From 5d355dc228bae3f9906a20fcb0991c3695ea5802 Mon Sep 17 00:00:00 2001
From: Zoltan Fridrich <zfridric@redhat.com>
Date: Tue, 25 Aug 2026 15:48:17 +0200
Subject: [PATCH] Fix CVE-2026-73282

Fix information disclosure and data corruption
via use-after-free in ssh client

Resolves: RHEL-248257

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
---
 openssh-8.0p1-CVE-2026-73282.patch | 51 ++++++++++++++++++++++++++++++
 openssh.spec                       | 10 +++++-
 2 files changed, 60 insertions(+), 1 deletion(-)
 create mode 100644 openssh-8.0p1-CVE-2026-73282.patch

diff --git a/openssh-8.0p1-CVE-2026-73282.patch b/openssh-8.0p1-CVE-2026-73282.patch
new file mode 100644
index 0000000..12afab8
--- /dev/null
+++ b/openssh-8.0p1-CVE-2026-73282.patch
@@ -0,0 +1,51 @@
+diff --color -ruNp a/ssh.c b/ssh.c
+--- a/ssh.c	2026-08-25 15:38:18.115917218 +0200
++++ b/ssh.c	2026-08-25 15:44:36.797255562 +0200
+@@ -1629,14 +1629,24 @@ fork_postauth(void)
+ 		fatal("daemon() failed: %.200s", strerror(errno));
+ }
+ 
++struct rfwd_confirm_ctx {
++	int fid;
++};
++
+ /* Callback for remote forward global requests */
+ static void
+ ssh_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt)
+ {
+-	struct Forward *rfwd = (struct Forward *)ctxt;
++	struct rfwd_confirm_ctx *rctx = (struct rfwd_confirm_ctx *)ctxt;
++	struct Forward *rfwd;
+ 	u_int port;
+ 	int r;
+ 
++	if (rctx->fid < 0 || rctx->fid >= options.num_remote_forwards)
++		fatal("%s: invalid forwarding ID %d", __func__, rctx->fid);
++	rfwd = &options.remote_forwards[rctx->fid];
++	freezero(rctx, sizeof(*rctx));
++
+ 	/* XXX verbose() on failure? */
+ 	debug("remote forward %s for: listen %s%s%d, connect %s:%d",
+ 	    type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
+@@ -1762,6 +1772,8 @@ ssh_init_forwarding(struct ssh *ssh, cha
+ 
+ 	/* Initiate remote TCP/IP port forwardings. */
+ 	for (i = 0; i < options.num_remote_forwards; i++) {
++		struct rfwd_confirm_ctx *rctx;
++
+ 		debug("Remote connections from %.200s:%d forwarded to "
+ 		    "local address %.200s:%d",
+ 		    (options.remote_forwards[i].listen_path != NULL) ?
+@@ -1783,9 +1795,10 @@ ssh_init_forwarding(struct ssh *ssh, cha
+ 				logit("Warning: Could not request remote "
+ 				    "forwarding.");
+ 		} else {
++			rctx = xcalloc(1, sizeof(*rctx));
++			rctx->fid = i;
+ 			client_register_global_confirm(
+-			    ssh_confirm_remote_forward,
+-			    &options.remote_forwards[i]);
++			    ssh_confirm_remote_forward, rctx);
+ 		}
+ 	}
+ 
diff --git a/openssh.spec b/openssh.spec
index 8a9e2f2..712a273 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -66,7 +66,7 @@
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
 %global openssh_ver 8.0p1
-%global openssh_rel 32
+%global openssh_rel 33
 %global pam_ssh_agent_ver 0.10.3
 %global pam_ssh_agent_rel 8
 
@@ -317,6 +317,8 @@ Patch1029: openssh-8.0p1-proxyjump-username-validity-checks.patch
 Patch1030: openssh-8.0p1-CVE-2026-59995.patch
 # upstream 8dfe7ed6e2fd988de08df508355a196b956b2753
 Patch1031: openssh-8.0p1-CVE-2026-59999.patch
+# upstream 9910d5ef53124ce1157d57bc11e222658aa41299
+Patch1032: openssh-8.0p1-CVE-2026-73282.patch
 
 License: BSD
 Group: Applications/Internet
@@ -575,6 +577,7 @@ popd
 %patch1029 -p1 -b .proxyjump-username-validity-checks
 %patch1030 -p1 -b .cve-2026-59995
 %patch1031 -p1 -b .cve-2026-59999
+%patch1032 -p1 -b .CVE-2026-73282
 
 autoreconf
 pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
@@ -860,6 +863,11 @@ getent passwd sshd >/dev/null || \
 %endif
 
 %changelog
+* Tue Aug 25 2026 Zoltan Fridrich <zfridric@redhat.com> - 8.0p1-33
+- CVE-2026-73282: Fix information disclosure and data corruption
+  via use-after-free in ssh client
+  Resolves: RHEL-248257
+
 * Thu Aug 20 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-32
 - Improve fix for CVE-2023-38408, avoid invoking constructors on dlopen()
   Related: RHEL-234763