Debian Linux vulnerabilities

CVE-2024-35830 [MEDIUM] CVE-2024-35830: In the Linux kernel, the following vulnerability has been resolved: media: tc358743: register v4l2 In the Linux kernel, the following vulnerability has been resolved: media: tc358743: register v4l2 async device only after successful setup Ensure the device has been setup correctly before registering the v4l2 async device, thus allowing userspace to access.

CVE-2024-27059 [MEDIUM] CWE-369 CVE-2024-27059: In the Linux kernel, the following vulnerability has been resolved: USB: usb-storage: Prevent divid In the Linux kernel, the following vulnerability has been resolved: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values in the ATA ID information to calculate cylinder and head values when creating a CDB for READ or WRITE commands. The calculation involves division

CVE-2024-26743 [MEDIUM] CWE-770 CVE-2024-26743: In the Linux kernel, the following vulnerability has been resolved: RDMA/qedr: Fix qedr_create_user In the Linux kernel, the following vulnerability has been resolved: RDMA/qedr: Fix qedr_create_user_qp error flow Avoid the following warning by making sure to free the allocated resources in case that qedr_init_user_queue() fail. -----------[ cut here ]----------- WARNING: CPU: 0 PID: 143192 at drivers/infiniband/core/rdma_core.c:874 uverbs_destr

CVE-2024-26695 [MEDIUM] CWE-476 CVE-2024-26695: In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix null pointer In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked The SEV platform device can be shutdown with a null psp_master, e.g., using DEBUG_TEST_DRIVER_REMOVE. Found using KASAN: [ 137.148210] ccp 0000:23:00.1: enabling device (0000 -> 0002) [ 137.162647] ccp 000

CVE-2024-26640 [MEDIUM] CVE-2024-26640: In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx ze In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx zerocopy TCP rx zerocopy intent is to map pages initially allocated from NIC drivers, not pages owned by a fs. This patch adds to can_map_frag() these additional checks: - Page must not be a compound one. - page->mapping must be NULL. This fixes the panic re

CVE-2024-26635 [MEDIUM] CWE-909 CVE-2024-26635: In the Linux kernel, the following vulnerability has been resolved: llc: Drop support for ETH_P_TR_ In the Linux kernel, the following vulnerability has been resolved: llc: Drop support for ETH_P_TR_802_2. syzbot reported an uninit-value bug below. [0] llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2 (0x0011), and syzbot abused the latter to trigger the bug. write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[],

CVE-2024-35962 [MEDIUM] CVE-2024-35962: In the Linux kernel, the following vulnerability has been resolved: netfilter: complete validation In the Linux kernel, the following vulnerability has been resolved: netfilter: complete validation of user input In my recent commit, I missed that do_replace() handlers use copy_from_sockptr() (which I fixed), followed by unsafe copy_from_sockptr_offset() calls. In all functions, we can perform the @optlen validation before even calling xt_alloc_table_inf

CVE-2024-27437 [MEDIUM] CVE-2024-27437: In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Disable auto-enable o In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Disable auto-enable of exclusive INTx IRQ Currently for devices requiring masking at the irqchip for INTx, ie. devices without DisINTx support, the IRQ is enabled in request_irq() and subsequently disabled as necessary to align with the masked status flag. This presents a window

CVE-2024-26636 [MEDIUM] CVE-2024-26636: In the Linux kernel, the following vulnerability has been resolved: llc: make llc_ui_sendmsg() more In the Linux kernel, the following vulnerability has been resolved: llc: make llc_ui_sendmsg() more robust against bonding changes syzbot was able to trick llc_ui_sendmsg(), allocating an skb with no headroom, but subsequently trying to push 14 bytes of Ethernet header [1] Like some others, llc_ui_sendmsg() releases the socket lock before calling sock_all

CVE-2024-26917 [MEDIUM] CVE-2024-26917: In the Linux kernel, the following vulnerability has been resolved: scsi: Revert "scsi: fcoe: Fix p In the Linux kernel, the following vulnerability has been resolved: scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock" This reverts commit 1a1975551943f681772720f639ff42fbaa746212. This commit causes interrupts to be lost for FCoE devices, since it changed sping locks from "bh" to "irqsave". Instead, a work queue should be used, and wil

CVE-2024-26795 [MEDIUM] CVE-2024-26795: In the Linux kernel, the following vulnerability has been resolved: riscv: Sparse-Memory/vmemmap ou In the Linux kernel, the following vulnerability has been resolved: riscv: Sparse-Memory/vmemmap out-of-bounds fix Offset vmemmap so that the first page of vmemmap will be mapped to the first page of physical memory in order to ensure that vmemmap’s bounds will be respected during pfn_to_page()/page_to_pfn() operations. The conversion macros will produce c

CVE-2022-1195 [MEDIUM] CWE-362 CVE-2022-1195: A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allo A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device is detached and reclaim resources early.

CVE-2024-36005 [MEDIUM] CVE-2024-36005: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: honor tab In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: honor table dormant flag from netdev release event path Check for table dormant flag otherwise netdev release event path tries to unregister an already unregistered hook. [524854.857999] ------------[ cut here ]------------ [524854.858010] WARNING: CPU: 0 PID: 338659

CVE-2024-36007 [MEDIUM] CVE-2024-36007: In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix w In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix warning during rehash As previously explained, the rehash delayed work migrates filters from one region to another. This is done by iterating over all chunks (all the filters with the same priority) in the region and in each chunk iterating over all the filter

CVE-2025-38466 [MEDIUM] CVE-2025-38466: In the Linux kernel, the following vulnerability has been resolved: perf: Revert to requiring CAP_S In the Linux kernel, the following vulnerability has been resolved: perf: Revert to requiring CAP_SYS_ADMIN for uprobes Jann reports that uprobes can be used destructively when used in the middle of an instruction. The kernel only verifies there is a valid instruction at the requested offset, but due to variable instruction length cannot determine if this

CVE-2024-27431 [MEDIUM] CWE-908 CVE-2024-27431: In the Linux kernel, the following vulnerability has been resolved: cpumap: Zero-initialise xdp_rxq In the Linux kernel, the following vulnerability has been resolved: cpumap: Zero-initialise xdp_rxq_info struct before running XDP program When running an XDP program that is attached to a cpumap entry, we don't initialise the xdp_rxq_info data structure being used in the xdp_buff that backs the XDP program invocation. Tobias noticed that this lead

CVE-2025-38023 [MEDIUM] CWE-476 CVE-2025-38023: In the Linux kernel, the following vulnerability has been resolved: nfs: handle failure of nfs_get_ In the Linux kernel, the following vulnerability has been resolved: nfs: handle failure of nfs_get_lock_context in unlock path When memory is insufficient, the allocation of nfs_lock_context in nfs_get_lock_context() fails and returns -ENOMEM. If we mistakenly treat an nfs4_unlockdata structure (whose l_ctx member has been set to -ENOMEM) as valid

CVE-2024-26644 [MEDIUM] CWE-908 CVE-2024-26644: In the Linux kernel, the following vulnerability has been resolved: btrfs: don't abort filesystem w In the Linux kernel, the following vulnerability has been resolved: btrfs: don't abort filesystem when attempting to snapshot deleted subvolume If the source file descriptor to the snapshot ioctl refers to a deleted subvolume, we get the following abort: BTRFS: Transaction aborted (error -2) WARNING: CPU: 0 PID: 833 at fs/btrfs/transaction.c:1875

CVE-2025-38115 [MEDIUM] CWE-401 CVE-2025-38115: In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: fix a poten In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: fix a potential crash on gso_skb handling SFQ has an assumption of always being able to queue at least one packet. However, after the blamed commit, sch->q.len can be inflated by packets in sch->gso_skb, and an enqueue() on an empty SFQ qdisc can be followed by

CVE-2024-26727 [MEDIUM] CWE-617 CVE-2024-26727: In the Linux kernel, the following vulnerability has been resolved: btrfs: do not ASSERT() if the n In the Linux kernel, the following vulnerability has been resolved: btrfs: do not ASSERT() if the newly created subvolume already got read [BUG] There is a syzbot crash, triggered by the ASSERT() during subvolume creation: assertion failed: !anon_dev, in fs/btrfs/disk-io.c:1319 ------------[ cut here ]------------ kernel BUG at fs/btrfs/disk-io.c: