A flaw in the libssh library allows channel data callbacks to be invoked after the associated channel memory has already been freed. When an application processes data packets on a closed channel, the library attempts to access freed memory, which can result in a crash or a memory corruption state. The primary impact is a denial of service and potential instability of the application using libssh; no confirmed escalation or remote code execution has been documented, but memory corruption remains a significant risk.

Red Hat Enterprise Linux 10, 8, 9 and the Red Hat Hardened Images are affected because they ship the vulnerable libssh component. The specific affected versions of libssh are not listed in the CNA data. System administrators should verify the installed libssh package version against the vendor's errata RHSA-2026:42922.

The CVSS score of 4.3 classifies the vulnerability as moderate. The EPSS score of less than 1% indicates a very low likelihood that this flaw will be actively exploited in the wild, and it is not in the CISA KEV catalog. The likely attack vector is inferred from the description: an attacker could send crafted SSH data packets to a service or client that uses libssh, potentially triggering the callback on a closed channel. This could cause a crash or memory corruption if the attacker can control the packet sequence; however, no specific privilege escalation method is documented.