enforce some basic size and consistency checks on RSA private values
(d, iqmp, etc). This could be used for an (unlikely) DoS against ssh-agent
if an attacker can add a bogus key to it.
Anthropic ANT-2026-9VCMKJ8F
don't leave ssh-agent is a useless state if `ssh-add -s` is run multiple
times with the same PKCS#11 provider. Just refuse the operation.
Anthropic ANT-2026-944YIV1E
clean up properly when stopping the progress meter, even if backgrounded
and unable to output. Avoids reading free'd memory in a subsequent
progress meter invocation if the right (wrong) sequence of backgrounding
and forgroundings happened.
Anthropic ANT-2026-4MDN97DH
set an upper limit on the size of env names/values that will be accepted
for environment passing (e.g. SendEnv/AcceptEnv).
Reported as Anthropic ANT-2026-2XP5ZUQG but fixed differently
correct timeout accounting for ConnectTimeout and banner exchange that
was broken in openssh-9.5, which caused the timeout to be erroneously
reset between successful reads.
Anthropic ANT-2026-2UMTJC7S
avoid spurious disconnect if connecting as root with
`PermitRootLogin forced-commands-only` enabled and a authorized_keys
entry _without_ a `command=` option before a key _with_ this option.
Anthropic ANT-2026-29SEM083
make `ssh-keygen -lf /key` more strict on detecting the start of
private keys. Previously it would try to parse anything starting from any
line that contained "PRIVATE KEY", now it looks for more of the key header.
Anthropic ANT-2026-1T34TRV0
The adaptive noise immunity code has been present, but never enabled, since
day one, because athn_ani_get_rssi() was never written (it is just a stub).
Put all that code within #if 0 so that it does not waste kernel text.
pf(4) rule item traversal requires state mutex protection
When pf_test() decides whether a log action needs to be
handled for a matching state, it must also hold the
state mutex to stay synchronized with the purge thread,
which may be removing the same state.
Issue kindly reported by Acts1631.
OK henning@
make uncm(4) NCM 1.0 spec compliant
- Payload alignment now matches NCM 1.0
- Reserved bits in bmNtbFormatsSupported are now ignored by the host as
needed for NCM 1.0
- IN NTB size was clamped to 65535 without telling the device
- Initialization order is now alt setting 0 -> NCM parameter requests
-> alt setting 1
- Stop ignoring bmNetworkCapabilities and use GET_ as fallback
- Some cleanup for printing with the right placeholder and moving
variables around
From Jan Scheiber
Tested by Jan and myself on Android phones
Allocate the firmware dma memory segments individually, each aligned
to the next power of two of its size, same as Linux does. Packing
them into one 64KB-aligned buffer makes newer WCN7850 firmware (for
example WLAN.HMT.1.1.c7) crash on the respond-memory request, depending
on where the buffer lands in the physical memory.
This fixes the qwz(4) firmware loading for the Samsung Galaxy Book4
Edge with linux-firmware-20261019.
ok stsp@, kettenis@
Update to 2026fgtz from https://github.com/JodaOrg/global-tz
o Cuba will not fall back 2026-11-01; stays on -04 through 2027-11-07.
o No more leap seconds, and leap second tables no longer expire.
o Improve 1965/1966 data for Brazil.
