From 0d975df7da86f386d2a1162f9be5d7b865cf7f03 Mon Sep 17 00:00:00 2001
From: Yogita Urade <yurade@cisco.com>
Date: Thu, 15 Oct 2026 22:21:07 -0700
Subject: [PATCH] redis: fix CVE-2026-23479

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/redis/redis/commit/c14e9925e571c3c8ecbeb8632fe834faa32175ea
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-23479

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
---
 .../redis/redis-8.0.6/CVE-2026-23479.patch    | 77 +++++++++++++++++++
 meta-oe/recipes-extended/redis/redis_8.0.6.bb |  1 +
 2 files changed, 78 insertions(+)
 create mode 100644 meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-23479.patch

diff --git a/meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-23479.patch b/meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-23479.patch
new file mode 100644
index 0000000000..756d6dd746
--- /dev/null
+++ b/meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-23479.patch
@@ -0,0 +1,77 @@
+From 0fa208a25f95603e255211254097dd34a165fed0 Mon Sep 17 00:00:00 2001
+From: "debing.sun" <debing.sun@redis.com>
+Date: Mon, 29 Dec 2025 16:20:41 +0800
+Subject: [PATCH] Fix use-after-free when evicting blocked client during
+ unblock (CVE-2026-23479)
+
+When re-executing a pending command after unblocking, check the return value
+of `processCommandAndResetClient` and exit if needed.
+
+CVE: CVE-2026-23479
+Upstream-Status: Backport [https://github.com/redis/redis/commit/c14e9925e571c3c8ecbeb8632fe834faa32175ea]
+
+(cherry picked from commit c14e9925e571c3c8ecbeb8632fe834faa32175ea)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ src/blocked.c                  |  8 +++++++-
+ tests/unit/client-eviction.tcl | 29 +++++++++++++++++++++++++++++
+ 2 files changed, 36 insertions(+), 1 deletion(-)
+
+diff --git a/src/blocked.c b/src/blocked.c
+index 86cff0b7f..a35ffb569 100644
+--- a/src/blocked.c
++++ b/src/blocked.c
+@@ -676,7 +676,13 @@ static void unblockClientOnKey(client *c, robj *key) {
+         client *old_client = server.current_client;
+         server.current_client = c;
+         enterExecutionUnit(1, 0);
+-        processCommandAndResetClient(c);
++        if (processCommandAndResetClient(c) == C_ERR) {
++            /* Client was freed during command processing, exit immediately */
++            exitExecutionUnit();
++            server.current_client = old_client;
++            return;
++        }
++
+         if (!(c->flags & CLIENT_BLOCKED)) {
+             if (c->flags & CLIENT_MODULE) {
+                 moduleCallCommandUnblockedHandler(c);
+diff --git a/tests/unit/client-eviction.tcl b/tests/unit/client-eviction.tcl
+index 3caaf9bd4..62e42580c 100644
+--- a/tests/unit/client-eviction.tcl
++++ b/tests/unit/client-eviction.tcl
+@@ -607,5 +607,34 @@ start_server {} {
+     }
+ }
+ 
++start_server {} {
++    r flushall
++    r client no-evict on
++    r config set maxmemory-clients 0
++
++    test "Verify blocked client eviction during unblock does not cause use-after-free" {
++        # Create a deferring client that will be blocked on stream
++        # Use a long stream name to make client memory usage exceed 200000 bytes
++        set rd [redis_deferring_client]
++        $rd XREAD BLOCK 0 STREAMS mystream stream_[string repeat x 200000] $ $
++
++        # Wait for the client to be blocked
++        wait_for_condition 50 100 {
++            [s blocked_clients] eq {1}
++        } else {
++            fail "Client was not blocked"
++        }
++
++        # Now lower MAXMEMORY-CLIENTS to a low value and use
++        # XADD to unblock the blocked client, triggering eviction.
++        r MULTI
++        r CONFIG SET MAXMEMORY-CLIENTS 100000 ;# Put in MULTI to defer blocked client eviction until after EXEC
++        r XADD mystream * field val
++        r EXEC
++        r PING
++        $rd close
++    }
++}
++
+ } ;# tags
+ 
diff --git a/meta-oe/recipes-extended/redis/redis_8.0.6.bb b/meta-oe/recipes-extended/redis/redis_8.0.6.bb
index 67126c9fcf..f09bb8aba2 100644
--- a/meta-oe/recipes-extended/redis/redis_8.0.6.bb
+++ b/meta-oe/recipes-extended/redis/redis_8.0.6.bb
@@ -16,6 +16,7 @@ SRC_URI = "http://download.redis.io/releases/${BP}.tar.gz \
            file://0004-src-Do-not-reset-FINAL_LIBS.patch \
            file://0005-Define-_GNU_SOURCE-to-get-PTHREAD_MUTEX_INITIALIZER.patch \
            file://CVE-2026-81934.patch \
+           file://CVE-2026-23479.patch \
           "
 SRC_URI[sha256sum] = "6d0a9913887a4972536f9da226f1575859c34d86354129163260a5f9c6bd4229"