Hi Stefan!
The following changes since commit 6333226c2abb72f31648c251624c56e70993d625:
Merge tag 'pull-9p-20260725' of https://github.com/cschoenebeck/qemu into staging (2026-07-26 08:30:07 -0400)
are available in the Git repository at:
https://gitlab.com/thuth/qemu.git tags/pull-request-2026-07-27
for you to fetch changes up to 92abc3c51ebb3223a6fdb5bd3414b2943d7653b2:
hw/usb/hcd-xhci: Check return value of xhci_xfer_create_sgl() for errors (2026-07-27 13:00:45 +0200)
----------------------------------------------------------------
* Validate bounds in CXL "Set Feature" payloads
* Fix guest-triggerable heap OOB access in "usb-uas" device
* Fix possible crash via NULL pointer in ide_cancel_dma_sync()
* Avoid possible assert() usb_packet_copy()
* Check return value of xhci_xfer_create_sgl() for errors
----------------------------------------------------------------
Feifan Qian (1):
hw/cxl: Validate Set Feature payload bounds
Thomas Huth (4):
hw/usb/dev-uas: Fix guest-triggerable heap OOB access
hw/ide/core: Fix possible crash via NULL pointer in ide_cancel_dma_sync()
hw/usb/core: Avoid possible assert() in do_parameter() --> usb_packet_copy()
hw/usb/hcd-xhci: Check return value of xhci_xfer_create_sgl() for errors
hw/cxl/cxl-mailbox-utils.c | 24 ++++++++++++++++++++++++
hw/ide/core.c | 9 ++++++++-
hw/usb/core.c | 10 ++++++++++
hw/usb/dev-uas.c | 29 ++++++++++++++++++++---------
hw/usb/hcd-xhci.c | 10 +++++++---
5 files changed, 69 insertions(+), 13 deletions(-)