Debian Linux vulnerabilities

CVE-2025-38034 [MEDIUM] CWE-476 CVE-2025-38034: In the Linux kernel, the following vulnerability has been resolved: btrfs: correct the order of pre In the Linux kernel, the following vulnerability has been resolved: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref btrfs_prelim_ref() calls the old and new reference variables in the incorrect order. This causes a NULL pointer dereference because oldref is passed as NULL to trace_btrfs_prelim_ref_insert(). Note, trace_btrfs_

CVE-2025-38332 [MEDIUM] CVE-2025-38332: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BI In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BIOS version The strlcat() with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is passed in. Anyway, instead of memset() with 0 followed by a strlcat(), just use memcpy() and ensu

CVE-2025-38424 [MEDIUM] CVE-2025-38424: In the Linux kernel, the following vulnerability has been resolved: perf: Fix sample vs do_exit() In the Linux kernel, the following vulnerability has been resolved: perf: Fix sample vs do_exit() Baisheng Gao reported an ARM64 crash, which Mark decoded as being a synchronous external abort -- most likely due to trying to access MMIO in bad ways. The crash further shows perf trying to do a user stack sample while in exit_mmap()'s tlb_finish_mmu() -- i.e.

CVE-2025-38324 [MEDIUM] CVE-2025-38324: In the Linux kernel, the following vulnerability has been resolved: mpls: Use rcu_dereference_rtnl( In the Linux kernel, the following vulnerability has been resolved: mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). As syzbot reported [0], mpls_route_input_rcu() can be called from mpls_getroute(), where is under RTNL. net->mpls.platform_label is only updated under RTNL. Let's use rcu_dereference_rtnl() in mpls_route_input_rcu() to silence t

CVE-2025-38200 [MEDIUM] CWE-191 CVE-2025-38200: In the Linux kernel, the following vulnerability has been resolved: i40e: fix MMIO write access to In the Linux kernel, the following vulnerability has been resolved: i40e: fix MMIO write access to an invalid page in i40e_clear_hw When the device sends a specific input, an integer underflow can occur, leading to MMIO write access to an invalid page. Prevent the integer underflow by changing the type of related variables.

CVE-2025-23147 [MEDIUM] CWE-476 CVE-2025-23147: In the Linux kernel, the following vulnerability has been resolved: i3c: Add NULL pointer check in In the Linux kernel, the following vulnerability has been resolved: i3c: Add NULL pointer check in i3c_master_queue_ibi() The I3C master driver may receive an IBI from a target device that has not been probed yet. In such cases, the master calls `i3c_master_queue_ibi()` to queue an IBI work task, leading to "Unable to handle kernel read from unreada

CVE-2025-23141 [MEDIUM] CVE-2025-23141: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Acquire SRCU in KVM_G In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses Acquire a lock on kvm->srcu when userspace is getting MP state to handle a rather extreme edge case where "accepting" APIC events, i.e. processing pending INIT or SIPI, can trigger accesses to guest memory. If the

CVE-2025-37905 [MEDIUM] CWE-401 CVE-2025-37905: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Balance dev In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Balance device refcount when destroying devices Using device_find_child() to lookup the proper SCMI device to destroy causes an unbalance in device refcount, since device_find_child() calls an implicit get_device(): this, in turns, inhibits the call of the provi

CVE-2025-38386 [MEDIUM] CWE-416 CVE-2025-38386: In the Linux kernel, the following vulnerability has been resolved: ACPICA: Refuse to evaluate a me In the Linux kernel, the following vulnerability has been resolved: ACPICA: Refuse to evaluate a method if arguments are missing As reported in [1], a platform firmware update that increased the number of method parameters and forgot to update a least one of its callers, caused ACPICA to crash due to use-after-free. Since this a result of a clear

CVE-2025-38193 [MEDIUM] CWE-190 CVE-2025-38193: In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: reject inva In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: reject invalid perturb period Gerrard Tai reported that SFQ perturb_period has no range check yet, and this can be used to trigger a race condition fixed in a separate patch. We want to make sure ctl->perturb_period * HZ will not overflow and is positive. tc

CVE-2025-37964 [MEDIUM] CVE-2025-37964: In the Linux kernel, the following vulnerability has been resolved: x86/mm: Eliminate window where In the Linux kernel, the following vulnerability has been resolved: x86/mm: Eliminate window where TLB flushes may be inadvertently skipped tl;dr: There is a window in the mm switching code where the new CR3 is set and the CPU should be getting TLB flushes for the new mm. But should_flush_tlb() has a bug and suppresses the flush. Fix it by widening the wind

CVE-2025-37781 [MEDIUM] CWE-476 CVE-2025-37781: In the Linux kernel, the following vulnerability has been resolved: i2c: cros-ec-tunnel: defer prob In the Linux kernel, the following vulnerability has been resolved: i2c: cros-ec-tunnel: defer probe if parent EC is not present When i2c-cros-ec-tunnel and the EC driver are built-in, the EC parent device will not be found, leading to NULL pointer dereference. That can also be reproduced by unbinding the controller driver and then loading i2c-cro

CVE-2025-38470 [MEDIUM] CVE-2025-38470: In the Linux kernel, the following vulnerability has been resolved: net: vlan: fix VLAN 0 refcount In the Linux kernel, the following vulnerability has been resolved: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime Assuming the "rx-vlan-filter" feature is enabled on a net device, the 8021q module will automatically add or remove VLAN 0 when the net device is put administratively up or down, respectively. There are a couple o

CVE-2025-38086 [MEDIUM] CWE-908 CVE-2025-38086: In the Linux kernel, the following vulnerability has been resolved: net: ch9200: fix uninitialised In the Linux kernel, the following vulnerability has been resolved: net: ch9200: fix uninitialised access during mii_nway_restart In mii_nway_restart() the code attempts to call mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read() utilises a local buffer called "buff", which is initialised with control_read(). However "buff" is conditional

CVE-2025-37929 [MEDIUM] CWE-476 CVE-2025-37929: In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Add missing sent In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays Commit a5951389e58d ("arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists") added some additional CPUs to the Spectre-BHB workaround, including some new arrays for designs that require new 'k' v

CVE-2024-26984 [MEDIUM] CWE-362 CVE-2024-26984: In the Linux kernel, the following vulnerability has been resolved: nouveau: fix instmem race condi In the Linux kernel, the following vulnerability has been resolved: nouveau: fix instmem race condition around ptr stores Running a lot of VK CTS in parallel against nouveau, once every few hours you might see something like this crash. BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD 8000000114e6e067 P4D 8000000114e6e067 PUD 10

CVE-2015-4858 [MEDIUM] CVE-2015-4858: Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2015-4913.

CVE-2025-38185 [MEDIUM] CWE-401 CVE-2025-38185: In the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Free invalid lengt In the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Free invalid length skb in atmtcp_c_send(). syzbot reported the splat below. [0] vcc_sendmsg() copies data passed from userspace to skb and passes it to vcc->dev->ops->send(). atmtcp_c_send() accesses skb->data as struct atmtcp_hdr after checking if skb->len is 0, bu

CVE-2025-38465 [MEDIUM] CWE-401 CVE-2025-38465: In the Linux kernel, the following vulnerability has been resolved: netlink: Fix wraparounds of sk- In the Linux kernel, the following vulnerability has been resolved: netlink: Fix wraparounds of sk->sk_rmem_alloc. Netlink has this pattern in some places if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) atomic_add(skb->truesize, &sk->sk_rmem_alloc); , which has the same problem fixed by commit 5a465a0da13e ("udp: Fix multiple wraparounds of

CVE-2025-38336 [MEDIUM] CVE-2025-38336: In the Linux kernel, the following vulnerability has been resolved: ata: pata_via: Force PIO for AT In the Linux kernel, the following vulnerability has been resolved: ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 The controller has a hardware bug that can hard hang the system when doing ATAPI DMAs without any trace of what happened. Depending on the device attached, it can also prevent the system from booting. In this case, the system han