm 644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/%{name}.conf
 * Tue May 05 2026 Petr Menšík <pemensik@redhat.com> - 2.85-19
 - Prevent overflow in extract_name function (CVE-2026-2291)
 - Prevent DoS in DNSSEC validation (CVE-2026-4890)
+- Prevent out-of-bounds read in DNSSEC validation (CVE-2026-4891)
 
 * Thu Dec 11 2025 Fedor Vorobev <fvorobev@redhat.com> - 2.85-18
 - Added installation of tmpfiles config.