Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: hardening gsskrb5unwrapv2 against short tokens gsskrb5unwrapv2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSSKRB5TOKHDRLEN 16 bytes long; its rotateleft helper passe...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix response queue over-consumption in qlaconsumeiocb qla24xxprocessresponsequeue advances ringptr past the head IOCB before dispatching; thus, by the time qlaconsumeiocb runs, ringptr already points to the first...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/rcar: Fix error checking in probe This code inadvertently calls thermalzonedeviceenable before checking whether thermalzonedeviceregisterwithtrips failed. Move the call to a later point to prevent an error pointer...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ata: patasl82c105: fix bridge revision use-after-free pcigetslot returns a referenced PCI device. Commit 44c10138fd4b “PCI: Change all drivers to use pcidevice-revision” replaced a configuration-space read with direct access to t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: dummy: Check card index validity at probe snddummyprobe blindly trusts that the given devptr-id value is within the proper card index range. It’s fine for the devices the driver itself creates during the module probe;...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: NFSD: Restart sscexpireumount walk after dropping nfsdssclock nfsd4sscexpireumount walks nn-nfsdsscmountlist using listforeachentrysafeni, tmp, .... For each expired entry, it sets nsuibusy = true, drops nfsdssclock to invoke...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Be sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages The accountmem and unaccountmem functions call getuid, which increments the reference count of struct userstruct on every invocation. However, we do not decrement th...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: Acquire initmm lock on huge vmap to avoid ptdump UAF Patch series “mm: fix UAF caused by race between ptdump and vmap pgtable freeing”, v6. Kernel page table walkers fall into two broad categories – those ranges where...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks through hdev-acceptlist while sending a synchronous HCI command to each remote-wakeup device. The suspend path holds hdev-reqlock, but...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown destroyclient releases a client’s open owners, but a lock owner whose only reference is a blocked lock nbl remains on clownerstrhashtbl. clienthasstate does not count...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: md/raid5-ppl: fix use-after-free in ppldoflush The loop in ppldoflush continues iterating after calling ppliounitfinished, touching io-pendingflushes and leading to a use-after-free. Add a break statement to stop the loop once io...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: do not keep a stale msc-input if no input is claimed magicmouseinputmapping caches the first hidinput's inputdev in msc-input while the report descriptor is parsed; the rest of the driver treats a non-NULL...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix double free in bnx2xinitfirmware error path bnx2xinitfirmware frees bp-initops, bp-initdata and bp-initopsoffsets in its error path without setting them to NULL. The cleanup function bnx2xreleasefirmware frees the same...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blkrqpayloadbytes Commit 25e5cb780e62 “nvme-tcp: fix possible crash in writezeroes processing” established that blkrqpayloadbytes must not be read without first checking blkrqnrphyssegment...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: unlock immaprwsem before releasing after-split folios foliosplit keeps dereferencing the mapping after the split: shmemunchargemapping-host and remappage while the folios are still frozen/locked, and...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: fix refcount leak in isfullcharged In isfullcharged, powersupplygetbyname is called to obtain a reference to the fuelgauge power supply. If the voltage check uV = desc-fullbattuV succeeds, the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix info leak and UAF in device unregister path i3cmasterunregisteri3cdevs clears i3cdev-dev-desc before calling deviceunregister. During deviceunregister, devicedel emits a KOBJREMOVE uevent and unbinds the driver...