From 5dc3c53a895d60ce91182c2c40cde4bf83de7c4e Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <dbelyavs@redhat.com>
Date: Wed, 12 Aug 2026 13:30:43 +0200
Subject: [PATCH] Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to
 incorrect

...handling of forwarding and tunneling options

Resolves: RHEL-236275
---
 openssh-10.4p1-CVE-2026-59999.patch | 14 ++++++++++++++
 openssh.spec                        |  8 ++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 openssh-10.4p1-CVE-2026-59999.patch

diff --git a/openssh-10.4p1-CVE-2026-59999.patch b/openssh-10.4p1-CVE-2026-59999.patch
new file mode 100644
index 0000000..67b203e
--- /dev/null
+++ b/openssh-10.4p1-CVE-2026-59999.patch
@@ -0,0 +1,14 @@
+diff --git a/serverloop.c b/serverloop.c
+index 8a6e3db80..9d8a3429e 100644
+--- a/serverloop.c
++++ b/serverloop.c
+@@ -523,7 +523,8 @@ server_request_tun(struct ssh *ssh)
+ 		ssh_packet_send_debug(ssh, "Unsupported tunnel device mode.");
+ 		return NULL;
+ 	}
+-	if ((options.permit_tun & mode) == 0) {
++	if ((options.permit_tun & mode) == 0 || options.disable_forwarding ||
++	    auth_opts->restricted) {
+ 		ssh_packet_send_debug(ssh, "Server has rejected tunnel device "
+ 		    "forwarding");
+ 		return NULL;
diff --git a/openssh.spec b/openssh.spec
index adc8b18..d7552cd 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -261,6 +261,10 @@ Patch1046: openssh-9.9p1-cve-2026-60002.patch
 Patch1047: openssh-9.9p1-copy-data-ext-self-copy.patch
 # upstream 6a57081dc35acf3ee298108d4bc3580489608d5f
 Patch1048: openssh-10.4p1-CVE-2026-59995.patch
+# upstream 8dfe7ed6e2fd988de08df508355a196b956b2753
+# upstream d322f2ccf7da095ce94d1d99cb563246f61487b0
+# combines CVE-2026-59999 and CVE-2026-73283
+Patch1049: openssh-10.4p1-CVE-2026-59999.patch
 
 License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
 Requires: /sbin/nologin
@@ -473,6 +477,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
 %patch -P 1046 -p1 -b .cve-2026-60002
 %patch -P 1047 -p1 -b .copy-data-ext-self-copy
 %patch -P 1048 -p1 -b .CVE-2026-59995
+%patch -P 1049 -p1 -b .CVE-2026-59999
 
 %patch -P 100 -p1 -b .coverity
 
@@ -757,6 +762,9 @@ test -f %{sysconfig_anaconda} && \
 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded
   file location
   Resolves: RHEL-236323
+- Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect
+  handling of forwarding and tunneling options
+  Resolves: RHEL-236275
 
 * Thu Jul 16 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-28
 - Fix GSSAPI indicators check ignoring subsequent deny rules if