Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: bridge: brndsend: validate ND option lengths brndsend checks ND options based on their length values provided by the user. A malformed option may cause the parser to move past the calculated option span or to use a source LLADDR...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: HID: Add HIDCLAIMEDINPUT guards in rawevent callbacks missing them In commit 2ff5baa9b527 “HID: appleir: Fix potential NULL dereference at raw event handle”, we address the issue that raw event callbacks can occur even on a HID...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix locking for bcmop runtime updates Commit c2aba69d0c36 “can: bcm: add locking for bcmop runtime updates” adds locking for certain variables that can be modified at runtime when updating the sending bcmop via a new...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix locking in hciconnrequestevt with HCIPROTODEFER When protocol sets HCIPROTODEFER, hciconnrequestevt calls hciconnectcfmconn without hdev-lock. Generally hciconnectcfm assumes that the lock is held; if conn is delet...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ceph: fix a buffer leak in cephsetxattr The oldblob in cephsetxattr can store ci-ixattrs.preallocblob value during the retry. However, it is never called the cephbufferput for the oldblob object. This patch fixes the issue of the...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ice: fix double free in icesfethactivate error path When auxiliarydeviceadd fails, icesfethactivate jumps to auxdevuninit and calls auxiliarydeviceuninit&sfdev-adev. The device release callback icesfdevrelease frees sfdev; howeve...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix integer overflow in rununpack volume boundary check The volume boundary check lcn + len sbi-used.bitmap.nbits utilizes raw addition, which can wrap around for large lcn and len values, thereby bypassing validation. Use...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: prevent overflow in lookup table allocation When calculating the lookup table size, ensure the following multiplication does not overflow: - The maximum value of desc-fieldlen is U8MAX multiplied by...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: netfilter: nflog: validate MAC header was set before dumping it The fallback path of dumpmacheader guards access to the MAC header only when “skb-macheader != skb-networkheader”, without checking skbmacheaderwasset. When the MAC...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: greybus: gb-beagleplay: bound bootloader receive buffering cc1352bootloaderrx appends each serdev chunk to the fixed rxbuffer prior to parsing bootloader packets. This helper can retain leftover bytes between callbacks, and may...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fixed memory leak in the error path of hciallocdev Early failures in Bluetooth HCI UART configuration lead to SRCU percpu memory leaks. When device initialization fails prior to completion of hciregisterdev, the...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: frndis: Protect RNDIS options with mutex The class/subclass/protocol options are susceptible to race conditions, as they can be accessed concurrently via configfs. Use an existing mutex to protect these options. This...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix memory leak in xhcidisableslot xhcialloccommand allocates a command structure; when the second argument is true, it also allocates a completion structure. Currently, the error handling path in xhcidisableslot only...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix VF illegal register access Register WXCFGPORTST is a PF restricted register. When a VF is initialized, attempting to read this register triggers an illegal register access, which leads to a system hang. When the...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: HID: playstation: Clamp numtouchreports Wouldn’t a device ever lie about the number of touch reports? If it did, the loop in dualshock4parsereport would read from the end of the touchreports array, up to approximately 2 KiB—the...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check tdls flag in ieee80211tdlsoper When NL80211TDLSENABLELINK is called, the code only checks whether the station exists, but does not verify whether it is actually a TDLS station. This allows the operation to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: read txq-readptr under lock If we read txq-readptr without a lock, we can read the same value twice, then obtain the lock, and reclaim it from two different locations. Crucially, this causes the same entry to be...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix OOB write in QUERYINFO for compound requests When a compound request such as READ + QUERYINFOSecurity is received, and the first command READ consumes most of the response buffer, ksmbd could write beyond the allocated...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix recursive locking in configfsopenfile In flushwritebuffer, &p-fragsem is acquired and then the loaded store function is called, which is targetcoreitemdbrootstore in this case. This function calls filpopen, afte...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: pmdomain: core: Fix detach procedure for virtual devices in genpd When a device is attached to a PM domain via genpddevpmattachbyid, genpd calls pmruntimeenable for the corresponding virtual device it registers. Although this...