Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: tee: optee: Prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a199 “tee: optee: Fix supplicant wait loop” made the client wait as killable so it can be interrupted during shutdown or after a...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: b43legacy: enforce bounds check on firmware key index in RX path The same fix as in b43: the firmware-controlled key index in b43legacyrx can exceed dev-maxnrkeys. The existing B43legacyWARNON is non-enforcing in production...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payloadsize in rxercv Currently, rxercv only checks that the incoming packet is at least headersizepkt bytes long prior to using payloadsize. However, payloadsize subtracts both the...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: only purge non-released claims When batadvblapurgeclaims processes the list of claims, it only iterates over the hash list using an rcureadlock. Due to a possible parallel batadvclaimput, it is possible that it...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skbiserrqueue treats PACKETOUTGOING as the sole indicator for a skb originating from skerrorqueue. This assumption does not hold for AFPACKET sockets; outgoing packet taps are...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption When decrypting data that is not in-place src != dst, there is no need to save the high-order sequence bits in dst as they can simply be re-copied...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix MR cleanup on copy error rdsrdmamap passes ownership of sg/pages to the transport after getmr succeeds. If copying the generated cookie back to user space fails afterward, the error path must not free those resource...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject unknown opcodes before ICRC processing Even after applying commit 7244491dab34 “RDMA/rxe: Validate pad and ICRC before payloadsize in rxercv”, a single unauthenticated UDP packet can still trigger a panic. That...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: fix divide-by-zero in rtscmin m2sm converts a u32 slope to a u64 scaled value. For large inputs e.g., m1=4000000000, the result can reach 2^32. rtscmin stores the difference between two such u64 values in a u3...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: bpf: reject direct access to nullable PTRTOBUF pointers checkmemaccess matches PTRTOBUF via basetype, which strips PTRMAYBENULL, allowing direct dereferencing without a null check. Map iterator ctx-key and ctx-value are PTRTOBUF ...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: macb: Use devconsumeskbany to free TX SKBs The napiconsumeskb function is not intended to be called in an IRQ disabled context. However, after commit 6bc8a5098bf4 “net: macb: Fix txptrlock locking”, the freeing of TX SKBs is...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix a possible use-after-free when removing a bridge port When per-VLAN multicast snooping is enabled, the bridge iterates over all bridge ports, disables the per-port multicast context on each port and enables the...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16260: fix division by zero in writeraw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero to the samplingfrequency sysfs attribute triggers a division by zero...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate ACL entry sizes in f2fsaclfromdisk f2fsaclcount only validates the aggregate ACL xattr length. A malformed ACL can still place ACLUSER or ACLGROUP in a slot that only contains struct f2fsaclentryshort bytes;...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tvlv: reject oversized TVLV packets batadvtvlvcontainerogmappend constructs a TVLV packet section from the tvlv.containerlist. The total size of this section is determined by batadvtvlvcontainerlistsize, which sums th...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: handle forward allocation error batadvdatforwarddata calls pskbcopyforclone to duplicate an skb for each DHT candidate; however, it fails to check the return value before passing it to...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: directly shut down timer on cleanup batadvtpsendercleanup was calling timerdeletesync followed by timerdelete to prevent the timer handler from rearming itself between the two calls. This double-deletion...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: prevent use-after-free when deleting claims When batadvbladelbackboneclaims removes all claims for a backbone, it does so by removing the link entry from the hash list. This list entry itself was one of the...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo-ttm object might be modified by calling ttmbovalidate, and later moved to an i915tt object to obtain the correct pointer. A user reported encountering the following bug...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: Reset prog ptr to oldprog in case of error in mtkxdpsetup Reset the eBPF program pointer to oldprog and do not decrement its ref-count if the mtkopen routine in mtkxdpsetup fails...