Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hardheaderlen in non-ring send paths packetsnd reads dev-hardheaderlen multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: validate skbdst before accessing it tc ingress and openvswitch do not guarantee that routing information is available. These subsystems rely on the conntrack helper infrastructure, and the SIP helper...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset causes the device to use the global tagset, whose driverdata remains NULL. Consequently, nullmapqueues falls back to the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmdnode-databuf. Several callers pass stack-allocated objects there. If waiteventinterruptibletimeout ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: bound device offsets in the MUX downlink decoder muxdladbdecode walks a chain of aggregated datagram tables using offsets and lengths taken from the modem. firsttableindex, nexttableindex, tablelength,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in in6devstatsget devgetbyindexrcu could return NULL if the original physical device is unregistered. Found by Sashiko...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: software node: Fix softwarenodegetreferenceargs with index -1 The bounds check for the index passed to softwarenodegetreferenceargs failed when UINTMAX was provided; this could result in an out-of-bounds access to the property...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept preallocation with socket teardown rxrpckernelchargeaccept reads rx-backlog without any socket/backlog synchronization and passes that raw pointer into rxrpcservicepreallocone. A concurrent...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket using isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from i...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claims and progresses a transfer; the RX path consumes Flow Control/echo frames; and two hrtimers...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronizercu in isotprelease isotpnotify unregisters the RCU CAN filters via canrxunregister and clears so-bound without waiting for a grace period. isotprelease uses so-bound to decide whether it...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: ipip: requires CAPNETADMIN in the device netns for changelink ipipchangelink operates on at most two netns: devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrminterface: requires CAPNETADMIN in the device’s netns for changelink xfrmichangelink operates on at most two netns: devnetdev and the interface link netns xi-net. These differ whenever the device is created in or moved ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00getfirmwarestate The mbxcmdt is allocated on the stack but left uninitialized. qla2x00mailboxcommand has several early-return paths PCI permanent failure, device failed, EEH busy, ISP...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: hwmon: adm1275: Prevent reading uninitialized stack While adding support for the ROHM BD127X0 hot-swap controllers, Sashiko reported an error in device-name comparison, which can lead to reading uninitialized stack memory. Quotin...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: veth: convert fraglist skbs before running XDP A fraglist skb can reach veth with datalen set but nrfrags zero. vethconvertskbtoxdpbuff only converts skbs that are shared, locked, have frags, or do not have enough headroom. It...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fix memory leak on registration failure The allocated device name is never freed on early ULPI device registration failures. This can be fixed by initializing the device structure earlier and releasing the initial...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate ranges in damonsetregions The DAMON core logic assumes that no length regions exist. However, several DAMON API callers—including DAMONSYSFS, DAMONRECLAIM, and DAMONLRUSORT—allow users to set empty...