Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: futex: Prevent rcuwait use-after-free during requeue PI On PREEMPTRT, FUTEXCMPREQUEUEPI can trigger a KASAN report slab-out-of-bounds in futexrequeuepicomplete when calling rcuwaitwakeup. The futexq used by futexwaitrequeuepi is...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: afpacket: Do not send zero-byte data in tpacketsnd. SyZBot reported a WARNING in devqueuexmit triggered via tpacketsnd: skbassertlen WARNING: at include/linux/skbuff.h:2753 skbassertlen WARNING: at devqueuexmit+0x21bc/0x4970...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 atomic SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic polling path rejects it as -EPROTO. Worse still, it returns without a NACK+STOP: the next receive cycle...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: check streams bounds before overflow The data-streams overflow check is performed after the buffer overflow has already occurred. Move the overflow check to occur before the write operation. As a side note, issuing...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: fix use-after-free on probe failure The vub300 driver manages its controller state using vub300-kref; vub300delete frees the mmc host when the last reference is dropped. However, the probe error path after the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject BPFMAPTYPEINODESTORAGE creation if BPF LSM is uninitialized When CONFIGBPFLSM=y is set, BPF inode storage maps BPFMAPTYPEINODESTORAGE are compiled into the kernel. However, if the BPF LSM is not explicitly enabled at...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix SQB pointer leak on init failure otx2inithwresources initializes SQ aura and pool resources before several later setup steps. On failure, errfreesqptrs only frees SQB pages, leaving the per-SQ sqbptrs arrays...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: do not leak bad clone into future transaction Upon a memory allocation failure, the cloned nftpipapomatch can enter a bad state: - Some fields may have their lookup tables resized while others did not. -...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S and MMS136 The MMS134S and MMS136 touch controllers have an event size of 6 bytes rather than 8 bytes. When mms114readreg reads the touch data packet from the device into the touch...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix memory leak in ieee80211registerhw If kmemdup fails while copying supported band structures, the error path jumps to failrate. This skips ratecontroldeinitialize and leaks the initialized local-ratectrl. This...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: fix deadlock in usbgmaketpg usbgmaketpg holds a deplock while calling configfsdependitemunlocked, which acquires the configfs root inode lock when operating across subsystems. This creates a circular lock...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP, but bcmrxsetup never did the same for the RTR-reply frame configure...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative integer, which is converted to unsigned when compared again...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: regulator: as3722getregulatordtdata: fix premature ofnodeput leaving dangling ofnode pointer In as3722getregulatordtdata, ofgetchildbyname acquires a reference on np, which is then assigned to pdev-dev.ofnode. The function...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: thermal: intel: int3400: clean up ODVP on probe failures evaluateodvp creates per-ODVP sysfs files before the thermal zone and later probe resources are registered. Currently, the unwind path only calls cleanupodvp from the late...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: remoteproc: fix OOB read via signed offset in rsctableforeachentry table-offseti is a u32 value provided by the firmware; however, it was stored as a signed int. A specially crafted offset such as 0xFFFFFFF0 results in a value of...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: invoke pmgenpdremove before freeing genpd Call pmgenpdremove to unregister from the global list prior to releasing acpgenpd memory, and clear the pointer after free. cherry picked from commit...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Initialize IRQ data before requesting IRQs dwedmairqrequest passes the struct dwedmairq to requestirq before dwedmachannelsetup fills the back pointer. As a result, a shared interrupt can enter the handler wit...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: gate mustwait writability check on ptepresent userfaultfdmustwait and userfaultfdhugemustwait read the PTE without taking the page table lock and then apply ptewrite / hugeptewrite to it. These accessors decode bits...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix root leak if its reloc root is unexpected in mergerelocroots If we have an unexpected relocroot for our root, we jump to the out label but never drop the reference we obtained for root, resulting in a leak. Add a missi...