Debian Linux vulnerabilities

CVE-2024-58054 [HIGH] CVE-2024-58054: In the Linux kernel, the following vulnerability has been resolved: staging: media: max96712: fix k In the Linux kernel, the following vulnerability has been resolved: staging: media: max96712: fix kernel oops when removing module The following kernel oops is thrown when trying to remove the max96712 module: Unable to handle kernel paging request at virtual address 00007375746174db Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL

CVE-2025-37739 [HIGH] CWE-125 CVE-2025-37739: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid out-of-bound In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() syzbot reports an UBSAN issue as below: ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in fs/f2fs/node.h:381:10 index 18446744073709550692 is out of range for type '__le32[5]' (aka 'unsign

CVE-2025-38286 [HIGH] CWE-125 CVE-2025-38286: In the Linux kernel, the following vulnerability has been resolved: pinctrl: at91: Fix possible out In the Linux kernel, the following vulnerability has been resolved: pinctrl: at91: Fix possible out-of-boundary access at91_gpio_probe() doesn't check that given OF alias is not available or something went wrong when trying to get it. This might have consequences when accessing gpio_chips array with that value as an index. Note, that BUG() can be com

CVE-2025-38103 [HIGH] CWE-125 CVE-2025-38103: In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: Eliminate recurren In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() Update struct hid_descriptor to better reflect the mandatory and optional parts of the HID Descriptor as per USB HID 1.11 specification. Note: the kernel currently does not parse any optional HID class descriptors,

CVE-2025-38320 [HIGH] CWE-125 CVE-2025-38320: In the Linux kernel, the following vulnerability has been resolved: arm64/ptrace: Fix stack-out-of- In the Linux kernel, the following vulnerability has been resolved: arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() KASAN reports a stack-out-of-bounds read in regs_get_kernel_stack_nth(). Call Trace: [ 97.283505] BUG: KASAN: stack-out-of-bounds in regs_get_kernel_stack_nth+0xa8/0xc8 [ 97.284677] Read of size 8 at addr ffff

CVE-2021-43536 [MEDIUM] CWE-200 CVE-2021-43536: Under certain circumstances, asynchronous functions could have caused a navigation to fail but expos Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

CVE-2025-39760 [HIGH] CWE-125 CVE-2025-39760: In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size. Fix this up by checking the size first before looking at any of the fields in the d

CVE-2025-39757 [HIGH] CWE-125 CVE-2025-39757: In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB acce

CVE-2025-38342 [HIGH] CWE-125 CVE-2025-38342: In the Linux kernel, the following vulnerability has been resolved: software node: Correct a OOB ch In the Linux kernel, the following vulnerability has been resolved: software node: Correct a OOB check in software_node_get_reference_args() software_node_get_reference_args() wants to get @index-th element, so the property value requires at least '(index + 1) * sizeof(*ref)' bytes but that can not be guaranteed by current OOB check, and may cause OO

CVE-2025-39687 [HIGH] CVE-2025-39687: In the Linux kernel, the following vulnerability has been resolved: iio: light: as73211: Ensure buf In the Linux kernel, the following vulnerability has been resolved: iio: light: as73211: Ensure buffer holes are zeroed Given that the buffer is copied to a kfifo that ultimately user space can read, ensure we zero it.

CVE-2025-38483 [HIGH] CWE-125 CVE-2025-38483: In the Linux kernel, the following vulnerability has been resolved: comedi: das16m1: Fix bit shift In the Linux kernel, the following vulnerability has been resolved: comedi: das16m1: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: /* only irqs 2, 3, 4, 5, 6, 7, 10, 11, 12, 14, and 15 are valid */ if ((1 options[1]) & 0xdcfc) { However, `it->options[i]` is an unchecked `int` value from userspace,

CVE-2025-38482 [HIGH] CWE-125 CVE-2025-38482: In the Linux kernel, the following vulnerability has been resolved: comedi: das6402: Fix bit shift In the Linux kernel, the following vulnerability has been resolved: comedi: das6402: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: /* IRQs 2,3,5,6,7, 10,11,15 are valid for "enhanced" mode */ if ((1 options[1]) & 0x8cec) { However, `it->options[i]` is an unchecked `int` value from userspace, so the

CVE-2025-38715 [HIGH] CWE-125 CVE-2025-38715: In the Linux kernel, the following vulnerability has been resolved: hfs: fix slab-out-of-bounds in In the Linux kernel, the following vulnerability has been resolved: hfs: fix slab-out-of-bounds in hfs_bnode_read() This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods

CVE-2025-38497 [HIGH] CWE-125 CVE-2025-38497: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Fix OOB In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Fix OOB read on empty string write When writing an empty string to either 'qw_sign' or 'landingPage' sysfs attributes, the store functions attempt to access page[l - 1] before validating that the length 'l' is greater than zero. This patch fixes the vulnerabili

CVE-2025-39853 [HIGH] CWE-125 CVE-2025-39853: In the Linux kernel, the following vulnerability has been resolved: i40e: Fix potential invalid acc In the Linux kernel, the following vulnerability has been resolved: i40e: Fix potential invalid access when MAC list is empty list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced. Fix this by using list_first_entry_or_null instead o

CVE-2025-39685 [HIGH] CWE-125 CVE-2025-39685: In the Linux kernel, the following vulnerability has been resolved: comedi: pcl726: Prevent invalid In the Linux kernel, the following vulnerability has been resolved: comedi: pcl726: Prevent invalid irq number The reproducer passed in an irq number(0x80008000) that was too large, which triggered the oob. Added an interrupt number check to prevent users from passing in an irq number that was too large. If `it->options[1]` is 31, then `1 options[1

CVE-2020-20445 [MEDIUM] CWE-369 CVE-2020-20445: FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/lpc.h, which allows a remote malicio FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/lpc.h, which allows a remote malicious user to cause a Denial of Service.

CVE-2025-39702 [HIGH] CWE-203 CVE-2025-39702: In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

CVE-2023-53259 [HIGH] CWE-125 CVE-2023-53259: In the Linux kernel, the following vulnerability has been resolved: VMCI: check context->notify_pag In the Linux kernel, the following vulnerability has been resolved: VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF The call to get_user_pages_fast() in vmci_host_setup_notify() can return NULL context->notify_page causing a GPF. To avoid GPF check if context->notify_page == NULL and return error if so. general prot

CVE-2025-39719 [HIGH] CWE-125 CVE-2025-39719: In the Linux kernel, the following vulnerability has been resolved: iio: imu: bno055: fix OOB acces In the Linux kernel, the following vulnerability has been resolved: iio: imu: bno055: fix OOB access of hw_xlate array Fix a potential out-of-bounds array access of the hw_xlate array in bno055.c. In bno055_get_regmask(), hw_xlate was iterated over the length of the vals array instead of the length of the hw_xlate array. In the case of bno055_gyr_sc