Debian Linux vulnerabilities

CVE-2024-26966 [MEDIUM] CWE-129 CVE-2024-26966: In the Linux kernel, the following vulnerability has been resolved: clk: qcom: mmcc-apq8084: fix te In the Linux kernel, the following vulnerability has been resolved: clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed

CVE-2024-26969 [MEDIUM] CWE-129 CVE-2024-26969: In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq8074: fix ter In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed b

CVE-2024-36020 [MEDIUM] CWE-908 CVE-2024-36020: In the Linux kernel, the following vulnerability has been resolved: i40e: fix vf may be used uninit In the Linux kernel, the following vulnerability has been resolved: i40e: fix vf may be used uninitialized in this function warning To fix the regression introduced by commit 52424f974bc5, which causes servers hang in very hard to reproduce conditions with resets races. Using two sources for the information is the root cause. In this function befor

CVE-2024-26973 [MEDIUM] CWE-908 CVE-2024-26973: In the Linux kernel, the following vulnerability has been resolved: fat: fix uninitialized field in In the Linux kernel, the following vulnerability has been resolved: fat: fix uninitialized field in nostale filehandles When fat_encode_fh_nostale() encodes file handle without a parent it stores only first 10 bytes of the file handle. However the length of the file handle must be a multiple of 4 so the file handle is actually 12 bytes long and the

CVE-2024-26744 [MEDIUM] CWE-476 CVE-2024-26744: In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Support specifying t In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Support specifying the srpt_service_guid parameter Make loading ib_srpt with this parameter set work. The current behavior is that setting that parameter while loading the ib_srpt kernel module triggers the following kernel crash: BUG: kernel NULL pointer dereference, a

CVE-2024-26778 [MEDIUM] CVE-2024-26778: In the Linux kernel, the following vulnerability has been resolved: fbdev: savage: Error out if pix In the Linux kernel, the following vulnerability has been resolved: fbdev: savage: Error out if pixclock equals zero The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may cause divide-by-zero error. Although pixclock is checked in savagefb_decode_var(), but it is not

CVE-2025-38575 [MEDIUM] CVE-2025-38575: In the Linux kernel, the following vulnerability has been resolved: ksmbd: use aead_request_free to In the Linux kernel, the following vulnerability has been resolved: ksmbd: use aead_request_free to match aead_request_alloc Use aead_request_free() instead of kfree() to properly free memory allocated by aead_request_alloc(). This ensures sensitive crypto data is zeroed before being freed.

CVE-2024-26752 [MEDIUM] CWE-131 CVE-2024-26752: In the Linux kernel, the following vulnerability has been resolved: l2tp: pass correct message leng In the Linux kernel, the following vulnerability has been resolved: l2tp: pass correct message length to ip6_append_data l2tp_ip6_sendmsg needs to avoid accounting for the transport header twice when splicing more data into an already partially-occupied skbuff. To manage this, we check whether the skbuff contains data using skb_queue_empty when de

CVE-2024-2496 [MEDIUM] CWE-476 CVE-2024-2496: A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

CVE-2024-36017 [MEDIUM] CVE-2024-36017: In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested IFLA_ In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a struct ifla_vf_vlan_info so the size of such attribute needs to be at least of sizeof(struct ifla_vf_vlan_info) which is 14 bytes. The current size validatio

CVE-2024-26663 [MEDIUM] CWE-476 CVE-2024-26663: In the Linux kernel, the following vulnerability has been resolved: tipc: Check the bearer type bef In the Linux kernel, the following vulnerability has been resolved: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() syzbot reported the following general protection fault [1]: general protection fault, probably for non-canonical address 0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000

CVE-2024-35815 [MEDIUM] CVE-2024-35815: In the Linux kernel, the following vulnerability has been resolved: fs/aio: Check IOCB_AIO_RW befor In the Linux kernel, the following vulnerability has been resolved: fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion The first kiocb_set_cancel_fn() argument may point at a struct kiocb that is not embedded inside struct aio_kiocb. With the current code, depending on the compiler, the req->ki_ctx read happens either before the IOCB_AIO_RW t

CVE-2024-36004 [MEDIUM] CVE-2024-36004: In the Linux kernel, the following vulnerability has been resolved: i40e: Do not use WQ_MEM_RECLAIM In the Linux kernel, the following vulnerability has been resolved: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue Issue reported by customer during SRIOV testing, call trace: When both i40e and the i40iw driver are loaded, a warning in check_flush_dependency is being triggered. This seems to be because of the i40e driver workqueue is allocated with th

CVE-2024-26688 [MEDIUM] CWE-476 CVE-2024-26688: In the Linux kernel, the following vulnerability has been resolved: fs,hugetlb: fix NULL pointer de In the Linux kernel, the following vulnerability has been resolved: fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super When configuring a hugetlb filesystem via the fsconfig() syscall, there is a possible NULL dereference in hugetlbfs_fill_super() caused by assigning NULL to ctx->hstate in hugetlbfs_parse_param() when the requested pag

CVE-2024-35996 [MEDIUM] CVE-2024-35996: In the Linux kernel, the following vulnerability has been resolved: cpu: Re-enable CPU mitigations In the Linux kernel, the following vulnerability has been resolved: cpu: Re-enable CPU mitigations by default for !X86 architectures Rename x86's to CPU_MITIGATIONS, define it in generic code, and force it on for all architectures exception x86. A recent commit to turn mitigations off by default if SPECULATION_MITIGATIONS=n kinda sorta missed that "cpu_miti

CVE-2024-27412 [MEDIUM] CVE-2024-27412: In the Linux kernel, the following vulnerability has been resolved: power: supply: bq27xxx-i2c: Do In the Linux kernel, the following vulnerability has been resolved: power: supply: bq27xxx-i2c: Do not free non existing IRQ The bq27xxx i2c-client may not have an IRQ, in which case client->irq will be 0. bq27xxx_battery_i2c_probe() already has an if (client->irq) check wrapping the request_threaded_irq(). But bq27xxx_battery_i2c_remove() unconditionally

CVE-2023-52622 [MEDIUM] CWE-770 CVE-2023-52622: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid online resizing fai In the Linux kernel, the following vulnerability has been resolved: ext4: avoid online resizing failures due to oversized flex bg When we online resize an ext4 filesystem with a oversized flexbg_size, mkfs.ext4 -F -G 67108864 $dev -b 4096 100M mount $dev $dir resize2fs $dev 16G the following WARN_ON is triggered: WARNING: CPU: 0 PID: 427 at mm/pa

CVE-2024-26743 [MEDIUM] CWE-770 CVE-2024-26743: In the Linux kernel, the following vulnerability has been resolved: RDMA/qedr: Fix qedr_create_user In the Linux kernel, the following vulnerability has been resolved: RDMA/qedr: Fix qedr_create_user_qp error flow Avoid the following warning by making sure to free the allocated resources in case that qedr_init_user_queue() fail. -----------[ cut here ]----------- WARNING: CPU: 0 PID: 143192 at drivers/infiniband/core/rdma_core.c:874 uverbs_destr

CVE-2024-26695 [MEDIUM] CWE-476 CVE-2024-26695: In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix null pointer In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked The SEV platform device can be shutdown with a null psp_master, e.g., using DEBUG_TEST_DRIVER_REMOVE. Found using KASAN: [ 137.148210] ccp 0000:23:00.1: enabling device (0000 -> 0002) [ 137.162647] ccp 000

CVE-2024-26635 [MEDIUM] CWE-909 CVE-2024-26635: In the Linux kernel, the following vulnerability has been resolved: llc: Drop support for ETH_P_TR_ In the Linux kernel, the following vulnerability has been resolved: llc: Drop support for ETH_P_TR_802_2. syzbot reported an uninit-value bug below. [0] llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2 (0x0011), and syzbot abused the latter to trigger the bug. write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[],