Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm: fix NULL pointer dereference in graphcallback When q6apmfreefragments is called, it frees rxdata.buf/txdata.buf and sets them to NULL under graph-lock. A late DSP buffer-done response can race with this:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stopthiscpu smpsendstop parks all secondary CPUs in stopthiscpu. The function marks the CPU offline for the scheduler via setcpuonlinefalse, but never informs RCU; thus, RCU continues to expe...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound copylcns dp-pagelcns index in analysis pass In logreplay’s analysis pass, after finddp returns a valid DIRPAGEENTRY for the targetattr, targetvcn tuple, the copylcns block walks lrh-lcnsfollow further entries: t16...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove auditdelrule is used for both netlink deletion templates and internal fsnotify autoremove. The former passes a parsed template which owns a temporary tree reference;...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: use skbcowhead in ip6tnlxmit ip6tnlxmit may need to expand headroom before it can push the outer IPv6 and optional encap headers. Currently, it does this by using skbreallocheadroom, copies skb-sk ownership, consumes t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4initcpstate nfs4allocinitcpntfstate publishes the new cpntf entry into the s2scpstateids IDR with cstype set within one s2scplock section; it then reacquires the lock to insert it into...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421: Fix shift-out-of-bounds in max3421hubcontrol The max3421hubcontrol function handles USB hub class requests to the virtual root hub. In both the ClearPortFeature and SetPortFeature switch statements, it modifie...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make releasescratchbuffers idempotent brcmfpciereleasescratchbuffers frees the shared.scratch and shared.ringupd DMA buffers using dmafreecoherent, but does not clear the pointers afterward—unlike the sibling...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: preserve tcskbcb across defragmentation tcfcthandlefragments calls nfcthandlefragments without saving and restoring skb-cb. The defrag helper clears IPCB/IP6CB, which aliases the tcskbcb/qdiscskbcb control buffe...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation slreallocbufs replaces rbuff and updates buffsize while holding sl-lock. slipreceivebuf reads those fields and writes through rbuff without holding the lock. Therefore, a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx11: replace BUGON with WARNON There’s no need to crash the kernel for these cases. cherry picked from commit daa62107452d2451787c4248ca38fa2d1a0cbefd...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvmesetupdiscard always maps sizeofstruct nvmedsmrange NVMEDSMMAXRANGES = 4096 bytes as the DSM payload however many ranges the command declares, because some devices ignore the 'Number of...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidiocsfmtvidcap and vidiocsstd modify the device-wide dev-width / dev-norm values; however, they only refuse such changes when the video queue dev-vidq is...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL pointer dereference in ath11khalsrngaccessbegin In ATH11KQMIEVENTFWREADY, ATH11KFLAGREGISTERED is set unconditionally even when ath11kcoreqmifirmwareready fails. This leaves the driver in an inconsistent...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix missing pointer check in hdacomponentmanagerinit function The componentmatchadd function may assign the ‘matchptr’ pointer the value ERRPTR-ENOMEM, which will subsequently be dereferenced. The call stack leading to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: geneve: requires CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns: devnetdev and the sticky underlay netns geneve-net. They differ once the device is created in or moved to a netns...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hardheaderlen in non-ring send paths packetsnd reads dev-hardheaderlen multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: validate skbdst before accessing it tc ingress and openvswitch do not guarantee that routing information is available. These subsystems rely on the conntrack helper infrastructure, and the SIP helper...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset causes the device to use the global tagset, whose driverdata remains NULL. Consequently, nullmapqueues falls back to the...