)]}'
{
  "commit": "c65deba6dff0140c423ef2146addf6277bc942f8",
  "tree": "dde4c8812c13691f6b92a51b4e49fc3f36d8ce99",
  "parents": [
    "19cc070c0f9a696f1ec666a1c12e685222e54963"
  ],
  "author": {
    "name": "Weiming Shi",
    "email": "bestswngs@gmail.com",
    "time": "Wed May 20 09:00:21 2026 -0700"
  },
  "committer": {
    "name": "Kevin Liu",
    "email": "zhihuil@google.com",
    "time": "Mon Jun 15 10:33:09 2026 -0700"
  },
  "message": "tun: free page on short-frame rejection in tun_xdp_one()\n\n[ Upstream commit f4feb1e20058e407cb00f45aff47f5b7e19a6bbf ]\n\ntun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without\nfreeing the page that vhost_net_build_xdp() allocated for it.\ntun_sendmsg() discards that -EINVAL and still returns total_len, so\nvhost_tx_batch() takes the success path and never frees the page; each\nshort frame in a batch leaks one page-frag chunk.\n\nA local process that can open /dev/net/tun and /dev/vhost-net can hit\nthis path: it attaches a tun/tap device as the vhost-net backend and\nfeeds TX descriptors whose length minus the virtio-net header is below\nETH_HLEN. Each kick leaks the page-frag chunks for that batch, and a\ntight submission loop exhausts host memory and triggers an OOM panic.\nFree the page before returning -EINVAL, matching the XDP-program error\npath in the same function.\n\nBUG\u003db/522217416\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2026-46321 in the Linux kernel.\n\ncos-patch: security-high\nFixes: 049584807f1d (\"tun: add missing verification for short frame\")\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nChange-Id: I44b8484fc2795e56570564f7dbcde14f495badba\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nReviewed-by: Dongli Zhang \u003cdongli.zhang@oracle.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260520160020.375349-2-bestswngs@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/160064\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Daniel Velasquez \u003crdvelasquez@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "fb9d425eff8c1b1c3e20a38349bc0d55fc0ca7ee",
      "old_mode": 33188,
      "old_path": "drivers/net/tun.c",
      "new_id": "19c33d21bab947434c85480ea9093d4b2a394775",
      "new_mode": 33188,
      "new_path": "drivers/net/tun.c"
    }
  ]
}