Debian Linux vulnerabilities

CVE-2024-26889 [MEDIUM] CWE-120 CVE-2024-26889: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix possib In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix possible buffer overflow struct hci_dev_info has a fixed size name[8] field so in the event that hdev->name is bigger than that strcpy would attempt to write past its size, so this fixes this problem by switching to use strscpy.

CVE-2024-26766 [MEDIUM] CWE-193 CVE-2024-26766: In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix sdma.h tx->num_des In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix sdma.h tx->num_descs off-by-one error Unfortunately the commit `fd8958efe877` introduced another error causing the `descs` array to overflow. This reults in further crashes easily reproducible by `sendmsg` system call. [ 1080.836473] general protection fault, probably

CVE-2022-42310 [MEDIUM] CWE-459 CVE-2022-42310: Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is committed after this situation, nodes without a valid parent

CVE-2024-35958 [MEDIUM] CVE-2024-35958: In the Linux kernel, the following vulnerability has been resolved: net: ena: Fix incorrect descrip In the Linux kernel, the following vulnerability has been resolved: net: ena: Fix incorrect descriptor free behavior ENA has two types of TX queues: - queues which only process TX packets arriving from the network stack - queues which only process TX packets forwarded to it by XDP_REDIRECT or XDP_TX instructions The ena_free_tx_bufs() cycles through all d

CVE-2024-26733 [MEDIUM] CWE-787 CVE-2024-26733: In the Linux kernel, the following vulnerability has been resolved: arp: Prevent overflow in arp_re In the Linux kernel, the following vulnerability has been resolved: arp: Prevent overflow in arp_req_get(). syzkaller reported an overflown write in arp_req_get(). [0] When ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour entry and copies neigh->ha to struct arpreq.arp_ha.sa_data. The arp_ha here is struct sockaddr, not struct socka

CVE-2024-27410 [MEDIUM] CVE-2024-27410: In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject iftype ch In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject iftype change with mesh ID change It's currently possible to change the mesh ID when the interface isn't yet in mesh mode, at the same time as changing it into mesh mode. This leads to an overwrite of data in the wdev->u union for the interface type it currently has,

CVE-2024-26675 [MEDIUM] CWE-770 CVE-2024-26675: In the Linux kernel, the following vulnerability has been resolved: ppp_async: limit MRU to 64K sy In the Linux kernel, the following vulnerability has been resolved: ppp_async: limit MRU to 64K syzbot triggered a warning [1] in __alloc_pages(): WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp) Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K") Adopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU) [1]: WARNING: C

CVE-2024-26906 [MEDIUM] CVE-2024-26906: In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disallow vsyscall page In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() When trying to use copy_from_kernel_nofault() to read vsyscall page through a bpf program, the following oops was reported: BUG: unable to handle page fault for address: ffffffffff600000 #PF: supervisor read access in kerne

CVE-2023-4132 [MEDIUM] CWE-416 CVE-2023-4132: A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occ A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition.

CVE-2024-35973 [MEDIUM] CWE-908 CVE-2024-35973: In the Linux kernel, the following vulnerability has been resolved: geneve: fix header validation i In the Linux kernel, the following vulnerability has been resolved: geneve: fix header validation in geneve[6]_xmit_skb syzbot is able to trigger an uninit-value in geneve_xmit() [1] Problem : While most ip tunnel helpers (like ip_tunnel_get_dsfield()) uses skb_protocol(skb, true), pskb_inet_may_pull() is only using skb->protocol. If anything els

CVE-2025-37875 [MEDIUM] CVE-2025-37875: In the Linux kernel, the following vulnerability has been resolved: igc: fix PTM cycle trigger logi In the Linux kernel, the following vulnerability has been resolved: igc: fix PTM cycle trigger logic Writing to clear the PTM status 'valid' bit while the PTM cycle is triggered results in unreliable PTM operation. To fix this, clear the PTM 'trigger' and status after each PTM transaction. The issue can be reproduced with the following: $ sudo phc2sys -R

CVE-2024-26863 [MEDIUM] CWE-908 CVE-2024-26863: In the Linux kernel, the following vulnerability has been resolved: hsr: Fix uninit-value access in In the Linux kernel, the following vulnerability has been resolved: hsr: Fix uninit-value access in hsr_get_node() KMSAN reported the following uninit-value access issue [1]: BUG: KMSAN: uninit-value in hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246 hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246 fill_frame_info net/hsr/hsr_forward.c:577

CVE-2025-37865 [MEDIUM] CWE-908 CVE-2025-37865: In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: fix -ENOEN In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported Russell King reports that on the ZII dev rev B, deleting a bridge VLAN from a user port fails with -ENOENT: https://lore.kernel.org/netdev/[email protected]/ This comes from mv88e6xxx_

CVE-2025-37889 [MEDIUM] CVE-2025-37889: In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Consistently treat p In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Consistently treat platform_max as control value This reverts commit 9bdd10d57a88 ("ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min"), and makes some additional related updates. There are two ways the platform_max could be interpreted; the maximum register value,

CVE-2024-27059 [MEDIUM] CWE-369 CVE-2024-27059: In the Linux kernel, the following vulnerability has been resolved: USB: usb-storage: Prevent divid In the Linux kernel, the following vulnerability has been resolved: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values in the ATA ID information to calculate cylinder and head values when creating a CDB for READ or WRITE commands. The calculation involves division

CVE-2024-26935 [MEDIUM] CVE-2024-26935: In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix unremoved procf In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix unremoved procfs host directory regression Commit fc663711b944 ("scsi: core: Remove the /proc/scsi/${proc_name} directory earlier") fixed a bug related to modules loading/unloading, by adding a call to scsi_proc_hostdir_rm() on scsi_remove_host(). But that led to a potentia

CVE-2024-26805 [MEDIUM] CWE-908 CVE-2024-26805: In the Linux kernel, the following vulnerability has been resolved: netlink: Fix kernel-infoleak-af In the Linux kernel, the following vulnerability has been resolved: netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter syzbot reported the following uninit-value access issue [1]: netlink_to_full_skb() creates a new `skb` and puts the `skb->data` passed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data size is specified as

CVE-2024-26645 [MEDIUM] CVE-2024-26645: In the Linux kernel, the following vulnerability has been resolved: tracing: Ensure visibility when In the Linux kernel, the following vulnerability has been resolved: tracing: Ensure visibility when inserting an element into tracing_map Running the following two commands in parallel on a multi-processor AArch64 machine can sporadically produce an unexpected warning about duplicate histogram entries: $ while true; do echo hist:key=id.syscall:val=hitcoun

CVE-2024-36957 [MEDIUM] CWE-193 CVE-2024-36957: In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: avoid off-by-one In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: avoid off-by-one read from userspace We try to access count + 1 byte from userspace with memdup_user(buffer, count + 1). However, the userspace only provides buffer of count bytes and only these count bytes are verified to be okay to access. To ensure the copied buffer

CVE-2024-26825 [MEDIUM] CWE-459 CVE-2024-26825: In the Linux kernel, the following vulnerability has been resolved: nfc: nci: free rx_data_reassemb In the Linux kernel, the following vulnerability has been resolved: nfc: nci: free rx_data_reassembly skb on NCI device cleanup rx_data_reassembly skb is stored during NCI data exchange for processing fragmented packets. It is dropped only when the last fragment is processed or when an NTF packet with NCI_OP_RF_DEACTIVATE_NTF opcode is received. Ho