Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: hardening gsskrb5unwrapv2 against short tokens gsskrb5unwrapv2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSSKRB5TOKHDRLEN 16 bytes long; its rotateleft helper passe...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blkrqpayloadbytes Commit 25e5cb780e62 “nvme-tcp: fix possible crash in writezeroes processing” established that blkrqpayloadbytes must not be read without first checking blkrqnrphyssegment...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on ttyregisterdriver failure If ttyregisterdriver fails, it drops the reference, but fails to set the global dbcttydriver to NULL, causing the unregister to be called again when the module exits. On...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don’t overflow gsosegs The user can specify any gsosize in a packet crafted with an AFPACKET PACKETVNETHDR socket, even smaller than TCPMINGSOSIZE = 8. Meanwhile, GSOMAXSIZE = 8 GSOMAXSEGS = 8...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: md/raid5-ppl: fix use-after-free in ppldoflush The loop in ppldoflush continues iterating after calling ppliounitfinished, touching io-pendingflushes and leading to a use-after-free. Add a break statement to stop the loop once io...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown destroyclient releases a client’s open owners, but a lock owner whose only reference is a blocked lock nbl remains on clownerstrhashtbl. clienthasstate does not count...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix error path in rtlpciprobe In the last error path of rtlpciprobe, the cleanup functions are skipped due to an incorrect goto label. Additionally, the successful calls to rtlinitrfkill, ieee80211registerhw,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv4: reject undersized MTUs in ipdofragment ipdofragment subtracts the IPv4 header length from the effective MTU and passes the resulting payload MTU to ipfragnext. If the effective MTU is smaller than hlen + 8, ipfragnext round...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed class value in securitygetclasses securitygetclasses sizes an array using pclasses.nprim and fills it with value - 1; thus, a class value never defined by the policy results in a NULL entry...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context brmulticasttoggleonevlan clears BRVLFLAGMCASTENABLED under br-multicastlock before stopping a VLAN's multicast context. This is the teardown handshake:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Several bsg handlers stage their request/reply in an uninitialized 256-byte on-stack buffer uint8t bsgDMAPOOLSIZE and fill it via sgcopytobuffer, which only copies as...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If “dmkvzallocpercpuallocsize, cputonodecpu” fails, the code jumps to the “out” label and calls dmstatfree. dmstatfree does “foreachpossiblecpucpu...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmpgqstarttimer There is a race condition between device teardown inetdevdestroy and incoming IGMP query processing igmprcv, resulting in a Use-After-Free condition in the IGMP timer callback...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: prestera: validate firmware header length presterafwhdrparse reads the firmware header before checking that the firmware image contains that header. Reject images shorter than struct presterafwheader before decoding the magi...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not trim a device which is not writeable BUG There is a bug report indicating that btrfs/242 may randomly fail due to a NULL pointer dereference: run fstests btrfs/242 at 2026-06-01 10:25:08 BTRFS: device fsid...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rlused against rlcount in refcount block validator ocfs2findrefcountrecinrl walks the on-disk refcount record array with: for ; i rfrecords.rlused; i++ rec = &rb-rfrecords.rlrecsi; ... rlrecs resides in a single...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the sample count to the packet payload isightpacket takes the frame count from the device iso packet and checks it only against the device claimed iso length. count = be32tocpupayload-samplecount; if...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: tipc: requires net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAPNETADMIN when an operation sets GENLADMINPERM or...