A flaw was found in OpenSSH sshd on platforms that do not support file-descriptor passing and that require root to allocate a PTY. After authentication, the sshd-session process keeps running as root instead of dropping to the logged-in user. That process can then act as root, including connecting to Unix-domain sockets and binding remote forwards to low-numbered TCP ports. Affected platforms are QNX 6, SCO OpenServer 5, and builds configured with --disable-fd-passing. OpenSSH 10.6 disables GatewayPorts and StreamLocalForwarding on those platforms and removes --disable-fd-passing. On Linux, privilege separation drops to the logged-in user, so Red Hat Enterprise Linux is not affected. Reserve the CVE for upstream. Do not file RHEL trackers.