)]}'
{
  "commit": "d530f2dfbd2d973b17a6d0ffbfe2afb692bdd69c",
  "tree": "8b8dbefbc07e70b1d0ae8926b8ff40cef548d031",
  "parents": [
    "a5cff318f06cd06b37224e15ee74d64d1df8b12b"
  ],
  "author": {
    "name": "Michael S. Tsirkin",
    "email": "mst@redhat.com",
    "time": "Mon Jul 20 01:26:42 2026 -0400"
  },
  "committer": {
    "name": "Michael S. Tsirkin",
    "email": "mst@redhat.com",
    "time": "Mon Jul 27 15:12:00 2026 -0400"
  },
  "message": "virtio: fix queue size validation against allocated maximum\n\nvirtio_add_queue() allocates used_elems for num_default entries, but\nvirtio_queue_set_num() accepts larger guest-supplied queue sizes up to\nVIRTQUEUE_MAX_SIZE. With VIRTIO_F_IN_ORDER, this lets the guest drive\nused_elems accesses past the allocation and cause out-of-bounds reads\nand writes.\n\nReject queue sizes larger than num_default in virtio_queue_set_num()\nand mark the device broken.\n\nFixes: e63c0ba1bc (\"virtio: Add support for guest setting of queue size\")\nFixes: CVE-2026-50626\nCc: Peter Maydell \u003cpeter.maydell@linaro.org\u003e\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/3882\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/3921\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/3923\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/3613\nReported-by: huntr bubble \u003cbubblehuntr@gmail.com\u003e\nReported-by: Jia Jia \u003cphysicalmtea@gmail.com\u003e\nReported-by: Miku Hatsune \u003canznu1l@gmail.com\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nMessage-ID: \u003ceb7cc3672a20db392f577edbece2300aa6754dd3.1784898967.git.mst@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "cdc8ba76f153552f543be1671ade67437bb0d57f",
      "old_mode": 33188,
      "old_path": "hw/virtio/virtio.c",
      "new_id": "4a6430c31c45a7fcae178c5d0da84511ceaf3e00",
      "new_mode": 33188,
      "new_path": "hw/virtio/virtio.c"
    }
  ]
}