)]}'
{
  "commit": "d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320",
  "tree": "909fcaf5a8105f7aa09955d507395d96fb25dc70",
  "parents": [
    "6973a21ee73c5567f883813c8ef414774b45892f"
  ],
  "author": {
    "name": "Kyle Zeng",
    "email": "kylebot@openai.com",
    "time": "Tue Aug 04 06:10:37 2026 +0000"
  },
  "committer": {
    "name": "Steffen Klassert",
    "email": "steffen.klassert@secunet.com",
    "time": "Tue Aug 18 12:16:19 2026 +0200"
  },
  "message": "xfrm: fix compat ALLOCSPI request use-after-free\n\nxfrm_state_netlink() builds the ALLOCSPI response with\ndump_one_state(), which already calls alloc_compat() with the response\nskb and header.\n\nxfrm_alloc_userspi() then calls alloc_compat() again, but passes the\noriginal request skb and its header. For a compat request, the\ntranslator therefore interprets the 228-byte compat xfrm_userspi_info\nas the 232-byte native layout and reads four bytes past the declared\npayload. It also publishes the translated child through the request\u0027s\nfrag_list.\n\nA multicast clone of the request shares skb_shared_info and can observe\nthat child. xfrm_user_rcv_msg() frees it after the request handler\nreturns, racing a compat receiver which may still be copying from it and\nresulting in a use-after-free.\n\nRemove the redundant conversion. The response keeps its correct compat\ntranslation from dump_one_state(), and no child is attached to the\ninbound request.\n\nFixes: 5f3eea6b7e8f (\"xfrm/compat: Attach xfrm dumps to 64\u003d\u003e32 bit translator\")\nAssisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nCo-developed-by: David Lee \u003cdavid.lee@trailofbits.com\u003e\nSigned-off-by: David Lee \u003cdavid.lee@trailofbits.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "980dbeb5a57de6d5b73b5e38784756483ef2a3e2",
      "old_mode": 33188,
      "old_path": "net/xfrm/xfrm_user.c",
      "new_id": "a2587c7e796b4ee4706adc4a4a9dd2898e5f8e45",
      "new_mode": 33188,
      "new_path": "net/xfrm/xfrm_user.c"
    }
  ]
}