microsoft · Azure Linux Security Servicing Account (azurelinux-security) · Sep 7, 2026
@@ -0,0 +1,49 @@
+From 2b4cc6c3290575bb7d39710df796b120de436309 Mon Sep 17 00:00:00 2001
+From: Nicola Murino <nicola.murino@gmail.com>
+Date: Sat, 13 Jun 2026 11:48:20 +0200
+Subject: [PATCH] ssh: reject unexpected message types on established channels
+
+ch.msg is only read while the channel open or a channel request with a
+reply is pending, so anything the default arm of channel.handlePacket
+delivered to it was never consumed. The blocking send there let a
+misbehaving peer fill the buffer with well-formed but unexpected message
+types carrying a valid channel id and stall the mux read loop,
+deadlocking the whole connection.
+
+No conforming peer sends such messages during the connection protocol.
+Treat them as a protocol error and tear the connection down, as
+handleUnknownChannelPacket already does for the same messages when the
+channel id is not in use.
+
+Fixes CVE-2026-56855
+Fixes golang/go#81317
+
+Change-Id: I87420dfe68fcb62a17df4b47dc5ffb6ccd72ba26
+Reviewed-on: https://go-review.googlesource.com/c/crypto/+/826524
+Reviewed-by: Roland Shoemaker <roland@golang.org>
+LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
+Auto-Submit: Neal Patel <nealpatel@google.com>
+Reviewed-by: Nicholas Husin <husin@google.com>
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/golang/crypto/commit/86efde54dc7069251a8b007026c500d28e4239ce.patch
+---
+ vendor/golang.org/x/crypto/ssh/channel.go | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/vendor/golang.org/x/crypto/ssh/channel.go b/vendor/golang.org/x/crypto/ssh/channel.go
+index b80b8be..9bc249e 100644
+--- a/vendor/golang.org/x/crypto/ssh/channel.go
++++ b/vendor/golang.org/x/crypto/ssh/channel.go
+@@ -483,7 +483,8 @@ func (ch *channel) handlePacket(packet []byte) error {
+
+ 		ch.incomingRequests <- &req
+ 	default:
+-		ch.msg <- msg
++		// No other message type is expected on an established channel.
++		return fmt.Errorf("ssh: unexpected message type %d on channel %d", packet[0], ch.localId)
+ 	}
+ 	return nil
+ }
+-- 
+2.45.4
+
@@ -0,0 +1,92 @@
+From d5f3b9daf9afa15c86b3ad2c2c7da64fa3595179 Mon Sep 17 00:00:00 2001
+From: Nicola Murino <nicola.murino@gmail.com>
+Date: Sat, 13 Jun 2026 11:54:07 +0200
+Subject: [PATCH] ssh: drop traffic on undecided channels
+
+A channel in the mux's chanList is not usable until it is established:
+an outbound channel has no confirmed remote id until the peer's open
+confirmation, and an inbound channel is not serviced by the application
+until it is accepted. handlePacket processed any channel message on it,
+so a misbehaving peer could flood channel requests and block the mux
+read loop on the send to incomingRequests, deadlocking the connection,
+or close an outbound channel before confirming it, making the victim
+tear down a half-initialized channel and emit a close for remote id 0,
+an unrelated channel of the peer.
+
+No such packet can be legitimate: the peer learns an inbound channel's
+local id only from the confirmation we have not sent yet, and on an
+outbound channel RFC 4254 lets it answer the open request only with a
+confirmation or a failure.
+
+Add an established flag, set when the channel becomes usable: for an
+outbound channel when the open response is received, for an inbound
+channel by Accept before the confirmation is sent. Until then
+handlePacket drops every packet other than the open response. The flag
+is separate from decided, which Reject also sets: a rejected channel is
+decided but must never carry traffic.
+
+Fixes CVE-2026-78662
+Fixes golang/go#81316
+
+Change-Id: Ib0983bb216a49808a2db1f4a4d92ee9fe38a3c51
+Reviewed-on: https://go-review.googlesource.com/c/crypto/+/826504
+Auto-Submit: Gopher Robot <gobot@golang.org>
+LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
+Reviewed-by: Roland Shoemaker <roland@golang.org>
+Reviewed-by: Neal Patel <nealpatel@google.com>
+Reviewed-by: Nicholas Husin <husin@google.com>
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/golang/crypto/commit/a6cdac60840750226b15617ac8858be44361b36b.patch
+---
+ vendor/golang.org/x/crypto/ssh/channel.go | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/vendor/golang.org/x/crypto/ssh/channel.go b/vendor/golang.org/x/crypto/ssh/channel.go
+index 77bac19..b80b8be 100644
+--- a/vendor/golang.org/x/crypto/ssh/channel.go
++++ b/vendor/golang.org/x/crypto/ssh/channel.go
+@@ -172,6 +172,12 @@ type channel struct {
+ 	// (for outbound channels) or received (for inbound channels).
+ 	decided bool
+
++	// established is set to true once the channel is open and may carry normal
++	// channel traffic: for an outbound channel when the peer's open
++	// confirmation is received, for an inbound channel when the local side
++	// accepts it. It is set and read from different goroutines.
++	established atomic.Bool
++
+ 	// direction contains either channelOutbound, for channels created
+ 	// locally, or channelInbound, for channels created by the peer.
+ 	direction channelDirection
+@@ -410,10 +416,20 @@ func (ch *channel) responseMessageReceived() error {
+ 		return errors.New("ssh: duplicate response received for channel")
+ 	}
+ 	ch.decided = true
++	ch.established.Store(true)
+ 	return nil
+ }
+
+ func (ch *channel) handlePacket(packet []byte) error {
++	// Only the open response is expected before the channel is established.
++	if !ch.established.Load() {
++		switch packet[0] {
++		case msgChannelOpenConfirm, msgChannelOpenFailure:
++		default:
++			return nil
++		}
++	}
++
+ 	switch packet[0] {
+ 	case msgChannelData, msgChannelExtendedData:
+ 		return ch.handleData(packet)
+@@ -518,6 +534,7 @@ func (ch *channel) Accept() (Channel, <-chan *Request, error) {
+ 		MaxPacketSize: ch.maxIncomingPayload,
+ 	}
+ 	ch.decided = true
++	ch.established.Store(true)
+ 	if err := ch.sendMessage(confirm); err != nil {
+ 		return nil, nil, err
+ 	}
+-- 
+2.45.4
+
@@ -3,7 +3,7 @@
 Summary: The open-source application container engine
 Name:    moby-engine
 Version: 25.0.3
-Release: 19%{?dist}
+Release: 20%{?dist}
 License: ASL 2.0
 Group:   Tools/Container
 URL: https://mobyproject.org
@@ -41,6 +41,8 @@ Patch22: CVE-2026-46597.patch
 Patch23: CVE-2026-39827.patch
 Patch24: CVE-2026-39835.patch
 Patch25: CVE-2026-56852.patch
+Patch26: CVE-2026-56855.patch
+Patch27: CVE-2026-78662.patch
 
 %{?systemd_requires}
 
@@ -136,6 +138,9 @@ fi
 %{_unitdir}/*
 
 %changelog
+* Mon Sep 07 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 25.0.3-20
+- Patch for CVE-2026-78662, CVE-2026-56855
+
 * Mon Jul 27 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 25.0.3-19
 - Patch for CVE-2026-56852