Debian Linux vulnerabilities

CVE-2025-38212 [HIGH] CWE-416 CVE-2025-38212: In the Linux kernel, the following vulnerability has been resolved: ipc: fix to protect IPCS lookup In the Linux kernel, the following vulnerability has been resolved: ipc: fix to protect IPCS lookups using RCU syzbot reported that it discovered a use-after-free vulnerability, [0] [0]: https://lore.kernel.org/all/[email protected]/ idr_for_each() is protected by rwsem, but this is not enough. If it is not protected by RC

CVE-2025-38118 [HIGH] CWE-416 CVE-2025-38118: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF on mgm In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete This reworks MGMT_OP_REMOVE_ADV_MONITOR to not use mgmt_pending_add to avoid crashes like bellow: BUG: KASAN: slab-use-after-free in mgmt_remove_adv_monitor_complete+0xe5/0x540 net/bluetooth/mgmt.c:5406 Read of size 8 at a

CVE-2025-38699 [HIGH] CWE-415 CVE-2025-38699: In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Double-free fix Whe In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Double-free fix When the bfad_im_probe() function fails during initialization, the memory pointed to by bfad->im is freed without setting bfad->im to NULL. Subsequently, during driver uninstallation, when the state machine enters the bfad_sm_stopping state and calls the bf

CVE-2025-38226 [HIGH] CWE-787 CVE-2025-38226: In the Linux kernel, the following vulnerability has been resolved: media: vivid: Change the siize In the Linux kernel, the following vulnerability has been resolved: media: vivid: Change the siize of the composing syzkaller found a bug: BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common

CVE-2025-39686 [HIGH] CVE-2025-39686: In the Linux kernel, the following vulnerability has been resolved: comedi: Make insn_rw_emulate_bi In the Linux kernel, the following vulnerability has been resolved: comedi: Make insn_rw_emulate_bits() do insn->n samples The `insn_rw_emulate_bits()` function is used as a default handler for `INSN_READ` instructions for subdevices that have a handler for `INSN_BITS` but not for `INSN_READ`. Similarly, it is used as a default handler for `INSN_WRITE` instr

CVE-2025-39701 [HIGH] CVE-2025-39701: In the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: Fix the drive In the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: Fix the driver update version check The security-version-number check should be used rather than the runtime version check for driver updates. Otherwise, the firmware update would fail when the update binary had a lower runtime version number than the current one. [ rjw:

CVE-2025-38157 [HIGH] CWE-787 CVE-2025-38157: In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: Abort software In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: Abort software beacon handling if disabled A malicious USB device can send a WMI_SWBA_EVENTID event from an ath9k_htc-managed device before beaconing has been enabled. This causes a device-by-zero error in the driver, leading to either a crash or an out of bounds rea

CVE-2025-38154 [HIGH] CWE-416 CVE-2025-38154: In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Avoid using sk_so In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Avoid using sk_socket after free when sending The sk->sk_socket is not locked or referenced in backlog thread, and during the call to skb_send_sock(), there is a race condition with the release of sk_socket. All types of sockets(tcp/udp/unix/vsock) will be affected. Ra

CVE-2023-52757 [HIGH] CWE-416 CVE-2023-52757: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential dead In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential deadlock when releasing mids All release_mid() callers seem to hold a reference of @mid so there is no need to call kref_put(&mid->refcount, __release_mid) under @server->mid_lock spinlock. If they don't, then an use-after-free bug would have occurred anywa

CVE-2025-39689 [HIGH] CWE-416 CVE-2025-39689: In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds the pointer to the global tracer hash to its iterator. Unlike the writer that allocates a copy of the hash, the reader keeps the pointer to the fi

CVE-2024-26614 [HIGH] CWE-667 CVE-2024-26614: In the Linux kernel, the following vulnerability has been resolved: tcp: make sure init the accept_ In the Linux kernel, the following vulnerability has been resolved: tcp: make sure init the accept_queue's spinlocks once When I run syz's reproduction C program locally, it causes the following issue: pvqspinlock: lock 0xffff9d181cd5c660 has corrupted value 0x0! WARNING: CPU: 19 PID: 21160 at __pv_queued_spin_unlock_slowpath (kernel/locking/qspinloc

CVE-2025-38707 [HIGH] CVE-2025-38707: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add sanity check for In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add sanity check for file name The length of the file name should be smaller than the directory entry size.

CVE-2025-38257 [HIGH] CVE-2025-38257: In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Prevent overflow in In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Prevent overflow in size calculation for memdup_user() Number of apqn target list entries contained in 'nr_apqns' variable is determined by userspace via an ioctl call so the result of the product in calculation of size passed to memdup_user() may overflow. In this case the actual

CVE-2025-38538 [HIGH] CWE-787 CVE-2025-38538: In the Linux kernel, the following vulnerability has been resolved: dmaengine: nbpfaxi: Fix memory In the Linux kernel, the following vulnerability has been resolved: dmaengine: nbpfaxi: Fix memory corruption in probe() The nbpf->chan[] array is allocated earlier in the nbpf_probe() function and it has "num_channels" elements. These three loops iterate one element farther than they should and corrupt memory. The changes to the second loop are more

CVE-2025-38259 [HIGH] CWE-416 CVE-2025-38259: In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd9335: Fix miss In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd9335: Fix missing free of regulator supplies Driver gets and enables all regulator supplies in probe path (wcd9335_parse_dt() and wcd9335_power_on_reset()), but does not cleanup in final error paths and in unbind (missing remove() callback). This leads to leaked memo

CVE-2025-38535 [HIGH] CVE-2025-38535: In the Linux kernel, the following vulnerability has been resolved: phy: tegra: xusb: Fix unbalance In the Linux kernel, the following vulnerability has been resolved: phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode When transitioning from USB_ROLE_DEVICE to USB_ROLE_NONE, the code assumed that the regulator should be disabled. However, if the regulator is marked as always-on, regulator_is_enabled() continues to return true, leading to

CVE-2025-38718 [HIGH] CWE-908 CVE-2025-38718: In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso pack In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported two use-of-uninitialized-memory bugs caused by this: BUG: KMSAN: uninit-value in sctp_inq_p

CVE-2025-38485 [HIGH] CWE-416 CVE-2025-38485: In the Linux kernel, the following vulnerability has been resolved: iio: accel: fxls8962af: Fix use In the Linux kernel, the following vulnerability has been resolved: iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush fxls8962af_fifo_flush() uses indio_dev->active_scan_mask (with iio_for_each_active_channel()) without making sure the indio_dev stays in buffer mode. There is a race if indio_dev exits buffer mode in the middle of th

CVE-2025-39783 [HIGH] CWE-787 CVE-2025-39783: In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs gro In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs group list head handling Doing a list_del() on the epf_group field of struct pci_epf_driver in pci_epf_remove_cfs() is not correct as this field is a list head, not a list entry. This list_del() call triggers a KASAN warning when an endpoint function drive

CVE-2025-39877 [HIGH] CWE-416 CVE-2025-39877: In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: fix use-after-f In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: fix use-after-free in state_show() state_show() reads kdamond->damon_ctx without holding damon_sysfs_lock. This allows a use-after-free race: CPU 0 CPU 1 ----- ----- state_show() damon_sysfs_turn_damon_on() ctx = kdamond->damon_ctx; mutex_lock(&damon_sysfs_lock); dam