From 6edfb52b3b364577d2db0334c0514a977efceed2 Mon Sep 17 00:00:00 2001
From: Jakub Jelen <jjelen@redhat.com>
Date: Wed, 1 Jul 2026 16:43:08 +0200
Subject: [PATCH] CVE-2026-59850 channels: Avoid processing DATA packets
 on closed channels
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Pavol Žáčik <pzacik@redhat.com>
(cherry picked from commit a8a3fa352bb5213e08a35e4494c6e44360e2e38a)

Index: libssh-0.10.6/src/channels.c
===================================================================
--- libssh-0.10.6.orig/src/channels.c
+++ libssh-0.10.6/src/channels.c
@@ -575,6 +575,13 @@ SSH_PACKET_CALLBACK(channel_rcv_data){
       channel->local_window,
       channel->remote_window);
 
+  if (channel->flags & SSH_CHANNEL_FLAG_CLOSED_REMOTE) {
+      SSH_LOG(SSH_LOG_WARNING, "Received data on (remotely) closed channel");
+      ssh_set_error(session, SSH_FATAL, "Received data on (remotely) closed channel");
+      SSH_STRING_FREE(str);
+      return SSH_PACKET_USED;
+  }
+
   /* What shall we do in this case? Let's accept it anyway */
   if (len > channel->local_window) {
     SSH_LOG(SSH_LOG_RARE,