Debian Linux vulnerabilities

CVE-2025-38491 [MEDIUM] CWE-667 CVE-2025-38491: In the Linux kernel, the following vulnerability has been resolved: mptcp: make fallback action and In the Linux kernel, the following vulnerability has been resolved: mptcp: make fallback action and fallback decision atomic Syzkaller reported the following splat: WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_do_fallback n

CVE-2025-37781 [MEDIUM] CWE-476 CVE-2025-37781: In the Linux kernel, the following vulnerability has been resolved: i2c: cros-ec-tunnel: defer prob In the Linux kernel, the following vulnerability has been resolved: i2c: cros-ec-tunnel: defer probe if parent EC is not present When i2c-cros-ec-tunnel and the EC driver are built-in, the EC parent device will not be found, leading to NULL pointer dereference. That can also be reproduced by unbinding the controller driver and then loading i2c-cro

CVE-2025-38194 [MEDIUM] CVE-2025-38194: In the Linux kernel, the following vulnerability has been resolved: jffs2: check that raw node were In the Linux kernel, the following vulnerability has been resolved: jffs2: check that raw node were preallocated before writing summary Syzkaller detected a kernel bug in jffs2_link_node_ref, caused by fault injection in jffs2_prealloc_raw_node_refs. jffs2_sum_write_sumnode doesn't check return value of jffs2_prealloc_raw_node_refs and simply lets any erro

CVE-2025-38577 [MEDIUM] CWE-416 CVE-2025-38577: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid panic in f2f In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid panic in f2fs_evict_inode As syzbot [1] reported as below: R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffe17473450 R13: 00007f28b1c10854 R14: 000000000000dae5 R15: 00007ffe17474520 ---[ end trace 0000000000000000 ]--- BUG: KASAN: use-after-free in __l

CVE-2015-1244 [MEDIUM] CWE-200 CVE-2015-1244: The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0. The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for WebSocket traffic.

CVE-2025-38324 [MEDIUM] CVE-2025-38324: In the Linux kernel, the following vulnerability has been resolved: mpls: Use rcu_dereference_rtnl( In the Linux kernel, the following vulnerability has been resolved: mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). As syzbot reported [0], mpls_route_input_rcu() can be called from mpls_getroute(), where is under RTNL. net->mpls.platform_label is only updated under RTNL. Let's use rcu_dereference_rtnl() in mpls_route_input_rcu() to silence t

CVE-2025-38400 [MEDIUM] CVE-2025-38400: In the Linux kernel, the following vulnerability has been resolved: nfs: Clean up /proc/net/rpc/nfs In the Linux kernel, the following vulnerability has been resolved: nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. syzbot reported a warning below [1] following a fault injection in nfs_fs_proc_net_init(). [0] When nfs_fs_proc_net_init() fails, /proc/net/rpc/nfs is not removed. Later, rpc_proc_exit() tries to remove /proc/net/rpc, and

CVE-2025-38424 [MEDIUM] CVE-2025-38424: In the Linux kernel, the following vulnerability has been resolved: perf: Fix sample vs do_exit() In the Linux kernel, the following vulnerability has been resolved: perf: Fix sample vs do_exit() Baisheng Gao reported an ARM64 crash, which Mark decoded as being a synchronous external abort -- most likely due to trying to access MMIO in bad ways. The crash further shows perf trying to do a user stack sample while in exit_mmap()'s tlb_finish_mmu() -- i.e.

CVE-2025-38691 [MEDIUM] CWE-908 CVE-2025-38691: In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encoding extents, the "layoutupdate_pages" page array is initialized only after the retry loop. Bu

CVE-2025-37949 [MEDIUM] CWE-476 CVE-2025-37949: In the Linux kernel, the following vulnerability has been resolved: xenbus: Use kref to track req l In the Linux kernel, the following vulnerability has been resolved: xenbus: Use kref to track req lifetime Marek reported seeing a NULL pointer fault in the xenbus_thread callstack: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: e030:__wake_up_common+0x4c/0x180 Call Trace: __wake_up_common_lock+0x82/0xd0 process_msg+0x18e/0x2

CVE-2025-38386 [MEDIUM] CWE-416 CVE-2025-38386: In the Linux kernel, the following vulnerability has been resolved: ACPICA: Refuse to evaluate a me In the Linux kernel, the following vulnerability has been resolved: ACPICA: Refuse to evaluate a method if arguments are missing As reported in [1], a platform firmware update that increased the number of method parameters and forgot to update a least one of its callers, caused ACPICA to crash due to use-after-free. Since this a result of a clear

CVE-2025-38034 [MEDIUM] CWE-476 CVE-2025-38034: In the Linux kernel, the following vulnerability has been resolved: btrfs: correct the order of pre In the Linux kernel, the following vulnerability has been resolved: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref btrfs_prelim_ref() calls the old and new reference variables in the incorrect order. This causes a NULL pointer dereference because oldref is passed as NULL to trace_btrfs_prelim_ref_insert(). Note, trace_btrfs_

CVE-2025-37958 [MEDIUM] CWE-476 CVE-2025-37958: In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix dereferenci In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix dereferencing invalid pmd migration entry When migrating a THP, concurrent access to the PMD migration entry during a deferred split scan can lead to an invalid address access, as illustrated below. To prevent this invalid access, it is necessary to check the PM

CVE-2025-38684 [MEDIUM] CWE-476 CVE-2025-38684: In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: use old 'nbands In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: use old 'nbands' while purging unused classes Shuang reported sch_ets test-case [1] crashing in ets_class_qlen_notify() after recent changes from Lion [2]. The problem is: in ets_qdisc_change() we purge unused DWRR queues; the value of 'q->nbands' is the new one, an

CVE-2025-38622 [MEDIUM] CVE-2025-38622: In the Linux kernel, the following vulnerability has been resolved: net: drop UFO packets in udp_rc In the Linux kernel, the following vulnerability has been resolved: net: drop UFO packets in udp_rcv_segment() When sending a packet with virtio_net_hdr to tun device, if the gso_type in virtio_net_hdr is SKB_GSO_UDP and the gso_size is less than udphdr size, below crash may happen. ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:4572

CVE-2025-38614 [MEDIUM] CWE-674 CVE-2025-38614: In the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded r In the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some recursion depth checks, but those recursion depth checks don't limit the d

CVE-2025-38193 [MEDIUM] CWE-190 CVE-2025-38193: In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: reject inva In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: reject invalid perturb period Gerrard Tai reported that SFQ perturb_period has no range check yet, and this can be used to trigger a race condition fixed in a separate patch. We want to make sure ctl->perturb_period * HZ will not overflow and is positive. tc

CVE-2015-1261 [MEDIUM] CWE-20 CVE-2015-1261: android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0. android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier during construction of a page-info popup, which allows remote attackers to spoof the URL bar or deliver misleading popup content via crafted text.

CVE-2025-38332 [MEDIUM] CVE-2025-38332: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BI In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BIOS version The strlcat() with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is passed in. Anyway, instead of memset() with 0 followed by a strlcat(), just use memcpy() and ensu

CVE-2025-38698 [MEDIUM] CVE-2025-38698: In the Linux kernel, the following vulnerability has been resolved: jfs: Regular file corruption ch In the Linux kernel, the following vulnerability has been resolved: jfs: Regular file corruption check The reproducer builds a corrupted file on disk with a negative i_size value. Add a check when opening this file to avoid subsequent operation failures.