Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUDCONNECTORTVMODENAMELEN entries and requires each name to be NUL-terminated. gudconnectoraddtvmode currently...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: uio: Fix stale info pointer in failed registration path After deviceadd, the UIO device becomes visible to userspace, allowing /dev/uioX to be opened. If a subsequent setup step fails, uioregisterdevice unwinds the device but...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: hwmon: nzxt-smart2 DMA-align output buffer Sashiko reports: When sendoutputreport calls hidhwoutputreport, the underlying USB HID core calls usbinterruptmsg, which maps this buffer directly for DMA. When the DMA mapping flushes o...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in sndsofupdatecontrol In sndsofupdatecontrol, the cdata-numelems provided by the firmware is checked against localcdata-data-size, but never against the actual allocation size. If...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: reading virtqueues under worker locks The commit bd50c5dc182b “vsock/virtio: add support for device suspend/resume” caused the run flags to transition from false to true when restore installs replacement virtqueues...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFSVOLUMERMTREE is set on Fix afsinsertvolumeintocell to set AFSVOLUMERMTREE on the volume replaced, not the new volume, since it is now removed from the cell’s volume tree. This will cause the old volume to b...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1xbopin with a cache, the resulting mapping is kept in the cache so it can be reused on subsequent pins. Each mapping held a reference to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen may be smaller than the length later programmed into the DMA scatterlist. Currently, the allocation size is calculated as:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: em28xx: defer audio-only extension registration The audio-only path registers extensions while probing the primary device. On a dual-TS board, this occurs before devnext is created. The duplicate device inherits isaudioonl...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforceprocesspacket reads fixed fields from joystick, wheel, and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: bound EDID block reads to the response buffer virtiogetedidblock validates the read offset only against the device-supplied resp-size field, never against the fixed-size resp-edid array. The EDID block index is driven...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: MIPS: mm: Fix out-of-bounds write in maarreswalk maarreswalk uses wi-numcfg as the index into the fixed-size wi-cfg array; however, it checks whether the array is full only after filling the selected entry. If walksystemramrange...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: cancel pendingrxwork before taking conn-lock l2capconndel takes conn-lock and then calls cancelworksync for pendingrxwork. processpendingrx also uses the same mutex; thus, the teardown operation can deadlock...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftcounter: serialize reset with spinlock A global static spinlock is added to serialize the fetch and reset operations of the counter, preventing concurrent “dump-and-reset” attempts from overwriting its values. The...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SENDRESPONSE length to the response buffer uvcsendresponse builds the UVC control response from a user-supplied struct uvcrequestdata: req-length = mintunsigned int, uvc-eventlength, data-length;...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: Return queued buffers on startstreaming failure The vb2 framework passes buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffer...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: fix dir put orders in accesspatternadddirs Patch series “mm/damon/sysfs-schemes: fix wrong directories put orders in error paths”. The error paths of the damonsysfsaccesspatternadddirs and...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: USB: idmouse: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: kcov: Fix data corruption and race conditions on PREEMPTRT SyZBot reports that KCOV state corruption occurs on PREEMPTRT kernels. Currently, the temporary storage used for saving/restoring remote KCOV states is allocated as a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: driver core: use READONCE for dev-driver in devhassyncstate devhassyncstate reads dev-driver twice without holding devicelock -- once for the NULL check and once to dereference -syncstate. Some callers only hold...