OpenSSH: use-after-free in the ssh client when remote-forwarding operations run concurrently

CVE-2026-73282Kernel, userspace & hypervisorcurated

Impact

A certain pair of concurrent remote-forwarding operations can leave the ssh client using reallocated memory after it has been freed. This is the client, not sshd - a listening SSH server on a GPU node is not exposed by this bug - so the exposure sits on bastions, jump hosts and automation runners that open -R forwards out to many hosts. NVD scores it 4.8 with high attack complexity, reflecting the race, and credits limited confidentiality and integrity impact; the OpenSSH release notes are the only reference and no exploitation technique or privilege escalation is described. Keep expectations at that level: this is a fleet-wide package hygiene item, not a maintenance-window emergency.

Who can reach it

A remote SSH server the client connects to, in a session using remote port forwarding, that can drive the forwarding operations into the racing pair. The attacker needs no credentials on the client host, but the client has to initiate the connection. sshd is not affected.

What to do

Move to OpenSSH 10.5, or take your distribution's backport once it lands. Cost is an ordinary package update - existing sessions keep running the old binary and pick up the fix on the next ssh invocation; no sshd restart, node drain or reboot is needed. Until patched, avoid -R remote forwarding toward servers you do not control.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-73282 https://www.openssh.org/releasenotes.html#10.5

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.