Debian Linux vulnerabilities

CVE-2022-48627 [MEDIUM] CWE-787 CVE-2022-48627: In the Linux kernel, the following vulnerability has been resolved: vt: fix memory overlapping when In the Linux kernel, the following vulnerability has been resolved: vt: fix memory overlapping when deleting chars in the buffer A memory overlapping copy occurs when deleting a long line. This memory overlapping copy can cause data corruption when scr_memcpyw is optimized to memcpy because memcpy does not ensure its behavior if the destination buf

CVE-2021-29264 [MEDIUM] CVE-2021-29264: An issue was discovered in the Linux kernel through 5.11.10. drivers/net/ethernet/freescale/gianfar. An issue was discovered in the Linux kernel through 5.11.10. drivers/net/ethernet/freescale/gianfar.c in the Freescale Gianfar Ethernet driver allows attackers to cause a system crash because a negative fragment size is calculated in situations involving an rx queue overrun when jumbo packets are used and NAPI is enabled, aka CID-d8861bab48b6.

CVE-2022-42259 [MEDIUM] CWE-190 CVE-2022-42259: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), w NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to denial of service.

CVE-2025-38575 [MEDIUM] CVE-2025-38575: In the Linux kernel, the following vulnerability has been resolved: ksmbd: use aead_request_free to In the Linux kernel, the following vulnerability has been resolved: ksmbd: use aead_request_free to match aead_request_alloc Use aead_request_free() instead of kfree() to properly free memory allocated by aead_request_alloc(). This ensures sensitive crypto data is zeroed before being freed.

CVE-2012-6136 [MEDIUM] CWE-276 CVE-2012-6136: tuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill arbitra tuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill arbitrary processes.

CVE-2024-26966 [MEDIUM] CWE-129 CVE-2024-26966: In the Linux kernel, the following vulnerability has been resolved: clk: qcom: mmcc-apq8084: fix te In the Linux kernel, the following vulnerability has been resolved: clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed

CVE-2024-26969 [MEDIUM] CWE-129 CVE-2024-26969: In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq8074: fix ter In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed b

CVE-2024-36020 [MEDIUM] CWE-908 CVE-2024-36020: In the Linux kernel, the following vulnerability has been resolved: i40e: fix vf may be used uninit In the Linux kernel, the following vulnerability has been resolved: i40e: fix vf may be used uninitialized in this function warning To fix the regression introduced by commit 52424f974bc5, which causes servers hang in very hard to reproduce conditions with resets races. Using two sources for the information is the root cause. In this function befor

CVE-2024-26973 [MEDIUM] CWE-908 CVE-2024-26973: In the Linux kernel, the following vulnerability has been resolved: fat: fix uninitialized field in In the Linux kernel, the following vulnerability has been resolved: fat: fix uninitialized field in nostale filehandles When fat_encode_fh_nostale() encodes file handle without a parent it stores only first 10 bytes of the file handle. However the length of the file handle must be a multiple of 4 so the file handle is actually 12 bytes long and the

CVE-2024-26744 [MEDIUM] CWE-476 CVE-2024-26744: In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Support specifying t In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Support specifying the srpt_service_guid parameter Make loading ib_srpt with this parameter set work. The current behavior is that setting that parameter while loading the ib_srpt kernel module triggers the following kernel crash: BUG: kernel NULL pointer dereference, a

CVE-2024-26778 [MEDIUM] CVE-2024-26778: In the Linux kernel, the following vulnerability has been resolved: fbdev: savage: Error out if pix In the Linux kernel, the following vulnerability has been resolved: fbdev: savage: Error out if pixclock equals zero The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may cause divide-by-zero error. Although pixclock is checked in savagefb_decode_var(), but it is not

CVE-2024-26777 [MEDIUM] CVE-2024-26777: In the Linux kernel, the following vulnerability has been resolved: fbdev: sis: Error out if pixclo In the Linux kernel, the following vulnerability has been resolved: fbdev: sis: Error out if pixclock equals zero The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may cause divide-by-zero error. In sisfb_check_var(), var->pixclock is used as a divisor to caculate dra

CVE-2024-2496 [MEDIUM] CWE-476 CVE-2024-2496: A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

CVE-2024-26752 [MEDIUM] CWE-131 CVE-2024-26752: In the Linux kernel, the following vulnerability has been resolved: l2tp: pass correct message leng In the Linux kernel, the following vulnerability has been resolved: l2tp: pass correct message length to ip6_append_data l2tp_ip6_sendmsg needs to avoid accounting for the transport header twice when splicing more data into an already partially-occupied skbuff. To manage this, we check whether the skbuff contains data using skb_queue_empty when de

CVE-2024-35815 [MEDIUM] CVE-2024-35815: In the Linux kernel, the following vulnerability has been resolved: fs/aio: Check IOCB_AIO_RW befor In the Linux kernel, the following vulnerability has been resolved: fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion The first kiocb_set_cancel_fn() argument may point at a struct kiocb that is not embedded inside struct aio_kiocb. With the current code, depending on the compiler, the req->ki_ctx read happens either before the IOCB_AIO_RW t

CVE-2024-36004 [MEDIUM] CVE-2024-36004: In the Linux kernel, the following vulnerability has been resolved: i40e: Do not use WQ_MEM_RECLAIM In the Linux kernel, the following vulnerability has been resolved: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue Issue reported by customer during SRIOV testing, call trace: When both i40e and the i40iw driver are loaded, a warning in check_flush_dependency is being triggered. This seems to be because of the i40e driver workqueue is allocated with th

CVE-2024-27412 [MEDIUM] CVE-2024-27412: In the Linux kernel, the following vulnerability has been resolved: power: supply: bq27xxx-i2c: Do In the Linux kernel, the following vulnerability has been resolved: power: supply: bq27xxx-i2c: Do not free non existing IRQ The bq27xxx i2c-client may not have an IRQ, in which case client->irq will be 0. bq27xxx_battery_i2c_probe() already has an if (client->irq) check wrapping the request_threaded_irq(). But bq27xxx_battery_i2c_remove() unconditionally

CVE-2024-26688 [MEDIUM] CWE-476 CVE-2024-26688: In the Linux kernel, the following vulnerability has been resolved: fs,hugetlb: fix NULL pointer de In the Linux kernel, the following vulnerability has been resolved: fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super When configuring a hugetlb filesystem via the fsconfig() syscall, there is a possible NULL dereference in hugetlbfs_fill_super() caused by assigning NULL to ctx->hstate in hugetlbfs_parse_param() when the requested pag

CVE-2024-35996 [MEDIUM] CVE-2024-35996: In the Linux kernel, the following vulnerability has been resolved: cpu: Re-enable CPU mitigations In the Linux kernel, the following vulnerability has been resolved: cpu: Re-enable CPU mitigations by default for !X86 architectures Rename x86's to CPU_MITIGATIONS, define it in generic code, and force it on for all architectures exception x86. A recent commit to turn mitigations off by default if SPECULATION_MITIGATIONS=n kinda sorta missed that "cpu_miti

CVE-2023-52622 [MEDIUM] CWE-770 CVE-2023-52622: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid online resizing fai In the Linux kernel, the following vulnerability has been resolved: ext4: avoid online resizing failures due to oversized flex bg When we online resize an ext4 filesystem with a oversized flexbg_size, mkfs.ext4 -F -G 67108864 $dev -b 4096 100M mount $dev $dir resize2fs $dev 16G the following WARN_ON is triggered: WARNING: CPU: 0 PID: 427 at mm/pa