)]}'
{
  "commit": "772cecf198da732faebb5dcfc46d66a505be8495",
  "tree": "477ccc145bc5973aa7d806445cd8e4f6b38a0b4c",
  "parents": [
    "a84b6fedbc97078788be78dbdd7517d143ad1a77"
  ],
  "author": {
    "name": "Florian Westphal",
    "email": "fw@strlen.de",
    "time": "Tue Jun 09 21:28:09 2026 +0200"
  },
  "committer": {
    "name": "Pablo Neira Ayuso",
    "email": "pablo@netfilter.org",
    "time": "Wed Jun 10 18:00:12 2026 +0200"
  },
  "message": "netfilter: nft_exthdr: fix register tracking for F_PRESENT flag\n\nnft_exthdr_init() passes user-controlled priv-\u003elen to\nnft_parse_register_store(), which marks that many bytes in the\nregister bitmap as initialized.  However, when NFT_EXTHDR_F_PRESENT\nis set, the eval paths write only 1 byte (nft_reg_store8) or\n4 bytes (*dest \u003d 0 on TCP/DCCP error path).  When len \u003e 4,\nregisters beyond the first are never written, retaining\nuninitialized stack data from nft_regs.\n\nBail out if userspace requests too much data when F_PRESENT is set.\n\nReported-by: Ji\u0027an Zhou \u003ceilaimemedsnaimel@gmail.com\u003e\nFixes: c078ca3b0c5b (\"netfilter: nft_exthdr: Add support for existence check\")\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e6a07c0df2079fe46c25ca04a170258da0a1ec4a",
      "old_mode": 33188,
      "old_path": "net/netfilter/nft_exthdr.c",
      "new_id": "d3fc7969f123c994a7d45ace64f20755afe43f52",
      "new_mode": 33188,
      "new_path": "net/netfilter/nft_exthdr.c"
    }
  ]
}