[rpms/openssh] rawhide: Fix CVE-2026-55655

[rpms/openssh] rawhide: Fix CVE-2026-55655

[Zoltan Fridrich]

            A new commit has been pushed.

            Repo   : rpms/openssh
            Branch : rawhide
            Commit : fdea50ab12e005f274ff8e4aa6f1210730e866f8
            Author : Zoltan Fridrich <zfridric@redhat.com>
            Date   : 2026-07-07T12:10:55+02:00
            Stats  : +8/-5 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/openssh/c/fdea50ab12e005f274ff8e4aa6f1210730e866f8?branch=rawhide

            Log:
            Fix CVE-2026-55655

Fix MITM of X11 forwarding via abstract UNIX socket pre-binding

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

---
diff --git a/0008-openssh-7.2p2-x11.patch b/0008-openssh-7.2p2-x11.patch
index 8f92375..055c596 100644
--- a/0008-openssh-7.2p2-x11.patch
+++ b/0008-openssh-7.2p2-x11.patch
@@ -42,7 +42,7 @@ index d7c55fc89..71cc67d17 100644
  	return -1;
  }
  
-@@ -5202,8 +5205,18 @@ static int
+@@ -5099,8 +5102,19 @@
  connect_local_xsocket(u_int dnr)
  {
  	char buf[1024];
@@ -51,10 +51,11 @@ index d7c55fc89..71cc67d17 100644
 +	int len, ret;
 +	len = snprintf(buf + 1, sizeof (buf) - 1, _PATH_UNIX_X, dnr);
 +#ifdef linux
-+	/* try abstract socket first */
-+	buf[0] = '\0';
-+	if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
-+		return ret;
++	if (getenv("SSH_INSECURE_ABSTRACT_SOCKET_ENABLED") != NULL) {
++		buf[0] = '\0';
++		if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
++			return ret;
++	}
 +#endif
 +	if ((ret = connect_local_xsocket_path(buf + 1, len)) >= 0)
 +		return ret;

diff --git a/openssh.spec b/openssh.spec
index 19efd63..5986a53 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -519,6 +519,8 @@ test -f %{sysconfig_anaconda} && \
   FIPS known-group validation that leads to client-side denial of service
 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator
   cleanup due to missing NULL terminator
+- CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket
+  pre-binding
 
 * Fri Jun 12 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 10.3p1-4
 - Rebuild against OpenSSL 4.0.1