Debian Linux vulnerabilities

CVE-2022-1419 [HIGH] CWE-416 CVE-2022-1419: The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refc The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of *drm_vgem_gem_object *(created in *vgem_gem_dumb_create*) concurrently, and *vgem_gem_dumb_create *will access the freed drm_vgem_gem_object.

CVE-2024-47745 [HIGH] CVE-2024-47745: In the Linux kernel, the following vulnerability has been resolved: mm: call the security_mmap_file In the Linux kernel, the following vulnerability has been resolved: mm: call the security_mmap_file() LSM hook in remap_file_pages() The remap_file_pages syscall handler calls do_mmap() directly, which doesn't contain the LSM security check. And if the process has called personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for RW pages, thi

CVE-2024-35886 [HIGH] CWE-674 CVE-2024-35886: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in fib6_dump_done(). syzkaller reported infinite recursive calls of fib6_dump_done() during netlink socket destruction. [1] From the log, syzkaller sent an AF_UNSPEC RTM_GETROUTE message, and then the response was generated. The following recvmmsg() resu

CVE-2024-47697 [HIGH] CWE-787 CVE-2024-47697: In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/r In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error Ensure index in rtl2830_pid_filter does not exceed 31 to prevent out-of-bounds access. dev->filters is a 32-bit value, so set_bit and clear_bit functions should only operate on indices from 0 to 31. If index is

CVE-2024-26988 [HIGH] CWE-787 CVE-2024-26988: In the Linux kernel, the following vulnerability has been resolved: init/main.c: Fix potential stat In the Linux kernel, the following vulnerability has been resolved: init/main.c: Fix potential static_command_line memory overflow We allocate memory of size 'xlen + strlen(boot_command_line) + 1' for static_command_line, but the strings copied into static_command_line are extra_command_line and command_line, rather than extra_command_line and boot_c

CVE-2023-52612 [HIGH] CWE-120 CVE-2023-52612: In the Linux kernel, the following vulnerability has been resolved: crypto: scomp - fix req->dst bu In the Linux kernel, the following vulnerability has been resolved: crypto: scomp - fix req->dst buffer overflow The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem.

CVE-2024-26852 [HIGH] CWE-416 CVE-2024-26852: In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() syzbot found another use-after-free in ip6_route_mpath_notify() [1] Commit f7225172f25a ("net/ipv6: prevent use after free in ip6_route_mpath_notify") was not able to fix the root cause. We need to defer the fib6_info_release

CVE-2024-47698 [HIGH] CWE-787 CVE-2024-47698: In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/r In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error Ensure index in rtl2832_pid_filter does not exceed 31 to prevent out-of-bounds access. dev->filters is a 32-bit value, so set_bit and clear_bit functions should only operate on indices from 0 to 31. If index is

CVE-2015-5364 [HIGH] CWE-399 CVE-2015-5364: The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allows remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood.

CVE-2024-52035 [HIGH] CWE-190 CVE-2024-52035: An integer overflow vulnerability exists in the OLE Document File Allocation Table Parser functional An integer overflow vulnerability exists in the OLE Document File Allocation Table Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.

CVE-2023-52482 [HIGH] CWE-787 CVE-2023-52482: In the Linux kernel, the following vulnerability has been resolved: x86/srso: Add SRSO mitigation f In the Linux kernel, the following vulnerability has been resolved: x86/srso: Add SRSO mitigation for Hygon processors Add mitigation for the speculative return stack overflow vulnerability which exists on Hygon processors too.

CVE-2025-37752 [HIGH] CWE-129 CVE-2025-37752: In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: move the li In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: move the limit validation It is not sufficient to directly validate the limit on the data that the user passes as it can be updated based on how the other parameters are changed. Move the check at the end of the configuration update process to also catch scenario

CVE-2024-26883 [HIGH] CWE-119 CVE-2024-26883: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow chec In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check on 32-bit arches The stackmap code relies on roundup_pow_of_two() to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arches, the roundup code itself can overflow by doing a

CVE-2014-8129 [HIGH] CWE-787 CVE-2014-8129: LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by failure of tif_next.c to verify that the BitsPerSample value is 2, and the t2p_sample_lab_signed_to_unsigned function in tiff2pdf.c.

CVE-2024-27395 [HIGH] CWE-416 CVE-2024-27395: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix Use-After In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix Use-After-Free in ovs_ct_exit Since kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal of ovs_ct_limit_exit, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will

CVE-2020-11061 [HIGH] CWE-122 CVE-2020-11061: In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in Bareos versions 19.2.8, 18.2.9 and 17.2.10.

CVE-2022-2978 [HIGH] CWE-416 CVE-2022-2978: A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers funct A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.

CVE-2024-42136 [HIGH] CWE-190 CVE-2024-42136: In the Linux kernel, the following vulnerability has been resolved: cdrom: rearrange last_media_cha In the Linux kernel, the following vulnerability has been resolved: cdrom: rearrange last_media_change check to avoid unintentional overflow When running syzkaller with the newly reintroduced signed integer wrap sanitizer we encounter this splat: [ 366.015950] UBSAN: signed-integer-overflow in ../drivers/cdrom/cdrom.c:2361:33 [ 366.021089] -92233720

CVE-2024-26895 [HIGH] CWE-416 CVE-2024-26895: In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: prevent use-aft In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces wilc_netdev_cleanup currently triggers a KASAN warning, which can be observed on interface registration error path, or simply by removing the module/unbinding device from driver: echo spi0.1 > /sys/bus/spi

CVE-2024-50063 [HIGH] CVE-2024-50063: In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent tail call between In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent tail call between progs attached to different hooks bpf progs can be attached to kernel functions, and the attached functions can take different parameters or return different return values. If prog attached to one kernel function tail calls prog attached to another kernel functi