Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in createspaceinfosubgroup error path When kobjectinitandadd fails, the call chain is: createspaceinfosubgroup - btrfssysfsaddspaceinfotype - kobjectinitandadd - failure - kobjectput&subgroup-kobj -...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: always free skb on ieee80211txprepareskb failure ieee80211txprepareskb has three error paths, but only two of them free the skb. The first error path ieee80211txprepare returning TXDROP does not free it, while...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: batman-adv: avoid OGM aggregation when skb tailroom is insufficient When the OGM aggregation state is toggled at runtime, an existing forwarded packet may have been allocated with only packetlen bytes, while a later packet can...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix stale direct dispatch state in ddspdsqid @p-scx.ddspdsqid can be left set non-SCXDSQINVALID triggering a spurious warning in markdirectdispatch when the next wakeup's ops.selectcpu calls scxbpfdsqinsert, such as:...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: gpio: Fix resource leaks on errors in gpiochipadddatawithkey Since commit aab5c6f20023 “GPIO: set device type for GPIO chips”, gdev-dev.release is unset. As a result, the reference count to gdev-dev is not dropped during error...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix iommumapsgtable return value check and avoid WARN Commit “iommu: return full error code from iommumapsgatomic” changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: padata: Fix pd UAF once and for all There is a race condition/UAF in padatareorder that goes back to the initial commit. A reference count is taken at the start of the process in padatadoparallel, and released at the end in...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Return error for inconsistent extended attributes ntfsreadea is called when we want to read extended attributes. There are some sanity checks for the validity of the EAs. However, it fails to return a proper error code...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwcmsgid from DMA buffer In manahwcrxeventhandler, resp-response.hwcmsgid is read from DMA-coherent memory and bounds-checked; then manahwchandleresp re-reads the same field from the same DMA...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix warning when unbinding If there is an error during some initialization related to firmware, the buffers dp-txringi.txstatus are released. However this is released again when the device is unbinded ath11kpci, and...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: kernel: Be more careful regarding dupmmap failures and uprobe registration If a memory allocation fails during dupmmap, the maple tree can remain in an unsafe state for other iterators besides the exit path. All locks are dropped...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: MIPS: DEC: Prevent initial console buffer from landing in XKPHYS In 64-bit configurations, calling the initial console output handler from a kernel thread other than the initial one results in the stack being placed in the XKPHYS...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Revert “i2c: i801: replace acpilock with I2C bus lock” This reverts commit f707d6b9e7c18f669adfdb443906d46cfbaaa0c1. Under rare circumstances, multiple udev threads can collect i801 device information during boot and...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Check bounds against the end of the BO whenever we access the msg...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: comedi: niatmio16d: Fix invalid cleanup after failed attach If the driver’s COMEDI “attach” handler function atmio16dattach returns an error, the COMEDI core will call the driver’s “detach” handler function atmio16ddetach to clea...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: KEYS: fix overflow in keyctlpkeyparamsget2 The length for the internal output buffer is calculated incorrectly, which can result in an overflow when a too small buffer is provided. Fix the bug by allocating the internal output wi...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Add missing CRYPTOALGASYNC The tegra crypto driver failed to set CRYPTOALGASYNC on its asynchronous algorithms, causing the crypto API to select them for users who request only synchronous algorithms. This results...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: Fix double-free in teqlmasterxmit Whenever a TEQL device has a lockless Qdisc as its root, qdiscreset should be called using the seqlock to avoid race conditions with the datapath. Failing to do so may result in...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ibmasm: Fix OOB reads in commandfilewrite due to missing size checks The commandfilewrite handler allocates a kernel buffer of exactly count bytes and copies user data into it; however, it fails to validate the buffer against the...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: check URB actuallength for interrupt-IN notifications USBTMC devices can utilize an optional interrupt endpoint for notification messages. These messages typically contain two-byte headers specifying the payload...