Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/brs: Fix kernel address leakage A user-only branch stack can contain branches originating from the kernel. As a result, kernel addresses are exposed to user space even when PERFSAMPLEBRANCHUSER is requested. On AMD...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context brmulticasttoggleonevlan clears BRVLFLAGMCASTENABLED under br-multicastlock before stopping a VLAN's multicast context. This is the teardown handshake:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: hardening gsskrb5unwrapv2 against short tokens gsskrb5unwrapv2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSSKRB5TOKHDRLEN 16 bytes long; its rotateleft helper passe...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/rcar: Fix error checking in probe This code inadvertently calls thermalzonedeviceenable before checking whether thermalzonedeviceregisterwithtrips failed. Move the call to a later point to prevent an error pointer...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: dummy: Check card index validity at probe snddummyprobe blindly trusts that the given devptr-id value is within the proper card index range. It’s fine for the devices the driver itself creates during the module probe;...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Be sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: Acquire initmm lock on huge vmap to avoid ptdump UAF Patch series “mm: fix UAF caused by race between ptdump and vmap pgtable freeing”, v6. Kernel page table walkers fall into two broad categories – those ranges where...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks through hdev-acceptlist while sending a synchronous HCI command to each remote-wakeup device. The suspend path holds hdev-reqlock, but...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown destroyclient releases a client’s open owners, but a lock owner whose only reference is a blocked lock nbl remains on clownerstrhashtbl. clienthasstate does not count...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: do not keep a stale msc-input if no input is claimed magicmouseinputmapping caches the first hidinput's inputdev in msc-input while the report descriptor is parsed; the rest of the driver treats a non-NULL...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix double free in bnx2xinitfirmware error path bnx2xinitfirmware frees bp-initops, bp-initdata and bp-initopsoffsets in its error path without setting them to NULL. The cleanup function bnx2xreleasefirmware frees the same...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blkrqpayloadbytes Commit 25e5cb780e62 “nvme-tcp: fix possible crash in writezeroes processing” established that blkrqpayloadbytes must not be read without first checking blkrqnrphyssegment...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: unlock immaprwsem before releasing after-split folios foliosplit keeps dereferencing the mapping after the split: shmemunchargemapping-host and remappage while the folios are still frozen/locked, and...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: fix refcount leak in isfullcharged In isfullcharged, powersupplygetbyname is called to obtain a reference to the fuelgauge power supply. If the voltage check uV = desc-fullbattuV succeeds, the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix info leak and UAF in device unregister path i3cmasterunregisteri3cdevs clears i3cdev-dev-desc before calling deviceunregister. During deviceunregister, devicedel emits a KOBJREMOVE uevent and unbinds the driver...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpadspisuspend retrieves the controller state using spigetdrvdata, but the probe never stores it; thus, suspend dereferences a NULL pointer. Store it during the probe...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: tpm: tpmtisspi: Use waitwoken in waitfortmpstat waiteventinterruptibletimeout evaluates its condition after setting the current task state to TASKINTERRUPTIBLE. When CONFIGDEBUGATOMICSLEEP is enabled, this triggers a warning when...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: misc: bcm-vk: Use acquire/release for msgqinited bcmvksyncmsgq fills the message queue information and then sets msgqinited. Readers call bcmvkdrvaccessok before accessing the message queues and their cached queue information...