Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL The mmcioctlcdromvolume function first reads the audio control mode page into a 32-byte stack buffer, with cgc-buflen set to 24. If the device returns a block descriptor, the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix NULL pointer dereference in isvmareahugepages findvmarea may return NULL if the given address is not a valid vmalloc area. Verify the return value before dereferencing it to prevent a kernel crash...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix hard lockup on disconnect If submitting the OOB write urb fails persistently e.g., if the device is being disconnected, the driver would loop indefinitely with interrupts disabled. Check for urb...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damonsetregions damonsetregions assumes that the input ranges are sorted by address and do not overlap each other. Initially, this assumption was intended to be explicitly...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: selinux: do not cancel a policy conversion that never started selwriteload calls selinuxpolicycancel when selmakepolicynodes fails, and that helper dereferences the outgoing policy to cancel its sidtab conversion. On the first...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/9p: fix infinite loop in p9clientrpc on fatal signal When p9clientrpc is called with type P9TFLUSH and the transport has no peer e.g., fd transport backed by pipes without a 9p server, a fatal signal causes an infinite loop:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hifusb: do not dereference hifdev after re-arming firmware request ath9khifrequestfirmware re-arms an asynchronous firmware load via requestfirmwarenowait, passing hifdev as the completion context, and then still...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: prestera: validate firmware header length presterafwhdrparse reads the firmware header before checking that the firmware image contains that header. Reject images shorter than struct presterafwheader before decoding the magi...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: tipc: requires net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAPNETADMIN when an operation sets GENLADMINPERM or...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: ipvti: requires CAPNETADMIN in the device netns for changelink vtichangelink operates on at most two netns: devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-battery: Fix missing nvmemdeviceput causing reference leak In cpcapbatterydetectbatterytype, the reference to an nvmem device obtained via nvmemdevicefind is not released with nvmemdeviceput on the success or...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: avoid moving extents to occupied clusters For non-auto OCFS2IOCMOVEEXT operations, userspace supplies a physical megoal. ocfs2moveextent initializes newphyscpos from that goal and expects ocfs2probeallocgroup to replace it...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the sample count to the packet payload isightpacket takes the frame count from the device iso packet and checks it only against the device claimed iso length. count = be32tocpupayload-samplecount; if...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlminspectfile lock-drop nlmtraversefiles pins the current file with fcount++ across a mutexunlock for nlminspectfile, but nothing pins the saved next pointer. A concurrent nlmreleasefile can kfree the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix tags leak when shrink nrhwqueues Although we don’t need to reallocate set-tags when shrinking nrhwqueues, we must still free those tags. Otherwise, they may be leaked. How to reproduce: 1. mount -t configfs configfs...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard stack limits against 32-bit overflow This patch ensures that arithmetic operations involving stack bounds are performed within the 64-bit domain, rather than the current 32-bit domain. The arithmetic involves adding a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add bounds check to rungethighestvcn rungethighestvcn parses a packed NTFS mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator to stop. A crafted $LogFile UpdateMappingPairs record whose...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: qede: sync udptunnel ports outside qedelock in the recovery path A TX timeout on a qede NIC that has VXLAN/GENEVE tunnel ports configured wedges the rtnetlink control plane of the whole machine: NETDEV WATCHDOG: ens6f1 qede:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages The accountmem and unaccountmem functions call getuid, which increments the reference count of struct userstruct on every invocation. However, we do not decrement th...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Check CAPNETADMIN for private ioctls Gate the SIOCDEVPRIVATE ioctl commands SIOCQETHADPSETSNMPCONTROL, SIOCQETHGETCARDTYPE and SIOCQETHQUERYOAT with CAPNETADMIN capable check to ensure unprivileged users cannot invoke...