From 2b2dad066dbee0077e1214a8ec40386fc39f44f3 Mon Sep 17 00:00:00 2001
From: Jakub Jelen <jjelen@redhat.com>
Date: Wed, 1 Jul 2026 16:43:08 +0200
Subject: [PATCH 12/12] CVE-2026-59850 channels: Avoid processing DATA packets
 on closed channels
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Pavol Žáčik <pzacik@redhat.com>
(cherry picked from commit a8a3fa352bb5213e08a35e4494c6e44360e2e38a)
---
 src/channels.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/channels.c b/src/channels.c
index 2b84352f..1c86fde8 100644
--- a/src/channels.c
+++ b/src/channels.c
@@ -590,6 +590,13 @@ SSH_PACKET_CALLBACK(channel_rcv_data){
     return SSH_PACKET_USED;
   }
 
+  if (channel->flags & SSH_CHANNEL_FLAG_CLOSED_REMOTE) {
+    SSH_LOG(SSH_LOG_WARNING, "Received data on (remotely) closed channel");
+    ssh_set_error(session, SSH_FATAL, "Received data on (remotely) closed channel");
+    SSH_STRING_FREE(str);
+    return SSH_PACKET_USED;
+  }
+
   if (len <= channel->local_window) {
     channel->local_window -= len;
   } else {
-- 
2.54.0