[High] Patch rust for CVE-2026-58050, CVE-2026-58051, CVE-2026-66033, CVE-2026-66034, CVE-2026-82251, CVE-2026-82253, CVE-2026-7598, CVE-2026-82252

[BinduSri-6522866]

Patch rust for CVE-2026-58050, CVE-2026-58051, CVE-2026-66033, CVE-2026-66034, CVE-2026-7598, CVE-2026-82251, CVE-2026-82252, CVE-2026-82253

CVE-2026-58050:
The affected file is present at two places "libssh2/src/publickey." Patched only shipped version ./src/tools/cargo/third-party/libssh2-sys/libssh2 in SPECS/rust/CVE-2026-58050.patch. The other version ./vendor/libssh2-sys-0.3.1/libssh2 which is affected is not getting compiled.
Backported. The third-party/libssh2-sys/libssh2/ uses the older _libssh2_error()/LIBSSH2_ALLOC() API, not upstream's renamed ssh2_err()/SSH2_ALLOC(). So used existing _libssh2_error.
CVE-2026-58051:
Same as Upstream patch.
CVE-2026-66033:
Same as Upstream patch.
CVE-2026-66034:
Backported. The third-party/libssh2-sys/libssh2/ uses the older _libssh2_error()/LIBSSH2_ALLOC() API, not upstream's renamed ssh2_err()/SSH2_ALLOC(). So used existing _libssh2_error.
CVE-2026-7598:
Same as Upstream patch.
CVE-2026-82252:
Same as Upstream patch.
CVE-2026-82251 & CVE-2026-82253:
Same as Upstream patch.
Except test file gix/tests/gix/submodule.rs is not present in our source code, so patch did not apply.
Upstream single fix GitoxideLabs/gitoxide@d2e193f touches two separate crates and is therefore split into two patches, one per CVE:

• CVE-2026-82251 — the gix half (vendor/gix-0.81.0): adds validated_name() and makes Submodule::git_dir() fallible so it rejects unsafe submodule names before joining them into .git/modules/.
• CVE-2026-82253 — the gix-validate half (vendor/gix-validate-0.11.0): hardens submodule::name() to reject a .. component anywhere in the name, not just the first occurrence.

Buddy build: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1194727&view=results

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Aditya Singh (v-aaditya)]

Peer-review analysis -
There are 2 versions of libssh2 in rust package, but as author confirmed these CVEs only affect ./src/tools/cargo/third-party/libssh2-sys/libssh2 -

aditya@azurelinux [ ~/AzureLinuxProject/cve-fix/rust/rustc-1.96.1-src ]$ find . -name libssh2
./src/tools/cargo/third-party/libssh2-sys/libssh2
./vendor/libssh2-sys-0.3.1/libssh2

• All the patches match with their respective upstream patches, only the ssh2_err() → _libssh2_error() / SSH2_ALLOC → LIBSSH2_ALLOC naming differs due to version mismatch.
• All the patches have upstream patch reference.
• Buddy Build has passed.
• All the patches apply cleanly. (checked .rpm.log)
• Ptest getting passed. (Checked .rpm.test.log)
• SPEC file has been correctly updated.

Final Verdict - LGTM. PR can be opened for FTE review.

[Kavya Sree Kaitepalli (KavyaSree2610)]

LGTM

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.