Debian Linux vulnerabilities

CVE-2025-38371 [MEDIUM] CWE-476 CVE-2025-38371: In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Disable interrupts bef In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Disable interrupts before resetting the GPU Currently, an interrupt can be triggered during a GPU reset, which can lead to GPU hangs and NULL pointer dereference in an interrupt context as shown in the following trace: [ 314.035040] Unable to handle kernel NULL pointer de

CVE-2025-38090 [MEDIUM] CVE-2025-38090: In the Linux kernel, the following vulnerability has been resolved: drivers/rapidio/rio_cm.c: preve In the Linux kernel, the following vulnerability has been resolved: drivers/rapidio/rio_cm.c: prevent possible heap overwrite In riocm_cdev_ioctl(RIO_CM_CHAN_SEND) -> cm_chan_msg_send() -> riocm_ch_send() cm_chan_msg_send() checks that userspace didn't send too much data but riocm_ch_send() failed to check that userspace sent sufficient data. The result

CVE-2015-3219 [MEDIUM] CWE-79 CVE-2015-3219: Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard ( Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.

CVE-2025-38478 [MEDIUM] CWE-908 CVE-2025-38478: In the Linux kernel, the following vulnerability has been resolved: comedi: Fix initialization of d In the Linux kernel, the following vulnerability has been resolved: comedi: Fix initialization of data for instructions that write to subdevice Some Comedi subdevice instruction handlers are known to access instruction data elements beyond the first `insn->n` elements in some cases. The `do_insn_ioctl()` and `do_insnlist_ioctl()` functions allocate

CVE-2025-38473 [MEDIUM] CWE-476 CVE-2025-38473: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix null-ptr-deref i In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() syzbot reported null-ptr-deref in l2cap_sock_resume_cb(). [0] l2cap_sock_resume_cb() has a similar problem that was fixed by commit 1bff51ea59a9 ("Bluetooth: fix use-after-free error in lock_sock_nested()"). Since both l2cap

CVE-2025-38691 [MEDIUM] CWE-908 CVE-2025-38691: In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encoding extents, the "layoutupdate_pages" page array is initialized only after the retry loop. Bu

CVE-2025-38480 [MEDIUM] CWE-908 CVE-2025-38480: In the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialize In the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized data in insn_rw_emulate_bits() For Comedi `INSN_READ` and `INSN_WRITE` instructions on "digital" subdevices (subdevice types `COMEDI_SUBD_DI`, `COMEDI_SUBD_DO`, and `COMEDI_SUBD_DIO`), it is common for the subdevice driver not to have `insn_read` an

CVE-2025-38455 [MEDIUM] CWE-476 CVE-2025-38455: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Reject SEV{-ES} intra In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight Reject migration of SEV{-ES} state if either the source or destination VM is actively creating a vCPU, i.e. if kvm_vm_ioctl_create_vcpu() is in the section between incrementing created_vcpus and online_vcp

CVE-2025-38577 [MEDIUM] CWE-416 CVE-2025-38577: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid panic in f2f In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid panic in f2fs_evict_inode As syzbot [1] reported as below: R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffe17473450 R13: 00007f28b1c10854 R14: 000000000000dae5 R15: 00007ffe17474520 ---[ end trace 0000000000000000 ]--- BUG: KASAN: use-after-free in __l

CVE-2025-38262 [MEDIUM] CWE-476 CVE-2025-38262: In the Linux kernel, the following vulnerability has been resolved: tty: serial: uartlite: register In the Linux kernel, the following vulnerability has been resolved: tty: serial: uartlite: register uart driver in init When two instances of uart devices are probing, a concurrency race can occur. If one thread calls uart_register_driver function, which first allocates and assigns memory to 'uart_state' member of uart_driver structure, the other i

CVE-2025-38229 [MEDIUM] CWE-908 CVE-2025-38229: In the Linux kernel, the following vulnerability has been resolved: media: cxusb: no longer judge r In the Linux kernel, the following vulnerability has been resolved: media: cxusb: no longer judge rbuf when the write fails syzbot reported a uninit-value in cxusb_i2c_xfer. [1] Only when the write operation of usb_bulk_msg() in dvb_usb_generic_rw() succeeds and rlen is greater than 0, the read operation of usb_bulk_msg() will be executed to read

CVE-2025-38222 [MEDIUM] CWE-190 CVE-2025-38222: In the Linux kernel, the following vulnerability has been resolved: ext4: inline: fix len overflow In the Linux kernel, the following vulnerability has been resolved: ext4: inline: fix len overflow in ext4_prepare_inline_data When running the following code on an ext4 filesystem with inline_data feature enabled, it will lead to the bug below. fd = open("file1", O_RDWR | O_CREAT | O_TRUNC, 0666); ftruncate(fd, 30); pwrite(fd, "a", 1, (1UL EXT4_I(

CVE-2025-38219 [MEDIUM] CVE-2025-38219: In the Linux kernel, the following vulnerability has been resolved: f2fs: prevent kernel warning du In the Linux kernel, the following vulnerability has been resolved: f2fs: prevent kernel warning due to negative i_nlink from corrupted image WARNING: CPU: 1 PID: 9426 at fs/inode.c:417 drop_nlink+0xac/0xd0 home/cc/linux/fs/inode.c:417 Modules linked in: CPU: 1 UID: 0 PID: 9426 Comm: syz-executor568 Not tainted 6.14.0-12627-g94d471a4f428 #2 PREEMPT(full) H

CVE-2025-38614 [MEDIUM] CWE-674 CVE-2025-38614: In the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded r In the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some recursion depth checks, but those recursion depth checks don't limit the d

CVE-2025-39756 [MEDIUM] CWE-401 CVE-2025-39756: In the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor tab In the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INT_MAX When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceed INT_MA

CVE-2025-38684 [MEDIUM] CWE-476 CVE-2025-38684: In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: use old 'nbands In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: use old 'nbands' while purging unused classes Shuang reported sch_ets test-case [1] crashing in ets_class_qlen_notify() after recent changes from Lion [2]. The problem is: in ets_qdisc_change() we purge unused DWRR queues; the value of 'q->nbands' is the new one, an

CVE-2025-38581 [MEDIUM] CWE-476 CVE-2025-38581: In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix crash when re In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix crash when rebind ccp device for ccp.ko When CONFIG_CRYPTO_DEV_CCP_DEBUGFS is enabled, rebinding the ccp device causes the following crash: $ echo '0000:0a:00.2' > /sys/bus/pci/drivers/ccp/unbind $ echo '0000:0a:00.2' > /sys/bus/pci/drivers/ccp/bind [ 204.976930

CVE-2025-38063 [MEDIUM] CVE-2025-38063: In the Linux kernel, the following vulnerability has been resolved: dm: fix unconditional IO thrott In the Linux kernel, the following vulnerability has been resolved: dm: fix unconditional IO throttle caused by REQ_PREFLUSH When a bio with REQ_PREFLUSH is submitted to dm, __send_empty_flush() generates a flush_bio with REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC, which causes the flush_bio to be throttled by wbt_wait(). An example from v5.4, similar problem

CVE-2025-38516 [MEDIUM] CWE-476 CVE-2025-38516: In the Linux kernel, the following vulnerability has been resolved: pinctrl: qcom: msm: mark certai In the Linux kernel, the following vulnerability has been resolved: pinctrl: qcom: msm: mark certain pins as invalid for interrupts On some platforms, the UFS-reset pin has no interrupt logic in TLMM but is nevertheless registered as a GPIO in the kernel. This enables the user-space to trigger a BUG() in the pinctrl-msm driver by running, for examp

CVE-2025-39752 [MEDIUM] CVE-2025-39752: In the Linux kernel, the following vulnerability has been resolved: ARM: rockchip: fix kernel hang In the Linux kernel, the following vulnerability has been resolved: ARM: rockchip: fix kernel hang during smp initialization In order to bring up secondary CPUs main CPU write trampoline code to SRAM. The trampoline code is written while secondary CPUs are powered on (at least that true for RK3188 CPU). Sometimes that leads to kernel hang. Probably because