Debian Linux vulnerabilities

CVE-2024-49883 [HIGH] CWE-416 CVE-2024-49883: In the Linux kernel, the following vulnerability has been resolved: ext4: aovid use-after-free in e In the Linux kernel, the following vulnerability has been resolved: ext4: aovid use-after-free in ext4_ext_insert_extent() As Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is reallocated in ext4_ext_create_new_leaf(), we'll use the stale path and cause UAF. Below is a sample trace with dummy values: ext4_ext_insert_extent path

CVE-2020-15567 [HIGH] CWE-362 CVE-2020-15567: An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or c An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT (nested paging) tables, Xen would in some circumstances use a series of non-atomic bitfield writes. Depending on the compiler version and optimisation

CVE-2024-44974 [HIGH] CWE-416 CVE-2024-44974: In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: avoid possible UaF w In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: avoid possible UaF when selecting endp select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a reference to it, to be read later on. If the entry is dereferenced after the RCU unlock, read

CVE-2022-49063 [HIGH] CWE-416 CVE-2022-49063: In the Linux kernel, the following vulnerability has been resolved: ice: arfs: fix use-after-free w In the Linux kernel, the following vulnerability has been resolved: ice: arfs: fix use-after-free when freeing @rx_cpu_rmap The CI testing bots triggered the following splat: [ 718.203054] BUG: KASAN: use-after-free in free_irq_cpu_rmap+0x53/0x80 [ 718.206349] Read of size 4 at addr ffff8881bd127e00 by task sh/20834 [ 718.212852] CPU: 28 PID: 20834

CVE-2024-26981 [HIGH] CWE-129 CVE-2024-26981: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix OOB in nilfs_set_de In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix OOB in nilfs_set_de_type The size of the nilfs_type_by_mode array in the fs/nilfs2/dir.c file is defined as "S_IFMT >> S_SHIFT", but the nilfs_set_de_type() function, which uses this array, specifies the index to read from the array in the same way as "(mode & S_IFMT) >>

CVE-2024-26736 [HIGH] CWE-787 CVE-2024-26736: In the Linux kernel, the following vulnerability has been resolved: afs: Increase buffer size in af In the Linux kernel, the following vulnerability has been resolved: afs: Increase buffer size in afs_update_volume_status() The max length of volume->vid value is 20 characters. So increase idbuf[] size up to 24 to avoid overflow. Found by Linux Verification Center (linuxtesting.org) with SVACE. [DH: Actually, it's 20 + NUL, so increase it to 24 an

CVE-2024-49950 [HIGH] CWE-416 CVE-2024-49950: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix uaf in l2 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix uaf in l2cap_connect [Syzbot reported] BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54 CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainte

CVE-2024-47730 [HIGH] CWE-416 CVE-2024-47730: In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - inject e In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - inject error before stopping queue The master ooo cannot be completely closed when the accelerator core reports memory error. Therefore, the driver needs to inject the qm error to close the master ooo. Currently, the qm error is injected after stopping queue, m

CVE-2025-37849 [HIGH] CWE-416 CVE-2025-37849: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on f In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCPU creation If kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl but leave the vGIC vCPU data initialised. Note only does this leak the corresponding memory when the vCPU is destroy

CVE-2024-35789 [HIGH] CWE-416 CVE-2024-35789: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check/clear fas In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes When moving a station out of a VLAN and deleting the VLAN afterwards, the fast_rx entry still holds a pointer to the VLAN's netdev, which can cause use-after-free bugs. Fix this by immediately calling ieee80211_check_

CVE-2024-46830 [HIGH] CVE-2024-46830: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Acquire kvm->srcu whe In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS Grab kvm->srcu when processing KVM_SET_VCPU_EVENTS, as KVM will forcibly leave nested VMX/SVM if SMM mode is being toggled, and leaving nested VMX reads guest memory. Note, kvm_vcpu_ioctl_x86_set_vcpu_events() can also be called

CVE-2024-36940 [HIGH] CWE-415 CVE-2024-36940: In the Linux kernel, the following vulnerability has been resolved: pinctrl: core: delete incorrect In the Linux kernel, the following vulnerability has been resolved: pinctrl: core: delete incorrect free in pinctrl_enable() The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free. The devm_pinctrl_de

CVE-2021-35039 [HIGH] CWE-347 CVE-2021-35039: kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f2 kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument.

CVE-2024-26958 [HIGH] CWE-416 CVE-2024-26958: In the Linux kernel, the following vulnerability has been resolved: nfs: fix UAF in direct writes In the Linux kernel, the following vulnerability has been resolved: nfs: fix UAF in direct writes In production we have been hitting the following warning consistently ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 17 PID: 1800359 at lib/refcount.c:28 refcount_warn_saturate+0x9c/0xe0 Workqueue: nfsiod nfs_dir

CVE-2024-26598 [HIGH] CWE-416 CVE-2024-26598: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Avoid pot In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache()

CVE-2024-46725 [HIGH] CWE-787 CVE-2024-46725: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix out-of-bounds w In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix out-of-bounds write warning Check the ring type value to fix the out-of-bounds write warning

CVE-2024-42160 [HIGH] CWE-754 CVE-2024-42160: In the Linux kernel, the following vulnerability has been resolved: f2fs: check validation of fault In the Linux kernel, the following vulnerability has been resolved: f2fs: check validation of fault attrs in f2fs_build_fault_attr() - It missed to check validation of fault attrs in parse_options(), let's fix to add check condition in f2fs_build_fault_attr(). - Use f2fs_build_fault_attr() in __sbi_store() to clean up code.

CVE-2024-26957 [HIGH] CWE-416 CVE-2024-26957: In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: fix reference coun In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: fix reference counting on zcrypt card objects Tests with hot-plugging crytpo cards on KVM guests with debug kernel build revealed an use after free for the load field of the struct zcrypt_card. The reason was an incorrect reference handling of the zcrypt card object whic

CVE-2024-46853 [HIGH] CWE-787 CVE-2024-46853: In the Linux kernel, the following vulnerability has been resolved: spi: nxp-fspi: fix the KASAN re In the Linux kernel, the following vulnerability has been resolved: spi: nxp-fspi: fix the KASAN report out-of-bounds bug Change the memcpy length to fix the out-of-bounds issue when writing the data that is not 4 byte aligned to TX FIFO. To reproduce the issue, write 3 bytes data to NOR chip. dd if=3b of=/dev/mtd0 [ 36.926103] ====================

CVE-2024-38588 [HIGH] CWE-416 CVE-2024-38588: In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix possible use-after- In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix possible use-after-free issue in ftrace_location() KASAN reports a bug: BUG: KASAN: use-after-free in ftrace_location+0x90/0x120 Read of size 8 at addr ffff888141d40010 by task insmod/424 CPU: 8 PID: 424 Comm: insmod Tainted: G W 6.9.0-rc2+ [...] Call Trace: dump_stack_