Debian Linux vulnerabilities

CVE-2025-38000 [HIGH] CWE-416 CVE-2025-38000: In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting b In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the child qdisc's peek() operation before incrementing sch->q.qlen and sch->qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this m

CVE-2024-26957 [HIGH] CWE-416 CVE-2024-26957: In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: fix reference coun In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: fix reference counting on zcrypt card objects Tests with hot-plugging crytpo cards on KVM guests with debug kernel build revealed an use after free for the load field of the struct zcrypt_card. The reason was an incorrect reference handling of the zcrypt card object whic

CVE-2025-37913 [HIGH] CWE-415 CVE-2025-37913: In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of qfq, there won't be a UAF, but the code will add the same

CVE-2024-46725 [HIGH] CWE-787 CVE-2024-46725: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix out-of-bounds w In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix out-of-bounds write warning Check the ring type value to fix the out-of-bounds write warning

CVE-2024-38588 [HIGH] CWE-416 CVE-2024-38588: In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix possible use-after- In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix possible use-after-free issue in ftrace_location() KASAN reports a bug: BUG: KASAN: use-after-free in ftrace_location+0x90/0x120 Read of size 8 at addr ffff888141d40010 by task insmod/424 CPU: 8 PID: 424 Comm: insmod Tainted: G W 6.9.0-rc2+ [...] Call Trace: dump_stack_

CVE-2025-39864 [HIGH] CWE-416 CVE-2025-39864: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-f In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f ("cfg80211: track hidden SSID networks properly"), adjust cfg80211_update_known_bss() to free the last beacon frame elements only if they're not shared via the corresponding '

CVE-2023-52637 [HIGH] CWE-416 CVE-2023-52637: In the Linux kernel, the following vulnerability has been resolved: can: j1939: Fix UAF in j1939_sk In the Linux kernel, the following vulnerability has been resolved: can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) Lock jsk->sk to prevent UAF when setsockopt(..., SO_J1939_FILTER, ...) modifies jsk->filters while receiving packets. Following trace was seen on affected system: BUG: KASAN: slab-use-after-free in j1939

CVE-2025-37914 [HIGH] CWE-415 CVE-2025-37914: In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: Fix double list In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of ets, there won't be a UAF, but the code will add the same

CVE-2025-38024 [HIGH] CWE-416 CVE-2025-38024: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix slab-use-after-fr In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcf/0x610 mm/kasan/report.c:489 kasan_report+0xb

CVE-2025-37991 [HIGH] CWE-415 CVE-2025-37991: In the Linux kernel, the following vulnerability has been resolved: parisc: Fix double SIGFPE crash In the Linux kernel, the following vulnerability has been resolved: parisc: Fix double SIGFPE crash Camm noticed that on parisc a SIGFPE exception will crash an application with a second SIGFPE in the signal handler. Dave analyzed it, and it happens because glibc uses a double-word floating-point store to atomically update function descriptors. As a

CVE-2025-39849 [HIGH] CWE-787 CVE-2025-39849: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID l In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some bounds checking.

CVE-2025-38415 [HIGH] CWE-787 CVE-2025-38415: In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result o In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl("/dev/loop0", LOOP_SET_BLOCK_SIZE, 0x8000). Now if this ioct

CVE-2021-47489 [HIGH] CVE-2021-47489: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix even more out o In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix even more out of bound writes from debugfs CVE-2021-42327 was fixed by: commit f23750b5b3d98653b31d4469592935ef6364ad67 Author: Thelford Williams Date: Wed Oct 13 16:04:13 2021 -0400 drm/amdgpu: fix out of bounds write but amdgpu_dm_debugfs.c contains more of the same issu

CVE-2025-38403 [HIGH] CVE-2025-38403: In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: Clear the vmci tran In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: Clear the vmci transport packet properly when initializing it In vmci_transport_packet_init memset the vmci_transport_packet before populating the fields to avoid any uninitialised data being left in the structure.

CVE-2025-38464 [HIGH] CWE-416 CVE-2025-38464: In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tip In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipc_conn_close(). syzbot reported a null-ptr-deref in tipc_conn_close() during netns dismantle. [0] tipc_topsrv_stop() iterates tipc_net(net)->topsrv->conn_idr and calls tipc_conn_close() for each tipc_conn. The problem is that tipc_conn_close() is call

CVE-2024-46859 [HIGH] CWE-129 CVE-2024-46859: In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses The panasonic laptop code in various places uses the SINF array with index values of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array is big enough. Not all panasonic laptops have this many SINF arra

CVE-2025-38280 [HIGH] CVE-2025-38280: In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid __bpf_prog_ret0_warn In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid __bpf_prog_ret0_warn when jit fails syzkaller reported an issue: WARNING: CPU: 3 PID: 217 at kernel/bpf/core.c:2357 __bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357 Modules linked in: CPU: 3 UID: 0 PID: 217 Comm: kworker/u32:6 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898f

CVE-2025-38375 [HIGH] CWE-125 CVE-2025-38375: In the Linux kernel, the following vulnerability has been resolved: virtio-net: ensure the received In the Linux kernel, the following vulnerability has been resolved: virtio-net: ensure the received length does not exceed allocated size In xdp_linearize_page, when reading the following buffers from the ring, we forget to check the received length with the true allocate size. This can lead to an out-of-bound read. This commit adds that missing chec

CVE-2025-38396 [HIGH] CVE-2025-38396: In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secu In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass Export anon_inode_make_secure_inode() to allow KVM guest_memfd to create anonymous inodes with proper security context. This replaces the current pattern of calling alloc_anon_inode() followed by inode_init_security_anon(

CVE-2025-39730 [HIGH] CVE-2025-39730: In the Linux kernel, the following vulnerability has been resolved: NFS: Fix filehandle bounds chec In the Linux kernel, the following vulnerability has been resolved: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() The function needs to check the minimal filehandle length before it can access the embedded filehandle.