Debian Linux vulnerabilities

CVE-2024-42160 [HIGH] CWE-754 CVE-2024-42160: In the Linux kernel, the following vulnerability has been resolved: f2fs: check validation of fault In the Linux kernel, the following vulnerability has been resolved: f2fs: check validation of fault attrs in f2fs_build_fault_attr() - It missed to check validation of fault attrs in parse_options(), let's fix to add check condition in f2fs_build_fault_attr(). - Use f2fs_build_fault_attr() in __sbi_store() to clean up code.

CVE-2024-26951 [HIGH] CWE-416 CVE-2024-26951: In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: check for d In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: check for dangling peer via is_dead instead of empty list If all peers are removed via wg_peer_remove_all(), rather than setting peer_list to empty, the peer is added to a temporary list with a head on the stack of wg_peer_remove_all(). If a netlink dump is resume

CVE-2023-52572 [HIGH] CWE-416 CVE-2023-52572: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix UAF in cifs_demultipl In the Linux kernel, the following vulnerability has been resolved: cifs: Fix UAF in cifs_demultiplex_thread() There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: d

CVE-2025-38298 [HIGH] CWE-787 CVE-2025-38298: In the Linux kernel, the following vulnerability has been resolved: EDAC/skx_common: Fix general pr In the Linux kernel, the following vulnerability has been resolved: EDAC/skx_common: Fix general protection fault After loading i10nm_edac (which automatically loads skx_edac_common), if unload only i10nm_edac, then reload it and perform error injection testing, a general protection fault may occur: mce: [Hardware Error]: Machine check events logged

CVE-2024-42314 [HIGH] CWE-416 CVE-2024-42314: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after-free when adding pages to compressed bio At add_ra_bio_pages() we are accessing the extent map to calculate 'add_size' after we dropped our reference on the extent map, resulting in a use-after-free. Fix this by computing 'add_size' before dropping our

CVE-2025-37789 [HIGH] CVE-2025-37789: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix nested ke In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix nested key length validation in the set() action It's not safe to access nla_len(ovs_key) if the data is smaller than the netlink header. Check that the attribute is OK first.

CVE-2025-37890 [HIGH] CWE-416 CVE-2025-37890: In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vuln In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfsc is assuming that checking for cl->qdisc->q.qlen == 0 guarantees that it

CVE-2025-38389 [HIGH] CVE-2025-38389: In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix timeline left In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix timeline left held on VMA alloc error The following error has been reported sporadically by CI when a test unbinds the i915 driver on a ring submission platform: [239.330153] ------------[ cut here ]------------ [239.330166] i915 0000:00:02.0: [drm] drm_WARN_ON(dev_priv->mm.

CVE-2025-38079 [HIGH] CWE-415 CVE-2025-38079: In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - fix double In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - fix double free in hash_accept If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also freed in af_alg_release, leading to slab-use-after-free error.

CVE-2026-41082 [HIGH] CWE-24 CVE-2026-41082: In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

CVE-2025-38425 [HIGH] CVE-2025-38425: In the Linux kernel, the following vulnerability has been resolved: i2c: tegra: check msg length in In the Linux kernel, the following vulnerability has been resolved: i2c: tegra: check msg length in SMBUS block read For SMBUS block read, do not continue to read if the message length passed from the device is '0' or greater than the maximum allowed bytes.

CVE-2025-38729 [HIGH] CWE-787 CVE-2025-38729: In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too.

CVE-2025-38131 [HIGH] CWE-416 CVE-2025-38131: In the Linux kernel, the following vulnerability has been resolved: coresight: prevent deactivate a In the Linux kernel, the following vulnerability has been resolved: coresight: prevent deactivate active config while enabling the config While enable active config via cscfg_csdev_enable_active_config(), active config could be deactivated via configfs' sysfs interface. This could make UAF issue in below scenario: CPU0 CPU1 (sysfs enable) load modul

CVE-2025-38697 [HIGH] CWE-129 CVE-2025-38697: In the Linux kernel, the following vulnerability has been resolved: jfs: upper bound check of tree In the Linux kernel, the following vulnerability has been resolved: jfs: upper bound check of tree index in dbAllocAG When computing the tree index in dbAllocAG, we never check if we are out of bounds realative to the size of the stree. This could happen in a scenario where the filesystem metadata are corrupted.

CVE-2015-1863 [MEDIUM] CWE-119 CVE-2015-1863: Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a deni Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries.

CVE-2025-38198 [HIGH] CWE-129 CVE-2025-38198: In the Linux kernel, the following vulnerability has been resolved: fbcon: Make sure modelist not s In the Linux kernel, the following vulnerability has been resolved: fbcon: Make sure modelist not set on unregistered console It looks like attempting to write to the "store_modes" sysfs node will run afoul of unregistered consoles: UBSAN: array-index-out-of-bounds in drivers/video/fbdev/core/fbcon.c:122:28 index -1 is out of range for type 'fb_info

CVE-2025-39743 [HIGH] CVE-2025-39743: In the Linux kernel, the following vulnerability has been resolved: jfs: truncate good inode pages In the Linux kernel, the following vulnerability has been resolved: jfs: truncate good inode pages when hard link is 0 The fileset value of the inode copy from the disk by the reproducer is AGGR_RESERVED_I. When executing evict, its hard link number is 0, so its inode pages are not truncated. This causes the bugon to be triggered when executing clear_inode()

CVE-2025-38239 [HIGH] CWE-129 CVE-2025-38239: In the Linux kernel, the following vulnerability has been resolved: scsi: megaraid_sas: Fix invalid In the Linux kernel, the following vulnerability has been resolved: scsi: megaraid_sas: Fix invalid node index On a system with DRAM interleave enabled, out-of-bound access is detected: megaraid_sas 0000:3f:00.0: requested/available msix 128/128 poll_queue 0 ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in ./arch/x86/include/

CVE-2025-39835 [HIGH] CVE-2025-39835: In the Linux kernel, the following vulnerability has been resolved: xfs: do not propagate ENODATA d In the Linux kernel, the following vulnerability has been resolved: xfs: do not propagate ENODATA disk errors into xattr code ENODATA (aka ENOATTR) has a very specific meaning in the xfs xattr code; namely, that the requested attribute name could not be found. However, a medium error from disk may also return ENODATA. At best, this medium error may escape t

CVE-2025-38548 [HIGH] CVE-2025-38548: In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Validate In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Validate the size of the received input buffer Add buffer_recv_size to store the size of the received bytes. Validate buffer_recv_size in send_usb_cmd().