mirror of
https://gitlab.com/qemu-project/qemu.git
synced 2026-08-26 22:23:12 -04:00
1f0495f4a3
Fix a heap-use-after-free in the virtio-rng frontend when a delayed
rng-random backend completion arrives after the virtio-rng device has been
hot-unplugged.
Fixes: CVE-2026-50624
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3917
Reported-by: Jia Jia <physicalmtea@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260724094931.3005968-1-lvivier@redhat.com>
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| accel-blocker.h | ||
| accel-ops.h | ||
| arch_init.h | ||
| balloon.h | ||
| block-backend-common.h | ||
| block-backend-global-state.h | ||
| block-backend-io.h | ||
| block-backend.h | ||
| block-ram-registrar.h | ||
| blockdev.h | ||
| confidential-guest-support.h | ||
| cpu-throttle.h | ||
| cpu-timers-internal.h | ||
| cpu-timers.h | ||
| cpus.h | ||
| cryptodev-vhost-user.h | ||
| cryptodev-vhost.h | ||
| cryptodev.h | ||
| device_tree.h | ||
| dirtylimit.h | ||
| dirtyrate.h | ||
| dma.h | ||
| dump-arch.h | ||
| dump.h | ||
| event-loop-base.h | ||
| host_iommu_device.h | ||
| hostmem.h | ||
| hvf.h | ||
| hvf_int.h | ||
| hw_accel.h | ||
| iommufd.h | ||
| iothread.h | ||
| kvm.h | ||
| kvm_int.h | ||
| kvm_xen.h | ||
| memory_mapping.h | ||
| numa.h | ||
| nvmm.h | ||
| os-posix.h | ||
| os-win32.h | ||
| qtest.h | ||
| replay.h | ||
| reset.h | ||
| rng-random.h | ||
| rng.h | ||
| rtc.h | ||
| runstate-action.h | ||
| runstate.h | ||
| seccomp.h | ||
| spdm-socket.h | ||
| stats.h | ||
| system.h | ||
| tcg.h | ||
| tpm.h | ||
| tpm_backend.h | ||
| tpm_util.h | ||
| vhost-user-backend.h | ||
| watchdog.h | ||
| whpx.h | ||
| xen-mapcache.h | ||
| xen.h | ||