Debian Linux vulnerabilities

CVE-2024-35830 [MEDIUM] CVE-2024-35830: In the Linux kernel, the following vulnerability has been resolved: media: tc358743: register v4l2 In the Linux kernel, the following vulnerability has been resolved: media: tc358743: register v4l2 async device only after successful setup Ensure the device has been setup correctly before registering the v4l2 async device, thus allowing userspace to access.

CVE-2024-27437 [MEDIUM] CVE-2024-27437: In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Disable auto-enable o In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Disable auto-enable of exclusive INTx IRQ Currently for devices requiring masking at the irqchip for INTx, ie. devices without DisINTx support, the IRQ is enabled in request_irq() and subsequently disabled as necessary to align with the masked status flag. This presents a window

CVE-2024-26640 [MEDIUM] CVE-2024-26640: In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx ze In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx zerocopy TCP rx zerocopy intent is to map pages initially allocated from NIC drivers, not pages owned by a fs. This patch adds to can_map_frag() these additional checks: - Page must not be a compound one. - page->mapping must be NULL. This fixes the panic re

CVE-2024-26636 [MEDIUM] CVE-2024-26636: In the Linux kernel, the following vulnerability has been resolved: llc: make llc_ui_sendmsg() more In the Linux kernel, the following vulnerability has been resolved: llc: make llc_ui_sendmsg() more robust against bonding changes syzbot was able to trick llc_ui_sendmsg(), allocating an skb with no headroom, but subsequently trying to push 14 bytes of Ethernet header [1] Like some others, llc_ui_sendmsg() releases the socket lock before calling sock_all

CVE-2024-26917 [MEDIUM] CVE-2024-26917: In the Linux kernel, the following vulnerability has been resolved: scsi: Revert "scsi: fcoe: Fix p In the Linux kernel, the following vulnerability has been resolved: scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock" This reverts commit 1a1975551943f681772720f639ff42fbaa746212. This commit causes interrupts to be lost for FCoE devices, since it changed sping locks from "bh" to "irqsave". Instead, a work queue should be used, and wil

CVE-2024-35962 [MEDIUM] CVE-2024-35962: In the Linux kernel, the following vulnerability has been resolved: netfilter: complete validation In the Linux kernel, the following vulnerability has been resolved: netfilter: complete validation of user input In my recent commit, I missed that do_replace() handlers use copy_from_sockptr() (which I fixed), followed by unsafe copy_from_sockptr_offset() calls. In all functions, we can perform the @optlen validation before even calling xt_alloc_table_inf

CVE-2024-26795 [MEDIUM] CVE-2024-26795: In the Linux kernel, the following vulnerability has been resolved: riscv: Sparse-Memory/vmemmap ou In the Linux kernel, the following vulnerability has been resolved: riscv: Sparse-Memory/vmemmap out-of-bounds fix Offset vmemmap so that the first page of vmemmap will be mapped to the first page of physical memory in order to ensure that vmemmap’s bounds will be respected during pfn_to_page()/page_to_pfn() operations. The conversion macros will produce c

CVE-2024-36005 [MEDIUM] CVE-2024-36005: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: honor tab In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: honor table dormant flag from netdev release event path Check for table dormant flag otherwise netdev release event path tries to unregister an already unregistered hook. [524854.857999] ------------[ cut here ]------------ [524854.858010] WARNING: CPU: 0 PID: 338659

CVE-2024-27431 [MEDIUM] CWE-908 CVE-2024-27431: In the Linux kernel, the following vulnerability has been resolved: cpumap: Zero-initialise xdp_rxq In the Linux kernel, the following vulnerability has been resolved: cpumap: Zero-initialise xdp_rxq_info struct before running XDP program When running an XDP program that is attached to a cpumap entry, we don't initialise the xdp_rxq_info data structure being used in the xdp_buff that backs the XDP program invocation. Tobias noticed that this lead

CVE-2024-36007 [MEDIUM] CVE-2024-36007: In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix w In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix warning during rehash As previously explained, the rehash delayed work migrates filters from one region to another. This is done by iterating over all chunks (all the filters with the same priority) in the region and in each chunk iterating over all the filter

CVE-2024-35936 [MEDIUM] CVE-2024-35936: In the Linux kernel, the following vulnerability has been resolved: btrfs: handle chunk tree lookup In the Linux kernel, the following vulnerability has been resolved: btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() The unhandled case in btrfs_relocate_sys_chunks() loop is a corruption, as it could be caused only by two impossible conditions: - at first the search key is set up to look for a chunk tree item, with offset -1, this is

CVE-2024-26644 [MEDIUM] CWE-908 CVE-2024-26644: In the Linux kernel, the following vulnerability has been resolved: btrfs: don't abort filesystem w In the Linux kernel, the following vulnerability has been resolved: btrfs: don't abort filesystem when attempting to snapshot deleted subvolume If the source file descriptor to the snapshot ioctl refers to a deleted subvolume, we get the following abort: BTRFS: Transaction aborted (error -2) WARNING: CPU: 0 PID: 833 at fs/btrfs/transaction.c:1875

CVE-2022-3169 [MEDIUM] CWE-20 CVE-2022-3169: A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive r A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting in a PCIe link disconnect.

CVE-2022-1195 [MEDIUM] CWE-362 CVE-2022-1195: A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allo A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device is detached and reclaim resources early.

CVE-2024-26727 [MEDIUM] CWE-617 CVE-2024-26727: In the Linux kernel, the following vulnerability has been resolved: btrfs: do not ASSERT() if the n In the Linux kernel, the following vulnerability has been resolved: btrfs: do not ASSERT() if the newly created subvolume already got read [BUG] There is a syzbot crash, triggered by the ASSERT() during subvolume creation: assertion failed: !anon_dev, in fs/btrfs/disk-io.c:1319 ------------[ cut here ]------------ kernel BUG at fs/btrfs/disk-io.c:

CVE-2024-26687 [MEDIUM] CWE-459 CVE-2024-26687: In the Linux kernel, the following vulnerability has been resolved: xen/events: close evtchn after In the Linux kernel, the following vulnerability has been resolved: xen/events: close evtchn after mapping cleanup shutdown_pirq and startup_pirq are not taking the irq_mapping_update_lock because they can't due to lock inversion. Both are called with the irq_desc->lock being taking. The lock order, however, is first irq_mapping_update_lock and then

CVE-2024-36006 [MEDIUM] CVE-2024-36006: In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix i In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage Both the function that migrates all the chunks within a region and the function that migrates all the entries within a chunk call list_first_entry() on the respective lists without checking that the lists are not empty. This is incorre

CVE-2024-26814 [MEDIUM] CWE-476 CVE-2024-26814: In the Linux kernel, the following vulnerability has been resolved: vfio/fsl-mc: Block calling inte In the Linux kernel, the following vulnerability has been resolved: vfio/fsl-mc: Block calling interrupt handler without trigger The eventfd_ctx trigger pointer of the vfio_fsl_mc_irq object is initially NULL and may become NULL if the user sets the trigger eventfd to -1. The interrupt handler itself is guaranteed that trigger is always valid betwe

CVE-2024-26702 [MEDIUM] CWE-125 CVE-2024-26702: In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: rm3100: add In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC Recently, we encounter kernel crash in function rm3100_common_probe caused by out of bound access of array rm3100_samp_rates (because of underlying hardware failures). Add boundary check to prevent

CVE-2025-38003 [MEDIUM] CVE-2025-38003: In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu read In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu read protection for procfs content When the procfs content is generated for a bcm_op which is in the process to be removed the procfs output might show unreliable data (UAF). As the removal of bcm_op's is already implemented with rcu handling this patch adds the m