Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix warning in poll cq direct mode CQs allocated by iballoccq always have a comphandler. Although in direct mode this handler is never expected to be called, it is still invoked when the driver is reset, triggering the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: NTB: ntbnetdev: Preserve RX queue depth on allocation failure ntbnetdevrxhandler passes the received skb to the network stack before allocating a replacement buffer. If the allocation fails, no data is replied. Consequently, ever...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound pagelcns index by the log record The copylcns loop and the redo shorten loop index pagelcns at j + i, where i runs up to the log record’s lcnsfollow. This count is checked only against the record’s own length, not...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix list corruption in allocatefileregionentries allocatefileregionentries fills resv-regioncache with newly allocated fileregion descriptors. Since allocation uses GFPKERNEL, resv-lock is dropped around it: the new...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dm-verity: make error counter atomic The error counter “v-corruptederrs” was not atomic, so it could be subject to race conditions. The call to dmauditlogtarget"max-corrupted-errors" may be skipped due to the races...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection remains alive while the CDC slot is fetched: sockhold&smc-sk;...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packetsetring updates the RX ring state under skreceivequeue.lock; however, it uses po-prothook.func to publish the tpacket receive mode after releasing that lock...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drmparsetiledblock drmparsetiledblock casts the DisplayID block to a struct displayidtiledblock and reads the full fixed layout up to tile-topologyid7 without checking block-numbytes. The DisplayID...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: ip6vti: requires CAPNETADMIN in the device netns for changelink vti6changelink operates on at most two netns: devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other tha...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix data race on rxstamp/rxifindex in bcmrxhandler For a receive operation subscribed to all interfaces ifindex == 0, the same operation is registered once in the shared per-netns wildcard filter list; thus, bcmrxhandle...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in updatebeaconinfo IE loop The IE parsing loop in updatebeaconinfo advances by pIE-length + 2 each iteration but only guards on i length from one byte past the allocated receive buffer...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2capgetconfopt derives the option length from the attacker-controlled opt-len field and immediately dereferences opt-val as u8, getunalignedle16 or...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndisrmhdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: ipu-bridge: Fix null pointer deref on SSDB/PLD parsing warnings When ipubridgeparserotation and ipubridgeparseorientation run, sensor-adev is not set yet. So if either of the devwarn calls about unknown values are hit this...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: coresight: etm4x: fix underflow for usage of nrseqstate - 1 According to the IHI006H Embedded Trace Macrocell Architecture Specification0, TRCSEQEVR is implemented only when TRCIDR5.NUMSEQSTATE is 0b100; in that case, n ranges fr...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Squashfs: ensure that the block offset is not negative If a negative offset is read from disk for instance, the offset within a decompressed fragment block, this causes squashfscopydata to perform an out-of-bounds access. The fix...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are assigned to jobs upon submission and recycled after they finish, never being cleared. Each slot...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject login PDUs declaring more data than was received isertloginrecvdone records how many bytes the HCA actually placed in the login buffer, but nothing compares that against the length the login PDU’s BHS declares...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: platform/surface: acpi-notify: Check ACPI companion before use Since every platform driver can be forced to match a device that does not match its list of device IDs due to devicematchdriveroverride, platform drivers that rely on...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: image: mdc800: change kmalloc to kzalloc Replace the kmalloc calls in usbmdc800init for irqurbbuffer and downloadurbbuffer with kzalloc, thereby preventing potential stack leaks when a shorter message is received in...