Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: tee: optee: Prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a199 “tee: optee: Fix supplicant wait loop” made the client wait as killable so it can be interrupted during shutdown or after a...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: spi: ch341: fix memory leaks on probe failures Make sure to deregister the controller, disable pins, and kill and free the RX URB on probe failures to mirror the disconnection process; this helps prevent memory leaks and...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: iouring/net: fix slab-out-of-bounds read in iobundlenbufs sqe-len is u32 but gets stored into sr-len which is int. When userspace passes sqe-len values exceeding INTMAX e.g., 0xFFFFFFFF, sr-len overflows to a negative value. This...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: nexthop: fix percpu use-after-free in removenhgrpentry When removing a nexthop from a group, removenhgrpentry publishes the new group via rcuassignpointer, then immediately frees the percpu stats of the removed entry using...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: usb: aqc111: Do not perform PM inside suspend callback syzbot reports “task hung in rpmresume” This is caused by aqc111suspend calling the PM variant of its writecmd routine. The simplified call trace looks like this:...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate rec-used in journal-replay file record check checkfilerecord validates rec-total against the record size but never validates rec-used. The doaction journal-replay handlers read rec-used from disk and use it to...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel rfkillblock work in wiphyunregister A use-after-free error has been identified in cfg80211shutdownallinterfaces by syzkaller: BUG: KASAN: use-after-free in cfg80211shutdownallinterfaces+0x213/0x220 Read of...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix memory leaks and NULL deref in smb2lock smb2lock has three error handling issues after listdel detaches smblock from locklist at nocheckcl: 1 If vfslockfile returns an unexpected error in the non-UNLOCK path, goto out...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: irqwork: Fix use-after-free in irqworksingle on PREEMPTRT On PREEMPTRT, non-HARD irqwork runs in per-CPU kthreads via runirqworkd, so irqworksync uses rcuwait to wait for BUSY==0. After irqworksingle clears BUSY via atomiccmpxchg...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ntfs3: Reject direct userspace writes to reserved $LX xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD, and $LXDEV as internal WSL permission metadata and reloads them into iuid, igid, and imode from ntfsgetwslperm. Since the empty-prefi...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix a possible use-after-free when removing a bridge port When per-VLAN multicast snooping is enabled, the bridge iterates over all bridge ports, disables the per-port multicast context on each port and enables the...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: fix divide-by-zero in rtscmin m2sm converts a u32 slope to a u64 scaled value. For large inputs e.g., m1=4000000000, the result can reach 2^32. rtscmin stores the difference between two such u64 values in a u3...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix null-ptr-deref in lecarpclearvccs Syzkaller reported a null-ptr-deref in lecarpclearvccs. This issue can be easily reproduced using the Syzkaller reproducer. In the ATM LANE LAN Emulation module, the same atmvcc can...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: remove refcounting in expectation dumpers The same pattern as the previous patch: do not keep the expectation object alive via refcount; instead, store a cookie value and use that as the skip hint for dump...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: mac80211: fix crash in ieee80211chanbwchange for APVLAN stations ieee80211chanbwchange iterates through all stations and accesses link-reserved.oper via sta-sdata-linklinkid. For stations on APVLAN interfaces e.g., 4addr WDS...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: s390/syscalls: Add spectre boundary for syscall dispatch table The s390 syscall number is directly controlled by userspace, but does not have an arrayindexnospec boundary to prevent access past the syscall function pointer tables...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: comedi: medaq: Fix potential overrun of firmware buffer me2600xilinxdownload loads the firmware requested by requestfirmware. It is possible for it to overrun the source buffer due to its blind trust in the file format. It reads ...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: HID: asus: avoid memory leak in asusreportfixup The asusreportfixup function was returning a newly allocated kmemdup-allocated buffer, but never freeing it. Switch to devmkzalloc to ensure the memory is managed and freed...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: serial: caif: hold tty-link reference in ldiscopen and serrelease When caifserial’s TX path calls ttywriteroom, the reproducer triggers a KASAN slab-use-after-free in ptywriteroom. The faulty access occurs on tty-link-port. Hold ...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dirlen length u16 widened to sizet. Two distinct OOB conditions follow when entry-length uuid, ... which always reads 4 dwords from diroffset. tbpropertyentryvalid only enforces diroffset +...