[rpms/openssh] f43: Fix CVE-2026-55653

[Zoltan Fridrich <zfridric@redhat.com>]

            A new commit has been pushed.

            Repo   : rpms/openssh
            Branch : f43
            Commit : da0e5b2f2a73910dff084219be36ae31d0606198
            Author : Zoltan Fridrich <zfridric@redhat.com>
            Date   : 2026-07-07T13:27:46+02:00
            Stats  : +11/-6 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/openssh/c/da0e5b2f2a73910dff084219be36ae31d0606198?branch=f43

            Log:
            Fix CVE-2026-55653

Fix double free in openssh DH-GEX client path
during FIPS known-group validation that leads
to client-side denial of service

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

---
diff --git a/0042-openssh-7.7p1-fips.patch b/0042-openssh-7.7p1-fips.patch
index f4729d7..4d0b256 100644
--- a/0042-openssh-7.7p1-fips.patch
+++ b/0042-openssh-7.7p1-fips.patch
@@ -275,17 +275,18 @@ index e99e0cf2..4c3feae0 100644
  #include <sys/types.h>
  
  #include <openssl/dh.h>
-@@ -115,6 +116,10 @@ input_kex_dh_gex_group(int type, u_int32_t seq, struct ssh *ssh)
- 		r = SSH_ERR_ALLOC_FAIL;
- 		goto out;
+@@ -117,6 +118,11 @@ input_kex_dh_gex_group(int type, u_int32
  	}
+ 	p = g = NULL; /* belong to kex->dh now */
+ 
 +	if (FIPS_mode() && dh_is_known_group(kex->dh) == 0) {
 +		r = SSH_ERR_INVALID_ARGUMENT;
 +		goto out;
 +	}
- 	p = g = NULL; /* belong to kex->dh now */
- 
++
  	/* generate and send 'e', client DH public key */
+ 	if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
+ 		goto out;
 diff --git a/myproposal.h b/myproposal.h
 index 8fe9276c..3e0ec682 100644
 --- a/myproposal.h

diff --git a/openssh.spec b/openssh.spec
index 3a0714f..1212d88 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -43,7 +43,7 @@
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
 Version: %{openssh_ver}
-Release: 9%{?dist}
+Release: 10%{?dist}
 URL: http://www.openssh.com/portable.html
 Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
 Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
@@ -598,6 +598,10 @@ test -f %{sysconfig_anaconda} && \
 %attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
 
 %changelog
+* Tue Jul 07 2026 Zoltan Fridrich <zfridric@redhat.com> - 10.0p1-10
+- CVE-2026-55653: Fix double free in openssh DH-GEX client path during
+  FIPS known-group validation that leads to client-side denial of service
+
 * Fri Apr 17 2026 Zoltan Fridrich <zfridric@redhat.com> - 10.0p1-9
 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol
   when not in preserving file mode