Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: validate ONFI extended parameter page sections nandflashdetectextparampage allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsbpf: prevent unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in clsbpfoffloadcmd. Reproducer on netdevsim: add a skipsw clsbpf filter, set the bpftcaccept debugfs knob to 0, then tc filt...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers basereleasememorypools unconditionally frees every ioc-pciesglookup entry, including ones the setup loop never allocated after a partial failure, causing a “bad dma” warni...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsiallocsgtables During fuzz testing, the following issue was discovered: BUG: KMSAN: uninit-value in dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x4a/0x70...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rspinfolen to avoid OOB sense-data read In qla2x00statusentry, the FWI2 status path advances sensedata and shrinks parsenselen by rspinfolen: if ISFWI2CAPABLEha sensedata += rspinfolen; parsenselen -=...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313rtcprobe calls devmrequestirq with IRQFSHARED and &pdev-dev as the cookie, but platformsetdrvdata is only called later after the clock setup. With a shared IRQ line...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver indexes the connector’s port altmode array using the GETCURRENTCAM response; this indexing is performed only after verifying that the value is...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: initialize resetwork at allocation time ffsfskillsb unconditionally calls cancelworksync on ffs-resetwork when a functionfs instance is unmounted: ffsdataresetffs; cancelworksync&ffs-resetwork; However,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling amseventtochannel may return a pointer past the end of dev-channels when no matching scanindex is found. This can lead to invalid memory access in...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page Table capacity in logreplay copylcns During the analysis phase of $LogFile journal replay, logreplay copies LCNs from each action log record into an existing Dirty Page Table DPT entry without boundi...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix register corruption from uninitialized cregs on error compatriscvgprset calls cregstoregs unconditionally, even when userregsetcopyin fails. Since cregs is an uninitialized stack variable, a copyin failure causes...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd When the remote proc starts while the NGD driver is being probed, or when the remote proc is already up during PDR lookup registration, or in the theoretical...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: radio-si476x: Unregister v4l2device on probe failure si476xradioprobe registers radio-v4l2dev before allocating the V4L2 controls and before registering the video device. If any of these later steps fail, the probe returns...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: cobalt: Avoid freeing ALSA private data twice sndcobaltcardcreate stores cobsc in sc-privatedata and installs sndcobaltcardprivatefree as sc-privatefree. From that point, sndcardfreesc releases cobsc through the ALSA card...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: rds: drop incoming messages that cross network namespace boundaries rdsfindbound looks up the destination socket using a global rhashtable keyed solely on addr, port, scopeid. Network namespaces are not part of the key, so a send...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix order of kfreercu and rcuassignpointer Sashiko pointed out that kfreercu was called before rcuassignpointer in handling the comment extension. Fix the order so that rcuassignpointer is called first...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix stale rx/tx ops after device removal RX: an RXSETUP update! for an existing op skipped canrxregister unconditionally, even when a concurrent NETDEVUNREGISTER had already torn down its registration op-rxregdev == NUL...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: Replace the guest-triggerable BUGON in ioeventfd datamatch with getunaligned Remove a BUGON that has been reachable since its initial addition, dating back to 2009, and instead use getunaligned to perform potentially-unalign...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring that the application writes directly; hence rxepostsend takes the isuser branch and schedules sendtask without validating the WQE...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Serialize flash version read in reset handler The “update cache versions without reset” sysfs reset operation 0x20261 calls getflashversion, which reads hardware flash registers, without holding ha-optrommutex. The...