Debian Linux vulnerabilities

CVE-2025-38535 [HIGH] CVE-2025-38535: In the Linux kernel, the following vulnerability has been resolved: phy: tegra: xusb: Fix unbalance In the Linux kernel, the following vulnerability has been resolved: phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode When transitioning from USB_ROLE_DEVICE to USB_ROLE_NONE, the code assumed that the regulator should be disabled. However, if the regulator is marked as always-on, regulator_is_enabled() continues to return true, leading to

CVE-2025-38422 [HIGH] CVE-2025-38422: In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Modify the EEPROM In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices Maximum OTP and EEPROM size for hearthstone PCI1xxxx devices are 8 Kb and 64 Kb respectively. Adjust max size definitions and return correct EEPROM length based on device. Also prevent out-of-bound read/write.

CVE-2025-38118 [HIGH] CWE-416 CVE-2025-38118: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF on mgm In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete This reworks MGMT_OP_REMOVE_ADV_MONITOR to not use mgmt_pending_add to avoid crashes like bellow: BUG: KASAN: slab-use-after-free in mgmt_remove_adv_monitor_complete+0xe5/0x540 net/bluetooth/mgmt.c:5406 Read of size 8 at a

CVE-2025-38396 [HIGH] CVE-2025-38396: In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secu In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass Export anon_inode_make_secure_inode() to allow KVM guest_memfd to create anonymous inodes with proper security context. This replaces the current pattern of calling alloc_anon_inode() followed by inode_init_security_anon(

CVE-2025-38157 [HIGH] CWE-787 CVE-2025-38157: In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: Abort software In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: Abort software beacon handling if disabled A malicious USB device can send a WMI_SWBA_EVENTID event from an ath9k_htc-managed device before beaconing has been enabled. This causes a device-by-zero error in the driver, leading to either a crash or an out of bounds rea

CVE-2025-38226 [HIGH] CWE-787 CVE-2025-38226: In the Linux kernel, the following vulnerability has been resolved: media: vivid: Change the siize In the Linux kernel, the following vulnerability has been resolved: media: vivid: Change the siize of the composing syzkaller found a bug: BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common

CVE-2004-0434 [CRITICAL] CWE-131 CVE-2004-0434: k5admind (kadmind) for Heimdal allows remote attackers to execute arbitrary code via a Kerberos 4 co k5admind (kadmind) for Heimdal allows remote attackers to execute arbitrary code via a Kerberos 4 compatibility administration request whose framing length is less than 2, which leads to a heap-based buffer overflow.

CVE-2025-38154 [HIGH] CWE-416 CVE-2025-38154: In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Avoid using sk_so In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Avoid using sk_socket after free when sending The sk->sk_socket is not locked or referenced in backlog thread, and during the call to skb_send_sock(), there is a race condition with the release of sk_socket. All types of sockets(tcp/udp/unix/vsock) will be affected. Ra

CVE-2025-38707 [HIGH] CVE-2025-38707: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add sanity check for In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add sanity check for file name The length of the file name should be smaller than the directory entry size.

CVE-2025-38212 [HIGH] CWE-416 CVE-2025-38212: In the Linux kernel, the following vulnerability has been resolved: ipc: fix to protect IPCS lookup In the Linux kernel, the following vulnerability has been resolved: ipc: fix to protect IPCS lookups using RCU syzbot reported that it discovered a use-after-free vulnerability, [0] [0]: https://lore.kernel.org/all/[email protected]/ idr_for_each() is protected by rwsem, but this is not enough. If it is not protected by RC

CVE-2025-38257 [HIGH] CVE-2025-38257: In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Prevent overflow in In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Prevent overflow in size calculation for memdup_user() Number of apqn target list entries contained in 'nr_apqns' variable is determined by userspace via an ioctl call so the result of the product in calculation of size passed to memdup_user() may overflow. In this case the actual

CVE-2025-39783 [HIGH] CWE-787 CVE-2025-39783: In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs gro In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs group list head handling Doing a list_del() on the epf_group field of struct pci_epf_driver in pci_epf_remove_cfs() is not correct as this field is a list head, not a list entry. This list_del() call triggers a KASAN warning when an endpoint function drive

CVE-2025-38485 [HIGH] CWE-416 CVE-2025-38485: In the Linux kernel, the following vulnerability has been resolved: iio: accel: fxls8962af: Fix use In the Linux kernel, the following vulnerability has been resolved: iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush fxls8962af_fifo_flush() uses indio_dev->active_scan_mask (with iio_for_each_active_channel()) without making sure the indio_dev stays in buffer mode. There is a race if indio_dev exits buffer mode in the middle of th

CVE-2025-38259 [HIGH] CWE-416 CVE-2025-38259: In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd9335: Fix miss In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd9335: Fix missing free of regulator supplies Driver gets and enables all regulator supplies in probe path (wcd9335_parse_dt() and wcd9335_power_on_reset()), but does not cleanup in final error paths and in unbind (missing remove() callback). This leads to leaked memo

CVE-2025-39911 [HIGH] CVE-2025-39911: In the Linux kernel, the following vulnerability has been resolved: i40e: fix IRQ freeing in i40e_v In the Linux kernel, the following vulnerability has been resolved: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path If request_irq() in i40e_vsi_request_irq_msix() fails in an iteration later than the first, the error path wants to free the IRQs requested so far. However, it uses the wrong dev_id argument for free_irq(), so it does not free the

CVE-2025-39776 [HIGH] CWE-416 CVE-2025-39776: In the Linux kernel, the following vulnerability has been resolved: mm/debug_vm_pgtable: clear page In the Linux kernel, the following vulnerability has been resolved: mm/debug_vm_pgtable: clear page table entries at destroy_args() The mm/debug_vm_pagetable test allocates manually page table entries for the tests it runs, using also its manually allocated mm_struct. That in itself is ok, but when it exits, at destroy_args() it fails to clear those

CVE-2020-11078 [MEDIUM] CWE-93 CVE-2020-11078: In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http. In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. T

CVE-2018-16229 [HIGH] CWE-125 CVE-2018-16229: The DCCP parser in tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccp_print_option(). The DCCP parser in tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccp_print_option().

CVE-2011-3045 [HIGH] CVE-2011-3045: Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.

CVE-2023-4055 [HIGH] CWE-120 CVE-2023-4055: When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.