Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix deviceregister error path When deviceregister fails in i3cmasterregisternewi3cdevs, putdevice is called to drop the reference taken by deviceregister. This drops the last reference, causing the device’s release...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Firmware: stratix10-svc: fix memory leaks and list corruption bugs Fix a memory leak when genpoolalloc fails by freeing pmem on the error path. Switch pmem allocation from devmkzalloc to kzalloc with explicit kfree in the free pa...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: prevent unbounded recursion in magicmouserawevent magicmouserawevent handles DOUBLEREPORTID 0xf7 packets, which pack two touch reports into one by splitting the packet and calling itself on each half. The only...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: rc: sunxi-cir: Unregister rc device on probe failure After rcregisterdevice succeeds, subsequent probe failures must unregister the device using rcunregisterdevice. Currently, the error path jumps to the allocation cleanup...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfc: digital: clamp SENSFRES length to the destination buffer digitalinrecvsensfres memcpys resp-len bytes from a remote NFC-F device response into the NFCSENSFRESMAXSIZE-byte target.sensfres field without an upper-bound check. A...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Cancel existing workqueues The initialization of the iowork and crwwork workqueues raises the question of whether they should be un-initialized. Add the corresponding cleanup tags in releasedev to ensure work isn’t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpadspisuspend retrieves the controller state using spigetdrvdata, but the probe never stores it; thus, suspend dereferences a NULL pointer. Store it during the probe...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears nextset before its final uses of the enclosing vCPU. If teardown observes nextset as false while the callback is still running,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: tree-checker: validate INODEREF's namelen BUG A crafted btrfs image can trigger the following crash: BUG: unable to handle page fault for address: ffffd1dc42884000 PF: supervisor write access in kernel mode PF:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: power: supply: ucs1002: fix use-after-free on remove ucs1002 has no remove callback, so unbind runs entirely through devm. The alert IRQ handler queues the healthpoll delayed work, and the work reschedules itself while the chip...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parallel fallback pcrypt installs pcryptaeaddone on the child AEAD request before trying to submit it through padata. If padatadoparallel returns -EBUSY, pcrypt falls back to calling the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hidgetreport for numbered reports When a caller passes a size of 0 to hidreportrawevent for a numbered report, the function originally calls hidgetreport without performing any size validation. Within...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks through hdev-acceptlist while sending a synchronous HCI command to each remote-wakeup device. The suspend path holds hdev-reqlock, but...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byddisconnect uses timerdelete before freeing the driver’s private data. It does not wait for a running bydcleartouch callback, which dereferences the private da...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free in l2capconnect Extend a critical section to prevent chan from early freeing. Also make the l2capconnect return type void. Nothing is using the returned value but it is ugly to return a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the mesh send cancel command when it is cancelled meshsendcancel queues the pending command with a NULL destroy callback; thus, it is only freed if sendcancel runs. A cancelled entry is leaked, as...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: remove WARNONONCE from skmcloop skmcloop can be called for sockets that are neither AFINET nor AFINET6 e.g., AFPACKET sockets when sending packets via raw/packet sockets over virtual devices such as VRF or ipvlan. In such...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32. The top-level policy validates only the container, so it does not...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE — once for the NULL check and once for the indirect notifyfailure call. A concurrent fsputdax can clear...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: selinux: requires every boolean value to be defined pbools.nprim comes from the policy image independently of how many booleans follow it; condindexbool fills boolvaltostruct at value - 1, so a count larger than the values presen...