Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix overflow in updatetgcfsrunnable A divide-by-zero crash is observed when running hackbench: 14697.488452 CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted 7.1.0-rc2+ 14697.492627 RIP:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Avoid buffer overread in ath11kwmitlvoprx Currently, in ath11kwmitlvoprx, the firmware buffer is read without first verifying that the buffer has enough data to hold a header. This could result in a buffer overread...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: cs35l33: drains threaded IRQ before runtime suspend Currently, cs35l33runtimesuspend switches the codec to regcachecacheonlytrue and powers it down without first quiescing the threaded IRQ registered by...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in in6devstatsget devgetbyindexrcu could return NULL if the original physical device is unregistered. Found by Sashiko...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmbwrite reads message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block wri...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent sntunacked underflow on CONNACK tipcskconnprotorcv subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter sntunacked without checking that it does not exceed the number of messages...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix refcount leak in efcthwioabort When efcthwreqtagalloc fails in efcthwioabort, the error path returns -ENOSPC without releasing the reference obtained via krefgetunlesszero earlier in the function. All other...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadatadst on RX SC delete When an offloaded MACsec RX SC is deleted, macsecdelrxscctx frees the per-SC metadatadst using metadatadstfree, which frees the object unconditionally and ignor...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: iommu/intel: Fix out-of-bounds memset in dmarlatencydisable dmarlatencydisable is intended to zero out only the single latencystatistic entry for the given type; however, the memset size was computed as sizeoflstat DMARLATENCYNUM...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check qlachkedifrxsadeletepending retrieves the SCSI command via GETCMDSPsp and immediately dereferences cmd-scdatadirection. That command pointer can be NULL: the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recvdlessread receives a PDATAREPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length is passed as the signed int datasize, and t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: drop TXRXNOTIFY on non-MMIO buses PKTTYPETXRXNOTIFY is an MMIO-only event; however, mt7921rxcheck and mt7921queuerxskb dispatch it to mt7921mactxfree on every bus. mt7921mactxfree cleans the DMA TX queues usin...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: invoke pmgenpdremove before freeing genpd Call pmgenpdremove to unregister from the global list prior to releasing acpgenpd memory, and clear the pointer after free. cherry picked from commit...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: comedi: comediparport: handle premature interrupt Syzbot reported a general protection fault in comedigetissubdevicerunning, which is called from the interrupt handler parportinterrupt within the “comediparport” driver. Currently...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: ravb: avoid dereferencing an invalid PTP clock The PTP clock is unavailable prior to the first open; thus, querying its index may result in a NULL pointer dereference. Registration failures can also leave an error pointer in...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drmdevregister failure and ioctl If drmdevregister fails after registering a minor e.g., after rendering a minor is registered but the primary minor fails, userspace might open the first minor and...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Always flush vpid02 on first use Ensure that vpid02 is always flushed on its first use by setting lastvpid=0 when allocating vpid02. Nestedvmxtransitiontlbflush will always detect a VPID change upon the first VM-Enter...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: tegra: tegra210ahub: Validate written enum value tegraahubputvalueenum reads e-valuesitem0 before checking whether item0 is within the enum item range. The existing check therefore happens too late to prevent an out-of-rang...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcnsfollow in logreplay conversion logreplay converts DIRPAGEENTRY32 records into DIRPAGE-entry records when replaying version 0 restart tables. During this conversion, the memmove length is derived directly fr...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP, but bcmrxsetup never did the same for the RTR-reply frame configure...