Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ELF: fixed the double read of kernel.randomizevaspace. The ELF loader uses “randomizevaspace” twice. This is a sysctl setting that can be changed at any time; therefore, two reads could potentially access different values,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: kthread: Unpark only parks kthreads. Calling kthreadunpark unconditionally is mostly harmless when the kthread is already unparked. In that case, the wake-up call is simply ignored because the task is not in the TASKPARKED state...

Astra Linux – Vulnerability in rsync

There is a path traversal vulnerability in rsync. This vulnerability stems from a behavior enabled by the --inc-recursive option, which is a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ICMP messages are rate-limited. After the committed issues, the two rate limiters are applied in this order: 1 Host-wide rate limit icmpglobalallow 2 Per-destination rate limit based on inetpeer To avoid side-channel attacks, we...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: NFSD: Limit the number of concurrent async COPY operations It seems that nothing limits the number of concurrent async COPY operations that clients can initiate. Additionally, AFAICT allows each async COPY to copy an unlimited...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftables – Use a timestamp to check for set element timeout. A timestamp field was added at the beginning of the transaction; it is stored in the nftablespernetns area. The .insert, .deactivate, and syncgc functions...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfs: Handling of the error from rpcprocregister in nfsnetinit. syzkaller reported a warning 0 that was triggered while destroying immature netnames. The rpcprocregister function was called in initnfsfs, but its error has been...

CVE-2024-10026

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances...

AZL-56201 CVE-2024-10026 affecting package podman for versions less than 5.6.1-2

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances...

UBUNTU-CVE-2024-10026

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances...

DEBIAN-CVE-2025-21663

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac-tegra: Read iommu stream id from device tree Nvidia's Tegra MGBE controllers require the IOMMU "Stream ID" SID to be written to the MGBEWRAPAXIASID0CTRL register. The current driver is hard coded to use MGBE0's...

SUSE CVE-2025-21642

In the Linux kernel, the following vulnerability has been resolved: mptcp: sysctl: sched: avoid using current-nsproxy Using the 'net' structure via 'current' is not recommended for different reasons. First, if the goal is to use it to read or write per-netns data, this is inconsistent with how th...

DEBIAN-CVE-2025-21647

In the Linux kernel, the following vulnerability has been resolved: sched: schcake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out ...

AZL-57546 CVE-2025-21635 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: rds: sysctl: rdstcprcv,sndbuf: avoid using current-nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the...

CVE-2025-21635

In the Linux kernel, the following vulnerability has been resolved: rds: sysctl: rdstcprcv,sndbuf: avoid using current-nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the...

CVE-2025-21642 mptcp: sysctl: sched: avoid using current->nsproxy

In the Linux kernel, the following vulnerability has been resolved: mptcp: sysctl: sched: avoid using current-nsproxy Using the 'net' structure via 'current' is not recommended for different reasons. First, if the goal is to use it to read or write per-netns data, this is inconsistent with how th...

AZL-55655 CVE-2024-12087 affecting package rsync for versions less than 3.4.1-1

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the --inc-recursive option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive option, a lack of proper...

AZL-55682 CVE-2024-12087 affecting package rsync for versions less than 3.4.1-1

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the --inc-recursive option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive option, a lack of proper...

PT-2025-8864

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.13.0-rc1+ 1464 Description A issue has been identified in the Linux kernel where the use of btrfs set item key safe to modify keys in the RAID stripe-tree can lead to corruption of the tree. This corruption is...

AZL-62684 CVE-2024-57804 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs The driver, through the SAS transport, exposes a sysfs interface to enable/disable PHYs in a controller/expander setup. When multiple PHYs are disabled and...