Debian Linux vulnerabilities

CVE-2018-9422 [HIGH] CWE-416 CVE-2018-9422: In get_futex_key of futex.c, there is a use-after-free due to improper locking. This could lead to l In get_futex_key of futex.c, there is a use-after-free due to improper locking. This could lead to local escalation of privilege with no additional privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-74250718 References: Upstream kernel.

CVE-2025-39864 [HIGH] CWE-416 CVE-2025-39864: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-f In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f ("cfg80211: track hidden SSID networks properly"), adjust cfg80211_update_known_bss() to free the last beacon frame elements only if they're not shared via the corresponding '

CVE-2025-23142 [HIGH] CWE-416 CVE-2025-23142: In the Linux kernel, the following vulnerability has been resolved: sctp: detect and prevent refere In the Linux kernel, the following vulnerability has been resolved: sctp: detect and prevent references to a freed transport in sendmsg sctp_sendmsg() re-uses associations and transports when possible by doing a lookup based on the socket endpoint and the message destination address, and then sctp_sendmsg_to_asoc() sets the selected transport in all

CVE-2025-23158 [HIGH] CWE-787 CVE-2025-23158: In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add check to In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add check to handle incorrect queue size qsize represents size of shared queued between driver and video firmware. Firmware can modify this value to an invalid large value. In such situation, empty_space will be bigger than the space actually available. Since new_w

CVE-2025-39849 [HIGH] CWE-787 CVE-2025-39849: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID l In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some bounds checking.

CVE-2025-37797 [HIGH] CWE-416 CVE-2025-37797: In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vuln In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-use condition in hfsc_change_class() when working with certain child qdiscs like netem or codel

CVE-2025-37738 [HIGH] CWE-416 CVE-2025-37738: In the Linux kernel, the following vulnerability has been resolved: ext4: ignore xattrs past end O In the Linux kernel, the following vulnerability has been resolved: ext4: ignore xattrs past end Once inside 'ext4_xattr_inode_dec_ref_all' we should ignore xattrs entries past the 'end' entry. This fixes the following KASAN reported issue: BUG: KASAN: slab-use-after-free in ext4_xattr_inode_dec_ref_all+0xb8c/0xe90 Read of size 4 at addr ffff888012c

CVE-2025-37923 [HIGH] CWE-787 CVE-2025-37923: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix oob write in trace In the Linux kernel, the following vulnerability has been resolved: tracing: Fix oob write in trace_seq_to_buffer() syzbot reported this bug: BUG: KASAN: slab-out-of-bounds in trace_seq_to_buffer kernel/trace/trace.c:1830 [inline] BUG: KASAN: slab-out-of-bounds in tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822 Write of size 4507 at ad

CVE-2025-37819 [HIGH] CWE-416 CVE-2025-37819: In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v2m: Prevent use af In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() With ACPI in place, gicv2m_get_fwnode() is registered with the pci subsystem as pci_msi_get_fwnode_cb(), which may get invoked at runtime during a PCI host bridge probe. But, the call back is wrongly marked as __init, cau

CVE-2025-38323 [HIGH] CWE-416 CVE-2025-38323: In the Linux kernel, the following vulnerability has been resolved: net: atm: add lec_mutex syzbot In the Linux kernel, the following vulnerability has been resolved: net: atm: add lec_mutex syzbot found its way in net/atm/lec.c, and found an error path in lecd_attach() could leave a dangling pointer in dev_lec[]. Add a mutex to protect dev_lecp[] uses from lecd_attach(), lec_vcc_attach() and lec_mcast_attach(). Following patch will use this mute

CVE-2025-38346 [HIGH] CWE-416 CVE-2025-38346: In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix UAF when lookup kal In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix UAF when lookup kallsym after ftrace disabled The following issue happens with a buggy module: BUG: unable to handle page fault for address: ffffffffc05d0218 PGD 1bd66f067 P4D 1bd66f067 PUD 1bd671067 PMD 101808067 PTE 0 Oops: Oops: 0000 [#1] SMP KASAN PTI Tainted: [O]=OO

CVE-2025-39686 [HIGH] CVE-2025-39686: In the Linux kernel, the following vulnerability has been resolved: comedi: Make insn_rw_emulate_bi In the Linux kernel, the following vulnerability has been resolved: comedi: Make insn_rw_emulate_bits() do insn->n samples The `insn_rw_emulate_bits()` function is used as a default handler for `INSN_READ` instructions for subdevices that have a handler for `INSN_BITS` but not for `INSN_READ`. Similarly, it is used as a default handler for `INSN_WRITE` instr

CVE-2025-39701 [HIGH] CVE-2025-39701: In the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: Fix the drive In the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: Fix the driver update version check The security-version-number check should be used rather than the runtime version check for driver updates. Otherwise, the firmware update would fail when the update binary had a lower runtime version number than the current one. [ rjw:

CVE-2025-37903 [HIGH] CWE-416 CVE-2025-37903: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix slab-use-a In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix slab-use-after-free in hdcp The HDCP code in amdgpu_dm_hdcp.c copies pointers to amdgpu_dm_connector objects without incrementing the kref reference counts. When using a USB-C dock, and the dock is unplugged, the corresponding amdgpu_dm_connector objects are free

CVE-2025-39689 [HIGH] CWE-416 CVE-2025-39689: In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds the pointer to the global tracer hash to its iterator. Unlike the writer that allocates a copy of the hash, the reader keeps the pointer to the fi

CVE-2025-38401 [HIGH] CWE-787 CVE-2025-38401: In the Linux kernel, the following vulnerability has been resolved: mtk-sd: Prevent memory corrupti In the Linux kernel, the following vulnerability has been resolved: mtk-sd: Prevent memory corruption from DMA map failure If msdc_prepare_data() fails to map the DMA region, the request is not prepared for data receiving, but msdc_start_data() proceeds the DMA with previous setting. Since this will lead a memory corruption, we have to stop the reque

CVE-2025-38618 [HIGH] CWE-416 CVE-2025-38618: In the Linux kernel, the following vulnerability has been resolved: vsock: Do not allow binding to In the Linux kernel, the following vulnerability has been resolved: vsock: Do not allow binding to VMADDR_PORT_ANY It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The socket returned by accept() also has port VMADDR_PORT_ANY but is not on the list of unbound sock

CVE-2025-38666 [HIGH] CWE-416 CVE-2025-38666: In the Linux kernel, the following vulnerability has been resolved: net: appletalk: Fix use-after-f In the Linux kernel, the following vulnerability has been resolved: net: appletalk: Fix use-after-free in AARP proxy probe The AARP proxy‐probe routine (aarp_proxy_probe_network) sends a probe, releases the aarp_lock, sleeps, then re-acquires the lock. During that window an expire timer thread (__aarp_expire_timer) can remove and kfree() the same ent

CVE-2025-38230 [HIGH] CVE-2025-38230: In the Linux kernel, the following vulnerability has been resolved: jfs: validate AG parameters in In the Linux kernel, the following vulnerability has been resolved: jfs: validate AG parameters in dbMount() to prevent crashes Validate db_agheight, db_agwidth, and db_agstart in dbMount to catch corrupted metadata early and avoid undefined behavior in dbAllocAG. Limits are derived from L2LPERCTL, LPERCTL/MAXAG, and CTLTREESIZE: - agheight: 0 to L2LPERCTL/2

CVE-2025-38183 [HIGH] CWE-787 CVE-2025-38183: In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix potential out In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() Before calling lan743x_ptp_io_event_clock_get(), the 'channel' value is checked against the maximum value of PCI11X1X_PTP_IO_MAX_CHANNELS(8). This seems correct and aligns with the PTP interrupt statu