)]}'
{
  "commit": "6229fbcef1f878b2df081c7911c7eaae12e54da5",
  "tree": "86dff6ba71b78048e086d350fcb99a558a8f92c8",
  "parents": [
    "99a1c3b63688231bd85860acfb055d8399035102"
  ],
  "author": {
    "name": "Marc-André Lureau",
    "email": "marcandre.lureau@redhat.com",
    "time": "Tue Jul 14 22:57:17 2026 +0400"
  },
  "committer": {
    "name": "Michael Tokarev",
    "email": "mjt@tls.msk.ru",
    "time": "Tue Jul 21 00:02:25 2026 +0300"
  },
  "message": "usbredir: fix use-after-free on buffered bulk packet overflow\n\nWhen usbredir_buffered_bulk_packet() splits a multi-fragment buffered\nbulk packet into max-packet-size chunks, only the final fragment owns\nthe shared parser allocation (via free_on_destroy). If bufp_alloc()\ndrops the final fragment due to queue overflow, it frees the backing\nbuffer while earlier fragments already queued still hold interior\npointers into it. Subsequent guest bulk-IN transfers then read from\nfreed heap memory.\n\nFix this by tracking how many fragments were queued during the current\npacket. When bufp_alloc() fails, remove all already-queued fragments\nfrom the tail of the endpoint queue before breaking out of the loop.\nIf the dropped fragment was non-final, free the data buffer explicitly\nsince no fragment took ownership.\n\nFixes: CVE-2026-15705\nFixes: b2d1fe67d09d (\"usbredir: Add support for buffered bulk input (v2)\")\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/3808\nReported-by: Feifan Qian \u003cbea1e@proton.me\u003e\nSigned-off-by: Marc-André Lureau \u003cmarcandre.lureau@redhat.com\u003e\nMessage-ID: \u003c20260714185717.1156157-1-marcandre.lureau@redhat.com\u003e\nSigned-off-by: Thomas Huth \u003cthuth@redhat.com\u003e\n(cherry picked from commit 9bf52d056a03cd3768caccbc4c88fcc34be26c28)\nSigned-off-by: Michael Tokarev \u003cmjt@tls.msk.ru\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "fda5bbca67615071ce6e0de9696bc661ab94208e",
      "old_mode": 33188,
      "old_path": "hw/usb/redirect.c",
      "new_id": "46db0b73af7ce559a1852985f1099cc5c8a83412",
      "new_mode": 33188,
      "new_path": "hw/usb/redirect.c"
    }
  ]
}