Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: Fixed a UAF issue when resolving a clash. KASAN reports the following UAF issues: - BUG: KASAN: A slab-use-after-free issue in tcfctflowtableprocessconn+0x12b/0x380 actct. A size 1 read at address ffff888c07603600 w...

DEBIAN-CVE-2025-21653

In the Linux kernel, the following vulnerability has been resolved: netsched: clsflow: validate TCAFLOWRSHIFT attribute syzbot found that TCAFLOWRSHIFT attribute was not validated. Right shitfing a 32bit integer is undefined for large shift values. UBSAN: shift-out-of-bounds in...

CVE-2025-21653 net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute

In the Linux kernel, the following vulnerability has been resolved: netsched: clsflow: validate TCAFLOWRSHIFT attribute syzbot found that TCAFLOWRSHIFT attribute was not validated. Right shitfing a 32bit integer is undefined for large shift values. UBSAN: shift-out-of-bounds in...

CVE-2024-53164

In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ordering of qlen adjustment Changes to sch-q.qlen around qdisctreereducebacklog need to happen before a call to said function because otherwise it may fail to notify parent qdiscs when the child is about to become...

UBUNTU-CVE-2024-53164

In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ordering of qlen adjustment Changes to sch-q.qlen around qdisctreereducebacklog need to happen before a call to said function because otherwise it may fail to notify parent qdiscs when the child is about to become...

SUSE CVE-2024-53044

In the Linux kernel, the following vulnerability has been resolved: net/sched: schapi: fix xainsert error path in tcfblockgetext This command: $ tc qdisc replace dev eth0 ingressblock 1 egressblock 1 clsact Error: block dev insert failed: -EBUSY. fails because user space requests the same block...

CVE-2024-53044 net/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext()

In the Linux kernel, the following vulnerability has been resolved: net/sched: schapi: fix xainsert error path in tcfblockgetext This command: $ tc qdisc replace dev eth0 ingressblock 1 egressblock 1 clsact Error: block dev insert failed: -EBUSY. fails because user space requests the same block...

SUSE CVE-2024-50126

In the Linux kernel, the following vulnerability has been resolved: net: sched: use RCU read-side critical section in tapriodump Fix possible use-after-free in 'tapriodump' by adding RCU read-side critical section there. Never seen on x86 but found on a KASAN-enabled arm64 system when investigati...

SUSE CVE-2024-50127

In the Linux kernel, the following vulnerability has been resolved: net: sched: fix use-after-free in tapriochange In 'tapriochange', 'admin' pointer may become dangling due to sched switch / removal caused by 'advancesched', and critical section protected by 'q-currententrylock' is too small to...

DEBIAN-CVE-2024-50126

In the Linux kernel, the following vulnerability has been resolved: net: sched: use RCU read-side critical section in tapriodump Fix possible use-after-free in 'tapriodump' by adding RCU read-side critical section there. Never seen on x86 but found on a KASAN-enabled arm64 system when investigati...

DEBIAN-CVE-2024-50127

In the Linux kernel, the following vulnerability has been resolved: net: sched: fix use-after-free in tapriochange In 'tapriochange', 'admin' pointer may become dangling due to sched switch / removal caused by 'advancesched', and critical section protected by 'q-currententrylock' is too small to...

UBUNTU-CVE-2024-50126

In the Linux kernel, the following vulnerability has been resolved: net: sched: use RCU read-side critical section in tapriodump Fix possible use-after-free in 'tapriodump' by adding RCU read-side critical section there. Never seen on x86 but found on a KASAN-enabled arm64 system when investigati...

AZL-51449 CVE-2024-50039 affecting package kernel for versions less than 5.15.173.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: accept TCASTAB only for root qdisc Most qdiscs maintain their backlog using qdiscpktlenskb on the assumption it is invariant between the enqueue and dequeue handlers. Unfortunately syzbot can crash a host rather easily...

UBUNTU-CVE-2024-50039

In the Linux kernel, the following vulnerability has been resolved: net/sched: accept TCASTAB only for root qdisc Most qdiscs maintain their backlog using qdiscpktlenskb on the assumption it is invariant between the enqueue and dequeue handlers. Unfortunately syzbot can crash a host rather easily...

kernel: net/sched: Fix UAF when resolving a clash

A use-after-free vulnerability was found in the net/sshd tcfctflowtableprocessconn of the Linux kernel. This flaw allows an attacker with a crafted payload to induce a system crash, resulting in a loss of system availability...

SUSE CVE-2023-52906

In the Linux kernel, the following vulnerability has been resolved: net/sched: actmpls: Fix warning during failed attribute validation The 'TCAMPLSLABEL' attribute is of 'NLAU32' type, but has a validation type of 'NLAVALIDATEFUNCTION'. This is an invalid combination according to the comment abov...

kernel: net/sched: Fix mirred deadlock on device recursion

In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix mirred deadlock on device recursion The Linux kernel CVE team has assigned CVE-2024-27010 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050148-CVE-2024-27010-5a68@gregkh/T...

UBUNTU-CVE-2024-40995

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: fix possible infinite loop in tcfidrcheckalloc syzbot found hanging tasks waiting on rtnllock 1 A reproducer is available in the syzbot bug. When a request to add multiple actions with the same index is sent, t...

SUSE CVE-2021-47595

In the Linux kernel, the following vulnerability has been resolved: net/sched: schets: don't remove idle classes from the round-robin list Shuang reported that the following script: 1 tc qdisc add dev ddd0 handle 10: parent 1: ets bands 8 strict 4 priomap 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 2 mauseza...

DEBIAN-CVE-2021-47557

In the Linux kernel, the following vulnerability has been resolved: net/sched: schets: don't peek at classes beyond 'nbands' when the number of DRR classes decreases, the round-robin active list can contain elements that have already been freed in etsqdiscchange. As a consequence, it's possible t...