Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Several bsg handlers stage their request/reply in an uninitialized 256-byte on-stack buffer uint8t bsgDMAPOOLSIZE and fill it via sgcopytobuffer, which only copies as...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: md/raid5-ppl: fix use-after-free in ppldoflush The loop in ppldoflush continues iterating after calling ppliounitfinished, touching io-pendingflushes and leading to a use-after-free. Add a break statement to stop the loop once io...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix error path in rtlpciprobe In the last error path of rtlpciprobe, the cleanup functions are skipped due to an incorrect goto label. Additionally, the successful calls to rtlinitrfkill, ieee80211registerhw,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq256xx: drain usbwork before freeing the charger The USB-PHY notifier queues usbwork, whose handler calls powersupplychangedbq-charger. The reset devm action only unregisters the notifier and was registered before...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byddisconnect uses timerdelete before freeing the driver’s private data. It does not wait for a running bydcleartouch callback, which dereferences the private da...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count fflayoutalloclseg decodes the filehandle-version array count from the flexfiles layout body. This value is used as the count for kzallocobjs; currently, the code only rejects...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: unlock immaprwsem before releasing after-split folios foliosplit keeps dereferencing the mapping after the split: shmemunchargemapping-host and remappage while the folios are still frozen/locked, and...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnat: avoid invalid natnet pointer use on failed nfnatinit We ran into below KASAN splat, which is mostly uninteresting, beside for having nfnatregisterfn in the call chain as a cause for the offending access:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtyperesize copies comment pointers using memcpy, not the comment objects themselves. During the period following a copy of an entry but prior to the table swap...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdmawcreceive decrements the transport’s Receive count for every completion before it dispatches a successful Receive to rpcrdmareplyhandler. The handler must post a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware nummsg in TX complete handler The firmware-controlled nummsg field u8, 0-255 drives the loop in ath6klwmitxcompleteeventrx, without any validation against the buffer length. This allows...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This results in a state confusion bug when the raw tab...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: unwind v4l2 device registration on probe error If the vpetop resource is missing, vpeprobe returns -ENODEV after v4l2deviceregister has succeeded. Probe failures do not call the driver’s remove callback, so the v4...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: pci: dm1105: Free allocated workqueue Destroy the allocated workqueue within the remove callback to release its resources, thereby fixing the memory leak...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Tracing: Fixed possible NULL dereferencing of hiter-dev in mmiotrace If mmiopipeopen fails to find a PCI device, hiter-dev will be set to NULL. The mmiotrace read function dereferences hiter-dev if hiter is present. The test for...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: riscv: Prevent NULL pointer dereference in machinekexecprepare A NULL pointer dereference issue is found in riscv’s machinekexecprepare, where image-segmenti.buf may be NULL and is copied without any checks. The NULL buf originat...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix portid extraction from SRC TAG On the packet reception path, the ID of the MAC Port on which the packet was received is embedded in the RX DMA Descriptor’s metadata. This ID is extracted usi...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Use opener credentials for FSCTL mutations SETSPARSE, SETZERODATA, and SETCOMPRESSION operate on an open SMB handle but call VFS xattr, fallocate, or fileattr helpers using the current ksmbd worker credentials. These helpe...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata, the tag loop bound is “while idx length - sizeofstruct tlvtypenvm”. “length” is a signed int from the firmware TLV header, an...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: fix uninitialized struct pages for ZONEDEVICE When DAX memory is hotplugged into an unoccupied subsection of an early section, sectionactivate reuses the unoptimized boot memmap. However, compoundnrpages still assumes...