diff --git a/openssh-9.9p1-copy-data-ext-self-copy.patch b/openssh-9.9p1-copy-data-ext-self-copy.patch
new file mode 100644
index 0000000..1fa43fc
--- /dev/null
+++ b/openssh-9.9p1-copy-data-ext-self-copy.patch
@@ -0,0 +1,51 @@
+diff --color -ruNp a/sftp-server.c b/sftp-server.c
+--- a/sftp-server.c	2026-07-17 16:23:12.293427062 +0200
++++ b/sftp-server.c	2026-07-17 16:29:01.480535500 +0200
+@@ -1625,6 +1625,7 @@ process_extended_copy_data(u_int32_t id)
+ 	u_int64_t len, read_off, read_len, write_off;
+ 	int r, copy_until_eof, status = SSH2_FX_OP_UNSUPPORTED;
+ 	size_t ret;
++	struct stat st_read, st_write;
+ 
+ 	if ((r = get_handle(iqueue, &read_handle)) != 0 ||
+ 	    (r = sshbuf_get_u64(iqueue, &read_off)) != 0 ||
+@@ -1647,12 +1648,35 @@ process_extended_copy_data(u_int32_t id)
+ 	} else
+ 		copy_until_eof = 0;
+ 
++	/* Disallow reading & writing to the same handle, path or inode */
+ 	read_fd = handle_to_fd(read_handle);
+ 	write_fd = handle_to_fd(write_handle);
+-
+-	/* Disallow reading & writing to the same handle or same path or dirs */
+-	if (read_handle == write_handle || read_fd < 0 || write_fd < 0 ||
+-	    !strcmp(handle_to_name(read_handle), handle_to_name(write_handle))) {
++	if (read_fd < 0 || write_fd < 0) {
++		error_f("bad read or write fd");
++		status = errno_to_portable(EBADF);
++		goto out;
++	}
++	if (fstat(read_fd, &st_read) != 0) {
++		status = errno_to_portable(errno);
++		error_f("fstat read_fd failed: %s", strerror(errno));
++		goto out;
++	}
++	if (fstat(write_fd, &st_write) != 0) {
++		status = errno_to_portable(errno);
++		error_f("fstat write_fd failed: %s", strerror(errno));
++		goto out;
++	}
++	if (read_handle == write_handle ||
++	    !strcmp(handle_to_name(read_handle), handle_to_name(write_handle)) ||
++	    (st_read.st_dev != 0 && st_read.st_ino != 0 &&
++	    st_read.st_dev == st_write.st_dev &&
++	    st_read.st_ino == st_write.st_ino)) {
++		error_f("refusing to read/write same file: "
++		    "read \"%s\" dev %lu ino %lu, write \"%s\" dev %lu ino %lu",
++		    handle_to_name(read_handle),
++		    (u_long)st_read.st_dev, (u_long)st_read.st_ino,
++		    handle_to_name(write_handle),
++		    (u_long)st_write.st_dev, (u_long)st_write.st_ino);
+ 		status = SSH2_FX_FAILURE;
+ 		goto out;
+ 	}
diff --git a/openssh.spec b/openssh.spec
index e61e5dc..1c8f56b 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -256,6 +256,9 @@ Patch1044: openssh-9.9p1-proxyjump-username-validity-checks.patch
 Patch1045: openssh-9.9p1-scp-remote-glob.patch
 # upstream e8bdfb151a356d0171fea4194dd205fbb252be23
 Patch1046: openssh-9.9p1-cve-2026-60002.patch
+# upstream 8b05bbeb293c5f777915e37e9ed43a06fb8e7614
+# upstream 5a5e47740b6466d58242aca28b9e584bab4ccf1d
+Patch1047: openssh-9.9p1-copy-data-ext-self-copy.patch
 
 License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
 Requires: /sbin/nologin
@@ -466,6 +469,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
 %patch -P 1044 -p1 -b .proxyjump-username-validity-checks
 %patch -P 1045 -p1 -b .scp-remote-glob
 %patch -P 1046 -p1 -b .cve-2026-60002
+%patch -P 1047 -p1 -b .copy-data-ext-self-copy
 
 %patch -P 100 -p1 -b .coverity
 
@@ -752,6 +756,8 @@ test -f %{sysconfig_anaconda} && \
   Resolves: RHEL-182151
 - Add default value for GSSAPIDelegateCredentials property in sshd_config manpage
   Resolves: RHEL-211135
+- Fix self-copy guard bypass in copy-data extension
+  Resolves: RHEL-191388
 
 * Fri Jun 26 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-27
 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during