From 137dded1ef31879e6476821d42a1323d09f0021d Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <dbelyavs@redhat.com>
Date: Wed, 12 Aug 2026 13:30:43 +0200
Subject: [PATCH] Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to
 incorrect

...handling of forwarding and tunneling options

Resolves: RHEL-236284
---
 openssh-10.4p1-CVE-2026-59999.patch | 14 ++++++++++++++
 openssh.spec                        |  8 ++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 openssh-10.4p1-CVE-2026-59999.patch

diff --git a/openssh-10.4p1-CVE-2026-59999.patch b/openssh-10.4p1-CVE-2026-59999.patch
new file mode 100644
index 0000000..67b203e
--- /dev/null
+++ b/openssh-10.4p1-CVE-2026-59999.patch
@@ -0,0 +1,14 @@
+diff --git a/serverloop.c b/serverloop.c
+index 8a6e3db80..9d8a3429e 100644
+--- a/serverloop.c
++++ b/serverloop.c
+@@ -523,7 +523,8 @@ server_request_tun(struct ssh *ssh)
+ 		ssh_packet_send_debug(ssh, "Unsupported tunnel device mode.");
+ 		return NULL;
+ 	}
+-	if ((options.permit_tun & mode) == 0) {
++	if ((options.permit_tun & mode) == 0 || options.disable_forwarding ||
++	    auth_opts->restricted) {
+ 		ssh_packet_send_debug(ssh, "Server has rejected tunnel device "
+ 		    "forwarding");
+ 		return NULL;
diff --git a/openssh.spec b/openssh.spec
index 5ad348c..5447cbf 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -271,6 +271,10 @@ Patch1047: openssh-9.9p1-cve-2026-60002.patch
 Patch1048: openssh-9.9p1-maxstartups-mistracking.patch
 # upstream 6a57081dc35acf3ee298108d4bc3580489608d5f
 Patch1049: openssh-10.4p1-CVE-2026-59995.patch
+# upstream 8dfe7ed6e2fd988de08df508355a196b956b2753
+# upstream d322f2ccf7da095ce94d1d99cb563246f61487b0
+# combines CVE-2026-59999 and CVE-2026-73283
+Patch1050: openssh-10.4p1-CVE-2026-59999.patch
 
 
 License: BSD
@@ -495,6 +499,7 @@ popd
 %patch1047 -p1 -b .cve-2026-60002
 %patch1048 -p1 -b .maxstartups-mistracking
 %patch1049 -p1 -b .CVE-2026-59995
+%patch1050 -p1 -b .CVE-2026-59999
 
 %patch100 -p1 -b .coverity
 
@@ -789,6 +794,9 @@ test -f %{sysconfig_anaconda} && \
 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded
   file location
   Resolves: RHEL-236326
+- Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect
+  handling of forwarding and tunneling options
+  Resolves: RHEL-236284
 
 * Thu Jul 30 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-11
 - Fix mistracking of MaxStartups process exits in some situations