Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Use overflow checks in controlupdate size calc In sofipc3controlupdate, the expectedsize calculation uses the cdata-numelems provided by the firmware in its arithmetic; this can overflow on 32-bit...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: Return queued buffers on startstreaming failure The vb2 framework passes buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffer...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf’s falist via fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa usin...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RapidIO: mportcdev: fix use-after-free in dmareqfree dmareqfree acquires bufmutex through req-map, drops the mapping reference with krefput, and then dereferences req-map again to unlock the mutex. If krefput drops the last...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound SNL TLV parsing to the skb and add length checks nfcllcprecvsnl walks through the SNL TLV list using a u16 offset/length pair derived from skb-len, without performing bounds checks on the actual skb data. Three...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Free RX data on late probe failure hfi1initdd allocates the shared AIP/VNIC RX support before returning. If hfi1init or hfi1registeribdevice later fails, initone tears down the device data without calling hfi1freerx...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer underflow in processread and processwrite usrlen is read from a network-supplied message field le16tocpu and used to compute datalen = off - usrlen without validating that usrlen off, causing an integer...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: Revoke copy-notify stateids before dropping their reference Copy-notify stateids reside in the s2scpstateids IDR and on their parent stid’s sccplist, with a single membership reference holding them in place...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: fix hugezeropfn race Patch series “mm/hugememory: fix hugezeropfn race”, version 2. There is a subtle race in the reference-counted hugezerofolio implementation. The fast path atomic logic fails to account for the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix blocking and non-blocking rng logic The blocking and non-blocking paths failed to provide valid entropy due to improper buffer management. Reading the buffer starting from byte 1, only 32 bytes of rand...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in closefiletableids A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode. Currently, ksmbdclosefd marks the file as clos...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL pointer dereference in ath11khalsrngaccessbegin In ATH11KQMIEVENTFWREADY, ATH11KFLAGREGISTERED is set unconditionally even when ath11kcoreqmifirmwareready fails. This leaves the driver in an inconsistent...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fix memory leak on registration failure The allocated device name is never freed on early ULPI device registration failures. This can be fixed by initializing the device structure earlier and releasing the initial...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page Table capacity in logreplay copylcns During the analysis phase of $LogFile journal replay, logreplay copies LCNs from each action log record into an existing Dirty Page Table DPT entry without boundi...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats agent registration race mlx5ehvvhcastatscreate registers the stats agent via mlx5hvvhcaagentcreate. The helper publishes the agent in hvvhca-agentstype under agentslock and immediately schedules an...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: gpio: mt7621: avoid corruption of shared interrupt trigger state Bank-shared fields such as ‘rising’ and ‘falling’ are modified using non-atomic read-modify-write operations. Since each gpio chip instance represents an entire ban...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: kcm: Use WRITEONCE when changing lower socket callbacks kcmattach replaces the skdataready and skwritespace callbacks of a live lower TCP socket with KCM handlers, while kcmunattach restores them later. These callback pointer...