Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in readchunkrange svcrdmareadchunkrange iterates through a Read chunk’s segment list to create a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: em28xx: defer audio-only extension registration The audio-only path registers extensions while probing the primary device. On a dual-TS board, this occurs before devnext is created. The duplicate device inherits isaudioonl...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When updating CR8 intercepts, get vmcs12 only if the vCPU is in guest mode so that a future change can have updated CR8 intercepts during vCPU creation,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Suppress UBSAN warnings caused by improper field usage The definition of reg-accesswidth varies based on the reg-spaceid type. The ACPIADRSPACEPLATFORMCOMM type utilizes accesswidth to denote the PCC region; if this...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: PCI: altera: Fix resource leaks on probe failure The chained IRQ handler is set during probe, but is only removed during the driver remove. If pcihostprobe fails, the handler and INTx IRQ domain remain set even though the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUDCONNECTORTVMODENAMELEN entries and requires each name to be NUL-terminated. gudconnectoraddtvmode currently...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16MAX entries During $LogFile replay, logreplay indexes the transaction table by the transactid taken from the log record header. checklogrec only verifies that transactid is non-zero...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmdnode-databuf. Several callers pass stack-allocated objects there. If waiteventinterruptibletimeout ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ip6gre: fix hardware header length for NBMA tunnels ip6gretnllinkconfigroute accumulates the lower device’s hardware header length into dev-hardheaderlen whenever headerops is set. This is incorrect for both users of headerops...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-fwnode: Fix fwnode leak in v4l2fwnodeparselink In v4l2fwnodeparselink, the remote endpoint fwnode reference is acquired using fwnodegraphgetremoteendpoint. This reference is properly released in the error paths, but i...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: orangefs: keep the readdir entry size 64-bit in fillfrompart fillfrompart computes the size of a directory entry in sizet but stores it in a u32. An entry length near U32MAX wraps it to a small value, bypassing the bounds check,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipcdiscrcv bearerdisable frees b-disc using the plain kfree provided by tipcdiscdelete, but tipcdiscrcv still dereferences b-disc during the RX softirq under rcureadlock tipcudprecv ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hardheaderlen in non-ring send paths packetsnd reads dev-hardheaderlen multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix NULL dereference in ffapartitioninfoget ffapartitioninfoget passes uuidstr directly to uuidparse without performing a NULL check. When a caller passes NULL, uuidparse - uuidparse - uuidisvalid dereferences t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/panel-edp: fix i2c adapter leak on probe failure Make sure to drop the i2c adapter reference on probe failure e.g., probe deferral and on driver unbind as well; if a device tree redundantly uses the ‘ddc-i2c-bus’ property to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free of usbdevice in usbdevrelease usbdevrelease drops its reference to the struct usbdevice before draining the list of completed async URBs; however, this drain path reads back through the same object...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct-lock is still held. When invalid logging is routed to nfnetlinklog and conntrack export is enabled, t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vcdata fbconnewmodelist is called whenever the modelist of a framebuffer changes. For each console mapped to it via fbdisplayi.mode, it reads vcconsi.d and passes the vcnu...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Free arenas on bttinit error paths The arenas allocated by discoverarenas or createarenas are not freed on certain error paths in bttinit. This leads to memory leaks when BTT initialization fails. Call freearenas from...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claims and progresses a transfer; the RX path consumes Flow Control/echo frames; and two hrtimers...