PT-2026-116689

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode kvm pkvm ioctl allowed WARNs when kvm get cap for kvm ioctl doesn't find the ioctl number in vm ioctl caps, and kvm arch vm ioctl calls it for every number the gener...

CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2023:1686585068)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2023:1686585068 advisory. - The 802.11 standard that underpins Wi-Fi Protected Access WPA, WPA2, and WPA3 and Wired Equivalent Privacy WEP doesn't require tha...

Linux Kernel Security Vulnerabilities

The Linux kernel version 5.17 contains a security vulnerability. This vulnerability arises from the fact that Bluetooth hcisync does not hold hdev-lock when searching and reading query cache entries. As a result, the concurrent HCIINQUIRY ioctl can refresh the cache and release the entries, leadi...

Linux Kernel Security Vulnerabilities

There are security vulnerabilities in Linux kernels versions from 3.2.99 to 3.3, from 3.16.54 to 3.17, from 3.18.94 to 3.19, from 4.1.50 to 4.2, from 4.4.115 to 4.5, from 4.9.78 to 4.10, from 4.14.15 to 4.15, and version 4.15. The vulnerability stems from ALSA’s handling of ioctl commands for...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.26 contains security vulnerabilities. These vulnerabilities stem from race conditions in the tty ioctl and hang-up operations within the USB serial driver. Access to port driver data or hardware occurs without checking whether the port is already hung up. This could...

Linux Kernel Security Vulnerabilities

The Linux kernel version 7.2 contains security vulnerabilities. These vulnerabilities stem from the ethtool IOCTL self-test path, which only holds a netdev lock on the ops-locked driver but not a rtnllock. During offline self-tests, when interfaces are closed and reopened using...

Linux Kernel Security Vulnerabilities

The Linux kernel version 7.0 contains a security vulnerability. This vulnerability stems from KVM arm64’s improper handling of user-space inputs when searching for unknown VM ioctl operations in protected mode. This improper handling triggers a WARN message and causes the pKVM host to crash...

Linux Kernel Security Vulnerabilities

The Linux kernel version 5.5 contains a security vulnerability. This vulnerability arises when the ARP ioctl function copies the struct arpreq provided by the user into the stack object. In this process, the arpdev field may lack a NUL terminator. When checking the device name, the strcmp functio...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from the pasteselection function, which releases the selection mutex lock during a loop. As a result, concurrent TIOCLINUX ioctl operations can reduce the vcsel.buflen to a value below pasted, leading to unsigned integer...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.26 contains security vulnerabilities. These vulnerabilities stem from race conditions between the tty break ioctl and hang operations. TCSBRK and TCSBRKP are not terminated in time, which may lead to the callback of the tty driver for devices that have been removed...

Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Check CAPNETADMIN for private ioctls Gate the SIOCDEVPRIVATE ioctl commands SIOCQETHADPSETSNMPCONTROL, SIOCQETHGETCARDTYPE and SIOCQETHQUERYOAT with CAPNETADMIN capable check to ensure unprivileged users cannot invoke...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Just as in a previous issue in this driver, usblpctrlmsg will collapse the usbcontrolmsg return value to 0/-errno, thereby discarding the actual number of bytes...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ocfs2: handle invalid dinode in ocfs2groupextend BUG kernel BUG at fs/ocfs2/resize.c:308! Oops: invalid opcode: 0000 1 SMP KASAN NOPTI RIP: 0010:ocfs2groupextend+0x10aa/0x1ae0 fs/ocfs2/resize.c:308 Code: 8b8520ff ffff83f8 860f858...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ptp: Ensure that info-enable callback is always set. The ioctl and sysfs handlers call the -enable callback unconditionally. Not all drivers implement this callback, resulting in NULL dereferencing. Examples of affected drivers:...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: fix idatasem unlock order in ext4indmigrate Fuzzing reports a possible deadlock in jbd2logwaitcommit. This issue occurs when an EXT4IOCMIGRATE ioctl is set to require synchronous updates because the file descriptor is opene...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ppp: The requirement for CAPNETADMIN in the target netns is necessary for unattached IOCTls. The opening of /dev/ppp is currently allowed for file-fcred-userns, while unattached administrative IOCTls operate on...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: btrfs: Fixed a use-after-free after failing to create a snapshot. In ioctl.c’s createsnapshot function, we allocate a pending snapshot structure and then attach it to the transaction’s list of pending snapshots. After that, we ca...

Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Prevent overflow in size calculation for memdupuser The number of apqn target list entries contained in the ‘nrapqns’ variable is determined by userspace via an ioctl call; thus, the product of these values used in...

Astra Linux – vulnerability in linux-5.10, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid block index in GC ioctl Syzbot reported list corruption caused by a double listaddtail call on bh-bassocbuffers within nilfslookupdirtydatabuffers. Analysis revealed that the root cause was the insertion of...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the return result of sbminblocksize Syzkaller reports a bug named “UBSAN: shift-out-of-bounds in squashfsbioread”. Syzkaller forks multiple processes. After mounting the Squashfs filesystem, it issues an...