Debian Linux vulnerabilities

CVE-2025-38735 [MEDIUM] CWE-476 CVE-2025-38735: In the Linux kernel, the following vulnerability has been resolved: gve: prevent ethtool ops after In the Linux kernel, the following vulnerability has been resolved: gve: prevent ethtool ops after shutdown A crash can occur if an ethtool operation is invoked after shutdown() is called. shutdown() is invoked during system shutdown to stop DMA operations without performing expensive deallocations. It is discouraged to unregister the netdev in thi

CVE-2025-38200 [MEDIUM] CWE-191 CVE-2025-38200: In the Linux kernel, the following vulnerability has been resolved: i40e: fix MMIO write access to In the Linux kernel, the following vulnerability has been resolved: i40e: fix MMIO write access to an invalid page in i40e_clear_hw When the device sends a specific input, an integer underflow can occur, leading to MMIO write access to an invalid page. Prevent the integer underflow by changing the type of related variables.

CVE-2025-37963 [MEDIUM] CVE-2025-37963: In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Only mitigate cBPF In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users Support for eBPF programs loaded by unprivileged users is typically disabled. This means only cBPF programs need to be mitigated for BHB. In addition, only mitigate cBPF programs that were loaded by an unprivileged user.

CVE-2025-37897 [MEDIUM] CWE-617 CVE-2025-37897: In the Linux kernel, the following vulnerability has been resolved: wifi: plfxlc: Remove erroneous In the Linux kernel, the following vulnerability has been resolved: wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release plfxlc_mac_release() asserts that mac->lock is held. This assertion is incorrect, because even if it was possible, it would not be the valid behaviour. The function is used when probe fails or after the device is disconnect

CVE-2025-38727 [MEDIUM] CWE-835 CVE-2025-38727: In the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry l In the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry looping in netlink_unicast() netlink_attachskb() checks for the socket's read memory allocation constraints. Firstly, it has: rmem sk_rcvbuf) to check if the just increased rmem value fits into the socket's receive buffer. If not, it proceeds and tri

CVE-2025-38337 [MEDIUM] CWE-476 CVE-2025-38337: In the Linux kernel, the following vulnerability has been resolved: jbd2: fix data-race and null-pt In the Linux kernel, the following vulnerability has been resolved: jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() Since handle->h_transaction may be a NULL pointer, so we should change it to call is_handle_aborted(handle) first before dereferencing it. And the following data-race was reported in my fuzzer: BUG: KCSAN: da

CVE-2025-38197 [MEDIUM] CWE-476 CVE-2025-38197: In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell_rbu: Fix lis In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell_rbu: Fix list usage Pass the correct list head to list_for_each_entry*() when looping through the packet list. Without this patch, reading the packet data via sysfs will show the data incorrectly (because it starts at the wrong packet), and clearing the packet l

CVE-2025-38126 [MEDIUM] CWE-369 CVE-2025-38126: In the Linux kernel, the following vulnerability has been resolved: net: stmmac: make sure that ptp In the Linux kernel, the following vulnerability has been resolved: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping The stmmac platform drivers that do not open-code the clk_ptp_rate value after having retrieved the default one from the device-tree can end up with 0 in clk_ptp_rate (as clk_get_rate can return 0). It wi

CVE-2025-38084 [MEDIUM] CVE-2025-38084: In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: unshare page tables In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: unshare page tables during VMA split, not before Currently, __split_vma() triggers hugetlb page table unsharing through vm_ops->may_split(). This happens before the VMA lock and rmap locks are taken - which is too early, it allows racing VMA-locked page faults in our process an

CVE-2025-37964 [MEDIUM] CVE-2025-37964: In the Linux kernel, the following vulnerability has been resolved: x86/mm: Eliminate window where In the Linux kernel, the following vulnerability has been resolved: x86/mm: Eliminate window where TLB flushes may be inadvertently skipped tl;dr: There is a window in the mm switching code where the new CR3 is set and the CPU should be getting TLB flushes for the new mm. But should_flush_tlb() has a bug and suppresses the flush. Fix it by widening the wind

CVE-2025-38468 [MEDIUM] CWE-476 CVE-2025-38468: In the Linux kernel, the following vulnerability has been resolved: net/sched: Return NULL when htb In the Linux kernel, the following vulnerability has been resolved: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree htb_lookup_leaf has a BUG_ON that can trigger with the following: tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 htb rate 64bit tc qdisc add

CVE-2025-38458 [MEDIUM] CWE-476 CVE-2025-38458: In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix NULL pointer der In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() atmarpd_dev_ops does not implement the send method, which may cause crash as bellow. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0010 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5324 C

CVE-2025-38066 [MEDIUM] CWE-617 CVE-2025-38066: In the Linux kernel, the following vulnerability has been resolved: dm cache: prevent BUG_ON by blo In the Linux kernel, the following vulnerability has been resolved: dm cache: prevent BUG_ON by blocking retries on failed device resumes A cache device failing to resume due to mapping errors should not be retried, as the failure leaves a partially initialized policy object. Repeating the resume operation risks triggering BUG_ON when reloading cac

CVE-2025-37989 [MEDIUM] CWE-401 CVE-2025-37989: In the Linux kernel, the following vulnerability has been resolved: net: phy: leds: fix memory leak In the Linux kernel, the following vulnerability has been resolved: net: phy: leds: fix memory leak A network restart test on a router led to an out-of-memory condition, which was traced to a memory leak in the PHY LED trigger code. The root cause is misuse of the devm API. The registration function (phy_led_triggers_register) is called from phy_a

CVE-2025-38624 [MEDIUM] CVE-2025-38624: In the Linux kernel, the following vulnerability has been resolved: PCI: pnv_php: Clean up allocate In the Linux kernel, the following vulnerability has been resolved: PCI: pnv_php: Clean up allocated IRQs on unplug When the root of a nested PCIe bridge configuration is unplugged, the pnv_php driver leaked the allocated IRQ resources for the child bridges' hotplug event notifications, resulting in a panic. Fix this by walking all child buses and dealloc

CVE-2025-38020 [MEDIUM] CWE-476 CVE-2025-38020: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Disable MACsec offlo In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Disable MACsec offload for uplink representor profile MACsec offload is not supported in switchdev mode for uplink representors. When switching to the uplink representor profile, the MACsec offload feature must be cleared from the netdevice's features. If left enabled,

CVE-2025-39812 [MEDIUM] CWE-908 CVE-2025-39812: In the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in In the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in sctp_v6_from_sk() syzbot found that sin6_scope_id was not properly initialized, leading to undefined behavior. Clear sin6_scope_id and sin6_flowinfo. BUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 __sctp_v6_cmp_addr+

CVE-2025-38576 [MEDIUM] CVE-2025-38576: In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: Make EEH driver de In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: Make EEH driver device hotplug safe Multiple race conditions existed between the PCIe hotplug driver and the EEH driver, leading to a variety of kernel oopses of the same general nature: A second class of oops is also seen when the underlying bus disappears during device rec

CVE-2025-38540 [MEDIUM] CVE-2025-38540: In the Linux kernel, the following vulnerability has been resolved: HID: quirks: Add quirk for 2 Ch In the Linux kernel, the following vulnerability has been resolved: HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras The Chicony Electronics HP 5MP Cameras (USB ID 04F2:B824 & 04F2:B82C) report a HID sensor interface that is not actually implemented. Attempting to access this non-functional sensor via iio_info causes system hangs as runtime

CVE-2025-38043 [MEDIUM] CVE-2025-38043: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Set dma_mask In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Set dma_mask for ffa devices Set dma_mask for FFA devices, otherwise DMA allocation using the device pointer lead to following warning: WARNING: CPU: 1 PID: 1 at kernel/dma/mapping.c:597 dma_alloc_attrs+0xe0/0x124