Debian Linux vulnerabilities

CVE-2022-3176 [HIGH] CWE-416 CVE-2022-3176: There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is p

CVE-2021-4037 [HIGH] CVE-2021-4037: A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel th A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a m

CVE-2025-37885 [HIGH] CWE-416 CVE-2025-37885: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reset IRTE to host co In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reset IRTE to host control if *new* route isn't postable Restore an IRTE back to host control (remapped or posted MSI mode) if the *new* GSI route prevents posting the IRQ directly to a vCPU, regardless of the GSI routing type. Updating the IRTE if and only if the new GSI i

CVE-2024-49884 [HIGH] CWE-416 CVE-2024-49884: In the Linux kernel, the following vulnerability has been resolved: ext4: fix slab-use-after-free i In the Linux kernel, the following vulnerability has been resolved: ext4: fix slab-use-after-free in ext4_split_extent_at() We hit the following use-after-free: BUG: KASAN: slab-use-after-free in ext4_split_extent_at+0xba8/0xcc0 Read of size 2 at addr ffff88810548ed08 by task kworker/u20:0/40 CPU: 0 PID: 40 Comm: kworker/u20:0 Not tainted 6.9.0-dirt

CVE-2022-42332 [HIGH] CWE-416 CVE-2022-42332: x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translatio x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Shadow mode maintains a pool of memory used for both shadow page tables as well as auxiliary data structures. To migrate or snapshot guests,

CVE-2021-28701 [HIGH] CWE-362 CVE-2021-28701: Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pa Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches (back) from v2 to v1. Freeing such pages requires that the hypervi

CVE-2024-54028 [HIGH] CWE-191 CVE-2024-54028: An integer underflow vulnerability exists in the OLE Document DIFAT Parser functionality of catdoc 0 An integer underflow vulnerability exists in the OLE Document DIFAT Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.

CVE-2024-43839 [HIGH] CWE-787 CVE-2024-43839: In the Linux kernel, the following vulnerability has been resolved: bna: adjust 'name' buf size of In the Linux kernel, the following vulnerability has been resolved: bna: adjust 'name' buf size of bna_tcb and bna_ccb structures To have enough space to write all possible sprintf() args. Currently 'name' size is 16, but the first '%s' specifier may already need at least 16 characters, since 'bnad->netdev->name' is used there. For '%d' specifiers, a

CVE-2024-26754 [HIGH] CWE-416 CVE-2024-26754: In the Linux kernel, the following vulnerability has been resolved: gtp: fix use-after-free and nul In the Linux kernel, the following vulnerability has been resolved: gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() The gtp_net_ops pernet operations structure for the subsystem must be registered before registering the generic netlink family. Syzkaller hit 'general protection fault in gtp_genl_dump_pdp' bug: general protection fa

CVE-2020-24386 [MEDIUM] CVE-2020-24386: An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure).

CVE-2023-2135 [HIGH] CWE-416 CVE-2023-2135: Use after free in DevTools in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who co Use after free in DevTools in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who convinced a user to enable specific preconditions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2024-46849 [HIGH] CWE-416 CVE-2024-46849: In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: axg-card: fix 'use In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: axg-card: fix 'use-after-free' Buffer 'card->dai_link' is reallocated in 'meson_card_reallocate_links()', so move 'pad' pointer initialization after this function when memory is already reallocated. Kasan bug report: BUG: KASAN: slab-use-after-free in axg_card_add_link

CVE-2024-49924 [HIGH] CWE-416 CVE-2024-49924: In the Linux kernel, the following vulnerability has been resolved: fbdev: pxafb: Fix possible use In the Linux kernel, the following vulnerability has been resolved: fbdev: pxafb: Fix possible use after free in pxafb_task() In the pxafb_probe function, it calls the pxafb_init_fbinfo function, after which &fbi->task is associated with pxafb_task. Moreover, within this pxafb_init_fbinfo function, the pxafb_blank function within the &pxafb_ops struct

CVE-2023-52669 [HIGH] CWE-787 CVE-2023-52669: In the Linux kernel, the following vulnerability has been resolved: crypto: s390/aes - Fix buffer o In the Linux kernel, the following vulnerability has been resolved: crypto: s390/aes - Fix buffer overread in CTR mode When processing the last block, the s390 ctr code will always read a whole block, even if there isn't a whole block of data left. Fix this by using the actual length left and copy it into a buffer first for processing.

CVE-2024-26625 [HIGH] CWE-416 CVE-2024-26625: In the Linux kernel, the following vulnerability has been resolved: llc: call sock_orphan() at rele In the Linux kernel, the following vulnerability has been resolved: llc: call sock_orphan() at release time syzbot reported an interesting trace [1] caused by a stale sk->sk_wq pointer in a closed llc socket. In commit ff7b11aa481f ("net: socket: set sock->sk to NULL after calling proto_ops::release()") Eric Biggers hinted that some protocols are mi

CVE-2024-46746 [HIGH] CWE-416 CVE-2024-46746: In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: free driver_data In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: free driver_data after destroying hid device HID driver callbacks aren't called anymore once hid_destroy_device() has been called. Hence, hid driver_data should be freed only after the hid_destroy_device() function returned as driver_data is used in several callbacks. I

CVE-2024-27396 [HIGH] CWE-416 CVE-2024-27396: In the Linux kernel, the following vulnerability has been resolved: net: gtp: Fix Use-After-Free in In the Linux kernel, the following vulnerability has been resolved: net: gtp: Fix Use-After-Free in gtp_dellink Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal of gtp_dellink, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To pr

CVE-2024-3857 [HIGH] CWE-416 CVE-2024-3857: The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garbage collection. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

CVE-2024-42302 [HIGH] CWE-416 CVE-2024-42302: In the Linux kernel, the following vulnerability has been resolved: PCI/DPC: Fix use-after-free on In the Linux kernel, the following vulnerability has been resolved: PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal Keith reports a use-after-free when a DPC event occurs concurrently to hot-removal of the same portion of the hierarchy: The dpc_handler() awaits readiness of the secondary bus below the Downstream Port where the DPC event

CVE-2021-47247 [HIGH] CWE-416 CVE-2021-47247: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free o In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free of encap entry in neigh update handler Function mlx5e_rep_neigh_update() wasn't updated to accommodate rtnl lock removal from TC filter update path and properly handle concurrent encap entry insertion/deletion which can lead to following use-after-free: