)]}'
{
  "commit": "c12cbf56320fb633484ee0ca1fb7d68d6b64b213",
  "tree": "66f14b8a1a5ab0ecebdf98f292814b5a65f882ec",
  "parents": [
    "7bad4bda74dc4713f398d3b7624ff05478e3a568"
  ],
  "author": {
    "name": "Zihan Xi",
    "email": "zihanx@nebusec.ai",
    "time": "Tue Jul 28 01:30:32 2026 +0800"
  },
  "committer": {
    "name": "Steffen Klassert",
    "email": "steffen.klassert@secunet.com",
    "time": "Tue Jul 28 10:48:18 2026 +0200"
  },
  "message": "xfrm: fix xfrm_state_construct() auth-trunc leak\n\nattach_auth_trunc() can allocate x-\u003eaalg while leaving\nx-\u003eprops.aalgo at zero when the selected auth algorithm has no\nsadb_alg_id. One real case is cmac(aes).\n\nxfrm_state_construct() then treats !x-\u003eprops.aalgo as \"no auth\nalgorithm attached yet\" and calls attach_auth(). That overwrites\nx-\u003eaalg and loses the first allocation. Any later failure or teardown\nonly frees the replacement pointer.\n\nCheck whether x-\u003eaalg is already attached instead of inferring that\nstate from x-\u003eprops.aalgo.\n\nFixes: 4447bb33f094 (\"xfrm: Store aalg in xfrm_state with a user specified truncation length\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nAssisted-by: Codex:gpt-5.4\nSigned-off-by: Zihan Xi \u003czihanx@nebusec.ai\u003e\nSigned-off-by: Ren Wei \u003cenjou1224z@gmail.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "d6db63304ba6bd5bbd9c09c665170936e1107ced",
      "old_mode": 33188,
      "old_path": "net/xfrm/xfrm_user.c",
      "new_id": "6266a92cf302085fbba2a42720d25d06dde77688",
      "new_mode": 33188,
      "new_path": "net/xfrm/xfrm_user.c"
    }
  ]
}