- CVE-2026-73282: ssh(1) use-after-free: a pending remote-forward global confirmation held a raw pointer into options.remote_forwards, which a forwarding added concurrently over the multiplexing socket could realloc away; carry the forwarding index in the callback context and resolve the entry at callback time. Backport upstream commit 9910d5ef. - CVE-2026-73283: sshd did not apply the authorized_keys 'restrict' keyword to tunnel-device forwarding; also reject tun forwarding in server_request_tun() when the key is restricted. Backport upstream commit d322f2cc.