Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: j1939: implement NETDEVUNREGISTER notification handler syzbot is reporting unregisternetdevice: waiting for vcan0 to become free. Usage count = 2 The problem is that the J1939 protocol does not have a NETDEVUNREGISTER...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: schtaprio: Replace direct dequeue call with peek and qdiscdequeuepeeked When taprio’s software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gsoskb; tapriodequeuefromtxq then tak...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Reject buffer reuse with different data length When data buffers are reused—for example, for interval sample records—the first record determines both the data length and the buffer size for user copy. Current...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Do not use testbit in lockless RCU readers in hash types Sashiko pointed out that there are a few lockless RCU readers using testbit, which is a relaxed atomic operation and provides no memory barrier guarantees...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix length check importwpinfo struct kvmhwbreakpoint::len is a u64 that is fully controlled by user space. This value is then assigned to wpinfo-len, which is an int. The bounds check is performed on the truncated valu...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: USB: c67x00: fix use-after-free in c67x00addisourb When TD creation fails for the last packet of an isochronous URB, c67x00addisourb returns the URB to the caller before updating the endpoint scheduling state. c67x00givebackurb...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fibnhcupdatemtu fibnhcupdatemtu walks the nexthop exception table under RTNL; however, RTNL does not serialize this walk with PMTU exception updates. The walk uses rcudereferenceprotected with a consta...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nfflowtableiterate only treats original-direction tuple nodes as owning entries. Publishing the original node first allows GC to observe and free a flow while flowoffloadadd is...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: keembay - Initialize completion before requesting IRQ kmbocsaesprobe requests the device IRQ before initializing irqcompletion. Once the handler is registered, it can run immediately; ocsaesirqhandler unconditionally call...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: tda18250: fix possible integer overflow An integer overflow may occur when variable exp equals zero. The result of shifting 1 exp - 1 may then lead to undefined behavior...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space using for i = 0; i registersize/sizeofu32; i++ which results in one extra iteration. savedconfigspac...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: serial: msm: Disable DMA for kernel console UART Currently, concurrent writes from user space and the kernel to the console can trigger a race condition that results in an infinite loop of the same messages being printed...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes atascsiwritesamexlat converts a SCSI WRITE SAME command with the UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM descriptor is constructe...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: cmipci: check sndctlnew1 return value sndctlnew1 can return NULL when memory allocation fails. sndcmipcispdifcontrols does not check the return value before dereferencing kctl-id.device, which can lead to a NULL pointer...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/gud: NUL-terminate TV mode names read from the device gudconnectoraddtvmode reads a buffer of fixed-size mode names from the USB device and passes pointers into it to drmmodecreatetvpropertieslegacy, which calls strlen on eac...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: wake linked drain waiters on unlink sndpcmdrain on a linked stream parks an on-stack wait entry on the drained peer’s runtime-sleep, and after scheduletimeout removes it only if that peer is still found in the caller’s...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Avoid buffer overread in ath11kwmitlvoprx Currently, in ath11kwmitlvoprx, the firmware buffer is read without first verifying that the buffer has enough data to hold a header. This could result in a buffer overread...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix NULL pointer dereference in debugfs shrinkerdebugfsadd creates both “count” and “scan” debugfs files unconditionally. This assumes that every shrinker implements both countobjects and scanobjects, which is not...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxswspvrslpmtreereplace When mlxswspvrslpmtreereplace fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: validate assoc response length before subtracting header wilcparseassocrespinfo computes the trailing IE length as ieslen = bufferlen - sizeofres; without first checking that bufferlen is at least sizeofstruct...