Debian Linux vulnerabilities

CVE-2024-36919 [MEDIUM] CWE-667 CVE-2024-36919: In the Linux kernel, the following vulnerability has been resolved: scsi: bnx2fc: Remove spin_lock_ In the Linux kernel, the following vulnerability has been resolved: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload The session resources are used by FW and driver when session is offloaded, once session is uploaded these resources are not used. The lock is not required as these fields won't be used any longer. The offload

CVE-2024-35988 [MEDIUM] CVE-2024-35988: In the Linux kernel, the following vulnerability has been resolved: riscv: Fix TASK_SIZE on 64-bit In the Linux kernel, the following vulnerability has been resolved: riscv: Fix TASK_SIZE on 64-bit NOMMU On NOMMU, userspace memory can come from anywhere in physical RAM. The current definition of TASK_SIZE is wrong if any RAM exists above 4G, causing spurious failures in the userspace access routines.

CVE-2024-35934 [MEDIUM] CVE-2024-35934: In the Linux kernel, the following vulnerability has been resolved: net/smc: reduce rtnl pressure i In the Linux kernel, the following vulnerability has been resolved: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() Many syzbot reports show extreme rtnl pressure, and many of them hint that smc acquires rtnl in netns creation for no good reason [1] This patch returns early from smc_pnet_net_init() if there is no netdevice yet. I am not e

CVE-2025-37765 [MEDIUM] CWE-416 CVE-2025-37765: In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: prime: fix ttm_bo_ In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: prime: fix ttm_bo_delayed_delete oops Fix an oops in ttm_bo_delayed_delete which results from dererencing a dangling pointer: Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b7b: 0000 [#1] PREEMPT SMP CPU: 4 UID: 0 PID: 1082 Comm: kwo

CVE-2024-26643 [MEDIUM] CWE-667 CVE-2024-26643: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: mark set In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path. Mingi Cho originally reported th

CVE-2025-37824 [MEDIUM] CWE-476 CVE-2025-37824: In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL pointer derefere In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL pointer dereference in tipc_mon_reinit_self() syzbot reported: tipc: Node number set to 1055423674 Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0

CVE-2024-26696 [MEDIUM] CWE-667 CVE-2024-26696: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix hang in nilfs_looku In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() Syzbot reported a hang issue in migrate_pages_batch() called by mbind() and nilfs_lookup_dirty_data_buffers() called in the log writer of nilfs2. While migrate_pages_batch() locks a folio and waits for the writeback to complete

CVE-2025-38706 [MEDIUM] CWE-476 CVE-2025-38706: In the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NU In the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null pointer dereference. This was reproduced with topology loading and marking a link as ignore due to missing hardware component on

CVE-2015-0432 [MEDIUM] CVE-2015-0432: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier allows remote authenticated user Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DDL : Foreign Key.

CVE-2025-37772 [MEDIUM] CWE-476 CVE-2025-37772: In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix workqueue crash i In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix workqueue crash in cma_netevent_work_handler struct rdma_cm_id has member "struct work_struct net_work" that is reused for enqueuing cma_netevent_work_handler()s onto cma_wq. Below crash[1] can occur if more than one call to cma_netevent_callback() occurs in quick su

CVE-2025-23138 [MEDIUM] CVE-2025-23138: In the Linux kernel, the following vulnerability has been resolved: watch_queue: fix pipe accountin In the Linux kernel, the following vulnerability has been resolved: watch_queue: fix pipe accounting mismatch Currently, watch_queue_set_size() modifies the pipe buffers charged to user->pipe_bufs without updating the pipe->nr_accounted on the pipe itself, due to the if (!pipe_has_watch_queue()) test in pipe_resize_ring(). This means that when the pipe is

CVE-2025-38115 [MEDIUM] CWE-401 CVE-2025-38115: In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: fix a poten In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: fix a potential crash on gso_skb handling SFQ has an assumption of always being able to queue at least one packet. However, after the blamed commit, sch->q.len can be inflated by packets in sch->gso_skb, and an enqueue() on an empty SFQ qdisc can be followed by

CVE-2025-38328 [MEDIUM] CWE-476 CVE-2025-38328: In the Linux kernel, the following vulnerability has been resolved: jffs2: check jffs2_prealloc_raw In the Linux kernel, the following vulnerability has been resolved: jffs2: check jffs2_prealloc_raw_node_refs() result in few other places Fuzzing hit another invalid pointer dereference due to the lack of checking whether jffs2_prealloc_raw_node_refs() completed successfully. Subsequent logic implies that the node refs have been allocated. Handle

CVE-2024-26999 [MEDIUM] CWE-667 CVE-2024-26999: In the Linux kernel, the following vulnerability has been resolved: serial/pmac_zilog: Remove flawe In the Linux kernel, the following vulnerability has been resolved: serial/pmac_zilog: Remove flawed mitigation for rx irq flood The mitigation was intended to stop the irq completely. That may be better than a hard lock-up but it turns out that you get a crash anyway if you're using pmac_zilog as a serial console: ttyPZ0: pmz: rx irq flood ! BUG:

CVE-2025-38560 [MEDIUM] CVE-2025-38560: In the Linux kernel, the following vulnerability has been resolved: x86/sev: Evict cache lines duri In the Linux kernel, the following vulnerability has been resolved: x86/sev: Evict cache lines during SNP memory validation An SNP cache coherency vulnerability requires a cache line eviction mitigation when validating memory after a page state change to private. The specific mitigation is to touch the first and last byte of each 4K page that is being vali

CVE-2024-35895 [MEDIUM] CWE-667 CVE-2024-35895: In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Prevent lock inve In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Prevent lock inversion deadlock in map delete elem syzkaller started using corpuses where a BPF tracing program deletes elements from a sockmap/sockhash map. Because BPF tracing programs can be invoked from any interrupt context, locks taken during a map_delete_elem o

CVE-2025-38005 [MEDIUM] CVE-2025-38005: In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma: Add mis In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma: Add missing locking Recent kernels complain about a missing lock in k3-udma.c when the lock validator is enabled: [ 4.128073] WARNING: CPU: 0 PID: 746 at drivers/dma/ti/../virt-dma.h:169 udma_start.isra.0+0x34/0x238 [ 4.137352] CPU: 0 UID: 0 PID: 746 Comm: kworker/

CVE-2025-37742 [MEDIUM] CWE-908 CVE-2025-37742: In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uninit-value access of In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uninit-value access of imap allocated in the diMount() function syzbot reports that hex_dump_to_buffer is using uninit-value: BUG: KMSAN: uninit-value in hex_dump_to_buffer+0x888/0x1100 lib/hexdump.c:171 hex_dump_to_buffer+0x888/0x1100 lib/hexdump.c:171 print_hex_dump+0x1

CVE-2025-38701 [MEDIUM] CWE-617 CVE-2025-38701: In the Linux kernel, the following vulnerability has been resolved: ext4: do not BUG when INLINE_DA In the Linux kernel, the following vulnerability has been resolved: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missing the system.data extended attribute. Since this can happen due to a maiciouly fuzzed file

CVE-2025-38466 [MEDIUM] CVE-2025-38466: In the Linux kernel, the following vulnerability has been resolved: perf: Revert to requiring CAP_S In the Linux kernel, the following vulnerability has been resolved: perf: Revert to requiring CAP_SYS_ADMIN for uprobes Jann reports that uprobes can be used destructively when used in the middle of an instruction. The kernel only verifies there is a valid instruction at the requested offset, but due to variable instruction length cannot determine if this