OpenSSH 10.6p2 released with critical security workaround for musl libc Linux

The OpenSSH team has released version 10.6p2 to address a critical security vulnerability that allows for password authentication bypass. This specific flaw impacts Linux-based systems that utilize the musl libc library in environments where PAM (Pluggable Authentication Modules) is disabled.

Users running distributions like Alpine Linux that fit this profile are advised to immediately disable SSH or set PasswordAuthentication=no as a temporary measure. The vulnerability does not affect non-Linux operating systems, Linux systems using glibc, or Linux systems configured with PAM support.

Security mitigation and technical changes

• Security Workaround: The release includes a fix for sshd(8) to prevent an authentication bypass triggered by specific conditions in musl libc environments lacking PAM.
• Post-Quantum Support: The update enables the ssh-mldsa44-ed25519 post-quantum hybris signature scheme as an allowed CA signature algorithm for both ssh(1) and sshd(8).
• Feature Deprecation: The scp(1) utility now emits a deprecation warning when using the -R flag for remote-to-remote copying, a feature slated for future removal.
• Performance Fix: A bug causing a CPU spin of less than one second when ChannelTimeout was active has been resolved in both the client and server components.
• Sandbox Updates: The seccomp sandbox for sshd(8) has been updated to allow the restart_syscall(2) system call.

Why it matters

This release is vital for administrators of lightweight Linux distributions, such as Alpine Linux, which frequently rely on musl libc. Because the OpenSSH team is moving toward more frequent release cycles to counter AI-assisted vulnerability discovery, users should expect faster patch delivery for critical flaws in the future.