Debian Linux vulnerabilities

CVE-2023-52637 [HIGH] CWE-416 CVE-2023-52637: In the Linux kernel, the following vulnerability has been resolved: can: j1939: Fix UAF in j1939_sk In the Linux kernel, the following vulnerability has been resolved: can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) Lock jsk->sk to prevent UAF when setsockopt(..., SO_J1939_FILTER, ...) modifies jsk->filters while receiving packets. Following trace was seen on affected system: BUG: KASAN: slab-use-after-free in j1939

CVE-2025-38377 [HIGH] CWE-416 CVE-2025-38377: In the Linux kernel, the following vulnerability has been resolved: rose: fix dangling neighbour po In the Linux kernel, the following vulnerability has been resolved: rose: fix dangling neighbour pointers in rose_rt_device_down() There are two bugs in rose_rt_device_down() that can cause use-after-free: 1. The loop bound `t->count` is modified within the loop, which can cause the loop to terminate early and miss some entries. 2. When removing an

CVE-2021-47489 [HIGH] CVE-2021-47489: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix even more out o In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix even more out of bound writes from debugfs CVE-2021-42327 was fixed by: commit f23750b5b3d98653b31d4469592935ef6364ad67 Author: Thelford Williams Date: Wed Oct 13 16:04:13 2021 -0400 drm/amdgpu: fix out of bounds write but amdgpu_dm_debugfs.c contains more of the same issu

CVE-2024-46859 [HIGH] CWE-129 CVE-2024-46859: In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses The panasonic laptop code in various places uses the SINF array with index values of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array is big enough. Not all panasonic laptops have this many SINF arra

CVE-2025-38494 [HIGH] CVE-2025-38494: In the Linux kernel, the following vulnerability has been resolved: HID: core: do not bypass hid_hw In the Linux kernel, the following vulnerability has been resolved: HID: core: do not bypass hid_hw_raw_request hid_hw_raw_request() is actually useful to ensure the provided buffer and length are valid. Directly calling in the low level transport driver function bypassed those checks and allowed invalid paramto be used.

CVE-2023-52757 [HIGH] CWE-416 CVE-2023-52757: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential dead In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential deadlock when releasing mids All release_mid() callers seem to hold a reference of @mid so there is no need to call kref_put(&mid->refcount, __release_mid) under @server->mid_lock spinlock. If they don't, then an use-after-free bug would have occurred anywa

CVE-2025-37913 [HIGH] CWE-415 CVE-2025-37913: In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of qfq, there won't be a UAF, but the code will add the same

CVE-2025-39730 [HIGH] CVE-2025-39730: In the Linux kernel, the following vulnerability has been resolved: NFS: Fix filehandle bounds chec In the Linux kernel, the following vulnerability has been resolved: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() The function needs to check the minimal filehandle length before it can access the embedded filehandle.

CVE-2025-38415 [HIGH] CWE-787 CVE-2025-38415: In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result o In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl("/dev/loop0", LOOP_SET_BLOCK_SIZE, 0x8000). Now if this ioct

CVE-2025-38280 [HIGH] CVE-2025-38280: In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid __bpf_prog_ret0_warn In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid __bpf_prog_ret0_warn when jit fails syzkaller reported an issue: WARNING: CPU: 3 PID: 217 at kernel/bpf/core.c:2357 __bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357 Modules linked in: CPU: 3 UID: 0 PID: 217 Comm: kworker/u32:6 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898f

CVE-2025-38350 [HIGH] CWE-416 CVE-2025-38350: In the Linux kernel, the following vulnerability has been resolved: net/sched: Always pass notifica In the Linux kernel, the following vulnerability has been resolved: net/sched: Always pass notifications when child class becomes empty Certain classful qdiscs may invoke their classes' dequeue handler on an enqueue operation. This may unexpectedly empty the child qdisc and thus make an in-flight class passive via qlen_notify(). Most qdiscs do not ex

CVE-2025-38024 [HIGH] CWE-416 CVE-2025-38024: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix slab-use-after-fr In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcf/0x610 mm/kasan/report.c:489 kasan_report+0xb

CVE-2025-38000 [HIGH] CWE-416 CVE-2025-38000: In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting b In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the child qdisc's peek() operation before incrementing sch->q.qlen and sch->qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this m

CVE-2025-37914 [HIGH] CWE-415 CVE-2025-37914: In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: Fix double list In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of ets, there won't be a UAF, but the code will add the same

CVE-2025-38375 [HIGH] CWE-125 CVE-2025-38375: In the Linux kernel, the following vulnerability has been resolved: virtio-net: ensure the received In the Linux kernel, the following vulnerability has been resolved: virtio-net: ensure the received length does not exceed allocated size In xdp_linearize_page, when reading the following buffers from the ring, we forget to check the received length with the true allocate size. This can lead to an out-of-bound read. This commit adds that missing chec

CVE-2025-38464 [HIGH] CWE-416 CVE-2025-38464: In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tip In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipc_conn_close(). syzbot reported a null-ptr-deref in tipc_conn_close() during netns dismantle. [0] tipc_topsrv_stop() iterates tipc_net(net)->topsrv->conn_idr and calls tipc_conn_close() for each tipc_conn. The problem is that tipc_conn_close() is call

CVE-2025-38697 [HIGH] CWE-129 CVE-2025-38697: In the Linux kernel, the following vulnerability has been resolved: jfs: upper bound check of tree In the Linux kernel, the following vulnerability has been resolved: jfs: upper bound check of tree index in dbAllocAG When computing the tree index in dbAllocAG, we never check if we are out of bounds realative to the size of the stree. This could happen in a scenario where the filesystem metadata are corrupted.

CVE-2025-38699 [HIGH] CWE-415 CVE-2025-38699: In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Double-free fix Whe In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Double-free fix When the bfad_im_probe() function fails during initialization, the memory pointed to by bfad->im is freed without setting bfad->im to NULL. Subsequently, during driver uninstallation, when the state machine enters the bfad_sm_stopping state and calls the bf

CVE-2025-38538 [HIGH] CWE-787 CVE-2025-38538: In the Linux kernel, the following vulnerability has been resolved: dmaengine: nbpfaxi: Fix memory In the Linux kernel, the following vulnerability has been resolved: dmaengine: nbpfaxi: Fix memory corruption in probe() The nbpf->chan[] array is allocated earlier in the nbpf_probe() function and it has "num_channels" elements. These three loops iterate one element farther than they should and corrupt memory. The changes to the second loop are more

CVE-2025-37991 [HIGH] CWE-415 CVE-2025-37991: In the Linux kernel, the following vulnerability has been resolved: parisc: Fix double SIGFPE crash In the Linux kernel, the following vulnerability has been resolved: parisc: Fix double SIGFPE crash Camm noticed that on parisc a SIGFPE exception will crash an application with a second SIGFPE in the signal handler. Dave analyzed it, and it happens because glibc uses a double-word floating-point store to atomically update function descriptors. As a