On Fri, Aug 21, 2026 at 12:22:35 +0200, Ján Tomko via Devel wrote: > From: Ján Tomko <[email protected]> > > CVE-2026-77158 > > In case of hitting the cleanup label, the disks array > was freed but the pointer was not cleared, leading > to a possible double free. > > Fixes: 0cb2d9f05d00497a715352f6ea28cf8fb6921731 (v6.10.0-9-g0cb2d9f05d) > Closes: https://gitlab.com/libvirt/libvirt/-/work_items/910 > Reported-by: David Korczynski (Ada Logics) > Found-by: Claude > Signed-off-by: Ján Tomko <[email protected]> > --- > src/hypervisor/qemu_agent.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/src/hypervisor/qemu_agent.c b/src/hypervisor/qemu_agent.c > index f5f50e3c92..431407b68e 100644 > --- a/src/hypervisor/qemu_agent.c > +++ b/src/hypervisor/qemu_agent.c > @@ -2562,7 +2562,7 @@ int qemuAgentGetDisks(qemuAgent *agent, > for (i = 0; i < ndata; i++) { > qemuAgentDiskInfoFree((*disks)[i]); > } > - g_free(*disks); > + g_clear_pointer(disks, g_free); > return -1; > } > > -- > 2.55.0 >
Reviewed-by: Peter Krempa <[email protected]>
