Hi Stefan! The following changes since commit 6333226c2abb72f31648c251624c56e70993d625:
Merge tag 'pull-9p-20260725' of https://github.com/cschoenebeck/qemu into staging (2026-07-26 08:30:07 -0400) are available in the Git repository at: https://gitlab.com/thuth/qemu.git tags/pull-request-2026-07-27 for you to fetch changes up to 92abc3c51ebb3223a6fdb5bd3414b2943d7653b2: hw/usb/hcd-xhci: Check return value of xhci_xfer_create_sgl() for errors (2026-07-27 13:00:45 +0200) ---------------------------------------------------------------- * Validate bounds in CXL "Set Feature" payloads * Fix guest-triggerable heap OOB access in "usb-uas" device * Fix possible crash via NULL pointer in ide_cancel_dma_sync() * Avoid possible assert() usb_packet_copy() * Check return value of xhci_xfer_create_sgl() for errors ---------------------------------------------------------------- Feifan Qian (1): hw/cxl: Validate Set Feature payload bounds Thomas Huth (4): hw/usb/dev-uas: Fix guest-triggerable heap OOB access hw/ide/core: Fix possible crash via NULL pointer in ide_cancel_dma_sync() hw/usb/core: Avoid possible assert() in do_parameter() --> usb_packet_copy() hw/usb/hcd-xhci: Check return value of xhci_xfer_create_sgl() for errors hw/cxl/cxl-mailbox-utils.c | 24 ++++++++++++++++++++++++ hw/ide/core.c | 9 ++++++++- hw/usb/core.c | 10 ++++++++++ hw/usb/dev-uas.c | 29 ++++++++++++++++++++--------- hw/usb/hcd-xhci.c | 10 +++++++--- 5 files changed, 69 insertions(+), 13 deletions(-)
