Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4initcpstate nfs4allocinitcpntfstate publishes the new cpntf entry into the s2scpstateids IDR with cstype set within one s2scplock section; it then reacquires the lock to insert it into...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421: Fix shift-out-of-bounds in max3421hubcontrol The max3421hubcontrol function handles USB hub class requests to the virtual root hub. In both the ClearPortFeature and SetPortFeature switch statements, it modifie...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make releasescratchbuffers idempotent brcmfpciereleasescratchbuffers frees the shared.scratch and shared.ringupd DMA buffers using dmafreecoherent, but does not clear the pointers afterward—unlike the sibling...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: preserve tcskbcb across defragmentation tcfcthandlefragments calls nfcthandlefragments without saving and restoring skb-cb. The defrag helper clears IPCB/IP6CB, which aliases the tcskbcb/qdiscskbcb control buffe...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation slreallocbufs replaces rbuff and updates buffsize while holding sl-lock. slipreceivebuf reads those fields and writes through rbuff without holding the lock. Therefore, a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx11: replace BUGON with WARNON There’s no need to crash the kernel for these cases. cherry picked from commit daa62107452d2451787c4248ca38fa2d1a0cbefd...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvmesetupdiscard always maps sizeofstruct nvmedsmrange NVMEDSMMAXRANGES = 4096 bytes as the DSM payload however many ranges the command declares, because some devices ignore the 'Number of...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidiocsfmtvidcap and vidiocsstd modify the device-wide dev-width / dev-norm values; however, they only refuse such changes when the video queue dev-vidq is...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL pointer dereference in ath11khalsrngaccessbegin In ATH11KQMIEVENTFWREADY, ATH11KFLAGREGISTERED is set unconditionally even when ath11kcoreqmifirmwareready fails. This leaves the driver in an inconsistent...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix missing pointer check in hdacomponentmanagerinit function The componentmatchadd function may assign the ‘matchptr’ pointer the value ERRPTR-ENOMEM, which will subsequently be dereferenced. The call stack leading to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: geneve: requires CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns: devnetdev and the sticky underlay netns geneve-net. They differ once the device is created in or moved to a netns...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hardheaderlen in non-ring send paths packetsnd reads dev-hardheaderlen multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: validate skbdst before accessing it tc ingress and openvswitch do not guarantee that routing information is available. These subsystems rely on the conntrack helper infrastructure, and the SIP helper...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset causes the device to use the global tagset, whose driverdata remains NULL. Consequently, nullmapqueues falls back to the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmdnode-databuf. Several callers pass stack-allocated objects there. If waiteventinterruptibletimeout ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: bound device offsets in the MUX downlink decoder muxdladbdecode walks a chain of aggregated datagram tables using offsets and lengths taken from the modem. firsttableindex, nexttableindex, tablelength,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in in6devstatsget devgetbyindexrcu could return NULL if the original physical device is unregistered. Found by Sashiko...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: software node: Fix softwarenodegetreferenceargs with index -1 The bounds check for the index passed to softwarenodegetreferenceargs failed when UINTMAX was provided; this could result in an out-of-bounds access to the property...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept preallocation with socket teardown rxrpckernelchargeaccept reads rx-backlog without any socket/backlog synchronization and passes that raw pointer into rxrpcservicepreallocone. A concurrent...