OpenSSH 10.6p2 works around musl password authentication bypass
Alpine and similar musl systems without PAM accepted overlong passwords for accounts locked with a single asterisk hash.
OpenSSH has released 10.6p2 with a workaround for a password authentication bypass on Linux systems that use musl libc and run sshd with PAM disabled. Alpine Linux is among the affected platforms.
On those systems, any account whose password hash field is a single asterisk (the usual lockout marker) could be entered by sending a password longer than 257 characters. musl's password-hashing routine returns the same asterisk string for those overlong inputs, so sshd treated the attempt as successful. OpenSSH maintainers say the root cause lies outside the daemon, but the condition is exploitable through sshd and can be avoided there.
The issue was reported by Özgün Kültekin of Wakefield. Operators who cannot upgrade at once can set PasswordAuthentication to no, which closes the path at the cost of disabling password logins.
On the oss-security list, Loganaden Velvindron stressed that the change is a workaround for musl behavior, not a defect fixed inside OpenSSH itself, and warned against coverage that frames it otherwise.