[High] Patch rust for CVE-2026-58050, CVE-2026-58051, CVE-2026-66033, CVE-2026-66034, CVE-2026-7598

[BinduSri-6522866]

Patch rust for CVE-2026-58050, CVE-2026-58051, CVE-2026-66033, CVE-2026-66034, CVE-2026-7598

CVE-2026-58050:
Backported. The third-party/libssh2-sys/libssh2/ uses the older _libssh2_error()/LIBSSH2_ALLOC() API, not upstream's renamed ssh2_err()/SSH2_ALLOC(). So used existing _libssh2_error.
CVE-2026-58051:
Same as Upstream patch.
CVE-2026-66033:
Same as Upstream patch.
CVE-2026-66034:
Backported. The third-party/libssh2-sys/libssh2/ uses the older _libssh2_error()/LIBSSH2_ALLOC() API, not upstream's renamed ssh2_err()/SSH2_ALLOC(). So used existing _libssh2_error.
CVE-2026-7598:
Same as Upstream patch.

Buddy build: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1194727&view=results

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Aditya Singh (v-aaditya)]

Peer-review analysis -
There are 2 versions of libssh2 in rust package, but as author confirmed these CVEs only affect ./src/tools/cargo/third-party/libssh2-sys/libssh2 -

aditya@azurelinux [ ~/AzureLinuxProject/cve-fix/rust/rustc-1.96.1-src ]$ find . -name libssh2
./src/tools/cargo/third-party/libssh2-sys/libssh2
./vendor/libssh2-sys-0.3.1/libssh2

• All the patches match with their respective upstream patches, only the ssh2_err() → _libssh2_error() / SSH2_ALLOC → LIBSSH2_ALLOC naming differs due to version mismatch.
• All the patches have upstream patch reference.
• Buddy Build has passed.
• All the patches apply cleanly. (checked .rpm.log)
• Ptest getting passed. (Checked .rpm.test.log)
• SPEC file has been correctly updated.

Final Verdict - LGTM. PR can be opened for FTE review.

[Kavya Sree Kaitepalli (KavyaSree2610)]

LGTM

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.