)]}'
{
  "commit": "70ec24885ddac7ae6ffb6a5e02df50beadea24bc",
  "tree": "321df2ac88d4554a6b04bc7954ed56e262227654",
  "parents": [
    "a8200aad075d1d0b56fed2780b1ee05f1ec7d516"
  ],
  "author": {
    "name": "Junrui Luo",
    "email": "moonafterrain@outlook.com",
    "time": "Sat Apr 04 15:44:35 2026 +0800"
  },
  "committer": {
    "name": "Kevin Berry",
    "email": "kpberry@google.com",
    "time": "Tue Jun 02 23:48:11 2026 -0700"
  },
  "message": "md/raid5: validate payload size before accessing journal metadata\n\ncommit b0cc3ae97e893bf54bbce447f4e9fd2e0b88bff9 upstream.\n\nr5c_recovery_analyze_meta_block() and\nr5l_recovery_verify_data_checksum_for_mb() iterate over payloads in a\njournal metadata block using on-disk payload size fields without\nvalidating them against the remaining space in the metadata block.\n\nA corrupted journal contains payload sizes extending beyond the PAGE_SIZE\nboundary can cause out-of-bounds reads when accessing payload fields or\ncomputing offsets.\n\nAdd bounds validation for each payload type to ensure the full payload\nfits within meta_size before processing.\n\nBUG\u003db/517291572\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2026-46070 in the Linux kernel.\n\ncos-patch: security-moderate\nFixes: b4c625c67362 (\"md/r5cache: r5cache recovery: part 1\")\nCc: stable@vger.kernel.org\nChange-Id: I6ac2928f037a31e4a1a9f543aad87b2a4c697fe4\nSigned-off-by: Junrui Luo \u003cmoonafterrain@outlook.com\u003e\nLink: https://lore.kernel.org/linux-raid/SYBPR01MB78815E78D829BB86CD7C8015AF5FA@SYBPR01MB7881.ausprd01.prod.outlook.com/\nSigned-off-by: Yu Kuai \u003cyukuai@fnnas.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Kernel CVE Triage Automation \u003ccloud-image-kernel-cve-triage-automation@prod.google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/154996\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Kevin Berry \u003ckpberry@google.com\u003e\nReviewed-by: Kevin Liu \u003czhihuil@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "53f3718c01ebe196bc9235bd9cfe026c0d7c9e26",
      "old_mode": 33188,
      "old_path": "drivers/md/raid5-cache.c",
      "new_id": "eac024485791043538d8a4ccaa2cd8905443ad09",
      "new_mode": 33188,
      "new_path": "drivers/md/raid5-cache.c"
    }
  ]
}