Debian Linux vulnerabilities

CVE-2024-35988 [MEDIUM] CVE-2024-35988: In the Linux kernel, the following vulnerability has been resolved: riscv: Fix TASK_SIZE on 64-bit In the Linux kernel, the following vulnerability has been resolved: riscv: Fix TASK_SIZE on 64-bit NOMMU On NOMMU, userspace memory can come from anywhere in physical RAM. The current definition of TASK_SIZE is wrong if any RAM exists above 4G, causing spurious failures in the userspace access routines.

CVE-2025-37824 [MEDIUM] CWE-476 CVE-2025-37824: In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL pointer derefere In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL pointer dereference in tipc_mon_reinit_self() syzbot reported: tipc: Node number set to 1055423674 Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0

CVE-2025-38387 [MEDIUM] CWE-476 CVE-2025-38387: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Initialize obj_event In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert The obj_event may be loaded immediately after inserted, then if the list_head is not initialized then we may get a poisonous pointer. This fixes the crash below: mlx5_core 0000:03:00.0: MLX5E: StrdRq(1) RqSz(8) StrdSz(

CVE-2025-38420 [MEDIUM] CWE-476 CVE-2025-38420: In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: do not ping dev In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: do not ping device which has failed to load firmware Syzkaller reports [1, 2] crashes caused by an attempts to ping the device which has failed to load firmware. Since such a device doesn't pass 'ieee80211_register_hw()', an internal workqueue managed by 'ieee80211_

CVE-2025-38285 [MEDIUM] CWE-617 CVE-2025-38285: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix WARN() in get_bpf_raw_ In the Linux kernel, the following vulnerability has been resolved: bpf: Fix WARN() in get_bpf_raw_tp_regs syzkaller reported an issue: WARNING: CPU: 3 PID: 5971 at kernel/trace/bpf_trace.c:1861 get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861 Modules linked in: CPU: 3 UID: 0 PID: 5971 Comm: syz-executor205 Not tainted 6.15.0-rc5-syzka

CVE-2025-38273 [MEDIUM] CVE-2025-38273: In the Linux kernel, the following vulnerability has been resolved: net: tipc: fix refcount warning In the Linux kernel, the following vulnerability has been resolved: net: tipc: fix refcount warning in tipc_aead_encrypt syzbot reported a refcount warning [1] caused by calling get_net() on a network namespace that is being destroyed (refcount=0). This happens when a TIPC discovery timer fires during network namespace cleanup. The recently added get_net(

CVE-2025-38066 [MEDIUM] CWE-617 CVE-2025-38066: In the Linux kernel, the following vulnerability has been resolved: dm cache: prevent BUG_ON by blo In the Linux kernel, the following vulnerability has been resolved: dm cache: prevent BUG_ON by blocking retries on failed device resumes A cache device failing to resume due to mapping errors should not be retried, as the failure leaves a partially initialized policy object. Repeating the resume operation risks triggering BUG_ON when reloading cac

CVE-2025-38706 [MEDIUM] CWE-476 CVE-2025-38706: In the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NU In the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null pointer dereference. This was reproduced with topology loading and marking a link as ignore due to missing hardware component on

CVE-2025-37897 [MEDIUM] CWE-617 CVE-2025-37897: In the Linux kernel, the following vulnerability has been resolved: wifi: plfxlc: Remove erroneous In the Linux kernel, the following vulnerability has been resolved: wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release plfxlc_mac_release() asserts that mac->lock is held. This assertion is incorrect, because even if it was possible, it would not be the valid behaviour. The function is used when probe fails or after the device is disconnect

CVE-2024-26643 [MEDIUM] CWE-667 CVE-2024-26643: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: mark set In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path. Mingi Cho originally reported th

CVE-2025-38074 [MEDIUM] CVE-2025-38074: In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: protect vq->log_use In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: protect vq->log_used with vq->mutex The vhost-scsi completion path may access vq->log_base when vq->log_used is already set to false. vhost-thread QEMU-thread vhost_scsi_complete_cmd_work() -> vhost_add_used() -> vhost_add_used_n() if (unlikely(vq->log_used)) QEMU disables vq

CVE-2025-37963 [MEDIUM] CVE-2025-37963: In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Only mitigate cBPF In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users Support for eBPF programs loaded by unprivileged users is typically disabled. This means only cBPF programs need to be mitigated for BHB. In addition, only mitigate cBPF programs that were loaded by an unprivileged user.

CVE-2025-37772 [MEDIUM] CWE-476 CVE-2025-37772: In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix workqueue crash i In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix workqueue crash in cma_netevent_work_handler struct rdma_cm_id has member "struct work_struct net_work" that is reused for enqueuing cma_netevent_work_handler()s onto cma_wq. Below crash[1] can occur if more than one call to cma_netevent_callback() occurs in quick su

CVE-2025-38345 [MEDIUM] CWE-401 CVE-2025-38345: In the Linux kernel, the following vulnerability has been resolved: ACPICA: fix acpi operand cache In the Linux kernel, the following vulnerability has been resolved: ACPICA: fix acpi operand cache leak in dswstate.c ACPICA commit 987a3b5cf7175916e2a4b6ea5b8e70f830dfe732 I found an ACPI cache leak in ACPI early termination and boot continuing case. When early termination occurs due to malicious ACPI table, Linux kernel terminates ACPI function

CVE-2025-38197 [MEDIUM] CWE-476 CVE-2025-38197: In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell_rbu: Fix lis In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell_rbu: Fix list usage Pass the correct list head to list_for_each_entry*() when looping through the packet list. Without this patch, reading the packet data via sysfs will show the data incorrectly (because it starts at the wrong packet), and clearing the packet l

CVE-2025-38126 [MEDIUM] CWE-369 CVE-2025-38126: In the Linux kernel, the following vulnerability has been resolved: net: stmmac: make sure that ptp In the Linux kernel, the following vulnerability has been resolved: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping The stmmac platform drivers that do not open-code the clk_ptp_rate value after having retrieved the default one from the device-tree can end up with 0 in clk_ptp_rate (as clk_get_rate can return 0). It wi

CVE-2025-37989 [MEDIUM] CWE-401 CVE-2025-37989: In the Linux kernel, the following vulnerability has been resolved: net: phy: leds: fix memory leak In the Linux kernel, the following vulnerability has been resolved: net: phy: leds: fix memory leak A network restart test on a router led to an out-of-memory condition, which was traced to a memory leak in the PHY LED trigger code. The root cause is misuse of the devm API. The registration function (phy_led_triggers_register) is called from phy_a

CVE-2025-38322 [MEDIUM] CVE-2025-38322: In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in ic In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in icl_update_topdown_event() The perf_fuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000 CPU: 23 UID: 0 PID: 0 Comm: swapper/23 Tainted: [W]=WARN Hardware name: Dell Inc. Precision

CVE-2025-38043 [MEDIUM] CVE-2025-38043: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Set dma_mask In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Set dma_mask for ffa devices Set dma_mask for FFA devices, otherwise DMA allocation using the device pointer lead to following warning: WARNING: CPU: 1 PID: 1 at kernel/dma/mapping.c:597 dma_alloc_attrs+0xe0/0x124

CVE-2025-38020 [MEDIUM] CWE-476 CVE-2025-38020: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Disable MACsec offlo In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Disable MACsec offload for uplink representor profile MACsec offload is not supported in switchdev mode for uplink representors. When switching to the uplink representor profile, the MACsec offload feature must be cleared from the netdevice's features. If left enabled,