356230 matches found
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice passes RMB pages to a pipe and takes a socket reference per entry, ensuring that the smcsock remains alive until the reader finishes. However, concurrent closes trigg...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO maxqlen accounting across reuseport migration The TCPFASTOPEN maxqlen of a listener becomes inaccurate, allowing far more pending Fast Open requests than it was originally configured to handle. This issue occurs...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhpinvokecallback unwinds earlier callbacks for the same hotplug state when one instance fails. Currently, the rollback path reuses ret, so a successful rollback can hide the...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Reject buffer reuse with different data length When data buffers are reused—for example, for interval sample records—the first record determines both the data length and the buffer size for user copy. Current...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: atomically update mac addresses When a MAC address is updated in batadvdatentryadd, it is done using a simple copy function. A parallel reader might only see parts of this update. In the worst case, the reader is...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix PBL chunk length computation On register MR, when creating a PBL, if it is an indirect PBL, we create a chunk list to store the pointers to PBL pages. Each chunk is 4KB in size and can hold 510 addresses...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Use kernel helpers for hex dumps Previously, when the driver printed hex dumps, the buffer was cast to an 8 byte long and printed using string formatters. If the buffer size was not a multiple of 8, a read buffer overflo...
Astra Linux – vulnerability in linux-6.12, linux-6.1
In the Linux kernel, the following vulnerability has been resolved: net: fix NULL pointer dereference in l3mdevl3rcv When delete l3s ipvlan: ip link del link eth0 ipvlan1 type ipvlan mode l3s This may cause a null pointer dereference: Call trace: iprcvfinish+0x48/0xd0 iprcv+0x5c/0x100...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: isofs: release zisofs block pointer buffer head zisofsfillpages reads the compressed block pointer table. The error paths release the current bufferhead; the loop also releases the old bufferhead when it advances. However, the...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvmiobusgetdev locking responsibilities to callers kvmiobusgetdev returns a device that is only matched by the address, and nothing else. This can cause a lifetime issue if the matched device is not the expected type, a...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: gpio: mt7621: avoid corruption of shared interrupt trigger state Bank-shared fields such as ‘rising’ and ‘falling’ are modified using non-atomic read-modify-write operations. Since each gpio chip instance represents an entire ban...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: kcm: Use WRITEONCE when changing lower socket callbacks kcmattach replaces the skdataready and skwritespace callbacks of a live lower TCP socket with KCM handlers, while kcmunattach restores them later. These callback pointer...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: ip6gre: fix hardware header length for NBMA tunnels ip6gretnllinkconfigroute accumulates the lower device’s hardware header length into dev-hardheaderlen whenever headerops is set. This is incorrect for both users of headerops...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm: fix NULL pointer dereference in graphcallback When q6apmfreefragments is called, it frees rxdata.buf/txdata.buf and sets them to NULL under graph-lock. A late DSP buffer-done response can race with this:...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stopthiscpu smpsendstop parks all secondary CPUs in stopthiscpu. The function marks the CPU offline for the scheduler via setcpuonlinefalse, but never informs RCU; thus, RCU continues to expe...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound copylcns dp-pagelcns index in analysis pass In logreplay’s analysis pass, after finddp returns a valid DIRPAGEENTRY for the targetattr, targetvcn tuple, the copylcns block walks lrh-lcnsfollow further entries: t16...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove auditdelrule is used for both netlink deletion templates and internal fsnotify autoremove. The former passes a parsed template which owns a temporary tree reference;...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: use skbcowhead in ip6tnlxmit ip6tnlxmit may need to expand headroom before it can push the outer IPv6 and optional encap headers. Currently, it does this by using skbreallocheadroom, copies skb-sk ownership, consumes t...