Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vcdata fbconnewmodelist is called whenever the modelist of a framebuffer changes. For each console mapped to it via fbdisplayi.mode, it reads vcconsi.d and passes the vcnu...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Free arenas on bttinit error paths The arenas allocated by discoverarenas or createarenas are not freed on certain error paths in bttinit. This leads to memory leaks when BTT initialization fails. Call freearenas from...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix potential buffer underflow in ath11khalrxmsdulistget When the first entry in msdudetails has a zero buffer address, the code accesses msdudetailsi - 1 with i == 0, resulting in a buffer underflow. The fix is...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct-lock is still held. When invalid logging is routed to nfnetlinklog and conntrack export is enabled, t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix handling of AIF enable without AISB When a guest attempts to register IRQs without specifying a summary bit, make sure that the associated GAITE then stores 0 for the guest AISB location instead of using...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix overflow in updatetgcfsrunnable A divide-by-zero crash is observed when running hackbench: 14697.488452 CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted 7.1.0-rc2+ 14697.492627 RIP:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in imspcuirq debug logging The debug logging in imspcuirq unconditionally prints data from pcu-urbinbuf. However, if the interrupt was triggered for pcu-urbctrl, the actual data resides in...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: schmultiq: Replace direct dequeue call with peek and qdiscdequeuepeeked multiqdequeue takes a packet from a band’s child with a direct -dequeue call after multiqpeek peeked it. When the child is non-work-conserving, th...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attroff in UpdateResidentValue against dataoff In the UpdateResidentValue case within doaction fslog.c:3307, lrh-attroff and lrh-redolen come from the on-disk LRH. When they satisfy aoff + dlen res.dataoff, the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmwcmddma locates the DMA suffix at unsigned long &cmd-body + header-size - sizeofsuffix without checking that header-size is large enough to contain both cmd-body an...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix GISC refcount leak on AIF enable failure kvms390giscregister registers the guest ISC before pinning the guest interrupt forwarding pages and allocating the AISB bit. If any of the later setup steps fail, the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fixed out-of-bounds write in irdmacopyuserpgaddrs The irdmacopyuserpgaddrs function loops through all umem DMA blocks to populate the PBLEs; it stops when either the last DMA block is reached or palloc-totalcnt is...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork copyhugetlbpagerange clears the uffd-wp bit of migration and hwpoison entries using hugepteclearuffdwp, which operates on the present-PTE bit position. Swap...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn-writeverf at request time and reports it to the client via CBOFFLOAD after the worker kthread completes. When post-copy vfsfsyncrange or...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: s390/perfcpumcf: Add missing arrayindexnospec to hwperfeventinit The ev variable is controlled by userspace via event-attr.config and is used as an array index after bounds checking, but without speculation barriers. Add the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipmi: fix refcount leak in iipmirequest When a caller provides a suppliedrecv message to iipmirequest, the function increments the user’s nrmsgs reference count. If an error occurs later, the outerr cleanup path only frees the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: fix fastmap use-after-free on filter The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4filter pointers indexed by id, iif. The reader route4classify populates this cache via...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Revert “thermal/drivers/hwmon: Clean up coding style a bit” Revert commit 030a48b0f6ce “thermal/drivers/hwmon: Clean up coding style a bit” which introduced a use-after-free in the error path of thermaladdhwmonsysfs by removing a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free of usbdevice in usbdevrelease usbdevrelease drops its reference to the struct usbdevice before draining the list of completed async URBs; however, this drain path reads back through the same object...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf’s falist via fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa usin...