)]}'
{
  "commit": "b9d248dfaca5e31377ea4f7204aae788a050bafd",
  "tree": "1b8869e4527752ae713d40fac2b7f57e531afff7",
  "parents": [
    "bf21298c082cc5561072bbfd79216d478861a5cd"
  ],
  "author": {
    "name": "Michael S. Tsirkin",
    "email": "mst@redhat.com",
    "time": "Fri Jul 24 07:26:29 2026 -0400"
  },
  "committer": {
    "name": "Michael S. Tsirkin",
    "email": "mst@redhat.com",
    "time": "Mon Jul 27 15:13:18 2026 -0400"
  },
  "message": "libvhost-user: fix heap overflow in vu_check_queue_inflights\n\nvu_check_queue_inflights counts inflight descriptors using inflight \u003d\u003d 1\nbut copies entries using inflight !\u003d 0. If the inflight field contains\nan unexpected non-0/1 value, the function copies more entries than it\nallocates and overflows the heap buffer.\n\nStop the copy pass once resubmit_num reaches the counted inuse value.\nNote: the value is not guest-accessible so not a security vulnerability.\n\nFixes: CVE-2026-63110\nFixes: 5f9ff1eff3 (\"libvhost-user: Support tracking inflight I/O in shared memory\")\nCc: Xie Yongji \u003cxieyongji@bytedance.com\u003e\nCc: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/3974\nReported-by: BB CC \u003cwywwzjj@gmail.com\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nMessage-Id: \u003ce2315efc526c0ee918485df4be69e2b26e8b7a73.1784892981.git.mst@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "c1c13dbc90be93a3d7d8ca5f5d5242456ace51e8",
      "old_mode": 33188,
      "old_path": "subprojects/libvhost-user/libvhost-user.c",
      "new_id": "a74d814bb48b5ae5fd87a9a9ff8ee9686f1931ee",
      "new_mode": 33188,
      "new_path": "subprojects/libvhost-user/libvhost-user.c"
    }
  ]
}