[rpms/openssh] f44: Fix CVE-2026-55653

[rpms/openssh] f44: Fix CVE-2026-55653

[Zoltan Fridrich]

            A new commit has been pushed.

            Repo   : rpms/openssh
            Branch : f44
            Commit : cb70301a1c672543fc561372c76c7a18ee014030
            Author : Zoltan Fridrich <zfridric@redhat.com>
            Date   : 2026-07-07T12:33:15+02:00
            Stats  : +11/-6 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/openssh/c/cb70301a1c672543fc561372c76c7a18ee014030?branch=f44

            Log:
            Fix CVE-2026-55653

Fix double free in openssh DH-GEX client path
during FIPS known-group validation that leads
to client-side denial of service

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

---
diff --git a/0038-openssh-7.7p1-fips.patch b/0038-openssh-7.7p1-fips.patch
index 18ebed3..8ef0722 100644
--- a/0038-openssh-7.7p1-fips.patch
+++ b/0038-openssh-7.7p1-fips.patch
@@ -275,17 +275,18 @@ index 097d83f30..ccbb9b580 100644
  #include <sys/types.h>
  
  #include "openbsd-compat/openssl-compat.h"
-@@ -115,6 +116,10 @@ input_kex_dh_gex_group(int type, u_int32_t seq, struct ssh *ssh)
- 		r = SSH_ERR_ALLOC_FAIL;
- 		goto out;
+@@ -117,6 +118,11 @@ input_kex_dh_gex_group(int type, u_int32
  	}
+ 	p = g = NULL; /* belong to kex->dh now */
+ 
 +	if (FIPS_mode() && dh_is_known_group(kex->dh) == 0) {
 +		r = SSH_ERR_INVALID_ARGUMENT;
 +		goto out;
 +	}
- 	p = g = NULL; /* belong to kex->dh now */
- 
++
  	/* generate and send 'e', client DH public key */
+ 	if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
+ 		goto out;
 diff --git a/myproposal.h b/myproposal.h
 index 8fe9276c2..3e0ec6826 100644
 --- a/myproposal.h

diff --git a/openssh.spec b/openssh.spec
index 025aea6..6df0c4e 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -43,7 +43,7 @@
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
 Version: %{openssh_ver}
-Release: 10%{?dist}
+Release: 11%{?dist}
 URL: http://www.openssh.com/portable.html
 Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
 Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
@@ -592,6 +592,10 @@ test -f %{sysconfig_anaconda} && \
 %attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
 
 %changelog
+* Tue Jul 07 2026 Zoltan Fridrich <zfridric@redhat.com> - 10.2p1-11
+- CVE-2026-55653: Fix double free in openssh DH-GEX client path during
+  FIPS known-group validation that leads to client-side denial of service
+
 * Thu Apr 30 2026 Manuel Fombuena <fombuena@outlook.com> - 10.2p1-10
 - Fix error message when fetching certs and keys on PKCS11 smartcards
   protected with PIN