Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: batman-adv: clear current gateway during teardown batadvgwnodefree removes the gateway list entries during mesh teardown, but it does not clear the currently selected gateway. This leaves stale gateway state behind across cleanup...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: validate minimum blocklen in ncmunwrapntb The blocklen value read from the host-provided NTB header is compared against ntbmax; however, there is no lower bound specified. When blocklen is smaller than...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix overflow when accumulating packets Add a check to ensure that x25sock.fraglen does not overflow. The fraglen also needs to be reset when purging fragmentqueue in x25clearqueues...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: usb: kaweth: validate USB endpoints The kaweth driver should validate that the device it is probing has the correct number and types of USB endpoints it expects before binding to it. If a malicious device lacks the same URBS...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix possible NULL pointer dereference in ufshcdaddcommandtrace The kernel log indicates a crash in ufshcdaddcommandtrace, due to a NULL pointer dereference when accessing hwq-id. This can happen if...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: mpu3050: Fix irq resource leak The interrupt handler is set up, but only a few lines down if iiotriggerregister fails to return properly and fails to release the handler. Add a cleanup goto to resolve the resource leak...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom Since upstream commit e75665dd0968 “wifi: wlcore: ensure skb headroom before skbpush”, wl1271txallocate and thus wl1271preparetxframe return -EAGAIN...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: tegra-video: Fix memory leak in tegrachanneltryformat The state object allocated by v4l2subdevstatealloc must be freed using v4l2subdevstatefree when it is no longer needed. In tegrachanneltryformat, two error paths return...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ntfs3: add buffer boundary checks to rununpack rununpack checks runbuf runlast at the top of the while loop but then reads sizesize and offsetsize bytes via rununpacks64 without verifying they fit within the remaining buffer. A...

Astra Linux - Vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: staging: sm750fb: fix division by zero in pstohz pstohz is called from hwsm750crtcsetmode without validating that pixclock is non-zero. A zero pixclock passed via FBIOPUTVSCREENINFO causes a division by zero. The issue is fixed b...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payloadsize in rxercv Currently, rxercv only checks that the incoming packet is at least headersizepkt bytes long prior to using payloadsize. However, payloadsize subtracts both the...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: only purge non-released claims When batadvblapurgeclaims processes the list of claims, it only iterates over the hash list using an rcureadlock. Due to a possible parallel batadvclaimput, it is possible that it...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skbiserrqueue treats PACKETOUTGOING as the sole indicator for a skb originating from skerrorqueue. This assumption does not hold for AFPACKET sockets; outgoing packet taps are...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix MR cleanup on copy error rdsrdmamap passes ownership of sg/pages to the transport after getmr succeeds. If copying the generated cookie back to user space fails afterward, the error path must not free those resource...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: macb: Use devconsumeskbany to free TX SKBs The napiconsumeskb function is not intended to be called in an IRQ disabled context. However, after commit 6bc8a5098bf4 “net: macb: Fix txptrlock locking”, the freeing of TX SKBs is...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tvlv: reject oversized TVLV packets batadvtvlvcontainerogmappend constructs a TVLV packet section from the tvlv.containerlist. The total size of this section is determined by batadvtvlvcontainerlistsize, which sums th...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: handle forward allocation error batadvdatforwarddata calls pskbcopyforclone to duplicate an skb for each DHT candidate; however, it fails to check the return value before passing it to...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: directly shut down timer on cleanup batadvtpsendercleanup was calling timerdeletesync followed by timerdelete to prevent the timer handler from rearming itself between the two calls. This double-deletion...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: prevent use-after-free when deleting claims When batadvbladelbackboneclaims removes all claims for a backbone, it does so by removing the link entry from the hash list. This list entry itself was one of the...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: media: intel/ipu6: fix error pointer dereference In a error path, isp-psys is confirmed to be an error pointer that is not NULL; therefore this condition is true and the error pointer is dereferenced. Consequently, isp-psys shoul...