Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject oversized encryptedkeysize in parsetag3packet parsetag3packet sets encryptedkeysize from the Tag 3 packet body without bounding it against ECRYPTFSMAXKEYBYTES 64. When encryptedkeysize 64,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid block index in GC ioctl Syzbot reported list corruption caused by a double listaddtail call on bh-bassocbuffers within nilfslookupdirtydatabuffers. Analysis revealed that the root cause was the insertion of...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Remove buffer from list prior to unmap operation fastrpcreqmunmapimpl is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free on mmstruct in bpffindvma bpffindvma reads task-mm and calls mmapreadtrylockmm without holding a reference on the mm. On a foreign task, a concurrent exitmm can free the mmstruct between the lockless read...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free in x25killbyneigh x25killbyneigh iterates through the global X.25 socket list to find sockets connected to a terminating neighbor. x25listlock protects the list membership while the lookup is in...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhpinvokecallback unwinds earlier callbacks for the same hotplug state when one instance fails. Currently, the rollback path reuses ret, so a successful rollback can hide the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with eventinput sndmidiinputevent must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: do not write beyond optlen in getsockopt pepgetsockopt clamps the reported length to the caller’s buffer using mint, but then stores the value via putuserval, int user optval, which always writes sizeofint bytes...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm: Fix drmcrtccommit leak if signaled when PAGEFLIPEVENT is used Commit 1c6ceeee6ebb “drm/atomic: Fix memleak on ERESTARTSYS during non-blocking commits” addressed a very similar issue where the event is allocated by...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce-tgthint in freetgts When freetgts frees all structures in ce-tlist, ce-tgthint is left pointing to one of the freed cachedfstgt structures. If ce-tgthint is not reset before it is used later, it results in a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: reject a flag character as the field delimiter The registration string starts with a user-specified delimiter that separates the individual fields. To ensure that field parsers terminate even on a truncated string,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix device reference leak in host1xdeviceparsedt error path After deviceinitialize, the embedded struct device in struct host1xdevice should be released via the device core using putdevice. In host1xdeviceadd, if...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but eramap calculates the writeset block before applying the target offset. Therefore, tables with a non-zero start...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. snumentries stores the number of entries in that array, not the highest valid index...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vduse: hold vduselock across IDR lookup in open path vdusedevopen looks up struct vdusedev through the IDR and then acquires dev-lock only after vduselock has been dropped. This creates a race condition where a concurrent...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: rapidio/tsi721: prevent a bad dereference in tsi721dbdpc Using a listforeach loop, if we fail to find the target item in the list, the loop terminates with the iterator—“dbell” in this case—pointing to invalid memory. This code...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel sched scan results work on unregister cfg80211schedscanresults can queue rdev-schedscanreswk from a driver result notification while a scheduled scan request is present. The work callback recovers the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00libprobedev uses the full rt2x00libremovedev teardown for all probe failures. However, drvdata allocation and workqueue allocation can fail before intfwork,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Check card index validity at probe The aloop driver blindly trusts that the given devptr-id value is within the proper card index range during probe. It’s acceptable for the devices created by the driver itself at th...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix listdel corruption in kfdcriuresumesvm The cleanup tail of kfdcriuresumesvm walks svms-criusvmmetadatalist and kfrees each struct criusvmmetadata without removing them from the list. The list head remains pointing...