Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byddisconnect uses timerdelete before freeing the driver’s private data. It does not wait for a running bydcleartouch callback, which dereferences the private da...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count fflayoutalloclseg decodes the filehandle-version array count from the flexfiles layout body. This value is used as the count for kzallocobjs; currently, the code only rejects...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: unlock immaprwsem before releasing after-split folios foliosplit keeps dereferencing the mapping after the split: shmemunchargemapping-host and remappage while the folios are still frozen/locked, and...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnat: avoid invalid natnet pointer use on failed nfnatinit We ran into below KASAN splat, which is mostly uninteresting, beside for having nfnatregisterfn in the call chain as a cause for the offending access:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtyperesize copies comment pointers using memcpy, not the comment objects themselves. During the period following a copy of an entry but prior to the table swap...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdmawcreceive decrements the transport’s Receive count for every completion before it dispatches a successful Receive to rpcrdmareplyhandler. The handler must post a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware nummsg in TX complete handler The firmware-controlled nummsg field u8, 0-255 drives the loop in ath6klwmitxcompleteeventrx, without any validation against the buffer length. This allows...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This results in a state confusion bug when the raw tab...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: unwind v4l2 device registration on probe error If the vpetop resource is missing, vpeprobe returns -ENODEV after v4l2deviceregister has succeeded. Probe failures do not call the driver’s remove callback, so the v4...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Tracing: Fixed possible NULL dereferencing of hiter-dev in mmiotrace If mmiopipeopen fails to find a PCI device, hiter-dev will be set to NULL. The mmiotrace read function dereferences hiter-dev if hiter is present. The test for...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: riscv: Prevent NULL pointer dereference in machinekexecprepare A NULL pointer dereference issue is found in riscv’s machinekexecprepare, where image-segmenti.buf may be NULL and is copied without any checks. The NULL buf originat...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Use opener credentials for FSCTL mutations SETSPARSE, SETZERODATA, and SETCOMPRESSION operate on an open SMB handle but call VFS xattr, fallocate, or fileattr helpers using the current ksmbd worker credentials. These helpe...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata, the tag loop bound is “while idx length - sizeofstruct tlvtypenvm”. “length” is a signed int from the firmware TLV header, an...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: re-check IOWQBITEXIT for each linked work item The commit 10dc95939817 “iouring/io-wq: check IOWQBITEXIT inside work run loop” fixed the obvious case where ioworkerhandlework took one exit-bit snapshot before...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ACPI: scan: fix bus ID cleanup on deviceadd failures When deviceadd fails after acpidevicesetname has allocated an instance ID and a new acpidevicebusid has been linked into acpibusidlist, the rollback path only removes wakeuplis...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: maintain the RCU lock across ipv6chkaddr in rdstcpladdrcheck rdstcpladdrcheck looks up a scoped IPv6 interface using devgetbyindexrcu, drops the RCU read-side lock, and only then passes the bare struct netdevice to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: firewire: net: Fix fragmented datagram reassembly fwnetfragnew maintains a sorted list of received fragments for a partial datagram. When a new fragment is adjacent to an existing fragment, the code checks whether the new fragmen...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: keys: ensure that the byte order of keyring key-chunks matches keyringdiffobjects keyringgetkeychunk loads description bytes into the index chunk low address first, while keyringdiffobjects identifies the first differing bit from...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: i2c: jz4780: Cache host clock rate at probe to prevent CCF preparelock deadlock This fix resolves a severe AB/BA deadlock occurring between the Common Clock Framework CCF and the I2C adapter lock. This deadlock occurs when an...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: do not keep a stale msc-input if no input is claimed magicmouseinputmapping caches the first hidinput's inputdev in msc-input while the report descriptor is parsed; the rest of the driver treats a non-NULL...