Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: HID: Add HIDCLAIMEDINPUT guards in rawevent callbacks missing them In commit 2ff5baa9b527 “HID: appleir: Fix potential NULL dereference at raw event handle”, we address the issue that raw event callbacks can occur even on a HID...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: can: mcp251x: fix deadlock in error path of mcp251xopen The mcp251xopen function calls freeirq in its error path while holding the mpclock mutex. However, if an interrupt has already occurred, the interrupt handler is waiting for...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fix OOB read and infinite loop in hcilecreatebigcompleteevt The hcilecreatebigcompleteevt function iterates over BTBOUND connections for a given BIG handle using a while loop; during each iteration, it access...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix race between concurrent split and refault The splitting of a PUD entry in walkpudrange can race with a concurrent thread refaulting the PUD leaf entry, causing it to attempt walking a PMD range that has already...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: fix NULL pointer dereference in iptunnelxmit on TEQL slave xmit teqlmasterxmit calls netdevstartxmitskb, slave to transmit through slave devices, but does not update skb-dev to the slave device beforehand. When a...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen – Clamp NEXIO datalen/xlen to the URB buffer size nexioreaddata extracts datalen and xlen from a packed be16 header within the device’s interrupt packet; it then iterates through packet-data0..xlen and...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix NULL pointer bug in svmrangesetattr processinfo can be NULL if the user does not call kfdioctlacquirevm before calling kfdioctlsvm. cherry picked from commit 83a26c812e0529eb040d31a76f73e33e637243d4...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: Fix NULL pointer dereferences in nexus handling The tpg-tpgnexus pointer in the USB Target driver is dynamically managed and tied to userspace configuration via ConfigFS. It can be NULL if the USB host sends...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: fix use-after-free on linked stream runtime in sndpcmdrain Within the drain loop, the local variable ‘runtime’ is reassigned to the runtime of a linked stream runtime = s-runtime at line 2157. After releasing the strea...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: mctp: route: hold key-lock in mctpflowprepareoutput mctpflowprepareoutput checks key-dev and may call mctpdevsetkey, but it does not hold key-lock while doing so. mctpdevsetkey and mctpdevreleasekey are annotated with...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. This is only valid while the driver still owns the buffer. mvpp2rxrefill can fail after the...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix use-after-free in ofunittestchangeset The variable ‘parent’ is assigned the value of ‘nchangeset’ earlier in the function; both refer to the same struct devicenode. The call to ofnodeputnchangeset can decrement...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: Fix interrupt storm after receiving bad ifid in IRQ handler Commit 31a7a0bbeb00 “dpaa2-switch: add bounds check for ifid in IRQ handler” introduces a range check for ifid to prevent out-of-bounds access. If an...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix work re-schedule after cancel in xfrmnatkeepalivenetfini After canceldelayedworksync is called from xfrmnatkeepalivenetfini, xfrmstatefini flushes remaining states via xfrmstatedelete, which calls...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211dfscaccancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to avoid a slab-use-after-free error...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Fix use-after-free in omap2430probe In omap2430probe, ofnodeputnp is called prematurely before the last access to np, leading to a use-after-free if the node’s reference count drops to zero. Move the ofnodepu...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: remoteproc: xlnx: Access buffer information only when IPI is buffered In the receive callback, check whether the message is NULL to prevent a crash that could occur due to a null pointer dereference...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: macb: properly unregister fixed rate clocks The additional resources allocated by clkregisterfixedrate must be released via clkunregisterfixedrate; otherwise they are lost...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix type confusion in l2capecredreconfrsp l2capecredreconfrsp casts the incoming data to struct l2capecredconnrsp the ECRED connection response, 8 bytes with result at offset 6 instead of struct...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pd-mapper: Fix element length in servreglocpfrreqei The element length declared in servreglocpfrreqei does not match the reason field of servreglocpfrreq; this can lead to a decoding error during PD crashes...