Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: USB: ldusb: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a kr...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: IB/isert: Post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs; thus, an initiator that does not wait for the final Login...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free in pepgetsb pepgetsb does not account for the possibility that pskbmaypull may have moved the skb data, and continues to access the old pointer, resulting in a Use-After-Free UAF condition...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: fix device reference leak in firmwareuploadregister firmwareuploadregister - fwcreateinstance - deviceinitialize After fwcreateinstance succeeds, the lifetime of the embedded struct device is expected to be manage...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcxhr: initialize mutexes before requesting threaded IRQ pcxhrprobe calls pcxhrthreadedirq before initializing mgr-lock, even though the threaded handler uses that mutex. Initialize the manager locks before requestthreadedi...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhtb: limit htbclassify inner-class filter hops htbclassify follows each filter-selected inner class by switching to cl-filterlist, but never bounds the number of hops. A filter on an inner class can point back to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: phy: sfp: free miibus in sfpi2cmdiobusdestroy sfpi2cmdiobuscreate allocates the I2C MDIO bus using mdioi2calloc, which is a plain non-devm allocation, and then registers it. sfpi2cmdiobusdestroy only unregisters the bus and...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beaconielen, assocreqlen, and assocresplen fields in ath6klwmiconnecteventrx are not validated against the buffer length. Their sum up t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach perfgroupdetach handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their groupleader...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE corescsi3emulateproregisterandmove maps the PERSISTENT RESERVE OUT parameter list with transportkmapdatasg and parses the destination TransportID using...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix xfrmstateconstruct auth-trunc leak attachauthtrunc can allocate x-aalg while leaving x-props.aalgo at zero when the selected auth algorithm has no sadbalgid. One real case is cmacaes. xfrmstateconstruct then treats...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump qla2x00freefcetrace frees and clears ha-fce while holding only fcemutex. The firmware-dump consumers qla27xxfwdtentryt264 and qla25xxcopyfce read ha-fce a NULL chec...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: thermal: intel: int3400: clean up ODVP on probe failures evaluateodvp creates per-ODVP sysfs files before the thermal zone and later probe resources are registered. Currently, the unwind path only calls cleanupodvp from the late...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: fix deadlock in usbgmaketpg usbgmaketpg holds a deplock while calling configfsdependitemunlocked, which acquires the configfs root inode lock when operating across subsystems. This creates a circular lock...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: speakup: keyhelp: guard letteroffsets possible out-of-range indexing helpinit builds letteroffsets by using the first byte of each function name as an index via start & 31 - 1. If functionnames are overridden from sysfs root with...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: do not queue completed sysfs fallback requests fwloadsysfsfallback calls deviceadd before adding the fwpriv to pendingfwhead. deviceadd publishes the fallback loading interface; thus, a userspace helper that...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Initialize IRQ data before requesting IRQs dwedmairqrequest passes the struct dwedmairq to requestirq before dwedmachannelsetup fills the back pointer. As a result, a shared interrupt can enter the handler wit...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: power: supply: twl4030charger: cancel workers via devm BCI is devm-allocated. Two workers BCI-work and BCI-currentworker dereference it. twl4030bciremove disables charging and masks interrupts. It does not cancel any worker. A...