Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udfloadsparablemap accepts a sparing table when sizeofst + le16tocpust-reallocationTableLen sb-sblocksize is false, i.e., it treats reallocationTableLen as a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: comedi: comediparport: handle premature interrupt Syzbot reported a general protection fault in comedigetissubdevicerunning, which is called from the interrupt handler parportinterrupt within the “comediparport” driver. Currently...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: erofs: cap LZMA stream pool size In fs/erofs/decompressorlzma.c, the module defines the global MicroLZMA stream pool via numpossiblecpus when the lzmastreams module parameter is unset; subsequently, zerofsloadlzmaconfig...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llcuiautobind llcuiautobind opens a SAP after choosing a dynamic LSAP. llcsapopen returns a reference owned by the caller, and llcsapaddsocket takes a second reference for the socket’s membership in...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beaconielen, assocreqlen, and assocresplen fields in ath6klwmiconnecteventrx are not validated against the buffer length. Their sum up t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtnat: reject unsupported target families xtnat SNAT and DNAT target handlers assume that an IP-family conntrack state exists and can dereference a NULL pointer when instantiated from an unsupported family via nftcompa...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: reset device before deleting virtqueues virtsndremove and virtsndfreeze delete the virtqueues before resetting the device. delvqs frees the vring backing, but does not provide a generic device quiesce operation. In...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: xfs: fix ilock leak on error in xfsdqgetnextid xfsdqgetnextid takes the quota inode ILOCK before calling xfsireadextents. If xfsireadextents fails, the function returns immediately without releasing the lock, resulting in a leak ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Device property: Fix infinite loop in fwnodeforeachchildnode When iterating over children of a fwnode that contains a secondary fwnode, fwnodegetnextchildnode can enter an infinite loop if the secondary fwnode has more than one...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadatadst on RX SC delete When an offloaded MACsec RX SC is deleted, macsecdelrxscctx frees the per-SC metadatadst using metadatadstfree, which frees the object unconditionally and ignor...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized localid in syncookie MPJOIN reconstruction mptcptokenjoincookieinitstate restores remotenonce, localnonce, backup, joinid, token and msk from the saved cookie entry when rebuilding the request socket for ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size vc4overflowmemwork points BPOA at a 512KB slot inside the 16MB binner BO, but writes the size of the whole BO to BPOS. On every binner out-of-memory event,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on this invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix UAF in hcidisconnectallsync Use-after-free can occur in hcidisconnectallsync if a connection is deleted by concurrent processing of a controller event. To prevent this, the code now attempts to iterate ove...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free in pepgetsb pepgetsb does not account for the possibility that pskbmaypull may have moved the skb data, and continues to access the old pointer, resulting in a Use-After-Free UAF condition...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reallocate update replies for mismatched IDs ovsflowcmdnew preallocates the optional reply skb before it takes ovsmutex and before it knows which existing flow will be updated. This is usually fine because the s...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: xthashlimit: validate hashtable supports XTHASHLIMITRATEMATCH The XTHASHLIMITRATEMATCH flag mode changes the semantics of the dsthashent structure, which represents an entry in the hashtable. There is a union area that...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: power: supply: twl4030charger: cancel workers via devm BCI is devm-allocated. Two workers BCI-work and BCI-currentworker dereference it. twl4030bciremove disables charging and masks interrupts. It does not cancel any worker. A...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: tridentfb: fix potential memory leak in tridentpciprobe In tridentpciprobe, the memory allocated for modelist via fbvideomodetomodelist is not freed in subsequent error paths. Fix this by calling fbdestroymodelist...