Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reallocate update replies for mismatched IDs ovsflowcmdnew preallocates the optional reply skb before it takes ovsmutex and before it knows which existing flow will be updated. This is usually fine because the s...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate PMSR FTM preamble range PMSR FTM request parsing accepts preamble values outside the enumerated nl80211 preamble range. Reject out-of-range values before using them in the parser capability bit test using...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix fibnlmsgsize for RTAVIA nexthops fibnlmsgsize still estimates nexthop space as if every gateway is encoded as an IPv4 RTAGATEWAY attribute. IPv4 routes can also carry an IPv6 gateway, which fibnexthopinfo dumps as RTAVI...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix UAF in hcidisconnectallsync Use-after-free can occur in hcidisconnectallsync if a connection is deleted by concurrent processing of a controller event. To prevent this, the code now attempts to iterate ove...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/niu: Niu requires MSIX ENTRYDATA fields to be touched prior to entry reads Fix niutrymsix so it does not trigger a fatal trap on sparc systems. Set PCIDEVFLAGSMSIXTOUCHENTRYDATAFIRST on the struct pcidev to work around a bug ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siwaccept siwaccept looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup checks whether...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Hardware reset is performed only after BAR mapping wanxlpciinitone stores the newly allocated card in driver data before the PLX BAR is mapped. Subsequent probe failures then propagate through wanxlpciremoveone,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: ip6gre: requires CAPNETADMIN in the device netns for changelink ip6grechangelink and ip6erspanchangelink operate on at most two netns: devnetdev and the tunnel link netns t-net. They differ once the device is created in or...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fixed an out-of-bounds condition in freerdatomicresources freerdatomicresources iterates using qp-attr.maxdestrdatomic. Updating maxdestrdatomic prior to freeing the old array can cause the free path to skip over the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: cpuidle: dtidlegenpd: kfree the original name allocation dtidlepdalloc calls kasprintf to get the full node path, then passes pd-name to kbasename for processing. dtidlepdfree frees pd-name, which is no longer the beginning of th...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Latch disableidled3 per device When disableidled3 was introduced in vfio-pci, it directly manipulated the device’s power state via pcisetpowerstate. Since there were no refcounts to maintain or any balancing mechanisms,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: avoid OOB read of build info string The virtbtsetupzephyr function sends the Zephyr vendor command 0xfc08 Read Build Information and passes the response to btdevinfo and hcisetfwinfo as a “%s” string starting...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: iio: dac: m62332: Fix regulator reference count imbalance m62332setvalue enables the Vcc regulator on every write of a non-zero value and disables it on every write of zero, without tracking the channel’s current state. Since the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser sndusbcaiaqtks4dispatch decodes the Traktor Kontrol S4 input stream in fixed 16-byte TKS4MSGBLOCKSIZE message blocks. On each iteration, it advances buf a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation skbudptunnelsegment retrieves the UDP header before ensuring that the tunnel header is present in the skb head. If skb-head is reallocated via pull, the previously saved UD...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: isofs: bound Rock Ridge symlink components to the SL record getsymlinkchunk and the SL handling in parserockridgeinodeinternal process variable-length components of a Rock Ridge “SL” symbolic link record. Each component consists ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate DFS referral PathConsumed parsedfsreferrals validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. However, the response also contains a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inetfragcreate arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before th...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed The vfioapmdevhotunplugcfg function uses the return value of bitmapandnot to determine whether the guest APCB needs to be updated. However, bitmapandnot...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: xthashlimit: validate hashtable supports XTHASHLIMITRATEMATCH The XTHASHLIMITRATEMATCH flag mode changes the semantics of the dsthashent structure, which represents an entry in the hashtable. There is a union area that...