Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: HID: appleir: fix UAF on pending keyuptimer in remove appleirremove runs hidhwstop before timerdeletesync. hidhwstop synchronously unregisters the HID input device via hiddisconnect - hidinputdisconnect - inputunregisterdevice,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix double completion race in ncidataexchangecomplete Both nciclosedevice and ncirxwork can call ncidataexchangecomplete concurrently. After commit 4527025d440ce8 “nfc: nci: fix circular locking dependency in...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages The accountmem and unaccountmem functions call getuid, which increments the reference count of struct userstruct on every invocation. However, we do not decrement th...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Fix locking when accessing mr-pd Sashiko points out that, due to reregmr, the PD is actually variable and all the touches in nldev are racey. Use mr-device instead of mr-pd-device. Getting the PD restrack ID is more...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctpserialpushheader case 2 and validates it only against the upper bound: if c...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list deletion Queue wake, stop, and disable paths walk local-interfaces under RCU. The bulk hardware teardown path removes entries via listdel, so an asynchronous transmit completion can foll...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix hard lockup on disconnect If submitting the OOB write urb fails persistently e.g., if the device is being disconnected, the driver would loop indefinitely with interrupts disabled. Check for urb...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: tty: clears cdev pointer after cdevadd failure ttycdevadd drops the cdev reference when cdevadd fails, but leaves driver-cdevsindex pointing to freed memory. ttyunregisterdevice later passes that stale pointer to cdevdel, causing...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent leak in itsvpeirqdomainalloc When itsirqgicdomainalloc fails, the following itsvpeirqdomainfree fails to invoke itsvepteardown for the corresponding interrupt, resulting in a resource leak. Invoke...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: image: mdc800: change kmalloc to kzalloc Replace the kmalloc calls in usbmdc800init for irqurbbuffer and downloadurbbuffer with kzalloc, thereby preventing potential stack leaks when a shorter message is received in...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidiocsfmtvidout calculates the size of the encoder’s CAPTURE buffer from the compressed descriptor pixfmtfwht, whose sizeimagemult is 3: codedw codedh 3 + sizeofstruct...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6klcfg80211connectevent subtracts fixed IE offsets from assocreqlen -= 4 and assocresplen -= 6, both u8, without any lower bound. The aggregate...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udffreeblocks checks the logical block number and count against the partition length, but drops the extent offset from that final bound. A crafted extent can pass the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: irqchip/crossbar: Use correct index in crossbardomainfree crossbardomainfree resets the domain data and then uses the nulled out irqdata-hwirq member as index to reset the irqmap entry and to write the relevant crossbar register...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: fix out-of-bounds read in errout of fbcondosetfont When fbcondosetfont fails e.g., due to a memory allocation failure within vcresize under heavy memory pressure, it jumps to the errout label to roll back the consol...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Call synchronizercu when unregistering This ensures that any RCU readers traversing the instance list have finished, before releasing the reference on the tracer that the instance points to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv6: ndisc: fix NULL deref in acceptuntrackedna acceptuntrackedna re-fetches the inet6dev using in6devgetdev, and dereferences idev-cnf.acceptuntrackedna without performing a NULL check, even though its sole caller, ndiscrecvna,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: fix refcount leak in isfullcharged In isfullcharged, powersupplygetbyname is called to obtain a reference to the fuelgauge power supply. If the voltage check uV = desc-fullbattuV succeeds, the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix VF bringup affecting PF promiscuous state Mbox handling of nixsetrxmode for a VF with promiscuous and allmulti flags set to false causes deletion of the PF’s promiscuous and allmulti MCAM rules. This occurs...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: fix uninitialized struct pages for ZONEDEVICE When DAX memory is hotplugged into an unoccupied subsection of an early section, sectionactivate reuses the unoptimized boot memmap. However, compoundnrpages still assumes...