Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with an incorrect size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but certain...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: maintain the RCU lock across ipv6chkaddr in rdstcpladdrcheck rdstcpladdrcheck looks up a scoped IPv6 interface using devgetbyindexrcu, drops the RCU read-side lock, and only then passes the bare struct netdevice to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: power: supply: ucs1002: fix use-after-free on remove ucs1002 has no remove callback, so unbind runs entirely through devm. The alert IRQ handler queues the healthpoll delayed work, and the work reschedules itself while the chip...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: remove WARNONONCE from skmcloop skmcloop can be called for sockets that are neither AFINET nor AFINET6 e.g., AFPACKET sockets when sending packets via raw/packet sockets over virtual devices such as VRF or ipvlan. In such...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: reacquire gw address after skb realloc The pskbmaypull function called by batadvblaisbackbonegw may reallocate the buffer behind the skb. Variables referencing the old buffer must be reassigned to prevent...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on ttyregisterdriver failure If ttyregisterdriver fails, it drops the reference, but fails to set the global dbcttydriver to NULL, causing the unregister to be called again when the module exits. On...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free stranded TX buffers on ring deinit aqvecdeinit drains the TX rings via a single aqringtxclean call, freeing at most AQCFGTXCLEANBUDGET 256 descriptors and stopping execution at hwhead; this function no longer...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv4: reject undersized MTUs in ipdofragment ipdofragment subtracts the IPv4 header length from the effective MTU and passes the resulting payload MTU to ipfragnext. If the effective MTU is smaller than hlen + 8, ipfragnext round...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: prestera: validate firmware header length presterafwhdrparse reads the firmware header before checking that the firmware image contains that header. Reject images shorter than struct presterafwheader before decoding the magi...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rlused against rlcount in refcount block validator ocfs2findrefcountrecinrl walks the on-disk refcount record array with: for ; i rfrecords.rlused; i++ rec = &rb-rfrecords.rlrecsi; ... rlrecs resides in a single...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Firmware: stratix10-svc: fix memory leaks and list corruption bugs Fix a memory leak when genpoolalloc fails by freeing pmem on the error path. Switch pmem allocation from devmkzalloc to kzalloc with explicit kfree in the free pa...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: check the data direction of a C2HData PDU nvmetcphandlec2hdata finds the request by command id and checks that it has a payload; however, it does not verify whether the command actually requests data reading...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller’s arrayblockcheck can only compare the header against itself; thus, a block with valuesize 4 and maxentries 1018 is internally consistent and passes checks...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE — once for the NULL check and once for the indirect notifyfailure call. A concurrent fsputdax can clear...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If “dmkvzallocpercpuallocsize, cputonodecpu” fails, the code jumps to the “out” label and calls dmstatfree. dmstatfree does “foreachpossiblecpucpu...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: qede: sync udptunnel ports outside qedelock in the recovery path A TX timeout on a qede NIC that has VXLAN/GENEVE tunnel ports configured wedges the rtnetlink control plane of the whole machine: NETDEV WATCHDOG: ens6f1 qede:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32. The top-level policy validates only the container, so it does not...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: selinux: requires every boolean value to be defined pbools.nprim comes from the policy image independently of how many booleans follow it; condindexbool fills boolvaltostruct at value - 1, so a count larger than the values presen...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject login PDUs declaring more data than was received isertloginrecvdone records how many bytes the HCA actually placed in the login buffer, but nothing compares that against the length the login PDU’s BHS declares...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfc: digital: clamp SENSFRES length to the destination buffer digitalinrecvsensfres memcpys resp-len bytes from a remote NFC-F device response into the NFCSENSFRESMAXSIZE-byte target.sensfres field without an upper-bound check. A...