[bonzini]

Technically the bug is in upstream code, but it is latent without the Red Hat patch:

> cleanup_exit() was not meant to be called from a signal handler [...] Fedora 38+ has moved to newer upstream OpenSSH that doesn't have the problematic cleanup_exit() call.

> This extra problematic logic only existed in upstream OpenSSH(-portable) for ~9 months

The fix also doesn't touch the Red Hat-specific code:

     diff -urp openssh-8.7p1-38.el9_4.1-tree.orig/sshd.c openssh-8.7p1-38.el9_4.1-tree/sshd.c
     --- openssh-8.7p1-38.el9_4.1-tree.orig/sshd.c 2024-07-08 03:42:51.431994307 +0200
     +++ openssh-8.7p1-38.el9_4.1-tree/sshd.c 2024-07-08 03:48:13.860316451 +0200
     @@ -384,7 +384,7 @@ grace_alarm_handler(int sig)
      
       /* Log error and exit. */
       if (use_privsep && pmonitor != NULL && pmonitor->m_pid <= 0)
     -  cleanup_exit(255); /* don't log in privsep child */
     +  _exit(1); /* don't log in privsep child */
       else {
        sigdie("Timeout before authentication for %s port %d",
            ssh_remote_ipaddr(the_active_state),

They suggest applying it even on non Red Hat distros.