Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: USB: idmouse: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: kcov: Fix data corruption and race conditions on PREEMPTRT SyZBot reports that KCOV state corruption occurs on PREEMPTRT kernels. Currently, the temporary storage used for saving/restoring remote KCOV states is allocated as a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: driver core: use READONCE for dev-driver in devhassyncstate devhassyncstate reads dev-driver twice without holding devicelock -- once for the NULL check and once to dereference -syncstate. Some callers only hold...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: cs35l34: drains threaded IRQ before runtime suspend Currently, cs35l34runtimesuspend switches the codec to regcachecacheonlytrue, asserts reset low, and powers the device off without first quiescing the threaded IRQ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: cs35l33: drains threaded IRQ before runtime suspend Currently, cs35l33runtimesuspend switches the codec to regcachecacheonlytrue and powers it down without first quiescing the threaded IRQ registered by...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: portman2x4: Check card index validity at probe Although the portman2x4 driver performs a check on the given devptr-id value, it does not verify whether the value is negative; this value is often set to “none” or similar whe...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTORAW MUST drop incoming ICMP Yizhou Zhao reported that having just one RAW socket on protocol IPPROTORAW 255 is dangerous. socketAFINET, SOCKRAW, 255; A malicious incoming ICMP packet can set the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, while in urgent mode we refuse to build a multi-segment TSO packet, so every segment gets its own urgptr: / tcpwritexmit / limit = mssnow; if...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32rxdone appends each received CEC byte to rxmsg.msg using rxmsg.len as the write index, incrementing it on every RXBR receive-byte-ready interrupt without checking...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Protect sysfs discipline callbacks from accessing unallocated private data Several sysfs show/store handlers invoke a discipline callback that dereferences device-private, either directly or via the DASDDEFINEATTR macr...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: bmg160: bail out when bandwidth/filter is not in table bmg160getfilter iterates through bmg160sampfreqtable to find an entry matching the bwbits value read from the chip: for i = 0; i ARRAYSIZEbmg160sampfreqtable; ++i ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwactionframeparse rtwactionframeparse takes a framelen parameter but never actually checks it before indexing into the frame body: const u8 framebody = frame + sizeofstruct ieee80211hdr3addr;...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltechprocessrelpacket Make finger2 and also finger1 unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce-tgthint in freetgts When freetgts frees all structures in ce-tlist, ce-tgthint is left pointing to one of the freed cachedfstgt structures. If ce-tgthint is not reset before it is used later, it results in a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nfflowtableiterate only treats original-direction tuple nodes as owning entries. Publishing the original node first allows GC to observe and free a flow while flowoffloadadd is...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing device refcount for CAN filter removal sashiko-bot noted a problem related to concurrent device unregistration in isotp.c; this issue also exists in bcm.c. An earlier fix for raw.c, commit c275a176e4b6 “can:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm: Fix drmcrtccommit leak if signaled when PAGEFLIPEVENT is used Commit 1c6ceeee6ebb “drm/atomic: Fix memleak on ERESTARTSYS during non-blocking commits” addressed a very similar issue where the event is allocated by...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains until the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: read llcpsock-local under the socket lock in getsockopt nfcllcpgetsockopt reads llcpsock-local before locksocksk, then dereferences the cached pointer within the locked region. llcpsockbind assigns and clears...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice passes RMB pages to a pipe and takes a socket reference per entry, ensuring that the smcsock remains alive until the reader finishes. However, concurrent closes trigg...