Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidiocsfmtvidcap and vidiocsstd modify the device-wide dev-width / dev-norm values; however, they only refuse such changes when the video queue dev-vidq is...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL pointer dereference in ath11khalsrngaccessbegin In ATH11KQMIEVENTFWREADY, ATH11KFLAGREGISTERED is set unconditionally even when ath11kcoreqmifirmwareready fails. This leaves the driver in an inconsistent...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix missing pointer check in hdacomponentmanagerinit function The componentmatchadd function may assign the ‘matchptr’ pointer the value ERRPTR-ENOMEM, which will subsequently be dereferenced. The call stack leading to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: geneve: requires CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns: devnetdev and the sticky underlay netns geneve-net. They differ once the device is created in or moved to a netns...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hardheaderlen in non-ring send paths packetsnd reads dev-hardheaderlen multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: validate skbdst before accessing it tc ingress and openvswitch do not guarantee that routing information is available. These subsystems rely on the conntrack helper infrastructure, and the SIP helper...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset causes the device to use the global tagset, whose driverdata remains NULL. Consequently, nullmapqueues falls back to the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmdnode-databuf. Several callers pass stack-allocated objects there. If waiteventinterruptibletimeout ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: bound device offsets in the MUX downlink decoder muxdladbdecode walks a chain of aggregated datagram tables using offsets and lengths taken from the modem. firsttableindex, nexttableindex, tablelength,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in in6devstatsget devgetbyindexrcu could return NULL if the original physical device is unregistered. Found by Sashiko...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: software node: Fix softwarenodegetreferenceargs with index -1 The bounds check for the index passed to softwarenodegetreferenceargs failed when UINTMAX was provided; this could result in an out-of-bounds access to the property...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept preallocation with socket teardown rxrpckernelchargeaccept reads rx-backlog without any socket/backlog synchronization and passes that raw pointer into rxrpcservicepreallocone. A concurrent...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket using isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from i...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claims and progresses a transfer; the RX path consumes Flow Control/echo frames; and two hrtimers...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronizercu in isotprelease isotpnotify unregisters the RCU CAN filters via canrxunregister and clears so-bound without waiting for a grace period. isotprelease uses so-bound to decide whether it...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: ipip: requires CAPNETADMIN in the device netns for changelink ipipchangelink operates on at most two netns: devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrminterface: requires CAPNETADMIN in the device’s netns for changelink xfrmichangelink operates on at most two netns: devnetdev and the interface link netns xi-net. These differ whenever the device is created in or moved ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00getfirmwarestate The mbxcmdt is allocated on the stack but left uninitialized. qla2x00mailboxcommand has several early-return paths PCI permanent failure, device failed, EEH busy, ISP...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: hwmon: adm1275: Prevent reading uninitialized stack While adding support for the ROHM BD127X0 hot-swap controllers, Sashiko reported an error in device-name comparison, which can lead to reading uninitialized stack memory. Quotin...