From e9a2b0dc72dd3a9aa3a5210e89079a3b719475dc Mon Sep 17 00:00:00 2001
From: Stefan Eissing <stefan@eissing.org>
Date: Thu, 25 Jun 2026 10:19:17 +0200
Subject: [PATCH] multi_ev: refresh sock entry after remove callback

This was missed in the fix for CVE-2026-9080.

Reported-by: stze on hackerone
URL: https://hackerone.com/reports/3823985
Closes #22163
---
 lib/multi_ev.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/multi_ev.c b/lib/multi_ev.c
index 0da5b0e904..71e22b9b19 100644
--- a/lib/multi_ev.c
+++ b/lib/multi_ev.c
@@ -213,7 +213,11 @@ static CURLMcode mev_forget_socket(struct Curl_multi *multi,
     rc = multi->socket_cb(data, s, CURL_POLL_REMOVE,
                           multi->socket_userp, entry->user_data);
     mev_in_callback(multi, FALSE);
-    entry->announced = FALSE;
+    /* curl_easy_pause() is documented as callable from any callback; it
+     * re-enters mev_assess() which may free this 'entry'. Re-fetch. */
+    entry = mev_sh_entry_get(&multi->ev.sh_entries, s);
+    if(entry)
+      entry->announced = FALSE;
   }
 
   mev_sh_entry_kill(multi, s);
-- 
2.43.0