Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses The “DEC0 MODE” to “DEC7 MODE” controls are enumerated; however, txmacrodecmodeget and txmacrodecmodeput access their values via ucontrol-value.integer.value0 a long rather...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: xilinx: formatterpcm: fix streamdata leak on open error In xlnxformatterpcmopen, streamdata is allocated and adata-playstream or adata-capturestream is assigned early. If a later step, such as sndpcmhwconstraintstep or...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: atomically update mac addresses When a MAC address is updated in batadvdatentryadd, it is done using a simple copy function. A parallel reader might only see parts of this update. In the worst case, the reader is...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make releasescratchbuffers idempotent brcmfpciereleasescratchbuffers frees the shared.scratch and shared.ringupd DMA buffers using dmafreecoherent, but does not clear the pointers afterward—unlike the sibling...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltechprocessrelpacket Make finger2 and also finger1 unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated by NULLBDEVICEATTR refuse to modify the configuration of a live device by checking for NULLBDEVFLCONFIGURED; however, this flag...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: cancel pending IN work before freeing the midi object The fmidi driver embeds a work item midi-work whose handler, fmidiinwork, dereferences the enclosing struct fmidi through containerof. This work is armed...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4initcpstate nfs4allocinitcpntfstate publishes the new cpntf entry into the s2scpstateids IDR with cstype set within one s2scplock section; it then reacquires the lock to insert it into...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: round up PTP perout pin duration Pin duration is converted from the user-provided period to SJA1105 clock ticks, then passed as the cycletime argument to futurebasetime. Very small period values may become zero...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: skip dying blkg in blkcgactivatepolicy When switching IO schedulers on a block device, blkcgactivatepolicy can race with concurrent blkcg deletions, resulting in a use-after-free in rcuacceleratecbs. T1: T2: blkgdestr...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: jbd2: fix integer underflow in jbd2journalinitializefastcommit jbd2journalinitializefastcommit validates journal capacity by checking journal-jlast - numfcblks JBD2MINJOURNALBLOCKS. Both jlast and numfcblks are unsigned; thus, wh...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: read llcpsock-local under the socket lock in getsockopt nfcllcpgetsockopt reads llcpsock-local before locksocksk, then dereferences the cached pointer within the locked region. llcpsockbind assigns and clears...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix use-after-free race with concurrent NETDEVUNREGISTER isotprelease looked up the bound network device via devgetbyindex using the stored ifindex. During device unregistration, the device is unlisted from the ifinde...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Reject buffer reuse with different data length When data buffers are reused—for example, for interval sample records—the first record determines both the data length and the buffer size for user copy. Current...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver indexes the connector’s port altmode array using the GETCURRENTCAM response; this indexing is performed only after verifying that the value is...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound iinlinexattrsize for non-inline-xattr inodes When the flexibleinlinexattr feature is enabled, doreadinode loads the on-disk iinlinexattrsize unconditionally: if f2fssbhasflexibleinlinexattrsbi fi-iinlinexattrsize =...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: igc: remove napisynchronize from igcdown When an AFXDP zero-copy application is terminated abruptly, the XSK pool is torn down but NAPI continues to poll. igccleanrxirqzc then returns the full budget on each poll, causing...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsiallocsgtables During fuzz testing, the following issue was discovered: BUG: KMSAN: uninit-value in dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x4a/0x70...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: free STAG index when TPT entry write fails writetptentry allocates a new STAG index using c4iwgetresource and increments stats.stag.cur prior to programming the entry. When writeadaptermem fails, it returns an error...