Debian Linux vulnerabilities

CVE-2024-46746 [HIGH] CWE-416 CVE-2024-46746: In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: free driver_data In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: free driver_data after destroying hid device HID driver callbacks aren't called anymore once hid_destroy_device() has been called. Hence, hid driver_data should be freed only after the hid_destroy_device() function returned as driver_data is used in several callbacks. I

CVE-2024-26804 [HIGH] CWE-416 CVE-2024-26804: In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: prevent perpetu In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: prevent perpetual headroom growth syzkaller triggered following kasan splat: BUG: KASAN: use-after-free in __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 Read of size 1 at addr ffff88812fb4000e by task syz-executor183/5191 [..] kasan_report+0xda/0x110

CVE-2025-37923 [HIGH] CWE-787 CVE-2025-37923: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix oob write in trace In the Linux kernel, the following vulnerability has been resolved: tracing: Fix oob write in trace_seq_to_buffer() syzbot reported this bug: BUG: KASAN: slab-out-of-bounds in trace_seq_to_buffer kernel/trace/trace.c:1830 [inline] BUG: KASAN: slab-out-of-bounds in tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822 Write of size 4507 at ad

CVE-2024-3857 [HIGH] CWE-416 CVE-2024-3857: The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garbage collection. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

CVE-2022-41916 [HIGH] CWE-193 CVE-2022-41916: Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerabl Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users should upgrade to Heimdal 7.7.1 or 7.8

CVE-2024-27395 [HIGH] CWE-416 CVE-2024-27395: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix Use-After In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix Use-After-Free in ovs_ct_exit Since kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal of ovs_ct_limit_exit, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will

CVE-2024-27396 [HIGH] CWE-416 CVE-2024-27396: In the Linux kernel, the following vulnerability has been resolved: net: gtp: Fix Use-After-Free in In the Linux kernel, the following vulnerability has been resolved: net: gtp: Fix Use-After-Free in gtp_dellink Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal of gtp_dellink, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To pr

CVE-2024-42136 [HIGH] CWE-190 CVE-2024-42136: In the Linux kernel, the following vulnerability has been resolved: cdrom: rearrange last_media_cha In the Linux kernel, the following vulnerability has been resolved: cdrom: rearrange last_media_change check to avoid unintentional overflow When running syzkaller with the newly reintroduced signed integer wrap sanitizer we encounter this splat: [ 366.015950] UBSAN: signed-integer-overflow in ../drivers/cdrom/cdrom.c:2361:33 [ 366.021089] -92233720

CVE-2021-47247 [HIGH] CWE-416 CVE-2021-47247: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free o In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free of encap entry in neigh update handler Function mlx5e_rep_neigh_update() wasn't updated to accommodate rtnl lock removal from TC filter update path and properly handle concurrent encap entry insertion/deletion which can lead to following use-after-free:

CVE-2024-42302 [HIGH] CWE-416 CVE-2024-42302: In the Linux kernel, the following vulnerability has been resolved: PCI/DPC: Fix use-after-free on In the Linux kernel, the following vulnerability has been resolved: PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal Keith reports a use-after-free when a DPC event occurs concurrently to hot-removal of the same portion of the hierarchy: The dpc_handler() awaits readiness of the secondary bus below the Downstream Port where the DPC event

CVE-2025-23142 [HIGH] CWE-416 CVE-2025-23142: In the Linux kernel, the following vulnerability has been resolved: sctp: detect and prevent refere In the Linux kernel, the following vulnerability has been resolved: sctp: detect and prevent references to a freed transport in sendmsg sctp_sendmsg() re-uses associations and transports when possible by doing a lookup based on the socket endpoint and the message destination address, and then sctp_sendmsg_to_asoc() sets the selected transport in all

CVE-2025-37819 [HIGH] CWE-416 CVE-2025-37819: In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v2m: Prevent use af In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() With ACPI in place, gicv2m_get_fwnode() is registered with the pci subsystem as pci_msi_get_fwnode_cb(), which may get invoked at runtime during a PCI host bridge probe. But, the call back is wrongly marked as __init, cau

CVE-2025-37797 [HIGH] CWE-416 CVE-2025-37797: In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vuln In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-use condition in hfsc_change_class() when working with certain child qdiscs like netem or codel

CVE-2025-23158 [HIGH] CWE-787 CVE-2025-23158: In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add check to In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add check to handle incorrect queue size qsize represents size of shared queued between driver and video firmware. Firmware can modify this value to an invalid large value. In such situation, empty_space will be bigger than the space actually available. Since new_w

CVE-2025-37738 [HIGH] CWE-416 CVE-2025-37738: In the Linux kernel, the following vulnerability has been resolved: ext4: ignore xattrs past end O In the Linux kernel, the following vulnerability has been resolved: ext4: ignore xattrs past end Once inside 'ext4_xattr_inode_dec_ref_all' we should ignore xattrs entries past the 'end' entry. This fixes the following KASAN reported issue: BUG: KASAN: slab-use-after-free in ext4_xattr_inode_dec_ref_all+0xb8c/0xe90 Read of size 4 at addr ffff888012c

CVE-2018-9422 [HIGH] CWE-416 CVE-2018-9422: In get_futex_key of futex.c, there is a use-after-free due to improper locking. This could lead to l In get_futex_key of futex.c, there is a use-after-free due to improper locking. This could lead to local escalation of privilege with no additional privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-74250718 References: Upstream kernel.

CVE-2025-38323 [HIGH] CWE-416 CVE-2025-38323: In the Linux kernel, the following vulnerability has been resolved: net: atm: add lec_mutex syzbot In the Linux kernel, the following vulnerability has been resolved: net: atm: add lec_mutex syzbot found its way in net/atm/lec.c, and found an error path in lecd_attach() could leave a dangling pointer in dev_lec[]. Add a mutex to protect dev_lecp[] uses from lecd_attach(), lec_vcc_attach() and lec_mcast_attach(). Following patch will use this mute

CVE-2023-39947 [HIGH] CWE-122 CVE-2023-39947: eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Ma eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, even after the fix at commit 3492270, malformed `PID_PROPERTY_LIST` parameters cause heap overflow at a different program counter. This can remotely crash any Fast-DDS process. Versions

CVE-2025-37903 [HIGH] CWE-416 CVE-2025-37903: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix slab-use-a In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix slab-use-after-free in hdcp The HDCP code in amdgpu_dm_hdcp.c copies pointers to amdgpu_dm_connector objects without incrementing the kref reference counts. When using a USB-C dock, and the dock is unplugged, the corresponding amdgpu_dm_connector objects are free

CVE-2025-38401 [HIGH] CWE-787 CVE-2025-38401: In the Linux kernel, the following vulnerability has been resolved: mtk-sd: Prevent memory corrupti In the Linux kernel, the following vulnerability has been resolved: mtk-sd: Prevent memory corruption from DMA map failure If msdc_prepare_data() fails to map the DMA region, the request is not prepared for data receiving, but msdc_start_data() proceeds the DMA with previous setting. Since this will lead a memory corruption, we have to stop the reque