Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfatfinddirentry In exfatfinddirentry, each TYPEEXTEND file name entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length: if ++order == 2...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free In dmareleasechannel, check chan-device-privatecnt after calling dmachanput. However, dmachanput calls dmadeviceput, which may release the last reference to the device if the DMA provider ha...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: macb: drop in-flight Tx SKBs on close The MACB driver has since forever leaked the outgoing SKBs that have not yet been marked as completed. They live in queue-txskb which gets freed without remorse nor checking...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: sctp: validate Adaptation Indication parameter length The Adaptation Layer Indication parameter contains a fixed 32-bit Adaptation Code Point after its parameter header. However, sctpverifyparam accepts a header-only parameter...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidpgetrawreport waits for a numbered report, hidpprocessdata compares the expected report number with skb-data0. A connected HIDP peer can reply with only a DATA transactio...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix devres accumulation across driver rebind imx6socvolt is allocated using devmkcalloccpudev, ..., where cpudev is the CPU device returned by getcpudevice0. This device is never unbound, so its devres list is nev...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: ife: requires ETHHLEN to be pullable in ifedecode ifedecode may return after ensuring that only the outer IFE header and metadata are pullable. The caller then passes the decapped packet to ethtypetrans, which expects the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2capsocknewconnectioncb l2capsocknewconnectioncb returns l2cappisk-chan after releasing sockparent. Once the parent lock is dropped, the newly queued child socket sk becomes accessible via...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Do not remove an unregistered GPIO chip If the devmpinctrlregister function fails, bcm2835pinctrlprobe calls gpiochipremove before gpiochipadddata has registered the GPIO chip. This means that upon failure,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in QoS validation The ATM traffic classes exceeding ATMANYCLASS are rejected in checktp. SOATMQOS stores the provided QoS after checkqos succeeds; thus, accepting larger values result...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832: fix use-after-free in rtl2832remove canceldelayedworksync is called before i2cmuxdeladapters in rtl2832remove. While the cancel waits for any running instance of i2cgatework to finish, it does not prevent the time...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: selinux: requires every boolean value to be defined pbools.nprim comes from the policy image independently of how many booleans follow it; condindexbool fills boolvaltostruct at value - 1, so a count larger than the values presen...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftmetabridge: fix NFTMETABRIIIFPVID stack leak This needs to be tested to ensure it returns a non-zero value...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv4: reject undersized MTUs in ipdofragment ipdofragment subtracts the IPv4 header length from the effective MTU and passes the resulting payload MTU to ipfragnext. If the effective MTU is smaller than hlen + 8, ipfragnext round...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix bo-pin leaking in amdgpubocreatereserved amdgpubocreatereserved only allocates a new BO when boptr struct amdgpubo boptr as input parameter is NULL; otherwise, it simply skips creation. However, it unconditionally...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: metronomefb: fix potential memory leak in metronomefbprobe The memory allocated for pagerefs in fbdeferredioinit is not freed on the error path. Fix it by calling fbdeferrediocleanup...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: prevent NULL pointer dereference in picolcdsendandwait In picolcdsendandwait, an integer overflow of the signed loop counter ‘k’ can theoretically lead to a NULL pointer dereference of ‘rawdata’. If the loop execute...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix broken rx after throttle If the port is closed while throttled, the read urb is never resubmitted and the port will not receive any further data until the device is reconnected or the driver is...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: Acquire initmm lock on huge vmap to avoid ptdump UAF Patch series “mm: fix UAF caused by race between ptdump and vmap pgtable freeing”, v6. Kernel page table walkers fall into two broad categories – those ranges where...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. If this allocation fails, the function jumps to failure mode and calls...