Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow Commit 44e9a3bb76e5 “ARM: 9430/1: entry: Do a dummy read from VMAP shadow” added a dummy read from the KASAN VMAP stack shadow in switchto. The read uses ldr, but the...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Input: uinput - fix circular locking dependency with ff-core A lockdep circular locking dependency warning can be triggered reproducibly when using a force-feedback gamepad with uinput for example, playing ELDEN RING under Wine...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16260: fix division by zero in writeraw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero to the samplingfrequency sysfs attribute triggers a division by zero...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: radiotap: reject radiotap with unknown bits Currently, the radiotap parser is used only with the radiotap namespace not with vendor namespaces. However, when field 18 is used, both alignment and size remain unknown. In this...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: s390/entry: Scrub r12 register on kernel entry Prior to commit f33f2d4c7c80 “s390/bp: remove TIFISOLATEBP”, all entry handlers loaded r12 with the current task pointer lg %r12, LCCURRENT for use by the BPENTER/BPEXIT macros. That...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix circular locking dependency in nciclosedevice nciclosedevice flushes rxwq and txwq while holding reqlock. This causes a circular locking dependency because ncirxwork running on rxwq can end up taking reqlock too:...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Properly kill the timer upon removal The USB-audio MIDI code initializes the timer; however, in a rare case, the driver may be freed without calling the disconnect function. This leaves the timer in an active sta...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: soc: microchip: mpfs: Fix memory leak in mpfssyscontrollerprobe In mpfssyscontrollerprobe, if ofgetmtddevicebynode fails, the function returns immediately without freeing the allocated memory for syscontroller, resulting in a...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Added spectre boundary for syscall dispatch table The LoongArch syscall number is directly controlled by userspace; however, there is no arrayindexnospec boundary to prevent access beyond the syscall function pointer...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not free data reservation in fallback from inline due to -ENOSPC If we fail to create an inline extent due to -ENOSPC, we will attempt to go through the normal COW path, reserve an extent, create an ordered extent, etc...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Zeroing shared pages prior to exposure to userspace bnxtreallocucontext allocates uctx-shpg via getfreepageGFPKERNEL. The buddy allocator does not zero pages without GFPZERO; thus, the page contains stale kernel data...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: xfrm: routes MIGRATE notifications to the caller’s netns xfrmsendmigrate in net/xfrm/xfrmuser.c and pfkeysendmigrate in net/key/afkey.c both hardcode &initnet for the multicast that announces a successful XFRMMSGMIGRATE /...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix integer underflow in chain mode The jumbofrm chain-mode implementation unconditionally computes len = nopagedlen - bmax; where nopagedlen = skbheadlenskb linear bytes only and bmax is BUFSIZE8KiB or BUFSIZE2KiB...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: udptunnel: fix NULL deref caused by udpsockcreate6 when CONFIGIPV6=n When CONFIGIPV6 is disabled, the udpsockcreate6 function returns 0 success without actually creating a socket. Callers such as foucreate then proceed to...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in createspaceinfo error path When kobjectinitandadd fails, the call chain is: createspaceinfo - btrfssysfsaddspaceinfotype - kobjectinitandadd - failure - kobjectput&spaceinfo-kobj - spaceinforelease -...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: media: vidtv: fix nfeeds state corruption on startstreaming failure SyZBot reported a memory leak in vidtvpsiservicedescinit 1. When vidtvstartstreaming fails within vidtvstartfeed, the nfeeds counter is incremented even though n...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: mtd: docg3: fix use-after-free in docg3release In docg3release, the docg3 pointer is obtained from cascade-floors0-priv before the loop that calls docreleasedevice on each floor. docreleasedevice frees the docg3 struct via...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: arm64: tlb: Flush walk cache when unsharing PMD tables When hugepmdunshare is called to unshare a PMD table, the tlbunsharepmdptdesc function sets tlb-unsharedtables=true; however, the aarch64 tlbflush only checks tlb-freedtables...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fix OOB write in wacomhidsetdevicemode Currently, wacomhidsetdevicemode assumes that the HIDDGINPUTMODE usage is always located in the first field field0 of the feature report. However, a device may specify...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp-advdatalen and...