“This regression was introduced in October 2020 (OpenSSH 8.5p1) by commit 752250c (“revised log infrastructure for OpenSSH”), which accidentally removed an “#ifdef DO_LOG_SAFE_IN_SIGHAND” from sigdie()”
A logging cleanup in 2020 quietly brought back CVE-2006-5051, a signal handler race Mark Dowd reported 18 years ago. The result is unauthenticated remote root on sshd in its default configuration. Qualys needed about 10,000 tries and 6 to 8 hours to get a root shell on 32-bit Debian. A regression test for a 2006 bug would have caught it.