urgent security release: 10.6p2

[Loganaden Velvindron]

On Fri, 06 Nov 2026, 04:42 Andy Lutomirski via openssh-unix-dev, <
openssh-unix-dev at mindrot.org> wrote:

> On Thu, Nov 5, 2026, at 1:10 AM, Damien Miller wrote:
> > OpenSSH 10.6p2 has been released with a workaround for a critical
> > vulnerability.
> >
> > https://openssh.com/releasenotes.html#10.6p2
> >
> > If you operate a Linux system that uses musl libc without
> > PAM (Alpine Linux is one example) then stop reading and set
> > PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.
> >
> > This vulnerability does not exist on non-Linux systems, Linux/glibc
> > systems and Linux systems that use PAM for password authentication.
> >
> > We consider the root cause of this bug to be outside OpenSSH itself, but
> > we're in a good position to deliver a mitigation quickly.
>
> I tried to analyze the control flow associated with this bug, and I'm not
> sure it's entirely valid to call it musl's bug.  musl anticipates that
> someone might call crypt("garbage", "*")
>
I audited crypt() usage in linux. A lot of crypt() calls are now checking
for null on failure.

There are a few exceptions like vsftpd which need fixing.
https://github.com/InfrastructureServices/vsftpd/pull/9/files

The change in musl was done in 2012. We are in 2026 and I think that maybe
it's time for musl to return null on failure and adhere to the specs.