Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: platform/surface: acpi-notify: Check ACPI companion before use Since every platform driver can be forced to match a device that does not match its list of device IDs due to devicematchdriveroverride, platform drivers that rely on...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsdcopyfilerange samples dst-fwberr into "since" after the copy loop, then uses it to detect writeback errors via filemapcheckwberr once vfsfsyncrange returns. Because t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: image: mdc800: change kmalloc to kzalloc Replace the kmalloc calls in usbmdc800init for irqurbbuffer and downloadurbbuffer with kzalloc, thereby preventing potential stack leaks when a shorter message is received in...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidiocsfmtvidout calculates the size of the encoder’s CAPTURE buffer from the compressed descriptor pixfmtfwht, whose sizeimagemult is 3: codedw codedh 3 + sizeofstruct...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6klcfg80211connectevent subtracts fixed IE offsets from assocreqlen -= 4 and assocresplen -= 6, both u8, without any lower bound. The aggregate...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent leak in itsvpeirqdomainalloc When itsirqgicdomainalloc fails, the following itsvpeirqdomainfree fails to invoke itsvepteardown for the corresponding interrupt, resulting in a resource leak. Invoke...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list deletion Queue wake, stop, and disable paths walk local-interfaces under RCU. The bulk hardware teardown path removes entries via listdel, so an asynchronous transmit completion can foll...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: free the advertising instance on the failure and cancel paths advtimeoutexpire passes a kmalloced instance byte to hcicmdsyncqueue with a NULL destroy callback; only advtimeoutexpiresync actually frees it. Thi...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: ipvti: requires CAPNETADMIN in the device netns for changelink vtichangelink operates on at most two netns: devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftablesoffload: suppress WARNONONCE for ENOMEM in abort path In nftflowruleoffloadabort, WARNONONCEerr is triggered on every error during rollback, including -ENOMEM. Memory allocation failures are expected under...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Do not hex dump the attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAWPRIMITIVES header size before division vmwcmddraw computes maxnum = header-size - sizeofcmd-body / sizeofdecl; where header-size is a u32 value taken directly from the user-supplied command stream. When...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command arrived via the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: tty: clears cdev pointer after cdevadd failure ttycdevadd drops the cdev reference when cdevadd fails, but leaves driver-cdevsindex pointing to freed memory. ttyunregisterdevice later passes that stale pointer to cdevdel, causing...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: AppArmor: policyint ensures that list heads are initialized prior to the fail path. If profile creation fails before policyinit is completed, the list heads are not properly initialized, causing profilefree sanity checks to trigg...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This results in a state confusion bug when the raw tab...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum to avoid signed overflow soft lockup sfqinit sets q-quantum = pschedmtuqdiscdevsch unsigned. A device with a huge MTU e.g., a dummy device with maxmtu == 0 accepting MTU 2147483634 causes pschedmtu t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in ccparams debugfs getparam reads a congestion parameter as a u32 but formats it using the signed "%d" format into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, is...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix devres accumulation across driver rebind imx6socvolt is allocated using devmkcalloccpudev, ..., where cpudev is the CPU device returned by getcpudevice0. This device is never unbound, so its devres list is nev...