)]}'
{
  "commit": "c8f7244c8cccaaed4e6c9fe4b8a07e101d0423e5",
  "tree": "410de56141b25893ef9a03f0c23982d512c9eabd",
  "parents": [
    "770b136ff9bf3e319d19875da59c4f7f4853da3a"
  ],
  "author": {
    "name": "Eric Dumazet",
    "email": "edumazet@google.com",
    "time": "Tue May 05 15:39:27 2026 +0000"
  },
  "committer": {
    "name": "Jakub Kicinski",
    "email": "kuba@kernel.org",
    "time": "Wed May 06 18:11:33 2026 -0700"
  },
  "message": "tcp: tcp_child_process() related UAF\n\ntcp_child_process( .. child ...) currently calls sock_put(child).\n\nUnfortunately @child (named @nsk in callers) can be used after\nthis point to send a RST packet.\n\nTo fix this UAF, I remove the sock_put() from tcp_child_process()\nand let the callers handle this after it is safe.\n\nRemove @rsk variable in tcp_v4_do_rcv() and change tcp_v6_do_rcv()\nso that both functions look the same.\n\nFixes: cfb6eeb4c860 (\"[TCP]: MD5 Signature Option (RFC2385) support.\")\nReported-by: Damiano Melotti \u003cmelotti@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260505153927.3435532-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "8fc24c3743c5f905f8e07a26fb0edb40fb6ab767",
      "old_mode": 33188,
      "old_path": "net/ipv4/tcp_ipv4.c",
      "new_id": "c0526cc0398049fb34b5de20a1175d54942e80cd",
      "new_mode": 33188,
      "new_path": "net/ipv4/tcp_ipv4.c"
    },
    {
      "type": "modify",
      "old_id": "199f0b579e89cf25689e74a8d37bb0c022a6c92d",
      "old_mode": 33188,
      "old_path": "net/ipv4/tcp_minisocks.c",
      "new_id": "e6092c3ac840bdc1f62d4435c414e7f79edc10c2",
      "new_mode": 33188,
      "new_path": "net/ipv4/tcp_minisocks.c"
    },
    {
      "type": "modify",
      "old_id": "2c3f7a739709d7b89f376f79b71173e5f2d8e64e",
      "old_mode": 33188,
      "old_path": "net/ipv6/tcp_ipv6.c",
      "new_id": "51583aef0643e92c961fc00f48f1192184d087ed",
      "new_mode": 33188,
      "new_path": "net/ipv6/tcp_ipv6.c"
    }
  ]
}