From 9d3adf8db6da40a2e5966ca44989eedddc71a2f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A1n=20Tomko?= Date: Thu, 20 Aug 2026 15:17:25 +0200 Subject: [PATCH] qemu: agent: clear stale pointer in qemuAgentGetDisks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2026-77158 In case of hitting the cleanup label, the disks array was freed but the pointer was not cleared, leading to a possible double free. Fixes: 0cb2d9f05d00497a715352f6ea28cf8fb6921731 (v6.10.0-9-g0cb2d9f05d) Closes: https://gitlab.com/libvirt/libvirt/-/work_items/910 Reported-by: David Korczynski (Ada Logics) Found-by: Claude Signed-off-by: Ján Tomko Reviewed-by: Peter Krempa --- src/hypervisor/qemu_agent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/hypervisor/qemu_agent.c b/src/hypervisor/qemu_agent.c index f5f50e3c92..431407b68e 100644 --- a/src/hypervisor/qemu_agent.c +++ b/src/hypervisor/qemu_agent.c @@ -2562,7 +2562,7 @@ int qemuAgentGetDisks(qemuAgent *agent, for (i = 0; i < ndata; i++) { qemuAgentDiskInfoFree((*disks)[i]); } - g_free(*disks); + g_clear_pointer(disks, g_free); return -1; }