Debian Linux vulnerabilities

CVE-2025-38285 [MEDIUM] CWE-617 CVE-2025-38285: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix WARN() in get_bpf_raw_ In the Linux kernel, the following vulnerability has been resolved: bpf: Fix WARN() in get_bpf_raw_tp_regs syzkaller reported an issue: WARNING: CPU: 3 PID: 5971 at kernel/trace/bpf_trace.c:1861 get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861 Modules linked in: CPU: 3 UID: 0 PID: 5971 Comm: syz-executor205 Not tainted 6.15.0-rc5-syzka

CVE-2025-38100 [MEDIUM] CWE-476 CVE-2025-38100: In the Linux kernel, the following vulnerability has been resolved: x86/iopl: Cure TIF_IO_BITMAP in In the Linux kernel, the following vulnerability has been resolved: x86/iopl: Cure TIF_IO_BITMAP inconsistencies io_bitmap_exit() is invoked from exit_thread() when a task exists or when a fork fails. In the latter case the exit_thread() cleans up resources which were allocated during fork(). io_bitmap_exit() invokes task_update_io_bitmap(), which

CVE-2025-37931 [MEDIUM] CVE-2025-37931: In the Linux kernel, the following vulnerability has been resolved: btrfs: adjust subpage bit start In the Linux kernel, the following vulnerability has been resolved: btrfs: adjust subpage bit start based on sectorsize When running machines with 64k page size and a 16k nodesize we started seeing tree log corruption in production. This turned out to be because we were not writing out dirty blocks sometimes, so this in fact affects all metadata writes. W

CVE-2025-38273 [MEDIUM] CVE-2025-38273: In the Linux kernel, the following vulnerability has been resolved: net: tipc: fix refcount warning In the Linux kernel, the following vulnerability has been resolved: net: tipc: fix refcount warning in tipc_aead_encrypt syzbot reported a refcount warning [1] caused by calling get_net() on a network namespace that is being destroyed (refcount=0). This happens when a TIPC discovery timer fires during network namespace cleanup. The recently added get_net(

CVE-2025-37901 [MEDIUM] CVE-2025-37901: In the Linux kernel, the following vulnerability has been resolved: irqchip/qcom-mpm: Prevent crash In the Linux kernel, the following vulnerability has been resolved: irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs On Qualcomm chipsets not all GPIOs are wakeup capable. Those GPIOs do not have a corresponding MPM pin and should not be handled inside the MPM driver. The IRQ domain hierarchy is always applied, so it's required to expli

CVE-2025-38578 [MEDIUM] CWE-416 CVE-2025-38578: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid UAF in f2fs_ In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid UAF in f2fs_sync_inode_meta() syzbot reported an UAF issue as below: [1] [2] [1] https://syzkaller.appspot.com/text?tag=CrashReport&x=16594c60580000 BUG: KASAN: use-after-free in __list_del_entry_valid+0xa6/0x130 lib/list_debug.c:62 Read of size 8 at addr ffff8

CVE-2025-37936 [MEDIUM] CVE-2025-37936: In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: KVM: Mask PEBS_ In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. When generating the MSR_IA32_PEBS_ENABLE value that will be loaded on VM-Entry to a KVM guest, mask the value with the vCPU's desired PEBS_ENABLE value. Consulting only the host kernel's host vs. guest masks results

CVE-2024-26790 [MEDIUM] CWE-667 CVE-2024-26790: In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: fix SoC ma In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read There is chip (ls1028a) errata: The SoC may hang on 16 byte unaligned read transactions by QDMA. Unaligned read transactions initiated by QDMA may stall in the NOC (Network On-Chip), causing a deadlock condition. Sta

CVE-2025-38694 [MEDIUM] CWE-476 CVE-2025-38694: In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib7090p: In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() In dib7090p_rw_on_apb, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer de

CVE-2025-38391 [MEDIUM] CWE-125 CVE-2025-38391: In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displaypor In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: do not index invalid pin_assignments A poorly implemented DisplayPort Alt Mode port partner can indicate that its pin assignment capabilities are greater than the maximum value, DP_PIN_ASSIGN_F. In this case, calls to pin_assignment_show will cause

CVE-2025-38184 [MEDIUM] CWE-476 CVE-2025-38184: In the Linux kernel, the following vulnerability has been resolved: tipc: fix null-ptr-deref when a In the Linux kernel, the following vulnerability has been resolved: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer The reproduction steps: 1. create a tun interface 2. enable l2 bearer 3. TIPC_NL_UDP_GET_REMOTEIP with media name set to tun tipc: Started in network mode tipc: Node identity 8af312d38a21, cluster identity 4711 t

CVE-2025-39681 [MEDIUM] CVE-2025-39681: In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resc In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Since 923f3a2b48bd ("x86/resctrl: Query LLC monitoring properties once during boot") resctrl_cpu_detect() has been moved from common CPU initialization code to the vendor-specific BSP init helper, while Hygon didn't put t

CVE-2025-38698 [MEDIUM] CVE-2025-38698: In the Linux kernel, the following vulnerability has been resolved: jfs: Regular file corruption ch In the Linux kernel, the following vulnerability has been resolved: jfs: Regular file corruption check The reproducer builds a corrupted file on disk with a negative i_size value. Add a check when opening this file to avoid subsequent operation failures.

CVE-2025-38663 [MEDIUM] CVE-2025-38663: In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid file typ In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid file types when reading inodes To prevent inodes with invalid file types from tripping through the vfs and causing malfunctions or assertion failures, add a missing sanity check when reading an inode from a block device. If the file type is not valid, treat it as a f

CVE-2025-38470 [MEDIUM] CVE-2025-38470: In the Linux kernel, the following vulnerability has been resolved: net: vlan: fix VLAN 0 refcount In the Linux kernel, the following vulnerability has been resolved: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime Assuming the "rx-vlan-filter" feature is enabled on a net device, the 8021q module will automatically add or remove VLAN 0 when the net device is put administratively up or down, respectively. There are a couple o

CVE-2025-38387 [MEDIUM] CWE-476 CVE-2025-38387: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Initialize obj_event In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert The obj_event may be loaded immediately after inserted, then if the list_head is not initialized then we may get a poisonous pointer. This fixes the crash below: mlx5_core 0000:03:00.0: MLX5E: StrdRq(1) RqSz(8) StrdSz(

CVE-2025-38420 [MEDIUM] CWE-476 CVE-2025-38420: In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: do not ping dev In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: do not ping device which has failed to load firmware Syzkaller reports [1, 2] crashes caused by an attempts to ping the device which has failed to load firmware. Since such a device doesn't pass 'ieee80211_register_hw()', an internal workqueue managed by 'ieee80211_

CVE-2025-38009 [MEDIUM] CVE-2025-38009: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: disable napi on dri In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: disable napi on driver removal A warning on driver removal started occurring after commit 9dd05df8403b ("net: warn if NAPI instance wasn't shut down"). Disable tx napi before deleting it in mt76_dma_cleanup(). WARNING: CPU: 4 PID: 18828 at net/core/dev.c:7288 __netif_napi_del_

CVE-2025-38604 [MEDIUM] CWE-476 CVE-2025-38604: In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Kill URBs before In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Kill URBs before clearing tx status queue In rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing b_tx_status.queue. This change prevents callbacks from using already freed skb due to anchor was not killed before freeing such skb. BUG: kernel NUL

CVE-2025-38345 [MEDIUM] CWE-401 CVE-2025-38345: In the Linux kernel, the following vulnerability has been resolved: ACPICA: fix acpi operand cache In the Linux kernel, the following vulnerability has been resolved: ACPICA: fix acpi operand cache leak in dswstate.c ACPICA commit 987a3b5cf7175916e2a4b6ea5b8e70f830dfe732 I found an ACPI cache leak in ACPI early termination and boot continuing case. When early termination occurs due to malicious ACPI table, Linux kernel terminates ACPI function