Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: veth: fix NAPI leak in XDP enable error path During XDP enablement in veth, if xdprxqinforeg or xdprxqinforegmemmodel fails, the driver rolls back the changes. However, the rollback loop: for i--; i = start; i— decrements the loo...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: super: fix emergency thaw deadlock on frozen block devices dothawallcallback calls bdevthaw while holding sb-sumount exclusively. If the block device was frozen via bdevfreeze, dropping the last block layer freeze reference, it...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: selinux: avoid dereferencing sksocket in selinuxsctpbindconnect selinuxsctpbindconnect dereferences sk-sksocket to pass a struct socket to selinuxsocketbind and selinuxsocketconnecthelper. However, when the hook is invoked from t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receivebig receivebig bounds the device-announced length by bigpacketsnumskbfrags + 1 PAGESIZE. This is still too loose: addrecvbufbig sets sg1 to start at offset sizeofstruct paddedvnethdr into the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - bound the device-reported force-feedback effect index iforceprocesspacket handles a status report packet id 0x02 by taking a force-feedback effect index straight from the device wire and using it to address the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: spi: uniphier: Fix completion initialization order before devmrequestirq The driver calls devmrequestirq before initializing the completion used by the interrupt handler. Since the interrupt may occur immediately after...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcnsfollow in logreplay conversion logreplay converts DIRPAGEENTRY32 records into DIRPAGE-entry records when replaying version 0 restart tables. During this conversion, the memmove length is derived directly fr...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: remove debugfs files before client teardown cephdestroyclient tears down the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmapshow after cephmoncst...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: hwmon: nct6775-core Fix number of temperature registers for NCT6116 Unlike NCT6106, NCT6116 only has three temperature registers, along with three temperature source and temperature source configuration registers. The register...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition’s start offset directly from the on-disk VAT 2.0 header without checking it against the VAT inode size:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ipvsnaticmp Sashiko warns that a local attacker can modify the packet while it is being processed by IPVS. Several functions read the IP ihl field multiple times, which can lead to out-of-bounds...

Astra Linux – vulnerability in libsoup3, libsoup2.4

A flaw was found in libsoup’s SoupServer HTTP Range header processing. The sortranges comparator in soup-message-headers.c truncates a 64-bit subtraction result to a 32-bit integer, flipping the sign for range offsets differing by more than INTMAX. This results in the silently omission of request...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: iommu/intel: Fix out-of-bounds memset in dmarlatencydisable dmarlatencydisable is intended to zero out only the single latencystatistic entry for the given type; however, the memset size was computed as sizeoflstat DMARLATENCYNUM...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-rzg2l: Fix loss of interrupt rzg2lclearirqint and rzg2lcleartintint perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the interrupt just handled. Since these registers are...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Fix CEQ tasklet use-after-free on removal Each CEQ interrupt handler only schedules eqc-tasklet. The tasklet calls erdmaceqcompletionhandler, which reads the DMA-coherent EQ ring through getnextvalideqe and updates...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcake: drop WARNON1 for malformed packets in ACK filter The schcake ACK filter parses packets to locate the TCP header and filters out duplicate ACKs when the flow is backlogged. The parsing code contains a WARNON1...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: run gadget disconnect from sleepable suspend context dwc3gadgetsuspend takes dwc-lock with IRQs disabled and then calls dwc3disconnectgadget. For async callbacks, the helper only uses plain spinunlock/spinlock, so the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udfloadsparablemap accepts a sparing table when sizeofst + le16tocpust-reallocationTableLen sb-sblocksize is false, i.e., it treats reallocationTableLen as a...