Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: pwc: Return queued buffers on startstreaming failure The vb2 framework passes buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers via...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: Fix slab-use-after-free in chaoskeyrelease The chaoskey driver has a use-after-free bug in its release routine. If the user closes the device file after the USB device has been unplugged, a debugging log statement...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in decmsg buffer count check If the supplied msg2 numbuffers is 0x3FFFFFFF, the expression 6 + numbuffers 4 wraps to 2 and the bounds check passes, allowing the parser to loop far beyond the e...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames shorter than the authentication tag llsecdodecryptauth computes the associated-data length for the AEAD request as assoclen += datalen - authlen; where datalen is the number of bytes after the MAC...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdeallocpduser When accessing a PD via the netlink path, the only synchronization mechanism for such a PD is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC active reference counts HEVC slice parameters are shared stateless V4L2 controls; however, the standard validation path fails to verify the active L0/L1 reference counts prior to driver-specific...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: slip: remove sliphangup to fix use-after-free in slipreceivebuf Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free issue in slipreceivebuf when race conditions involving tty hangup occur. ttyldischangup calls...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gdsc: tear down per-domain genpds in gdscunregister gdscunregister removes the OF provider entry and tears down the parent/subdomain wiring, but never calls pmgenpdremove on the individual genericpmdomain structures...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds bit access on mtioflags mtioflags is a single unsigned long, but mtprocessslot, mtreleasependingpalms, and mtreleasecontacts use it as a per-slot bitmap indexed by the slot number. This slot...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix deviceregister error path When deviceregister fails in i3cmasterregisternewi3cdevs, putdevice is called to drop the reference taken by deviceregister. This drops the last reference, causing the device’s release...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: macvlan: inherits neededheadroom and neededtailroom from lowerdev macvlan devices inherit hardheaderlen from lowerdev during macvlaninit, but leave neededheadroom and neededtailroom set to 0. When the underlying lowerdev requires...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: sched/psi: Shut down rtpolltimer in psicgroupfree psischedulertpollwork is called locklessly from the scheduler hotpath and can race psitriggerdestroy taking down the last rtpoll trigger under rtpolltriggerlock:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bonding: Fix devconfall NULL dereference when IPv6 is disabled When booting with the ‘ipv6.disable=1’ parameter, devconfall is never initialized because inet6init exits before addrconfinit is called, which initializes it. However...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold eventmutex while checkpointing CRIU events kfdcriucheckpointevents counts the entries in p-eventidr via kfdgetnumevents, allocates an array sized to that count, and then walks the same IDR to fill it. Neither the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxsd9: fix runtime PM imbalance on writeraw error kxsd9writeraw takes a runtime PM reference via pmruntimegetsync, but returns -EINVAL directly when a scale with a non-zero integer part is requested, thereby skipping...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: fix refcount leak in isfullcharged In isfullcharged, powersupplygetbyname is called to obtain a reference to the fuelgauge power supply. If the voltage check uV = desc-fullbattuV succeeds, the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in tipcl2sendmsg Syzbot reported a slab-use-after-free in ipvlanhardheader when called from tipcl2sendmsg. The root cause is that tipcdisablel2media calls synchronizenet while b-mediaptr is still valid. This allows...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: tipc: fix infinite loop in tipcnlcompatdumpit The cmd-dumpit callback can return a negative errno, causing an infinite loop due to the whilelen condition. Since the loop never terminates, genlmutex is never released, and other...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command arrived via the...