Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: xfrm: ah: account for ESN high bits in async callbacks When ESN is enabled, AH allocates its temporary auth/ICV layout differently: The async ahash setup appends a 4-byte seqhi slot before the ICV or authdata area; however, the...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject empty multisync extension to prevent infinite loop v3dgetextensions iterates over a singly-linked list of ioctl extensions provided by userspace, with no bounds on the chain length. A local user can craft a...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: tpm: Use kfreesensitive to free auth session in tpmdevrelease tpmdevrelease uses plain kfree to free chip-auth, which contains sensitive cryptographic material including HMAC session keys, nonces, and passphrase data struct...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peermep deletion When a peer MEP is being deleted, canceldelayedworksync is called on ccmrxdwork before freeing. However, brcfmframerx runs in softirq context under rcureadlock without RTNL and...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: s390/syscalls: Add spectre boundary for syscall dispatch table The s390 syscall number is directly controlled by userspace, but does not have an arrayindexnospec boundary to prevent access past the syscall function pointer tables...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for direct shadow pages using sp-gfn plus the SPTE index. This assumption breaks for shadow paging if the guest page tables are modifie...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAYBACKLOG requests MAYBACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate L2CAPINFORSP payload length before access The l2capinformationrsp function checks whether cmdlen exceeds the fixed l2capinforsp header type + result, 4 bytes, but then reads rsp-data without verifying...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net/tcp-md5: Fix MAC comparison to be constant-time To prevent timing attacks, MACs must be compared in constant time. Use the appropriate helper function for this...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: unshare: fix unsharefs handling There’s an unpleasant corner case in unshare2, when we have a CLONENEWNS flag and current-fs hadn’t been shared at all; in that case copymntns gets passed current-fs instead of a private copy, whic...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: validate interrupt packet headers cypressreadintcallback parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 includes a two-byte status/count header, while Format 2 use...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow Commit 44e9a3bb76e5 “ARM: 9430/1: entry: Do a dummy read from VMAP shadow” added a dummy read from the KASAN VMAP stack shadow in switchto. The read uses ldr, but the...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Tracing: Do not call map-ops-eltfree if eltalloc fails In paths where tracingmapeltalloc failed to allocate objects, the map-ops-eltalloc call was never successful. In this case, map-ops-eltfree should not be called...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: irqwork: Fix use-after-free in irqworksingle on PREEMPTRT On PREEMPTRT, non-HARD irqwork runs in per-CPU kthreads via runirqworkd, so irqworksync uses rcuwait to wait for BUSY==0. After irqworksingle clears BUSY via atomiccmpxchg...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: s390/entry: Scrub r12 register on kernel entry Prior to commit f33f2d4c7c80 “s390/bp: remove TIFISOLATEBP”, all entry handlers loaded r12 with the current task pointer lg %r12, LCCURRENT for use by the BPENTER/BPEXIT macros. That...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: calls ksmbdvfskernpathendremoving on certain error paths There are two locations where ksmbdvfskernpathendremoving must be called to balance what the corresponding successful call to ksmbdvfskernpathstartremoving has...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix accept queue count leak on transport mismatch virtiotransportrecvlisten calls skacceptqadded before vsockassigntransport. If vsockassigntransport fails or selects a different transport, the error path returns...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Resolves soft lockup issue when opening /dev/sgX The parameter defreservedsize defines the default buffer size reserved for each Sgfd; it should be restricted to a range of 0 to 1,048,576 see...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Added spectre boundary for syscall dispatch table The LoongArch syscall number is directly controlled by userspace; however, there is no arrayindexnospec boundary to prevent access beyond the syscall function pointer...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: HID: asus: avoid memory leak in asusreportfixup The asusreportfixup function was returning a newly allocated kmemdup-allocated buffer, but never freeing it. Switch to devmkzalloc to ensure the memory is managed and freed...