Debian Linux vulnerabilities

CVE-2024-26689 [HIGH] CWE-416 CVE-2024-26689: In the Linux kernel, the following vulnerability has been resolved: ceph: prevent use-after-free in In the Linux kernel, the following vulnerability has been resolved: ceph: prevent use-after-free in encode_cap_msg() In fs/ceph/caps.c, in encode_cap_msg(), "use after free" error was caught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This implies before the refcount could be increment here, it was freed. In same file, in "handle_cap

CVE-2023-52752 [HIGH] CWE-416 CVE-2023-52752: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() Skip SMB sessions that are being teared down (e.g. @ses->ses_status == SES_EXITING) in cifs_debug_data_proc_show() to avoid use-after-free in @ses. This fixes the following GPF when reading from /proc/fs/cifs/DebugDa

CVE-2023-52691 [HIGH] CWE-415 CVE-2023-52691: In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix a double-free i In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix a double-free in si_dpm_init When the allocation of adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails, amdgpu_free_extended_power_table is called to free some fields of adev. However, when the control flow returns to si_dpm_sw_init, it goes to label dpm_

CVE-2024-44940 [HIGH] CVE-2024-44940: In the Linux kernel, the following vulnerability has been resolved: fou: remove warn in gue_gro_rec In the Linux kernel, the following vulnerability has been resolved: fou: remove warn in gue_gro_receive on unsupported protocol Drop the WARN_ON_ONCE inn gue_gro_receive if the encapsulated type is not known or does not have a GRO handler. Such a packet is easily constructed. Syzbot generates them and sets off this warning. Remove the warning as it is expe

CVE-2024-41096 [HIGH] CWE-416 CVE-2024-41096: In the Linux kernel, the following vulnerability has been resolved: PCI/MSI: Fix UAF in msi_capabil In the Linux kernel, the following vulnerability has been resolved: PCI/MSI: Fix UAF in msi_capability_init KFENCE reports the following UAF: BUG: KFENCE: use-after-free read in __pci_enable_msi_range+0x2c0/0x488 Use-after-free read at 0x0000000024629571 (in kfence-#12): __pci_enable_msi_range+0x2c0/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c p

CVE-2024-35791 [HIGH] CWE-416 CVE-2024-35791: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Flush pages under kvm In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() Do the cache flush of converted pages in svm_register_enc_region() before dropping kvm->lock to fix use-after-free issues where region and/or its array of pages could be freed by a different task, e.g. if u

CVE-2023-52621 [HIGH] CWE-617 CVE-2023-52621: In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcu_read_lock_trace_ In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers These three bpf_map_{lookup,update,delete}_elem() helpers are also available for sleepable bpf program, so add the corresponding lock assertion for sleepable bpf program, otherwise the following warning will be repo

CVE-2024-26951 [HIGH] CWE-416 CVE-2024-26951: In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: check for d In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: check for dangling peer via is_dead instead of empty list If all peers are removed via wg_peer_remove_all(), rather than setting peer_list to empty, the peer is added to a temporary list with a head on the stack of wg_peer_remove_all(). If a netlink dump is resume

CVE-2023-52572 [HIGH] CWE-416 CVE-2023-52572: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix UAF in cifs_demultipl In the Linux kernel, the following vulnerability has been resolved: cifs: Fix UAF in cifs_demultiplex_thread() There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: d

CVE-2015-1863 [MEDIUM] CWE-119 CVE-2015-1863: Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a deni Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries.

CVE-2024-42314 [HIGH] CWE-416 CVE-2024-42314: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after-free when adding pages to compressed bio At add_ra_bio_pages() we are accessing the extent map to calculate 'add_size' after we dropped our reference on the extent map, resulting in a use-after-free. Fix this by computing 'add_size' before dropping our

CVE-2026-41082 [HIGH] CWE-24 CVE-2026-41082: In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

CVE-2025-37789 [HIGH] CVE-2025-37789: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix nested ke In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix nested key length validation in the set() action It's not safe to access nla_len(ovs_key) if the data is smaller than the netlink header. Check that the attribute is OK first.

CVE-2025-38298 [HIGH] CWE-787 CVE-2025-38298: In the Linux kernel, the following vulnerability has been resolved: EDAC/skx_common: Fix general pr In the Linux kernel, the following vulnerability has been resolved: EDAC/skx_common: Fix general protection fault After loading i10nm_edac (which automatically loads skx_edac_common), if unload only i10nm_edac, then reload it and perform error injection testing, a general protection fault may occur: mce: [Hardware Error]: Machine check events logged

CVE-2025-38403 [HIGH] CVE-2025-38403: In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: Clear the vmci tran In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: Clear the vmci transport packet properly when initializing it In vmci_transport_packet_init memset the vmci_transport_packet before populating the fields to avoid any uninitialised data being left in the structure.

CVE-2025-38389 [HIGH] CVE-2025-38389: In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix timeline left In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix timeline left held on VMA alloc error The following error has been reported sporadically by CI when a test unbinds the i915 driver on a ring submission platform: [239.330153] ------------[ cut here ]------------ [239.330166] i915 0000:00:02.0: [drm] drm_WARN_ON(dev_priv->mm.

CVE-2025-38079 [HIGH] CWE-415 CVE-2025-38079: In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - fix double In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - fix double free in hash_accept If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also freed in af_alg_release, leading to slab-use-after-free error.

CVE-2025-38729 [HIGH] CWE-787 CVE-2025-38729: In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too.

CVE-2025-37921 [HIGH] CVE-2025-37921: In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated with the default remote (assuming one was configured) is deleted without holding the hash lock. This is wrong and will result in a warning [1] b

CVE-2025-37890 [HIGH] CWE-416 CVE-2025-37890: In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vuln In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfsc is assuming that checking for cl->qdisc->q.qlen == 0 guarantees that it