Debian Linux vulnerabilities

CVE-2025-37959 [MEDIUM] CVE-2025-37959: In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpf_redire In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpf_redirect_peer When bpf_redirect_peer is used to redirect packets to a device in another network namespace, the skb isn't scrubbed. That can lead skb information from one namespace to be "misused" in another namespace. As one example, this is causing Cilium to drop

CVE-2022-0171 [MEDIUM] CWE-459 CVE-2022-0171: A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization (SEV).

CVE-2022-40768 [MEDIUM] CWE-908 CVE-2022-40768: drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive inform drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case.

CVE-2014-0083 [MEDIUM] CWE-916 CVE-2014-0083: The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords. The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords.

CVE-2025-37858 [MEDIUM] CWE-190 CVE-2025-37858: In the Linux kernel, the following vulnerability has been resolved: fs/jfs: Prevent integer overflo In the Linux kernel, the following vulnerability has been resolved: fs/jfs: Prevent integer overflow in AG size calculation The JFS filesystem calculates allocation group (AG) size using 1 2TB aggregates on 32-bit systems), this 32-bit shift operation causes undefined behavior and improper AG sizing. On 32-bit architectures: - Left-shifting 1 by 3

CVE-2024-35807 [MEDIUM] CVE-2024-35807: In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on- In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize We observed a corruption during on-line resize of a file system that is larger than 16 TiB with 4k block size. With having more then 2^32 blocks resize_inode is turned off by default by mke2fs. The issue can be reproduced on a smaller file system

CVE-2024-36889 [MEDIUM] CVE-2024-36889: In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure snd_nxt is proper In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure snd_nxt is properly initialized on connect Christoph reported a splat hinting at a corrupted snd_una: WARNING: CPU: 1 PID: 38 at net/mptcp/protocol.c:1005 __mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005 Modules linked in: CPU: 1 PID: 38 Comm: kworker/1:1 Not tainted

CVE-2025-29769 [MEDIUM] CWE-122 CVE-2025-29769: libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence of an alpha channel in an input when it was not possible to determine the colour interpretation, known internally within libvips as "multiband". There aren't many ways to create a "multiband" input, but it is poss

CVE-2025-37851 [MEDIUM] CWE-674 CVE-2025-37851: In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: Add 'plane' valu In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: Add 'plane' value check Function dispc_ovl_setup is not intended to work with the value OMAP_DSS_WB of the enum parameter plane. The value of this parameter is initialized in dss_init_overlays and in the current state of the code it cannot take this value so it's no

CVE-2024-35877 [MEDIUM] CWE-401 CVE-2024-35877: In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: fix VM_PAT handling In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: fix VM_PAT handling in COW mappings PAT handling won't do the right thing in COW mappings: the first PTE (or, in fact, all PTEs) can be replaced during write faults to point at anon folios. Reliably recovering the correct PFN and cachemode using follow_phys() from PTEs

CVE-2024-26685 [MEDIUM] CWE-787 CVE-2024-26685: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential bug in en In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential bug in end_buffer_async_write According to a syzbot report, end_buffer_async_write(), which handles the completion of block device writes, may detect abnormal condition of the buffer async_write flag and cause a BUG_ON failure when using nilfs2. Nilfs2 itself

CVE-2024-26812 [MEDIUM] CWE-476 CVE-2024-26812: In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Create persistent INT In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Create persistent INTx handler A vulnerability exists where the eventfd for INTx signaling can be deconfigured, which unregisters the IRQ handler but still allows eventfds to be signaled with a NULL context through the SET_IRQS ioctl or through unmask irqfd if the device

CVE-2023-34256 [MEDIUM] CWE-125 CVE-2023-34256: An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated "When modifying the bl

CVE-2023-52627 [MEDIUM] CWE-476 CVE-2023-52627: In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7091r: Allow users In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7091r: Allow users to configure device events AD7091R-5 devices are supported by the ad7091r-5 driver together with the ad7091r-base driver. Those drivers declared iio events for notifying user space when ADC readings fall bellow the thresholds of low limit registers or

CVE-2025-39848 [MEDIUM] CWE-401 CVE-2025-39848: In the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in In the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in ax25_kiss_rcv() Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d ("net: introduce per netns packet chains"). skb->dev becomes NULL and we crash in __netif_receive_skb_core(). Before above commit, different kind of bugs or

CVE-2025-23141 [MEDIUM] CVE-2025-23141: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Acquire SRCU in KVM_G In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses Acquire a lock on kvm->srcu when userspace is getting MP state to handle a rather extreme edge case where "accepting" APIC events, i.e. processing pending INIT or SIPI, can trigger accesses to guest memory. If the

CVE-2025-38037 [MEDIUM] CVE-2025-38037: In the Linux kernel, the following vulnerability has been resolved: vxlan: Annotate FDB data races In the Linux kernel, the following vulnerability has been resolved: vxlan: Annotate FDB data races The 'used' and 'updated' fields in the FDB entry structure can be accessed concurrently by multiple threads, leading to reports such as [1]. Can be reproduced using [2]. Suppress these reports by annotating these accesses using READ_ONCE() / WRITE_ONCE(). [1

CVE-2025-38136 [MEDIUM] CWE-908 CVE-2025-38136: In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: Reorder clo In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: Reorder clock handling and power management in probe Reorder the initialization sequence in `usbhs_probe()` to enable runtime PM before accessing registers, preventing potential crashes due to uninitialized clocks. Currently, in the probe path, registers are ac

CVE-2025-38147 [MEDIUM] CWE-476 CVE-2025-38147: In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso fun In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AF_INET sk. syzkaller reported a null-ptr-deref in txopt_get(). [0] The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there. However, this never happens for IPv6 sockets as inet_sk(sk)->pinet

CVE-2025-37911 [MEDIUM] CWE-125 CVE-2025-37911: In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix out-of-bound memcp In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix out-of-bound memcpy() during ethtool -w When retrieving the FW coredump using ethtool, it can sometimes cause memory corruption: BUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] Corrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! !