Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: USB: serial: ioedgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edgeinterruptcallback adds the 16-bit value to txCredits without checking maxTxCredits. edgewrite...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: fix NULL pointer deref in vdectryfmtcommon When VIDIOCTRYFMT is called with an unsupported pixel format on the OUTPUT queue, vdectryfmtcommon falls back to V4L2PIXFMTMPEG2. However, if a distribution has local...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uaudio: Fix use-after-free on sound card disconnect gaudiocleanup invokes sndcardfreewhenclosed to initiate sound card teardown and immediately frees the underlying struct snduacchip context. However,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rspinfolen to avoid OOB sense-data read In qla2x00statusentry, the FWI2 status path advances sensedata and shrinks parsenselen by rspinfolen: if ISFWI2CAPABLEha sensedata += rspinfolen; parsenselen -=...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fusereffolio fusereffolio unlocks the request but does not re-lock it before returning. fusechanabort can end the request and the async end callback e.g., fusewritepagefree can free the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len, which comes directly from a device’s USB payload. The mask 0x0f allows values 0–15; however, the array size of usbif-d...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: ipip: requires CAPNETADMIN in the device netns for changelink ipipchangelink operates on at most two netns: devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvmesetupdiscard always maps sizeofstruct nvmedsmrange NVMEDSMMAXRANGES = 4096 bytes as the DSM payload however many ranges the command declares, because some devices ignore the 'Number of...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: reject an arena whose nfree is below the lane count The nfree field in the BTT info block—the number of reserved free blocks—is read from the medium without any validation. bttfreelistinit and bttrttinit populate the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: caam - use printhexdumpdevel to guard key hex dumps Use printhexdumpdevel for dumping sensitive key material in setkey and gensplitkey to avoid leaking secrets at runtime when CONFIGDYNAMICDEBUG is enabled...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix memory leak in radeonringrestore on lock failure radeonringrestore takes ownership of the data buffer allocated by radeonringbackup. The caller radeongpureset only frees it in the non-restore branch; in the restor...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afsgettree afsallocsbi uses kzalloc for memory allocation. And, if ctx-dynroot is not null, as-cell and as-volume are null. In traceafsgettree they are dereferenced. KASAN error message: KASAN...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation ipvsgetoutrt calls skbensurewritable, which may reallocate skb-head...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: serial: msm: Disable DMA for kernel console UART Currently, concurrent writes from user space and the kernel to the console can trigger a race condition that results in an infinite loop of the same messages being printed...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: hwmon: adm1275: Prevent reading uninitialized stack While adding support for the ROHM BD127X0 hot-swap controllers, Sashiko reported an error in device-name comparison, which can lead to reading uninitialized stack memory. Quotin...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor using anoninodegetfd, which allocates a new fd, creates the anonymous file, and inserts it into the process fd table before returning to the...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix overflow in dacloffset bounds check The dacloffset field was originally typed as int and used in an unchecked addition, which could overflow and bypass the existing bounds check in both smbcheckpermdacl and...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - fix information leak in evdevpassvalues In evdevpassvalues, the inputevent structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. On architectures where...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject PDUs declaring more data than was received isertrecvdone passes each received PDU to the opcode handlers without ever checking wc-bytelen, which represents the actual number of bytes the HCA placed into the recei...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: free STAG index when TPT entry write fails writetptentry allocates a new STAG index using c4iwgetresource and increments stats.stag.cur prior to programming the entry. When writeadaptermem fails, it returns an error...