Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: Always recalculate features after XDP clearing; fix null-deref issue. Features are recalculated when XDP is detached. Before: ip li set dev eth0 xdp obj xdpdummy.bpf.o sec xdp ip li set dev eth0 xdp off ethtool -k eth0...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: x86/efi: defer freeing of boot services memory efifreebootservices frees memory occupied by EFIBOOTSERVICESCODE and EFIBOOTSERVICESDATA using memblockfreelate. There are two issues with that: memblockfreelate should be used for...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix NULL pointer bug in svmrangesetattr processinfo can be NULL if the user does not call kfdioctlacquirevm before calling kfdioctlsvm. cherry picked from commit 83a26c812e0529eb040d31a76f73e33e637243d4...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: hdlcppp: Synchronize per-protocol timers before freeing hdlc state Each PPP control protocol LCP/IPCP/IPV6CP embedded in struct ppp registers a timer via timersetup. This struct ppp represents the hdlc-state allocation;...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen – Clamp NEXIO datalen/xlen to the URB buffer size nexioreaddata extracts datalen and xlen from a packed be16 header within the device’s interrupt packet; it then iterates through packet-data0..xlen and...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: check URB actuallength for interrupt-IN notifications USBTMC devices can utilize an optional interrupt endpoint for notification messages. These messages typically contain two-byte headers specifying the payload...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU Reject synchronizing the vCPU state to its associated VMSA if the vCPU has already been launched, i.e., if the VMSA has already been encrypted. On a hos...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: clk: microchip: mpfs-ccc: fix out of bounds access during output registration UBSAN reported an out of bounds access during registration of the last two outputs. This out of bounds access occurs because space is only allocated in...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix reference count leak in rxrpcserverkeyring This patch fixes a reference count leak in rxrpcserverkeyring by checking whether rx-securities is already set...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in createspaceinfosubgroup error path When kobjectinitandadd fails, the call chain is: createspaceinfosubgroup - btrfssysfsaddspaceinfotype - kobjectinitandadd - failure - kobjectput&subgroup-kobj -...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Fix error unwind in manaibcreateqprss Sashiko points out that manaibcfgvportsteering is leaked; the normal destroy path cleans it up...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix not releasing workqueue on .release The workqueue associated with a DSA/IAA device is not released when the object is freed...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: always free skb on ieee80211txprepareskb failure ieee80211txprepareskb has three error paths, but only two of them free the skb. The first error path ieee80211txprepare returning TXDROP does not free it, while...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipmi:ssif: Clean up kthread on errors If an error occurs after the ssif kthread is created, but before the main IPMI code starts the ssif interface, the ssif kthread will not be stopped. Therefore, ensure that the kthread is...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: lan966x: fix use-after-free and leak in lan966xfdmareload When lan966xfdmareload fails to allocate new RX buffers, the restore path restarts DMA using old descriptors whose pages had already been freed via...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: x86/fred: Correct speculative safety in fredextint arrayindexnospec is useless if its result spills onto the stack, as it makes the seemingly safe-under-speculation value subject to memory predictions. In practice, this means tha...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Inject UD for INVLPGA if EFER.SVME=0 INVLPGA should cause a UD when EFER.SVME is not set. Add a check to properly inject UD when EFER.SVME=0. sean: tag for stable@...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix locking for bcmop runtime updates Commit c2aba69d0c36 “can: bcm: add locking for bcmop runtime updates” adds locking for certain variables that can be modified at runtime when updating the sending bcmop via a new...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: batman-adv: avoid OGM aggregation when skb tailroom is insufficient When the OGM aggregation state is toggled at runtime, an existing forwarded packet may have been allocated with only packetlen bytes, while a later packet can...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix tx.buf use-after-free in isotpsendmsg isotpsendmsg uses only cmpxchg on so-tx.state to serialize access to so-tx.buf. isotprelease waits for ISOTPIDLE via waiteventinterruptible and then calls kfreeso-tx.buf. If a...