Yocto Project Security Advisory: CVE-2026-123158 (openssh with musl)

Yocto Project Security Advisory: CVE-2026-123158 (openssh with musl)
=======================================================

Published: 2026-11-09
Version: 1.0
CVE: CVE-2026-123158
Severity: High
Affected component: openembedded-core

Description
========
In OpenSSH before 10.6p2 with musl, in some specific configuration with pam disabled and password authentication enabled, password set as '*' (disabled), any password between 256 and 1024 characters succeeds.

The issue affects systems running openssh with musl, and PAM disabled in the openssh configuration. Therefore, the issue does not affect the default OpenEmbedded configuration that
uses glibc and not musl.

The vulnerability of a system depends on the user configuration of system users. Accounts present by default have a configuration not allowing a remote login (except the root). The root account access is not affected if the default 'PermitRootLogin=prohibit-password' stays set. However, in the default configuration, PAM is disabled by default and password login is enabled by default.

Affected releases
=============
- master, before commit 5247d0d8862c3402ac061fede5844da4d5c4be4c
- blacksail, before commit 3bbd2a4f81f368ae7eac580949e4717f7aeb4f06 (6.x up to 6.1 included)
- wrynose, before commit 2285da08068a6d1b4a64c9a52d85a58be50e4679 (6.0.x up to 6.0.4 included)
- scarthgap (fix in progress)

Mitigation
=======
The recommended solution is to update (see the section above)

If an update is not possible, and you are running a potentially affected system, follow one or more of those mitigations:
- Make sure that for all accounts that have passwords disabled (* in /etc/shadow), home directory and shell are set to values not allowing system access even if a password were set, for example :/nonexistent:/usr/sbin/nologin
- Disable password authentication (key authentication is not affected)
- Switch your ssh server temporarily to dropbear
- Manually update openssh to v10.6p2 or later, or manually backport the patch linked below.

References:
=========
- CVE entry:
https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/123xxx/CVE-2026-123158.json
- Fix commit in openssh:

https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482

Security contact: [email protected]

Changelog:
========
1.0 - initial advisory

-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group. View/Reply Online (#249857):
https://lists.openembedded.org/g/openembedded-core/message/249857
Mute This Topic: https://lists.openembedded.org/mt/122176520/1997914
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [ [email protected]]
-=-=-=-=-=-=-=-=-=-=-=-

Thanks Marta, there is a long thread on it on musl ml - https://www.openwall.com/lists/musl/2026/11/05/4
there are more packages that might need patching e.g. vsftp see - https://github.com/InfrastructureServices/vsftpd/pull/9

Yocto Project Security Advisory: CVE-2026-123158 (openssh with musl)
=======================================================

Published: 2026-11-09
Version: 1.0
CVE: CVE-2026-123158
Severity: High
Affected component: openembedded-core

Description
========
In OpenSSH before 10.6p2 with musl, in some specific configuration with pam disabled and password authentication enabled, password set as '*' (disabled), any password between 256 and 1024 characters succeeds.

The issue affects systems running openssh with musl, and PAM disabled in the openssh configuration. Therefore, the issue does not affect the default OpenEmbedded configuration that
uses glibc and not musl.

The vulnerability of a system depends on the user configuration of system users. Accounts present by default have a configuration not allowing a remote login (except the root). The root account access is not affected if the default 'PermitRootLogin=prohibit-password' stays set. However, in the default configuration, PAM is disabled by default and password login is enabled by default.

Affected releases
=============
- master, before commit 5247d0d8862c3402ac061fede5844da4d5c4be4c
- blacksail, before commit 3bbd2a4f81f368ae7eac580949e4717f7aeb4f06 (6.x up to 6.1 included)
- wrynose, before commit 2285da08068a6d1b4a64c9a52d85a58be50e4679 (6.0.x up to 6.0.4 included)
- scarthgap (fix in progress)

Mitigation
=======
The recommended solution is to update (see the section above)

If an update is not possible, and you are running a potentially affected system, follow one or more of those mitigations:
- Make sure that for all accounts that have passwords disabled (* in /etc/shadow), home directory and shell are set to values not allowing system access even if a password were set, for example :/nonexistent:/usr/sbin/nologin
- Disable password authentication (key authentication is not affected)
- Switch your ssh server temporarily to dropbear
- Manually update openssh to v10.6p2 or later, or manually backport the patch linked below.

References:
=========
- CVE entry: https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/123xxx/CVE-2026-123158.json
- Fix commit in openssh:
https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482

Security contact: [email protected]

Changelog:
========
1.0 - initial advisory