Debian Linux vulnerabilities

CVE-2024-26825 [MEDIUM] CWE-459 CVE-2024-26825: In the Linux kernel, the following vulnerability has been resolved: nfc: nci: free rx_data_reassemb In the Linux kernel, the following vulnerability has been resolved: nfc: nci: free rx_data_reassembly skb on NCI device cleanup rx_data_reassembly skb is stored during NCI data exchange for processing fragmented packets. It is dropped only when the last fragment is processed or when an NTF packet with NCI_OP_RF_DEACTIVATE_NTF opcode is received. Ho

CVE-2024-35893 [MEDIUM] CWE-908 CVE-2024-35893: In the Linux kernel, the following vulnerability has been resolved: net/sched: act_skbmod: prevent In the Linux kernel, the following vulnerability has been resolved: net/sched: act_skbmod: prevent kernel-infoleak syzbot found that tcf_skbmod_dump() was copying four bytes from kernel stack to user space [1]. The issue here is that 'struct tc_skbmod' has a four bytes hole. We need to clear the structure before filling fields. [1] BUG: KMSAN: ke

CVE-2024-35944 [MEDIUM] CVE-2024-35944: In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix memcpy() run-time war In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() Syzkaller hit 'WARNING in dg_dispatch_as_host' bug. memcpy: detected field-spanning write (size 56) of single field "&dg_info->msg" at drivers/misc/vmw_vmci/vmci_datagram.c:237 (size 24) WARNING: CPU: 0 PID: 1555 at drivers/mis

CVE-2024-36939 [MEDIUM] CVE-2024-36939: In the Linux kernel, the following vulnerability has been resolved: nfs: Handle error of rpc_proc_r In the Linux kernel, the following vulnerability has been resolved: nfs: Handle error of rpc_proc_register() in nfs_net_init(). syzkaller reported a warning [0] triggered while destroying immature netns. rpc_proc_register() was called in init_nfs_fs(), but its error has been ignored since at least the initial commit 1da177e4c3f4 ("Linux-2.6.12-rc2"). Rec

CVE-2024-26835 [MEDIUM] CVE-2024-26835: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: set dorma In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: set dormant flag on hook register failure We need to set the dormant flag again if we fail to register the hooks. During memory pressure hook registration can fail and we end up with a table marked as active but no registered hooks. On table/base chain deletion, nf_

CVE-2025-23150 [MEDIUM] CWE-193 CVE-2025-23150: In the Linux kernel, the following vulnerability has been resolved: ext4: fix off-by-one error in d In the Linux kernel, the following vulnerability has been resolved: ext4: fix off-by-one error in do_split Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split. BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 25

CVE-2024-35822 [MEDIUM] CVE-2024-35822: In the Linux kernel, the following vulnerability has been resolved: usb: udc: remove warning when q In the Linux kernel, the following vulnerability has been resolved: usb: udc: remove warning when queue disabled ep It is possible trigger below warning message from mass storage function, WARNING: CPU: 6 PID: 3839 at drivers/usb/gadget/udc/core.c:294 usb_ep_queue+0x7c/0x104 pc : usb_ep_queue+0x7c/0x104 lr : fsg_main_thread+0x494/0x1b3c Root cause is mas

CVE-2024-35825 [MEDIUM] CVE-2024-35825: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Fix handling In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Fix handling of zero block length packets While connecting to a Linux host with CDC_NCM_NTB_DEF_SIZE_TX set to 65536, it has been observed that we receive short packets, which come at interval of 5-10 seconds sometimes and have block length zero but still contain 1-2 valid

CVE-2025-38194 [MEDIUM] CVE-2025-38194: In the Linux kernel, the following vulnerability has been resolved: jffs2: check that raw node were In the Linux kernel, the following vulnerability has been resolved: jffs2: check that raw node were preallocated before writing summary Syzkaller detected a kernel bug in jffs2_link_node_ref, caused by fault injection in jffs2_prealloc_raw_node_refs. jffs2_sum_write_sumnode doesn't check return value of jffs2_prealloc_raw_node_refs and simply lets any erro

CVE-2023-52635 [MEDIUM] CWE-835 CVE-2023-52635: In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Synchronize devfr In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Synchronize devfreq_monitor_[start/stop] There is a chance if a frequent switch of the governor done in a loop result in timer list corruption where timer cancel being done from two place one from cancel_delayed_work_sync() and followed by expire_timers() can be seen

CVE-2025-37958 [MEDIUM] CWE-476 CVE-2025-37958: In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix dereferenci In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix dereferencing invalid pmd migration entry When migrating a THP, concurrent access to the PMD migration entry during a deferred split scan can lead to an invalid address access, as illustrated below. To prevent this invalid access, it is necessary to check the PM

CVE-2024-35796 [MEDIUM] CWE-476 CVE-2024-35796: In the Linux kernel, the following vulnerability has been resolved: net: ll_temac: platform_get_res In the Linux kernel, the following vulnerability has been resolved: net: ll_temac: platform_get_resource replaced by wrong function The function platform_get_resource was replaced with devm_platform_ioremap_resource_byname and is called using 0 as name. This eventually ends up in platform_get_resource_byname in the call stack, where it causes a nu

CVE-2025-38147 [MEDIUM] CWE-476 CVE-2025-38147: In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso fun In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AF_INET sk. syzkaller reported a null-ptr-deref in txopt_get(). [0] The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there. However, this never happens for IPv6 sockets as inet_sk(sk)->pinet

CVE-2025-23159 [MEDIUM] CWE-787 CVE-2025-23159: In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add a check In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add a check to handle OOB in sfr region sfr->buf_size is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to allocated size for such cases.

CVE-2023-52627 [MEDIUM] CWE-476 CVE-2023-52627: In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7091r: Allow users In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7091r: Allow users to configure device events AD7091R-5 devices are supported by the ad7091r-5 driver together with the ad7091r-base driver. Those drivers declared iio events for notifying user space when ADC readings fall bellow the thresholds of low limit registers or

CVE-2025-39827 [MEDIUM] CVE-2025-39827: In the Linux kernel, the following vulnerability has been resolved: net: rose: include node referen In the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in rose_neigh refcount Current implementation maintains two separate reference counting mechanisms: the 'count' field in struct rose_neigh tracks references from rose_node structures, while the 'use' field (now refcount_t) tracks references from rose_sock

CVE-2022-42328 [MEDIUM] CWE-667 CVE-2022-42328: Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-4232

CVE-2025-38400 [MEDIUM] CVE-2025-38400: In the Linux kernel, the following vulnerability has been resolved: nfs: Clean up /proc/net/rpc/nfs In the Linux kernel, the following vulnerability has been resolved: nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. syzbot reported a warning below [1] following a fault injection in nfs_fs_proc_net_init(). [0] When nfs_fs_proc_net_init() fails, /proc/net/rpc/nfs is not removed. Later, rpc_proc_exit() tries to remove /proc/net/rpc, and

CVE-2024-35902 [MEDIUM] CWE-476 CVE-2024-35902: In the Linux kernel, the following vulnerability has been resolved: net/rds: fix possible cp null d In the Linux kernel, the following vulnerability has been resolved: net/rds: fix possible cp null dereference cp might be null, calling cp->cp_conn would produce null dereference [Simon Horman adds:] Analysis: * cp is a parameter of __rds_rdma_map and is not reassigned. * The following call-sites pass a NULL cp argument to __rds_rdma_map() - r

CVE-2022-42329 [MEDIUM] CVE-2022-42329: Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Addi