Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition’s start offset directly from the on-disk VAT 2.0 header without checking it against the VAT inode size:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: fix memory leak from alloc-during-teardown race mptcppmdestroy empties msk-pm.annolist and msk-pm.userspacepmlocaladdrlist under msk-pm.lock during socket teardown, dropping the lock between the two. A concurrent...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mtd: mtdoops: free page bitmap when the backing MTD is removed mtdoopsnotifyadd allocates oopspageused when the configured MTD device is registered. mtdoopsnotifyremove detaches from that device but leaves the bitmap allocated. I...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute stores with the lock The NULLBDEVICEATTR store takes no lock: applyfn attributes submitqueues, pollqueues get dev-NAME written again after applyfn returns, outside its lock; APPLY=NULL...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Fix internal port memory leak The flow rule can be splited, and the extra postact rules are added to postact table. It's possible to trigger memleak when the rule forwards packets from internal port and over tunnel...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: drop TXRXNOTIFY on non-MMIO buses PKTTYPETXRXNOTIFY is an MMIO-only event; however, mt7615rxcheck and mt7615queuerxskb dispatch it to mt7615mactxfree on every bus. mt7615mactxfree cleans the DMA TX queues usin...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: release hif2 reference on probe IRQ failure The hif2 reference obtained by mt7915pciinithif2 is only released on error paths where dev-hif2 is set to null; this value is assigned only after the IRQ setup. If...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: gate mustwait writability check on ptepresent userfaultfdmustwait and userfaultfdhugemustwait read the PTE without taking the page table lock and then apply ptewrite / hugeptewrite to it. These accessors decode bits...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: tridentfb: fix potential memory leak in tridentpciprobe In tridentpciprobe, the memory allocated for modelist via fbvideomodetomodelist is not freed in subsequent error paths. Fix this by calling fbdestroymodelist...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in isapintkip IE loop The loop in isapintkip iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE-elementid and pIE-length are rea...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Serialize accesses to the owner and mirror list with separate lock The interaction between KVMCAPVMMOVEENCCONTEXTFROM and KVMCAPVMCOPYENCCONTEXTFROM can lead to two separate issues: - In sevmigratefrom, when the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: virmidi: Check card index validity at probe The virmidi driver blindly trusts that the given devptr-id value is within the proper card index range during probe. It’s acceptable for the devices the driver creates at the modu...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: PCI/proc: Use filenscapable when checking config space read access procbuspciread determines how much of the config space is readable based on capableCAPSYSADMIN, which checks the credentials of the task calling read, not those o...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: md/raid1: free r1bio when REQNOWAIT is set and read would block on retry When a read is retried, raid1readrequest may be called with a pre-allocated r1bio. If waitreadbarrier fails for a REQNOWAIT read, the bio is completed and t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrangetimer at driver unbind letsketchdriver does not provide a .remove callback; however, letsketchprobe rearms the per-device timer: timersetup&data-inrangetimer, letsketchinrangetimeout, 0; The time...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: move hardware offload step after building the chain blob Allocate the chain blob before the ruleset offload to reduce the likelihood of entering an inconsistent state where the offloaded ruleset in the NIC an...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL htransaction deref in ocfs2assuretranscredits BUG Direct writes to unwritten extents can cause the kernel to panic in ocfs2assuretranscredits when the journal aborts during DIO completion. This crash is a general...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 atomic SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic polling path rejects it as -EPROTO. Worse still, it returns without a NACK+STOP: the next receive cycle...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: USB: ldusb: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a kr...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: IB/isert: Post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs; thus, an initiator that does not wait for the final Login...