Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix out-of-bounds write in ncitargetautoactivated ncitargetautoactivated appends a target to the fixed-size array ndev-targetsNCIMAXDISCOVEREDTARGETS and increments ndev-ntargets without first checking whether the array...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - add response length checks The driver processes response data from device buffers without verifying that the device actually sent enough data. This can lead to out-of-bounds reads or processing stale data. Add...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: igbvf: Fix leak in TX DMA error cleanup If an error occurs while mapping TX buffers, the driver should unmap any buffers already mapped for that skb. Since the count is incremented before each frag mapping, it always matches the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vxlan: use neighhasnapshot in routeshortcircuit The neighbor hardware address n-ha can be updated asynchronously by the neighbor subsystem, protected by n-halock seqlock. Reading n-ha without holding the seqlock loop can lead to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock FD links procpidgetlink and procpidreadlink currently look up the task from the pid once, then perform the ptrace access check on that task, and finally look up the task from the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host sends SYNTHHIDINITIALDEVICEINFO messages containing a HID descriptor followed by the report descriptor bytes. mousevsconreceivedeviceinfo trusts...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject too-small tag 70 packets ecryptfsparsetag70packet subtracts fixed metadata fields from the parsed packet body size to derive the encrypted filename size. A malformed packet with a body smaller than those fixed...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: do not enable DAX on new encrypted files Currently, when a new encrypted regular file is created, the call to ext4setinodeflagsinode, init=true in ext4newinode is made before EXT4INODEENCRYPT is set. As a result, it can set...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: fqcodel: clamp default quantum and mtu fqcodelinit sets q-quantum = pschedmtuqdiscdevsch without clamping. A device with a huge MTU e.g., a dummy device where maxmtu == 0 and accepts MTU 2147483634 causes pschedmtu to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers The FRU and I2C bsg handlers stage their transfers in a DMAPOOLSIZE 256-byte bounce buffer obtained via dmapoolalloc, which does not zero out the allocation. They...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Added the missing accessok call to copyusersyms As reported by sashiko, we used getuser without a prior accessok call on the user space pointer. This call was added to cover the entire pointer array. Additionally, the error...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5IBMETHODDEVXSUBSCRIBEEVENT links eventsub into sublist before initializing the fields used by the shared error path. If eventfdctxfdget then fails, the unwind path...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix out-of-bounds write when probed more than once imx6socvolt is allocated fresh on every probe, sized to the number of ARM OPPs: imx6socvolt = devmkcalloccpudev, num, sizeofimx6socvolt, GFPKERNEL; but it is fill...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Thunderbolt: The DROM dual link port number was bound prior to indexing sw-ports. tbdromparseentryport validates the device-supplied header-index against sw-config.maxportnumber before indexing sw-ports, but the sibling field...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlminspectfile lock-drop nlmtraversefiles pins the current file with fcount++ across a mutexunlock for nlminspectfile, but nothing pins the saved next pointer. A concurrent nlmreleasefile can kfree the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collectmd mode when metadatadst allocation fails In collectmd mode, ipiptunnelrcv returns 0 without freeing the skb when iptunrxdst fails to allocate the metadatadst. ipiprcv and mplsiprcv are registered as...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: make nftobject rhltable per table The nftobject rhltable is global; this enables access to objects that have been unmangled from lookup paths by other existing netns. Since nftobjdestroy releases the object...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: sched/rt: Make RTPUSHIPI disabled by default for non-PREEMPTRT contexts RT task migration is handled aggressively. When a CPU schedules a high-priority RT task for a lower-priority task, it checks whether there are any RT tasks...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold eventmutex while checkpointing CRIU events kfdcriucheckpointevents counts the entries in p-eventidr via kfdgetnumevents, allocates an array sized to that count, and then walks the same IDR to fill it. Neither the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks through uCAN records packed in a single USB receive buffer. Each record must contain the fixed header corresponding to its type; the CAN payload bytes mu...