Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: atm: usbatm: fix invalid cirange initialization SyZBot reported a shift-out-of-bounds condition in vccconnect: UBSAN: shift-out-of-bounds in net/atm/common.c:382:32 The shift exponent -1 is negative CPU: 0 UID: 0 PID: 5987...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3gadgetqueue maps the request before checking whether the QMU GPD ring can accept another transfer. The request is returned with -EAGAIN before it is linked on the endpoint request...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qethsnmpcommand and qethl3arpquery allocate a buffer sized by a user-supplied length udatalen without checking a lower bound; they then set udataoffset to a fixe...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: remove WARNONONCE from skmcloop skmcloop can be called for sockets that are neither AFINET nor AFINET6 e.g., AFPACKET sockets when sending packets via raw/packet sockets over virtual devices such as VRF or ipvlan. In such...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftablesoffload: suppress WARNONONCE for ENOMEM in abort path In nftflowruleoffloadabort, WARNONONCEerr is triggered on every error during rollback, including -ENOMEM. Memory allocation failures are expected under...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to a skb before nfctbridgepre sees it. For non-IPv4 and non-IPv6 EtherTypes, nfctbridgepre currently...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix uninit-value in the RF discover/activated NTF handlers ncirfdiscoverntfpacket and ncirfintfactivatedntfpacket each parse a notification into an on-stack struct ncirfdiscoverntf / ncirfintfactivatedntf that is not...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Clear affinity hint before calling ath11kpcicfreeirq in error path If a shared IRQ is used by the driver due to platform limitations, then the IRQ affinity hint is set right after the allocation of IRQ vectors in...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks through uCAN records packed in a single USB receive buffer. Each record must contain the fixed header corresponding to its type; the CAN payload bytes mu...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ax25: fixed use-after-free bugs caused by ax25dsdeltimer When the ax25 device is detaching, ax25devdevicedown calls ax25dsdeltimer to clean up the slavetimer. While the timer handler is running, ax25dsdeltimer that calls deltimer...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: Drop aux devices together with DP controller By using devres to depopulate the aux bus, it ensures that when a probe is deferred, the EDP panel device is destroyed and recreated on the next attempt. However, the struc...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: bpfskstorage: Fix invalid wait context lockdep report ‘./testprogs -t testlocalstorage’ reported a splat: 27.137569 ============================= 27.138122 BUG: Invalid wait context 27.138650 6.5.0-03980-gd11ae1b16b0a 247...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks through hdev-acceptlist while sending a synchronous HCI command to each remote-wakeup device. The suspend path holds hdev-reqlock, but...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: sctp: validate stream count in sctpprocessstrresetinreq When processing a RESETINREQUEST from a peer, sctpprocessstrresetinreq derives the stream count from the parameter length but does not check whether the resulting...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix 'hdev-discovery.uuids' NULL dereference 'uuidcount' member of struct 'discoverystate' is assigned and read without any locks, so there is a chance of situation when uuidcount != 0, but uuids is NULL and there...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: do not enable DAX on new encrypted files Currently, when a new encrypted regular file is created, the call to ext4setinodeflagsinode, init=true in ext4newinode is made before EXT4INODEENCRYPT is set. As a result, it can set...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Fix memory overread in ring handler maxresponse and sensornum are read from different EC commands: - maxresponse is obtained from crosecgetprotoinfo. ecdev-maxresponse = info-maxresponsepacketsize -...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when they become auto-bound. This means that skisrefcountedunbound = true, while skisrefcountedbound = false. Since sockmap accepts unbou...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: sctp: Hold socket lock when dumping endpoints in sctpdiag The SCTPDIAG endpoint dumping routine traversed endpoint address lists without holding locksock, even though those lists could be modified concurrently via socket operatio...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct filelock in SMB2LOCK deferred-lock cancellation When a blocking byte-range lock request is deferred via the FILELOCKDEFERRED path, ksmbd registers the asynchronous work into the connection’s asyncrequests...