From b18b97d782305e61c50cc0c6ca9161e2bfd94a4b Mon Sep 17 00:00:00 2001
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Date: Fri, 11 Sep 2026 11:09:28 +1200
Subject: [PATCH] unbound: patch CVE-2026-55990

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55990

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
---
 .../unbound/unbound/CVE-2026-55990.patch      | 59 +++++++++++++++++++
 .../recipes-support/unbound/unbound_1.24.2.bb |  1 +
 2 files changed, 60 insertions(+)
 create mode 100644 meta-networking/recipes-support/unbound/unbound/CVE-2026-55990.patch

diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2026-55990.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2026-55990.patch
new file mode 100644
index 0000000000..676f1aa17e
--- /dev/null
+++ b/meta-networking/recipes-support/unbound/unbound/CVE-2026-55990.patch
@@ -0,0 +1,59 @@
+From 6e6c039d23afb169991fa489c2010ab0069a2cab Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Wed, 22 Jul 2026 10:18:41 +0200
+Subject: [PATCH] - Fix CVE-2026-55990, Packet of death for a DNSCrypt
+ misconfigured   Unbound. Thanks to Qifan Zhang, Palo Alto Networks, for the
+ report.
+
+(cherry picked from commit ae1b3810cc3a8eb9b43c378289f74020b42aa7f4)
+
+CVE: CVE-2026-55990
+Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/ae1b3810cc3a8eb9b43c378289f74020b42aa7f4]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ dnscrypt/dnscrypt.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/dnscrypt/dnscrypt.c b/dnscrypt/dnscrypt.c
+index 173484cdf..bf858361f 100644
+--- a/dnscrypt/dnscrypt.c
++++ b/dnscrypt/dnscrypt.c
+@@ -663,6 +663,8 @@ dnsc_find_cert(struct dnsc_env* dnscenv, struct sldns_buffer* buffer)
+ 	}
+ 	dnscrypt_header = (struct dnscrypt_query_header *)sldns_buffer_begin(buffer);
+ 	for (i = 0U; i < dnscenv->signed_certs_count; i++) {
++		if(!certs[i].keypair)
++			continue;
+ 		if (memcmp(certs[i].magic_query, dnscrypt_header->magic_query,
+                    DNSCRYPT_MAGIC_HEADER_LEN) == 0) {
+ 			return &certs[i];
+@@ -804,6 +806,7 @@ dnsc_parse_keys(struct dnsc_env *env, struct config_file *cfg)
+ 		sizeof *env->keypairs);
+ 	env->certs = sodium_allocarray(env->signed_certs_count,
+ 		sizeof *env->certs);
++	memset(env->certs, 0, env->signed_certs_count * sizeof(*env->certs));
+ 
+ 	cert_id = 0U;
+ 	keypair_id = 0U;
+@@ -963,12 +966,19 @@ dnsc_create(void)
+ int
+ dnsc_apply_cfg(struct dnsc_env *env, struct config_file *cfg)
+ {
++    int nkeys;
+     if(dnsc_parse_certs(env, cfg) <= 0) {
+         fatal_exit("dnsc_apply_cfg: no cert file loaded");
+     }
+-    if(dnsc_parse_keys(env, cfg) <= 0) {
++    nkeys = dnsc_parse_keys(env, cfg);
++    if(nkeys <= 0) {
+         fatal_exit("dnsc_apply_cfg: no key file loaded");
+     }
++    if((size_t)nkeys < env->signed_certs_count) {
++	fatal_exit("dnsc_apply_cfg: %u dnscrypt-provider-cert file(s) have no "
++		"matching dnscrypt-secret-key",
++		(unsigned)(env->signed_certs_count - (size_t)nkeys));
++    }
+     randombytes_buf(env->hash_key, sizeof env->hash_key);
+     env->provider_name = cfg->dnscrypt_provider;
+ 
diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
index b867ea9b73..e4d18e9b2a 100644
--- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
+++ b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
@@ -39,6 +39,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
            file://CVE-2026-55708.patch \
            file://CVE-2026-55717.patch \
            file://CVE-2026-55973.patch \
+           file://CVE-2026-55990.patch \
            "
 
 SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"