Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Free arenas on bttinit error paths The arenas allocated by discoverarenas or createarenas are not freed on certain error paths in bttinit. This leads to memory leaks when BTT initialization fails. Call freearenas from...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claims and progresses a transfer; the RX path consumes Flow Control/echo frames; and two hrtimers...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket using isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from i...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: reading virtqueues under worker locks The commit bd50c5dc182b “vsock/virtio: add support for device suspend/resume” caused the run flags to transition from false to true when restore installs replacement virtqueues...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel sched scan results work on unregister cfg80211schedscanresults can queue rdev-schedscanreswk from a driver result notification while a scheduled scan request is present. The work callback recovers the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: round up PTP perout pin duration Pin duration is converted from the user-provided period to SJA1105 clock ticks, then passed as the cycletime argument to futurebasetime. Very small period values may become zero...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject PDUs declaring more data than was received isertrecvdone passes each received PDU to the opcode handlers without ever checking wc-bytelen, which represents the actual number of bytes the HCA placed into the recei...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Revert “thermal/drivers/hwmon: Clean up coding style a bit” Revert commit 030a48b0f6ce “thermal/drivers/hwmon: Clean up coding style a bit” which introduced a use-after-free in the error path of thermaladdhwmonsysfs by removing a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Use kernel helpers for hex dumps Previously, when the driver printed hex dumps, the buffer was cast to an 8 byte long and printed using string formatters. If the buffer size was not a multiple of 8, a read buffer overflo...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling The Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT or ISOEND packets. Currently, we reject them if they are the last packet. If the controller sends a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313rtcprobe calls devmrequestirq with IRQFSHARED and &pdev-dev as the cookie, but platformsetdrvdata is only called later after the clock setup. With a shared IRQ line...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length The MPDU length in the rx descriptor comes from the hardware. In monitor mode with the fcsfail filter enabled, the hardware passes up corrupted frames; a corrupted...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: geneve: requires CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns: devnetdev and the sticky underlay netns geneve-net. They differ once the device is created in or moved to a netns...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: amt: Re-read skb header pointers after every pull Several AMT receive and transmit paths cache a pointer into the skb head iphdr, ipv6hdr, ethhdr, or the AMT message header and then call a helper that can reallocate that head...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing device refcount for CAN filter removal sashiko-bot noted a problem related to concurrent device unregistration in isotp.c; this issue also exists in bcm.c. An earlier fix for raw.c, commit c275a176e4b6 “can:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vduse: hold vduselock across IDR lookup in open path vdusedevopen looks up struct vdusedev through the IDR and then acquires dev-lock only after vduselock has been dropped. This creates a race condition where a concurrent...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent sntunacked underflow on CONNACK tipcskconnprotorcv subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter sntunacked without checking that it does not exceed the number of messages...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn-preauthinfo in concurrent SMB2 NEGOTIATE conn-preauthinfo is a shared connection state struct preauthintegrityinfo, kmalloc-96 that is allocated and freed by the SMB2 NEGOTIATE handler and then...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice passes RMB pages to a pipe and takes a socket reference per entry, ensuring that the smcsock remains alive until the reader finishes. However, concurrent closes trigg...