Debian Linux vulnerabilities

CVE-2025-38468 [MEDIUM] CWE-476 CVE-2025-38468: In the Linux kernel, the following vulnerability has been resolved: net/sched: Return NULL when htb In the Linux kernel, the following vulnerability has been resolved: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree htb_lookup_leaf has a BUG_ON that can trigger with the following: tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 htb rate 64bit tc qdisc add

CVE-2025-38458 [MEDIUM] CWE-476 CVE-2025-38458: In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix NULL pointer der In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() atmarpd_dev_ops does not implement the send method, which may cause crash as bellow. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0010 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5324 C

CVE-2025-38337 [MEDIUM] CWE-476 CVE-2025-38337: In the Linux kernel, the following vulnerability has been resolved: jbd2: fix data-race and null-pt In the Linux kernel, the following vulnerability has been resolved: jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() Since handle->h_transaction may be a NULL pointer, so we should change it to call is_handle_aborted(handle) first before dereferencing it. And the following data-race was reported in my fuzzer: BUG: KCSAN: da

CVE-2025-38203 [MEDIUM] CWE-476 CVE-2025-38203: In the Linux kernel, the following vulnerability has been resolved: jfs: Fix null-ptr-deref in jfs_ In the Linux kernel, the following vulnerability has been resolved: jfs: Fix null-ptr-deref in jfs_ioc_trim [ Syzkaller Report ] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000087: 0000 [#1 KASAN: null-ptr-deref in range [0x0000000000000438-0x000000000000043f] CPU: 2 UID: 0 PID: 10614 Comm: syz-executor.0 Not tai

CVE-2025-38040 [MEDIUM] CVE-2025-38040: In the Linux kernel, the following vulnerability has been resolved: serial: mctrl_gpio: split disab In the Linux kernel, the following vulnerability has been resolved: serial: mctrl_gpio: split disable_ms into sync and no_sync APIs The following splat has been observed on a SAMA5D27 platform using atmel_serial: BUG: sleeping function called from invalid context at kernel/irq/manage.c:738 in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 27, name:

CVE-2025-38161 [MEDIUM] CWE-191 CVE-2025-38161: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error flow upon In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction Upon RQ destruction if the firmware command fails which is the last resource to be destroyed some SW resources were already cleaned regardless of the failure. Now properly rollback the object to its original state u

CVE-2025-38214 [MEDIUM] CWE-476 CVE-2025-38214: In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix fb_set_var to preven In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var If fb_add_videomode() in fb_set_var() fails to allocate memory for fb_videomode, later it may lead to a null-ptr dereference in fb_videomode_to_var(), as the fb_info is registered while not having the mode in mo

CVE-2025-37972 [MEDIUM] CWE-476 CVE-2025-37972: In the Linux kernel, the following vulnerability has been resolved: Input: mtk-pmic-keys - fix poss In the Linux kernel, the following vulnerability has been resolved: Input: mtk-pmic-keys - fix possible null pointer dereference In mtk_pmic_keys_probe, the regs parameter is only set if the button is parsed in the device tree. However, on hardware where the button is left floating, that node will most likely be removed not to enable that input. In

CVE-2025-37742 [MEDIUM] CWE-908 CVE-2025-37742: In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uninit-value access of In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uninit-value access of imap allocated in the diMount() function syzbot reports that hex_dump_to_buffer is using uninit-value: BUG: KMSAN: uninit-value in hex_dump_to_buffer+0x888/0x1100 lib/hexdump.c:171 hex_dump_to_buffer+0x888/0x1100 lib/hexdump.c:171 print_hex_dump+0x1

CVE-2024-26696 [MEDIUM] CWE-667 CVE-2024-26696: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix hang in nilfs_looku In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() Syzbot reported a hang issue in migrate_pages_batch() called by mbind() and nilfs_lookup_dirty_data_buffers() called in the log writer of nilfs2. While migrate_pages_batch() locks a folio and waits for the writeback to complete

CVE-2025-38701 [MEDIUM] CWE-617 CVE-2025-38701: In the Linux kernel, the following vulnerability has been resolved: ext4: do not BUG when INLINE_DA In the Linux kernel, the following vulnerability has been resolved: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missing the system.data extended attribute. Since this can happen due to a maiciouly fuzzed file

CVE-2025-38218 [MEDIUM] CVE-2025-38218: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on sit_bitmap_size w/ below testcase, resize will generate a corrupted image which contains inconsistent metadata, so when mounting such image, it will trigger kernel panic: touch img truncate -s $((512*1024*1024*1024)) img mkfs.f2fs -f img $((256*1024*1024))

CVE-2025-37961 [MEDIUM] CWE-908 CVE-2025-37961: In the Linux kernel, the following vulnerability has been resolved: ipvs: fix uninit-value for sadd In the Linux kernel, the following vulnerability has been resolved: ipvs: fix uninit-value for saddr in do_output_route4 syzbot reports for uninit-value for the saddr argument [1]. commit 4754957f04f5 ("ipvs: do not use random local source address for tunnels") already implies that the input value of saddr should be ignored but the code is still re

CVE-2025-22119 [MEDIUM] CWE-908 CVE-2025-22119: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: init wiphy_work In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: init wiphy_work before allocating rfkill fails syzbort reported a uninitialize wiphy_work_lock in cfg80211_dev_free. [1] After rfkill allocation fails, the wiphy release process will be performed, which will cause cfg80211_dev_free to access the uninitialized wiphy

CVE-2025-38354 [MEDIUM] CVE-2025-38354: In the Linux kernel, the following vulnerability has been resolved: drm/msm/gpu: Fix crash when thr In the Linux kernel, the following vulnerability has been resolved: drm/msm/gpu: Fix crash when throttling GPU immediately during boot There is a small chance that the GPU is already hot during boot. In that case, the call to of_devfreq_cooling_register() will immediately try to apply devfreq cooling, as seen in the following crash: Unable to handle kerne

CVE-2025-38578 [MEDIUM] CWE-416 CVE-2025-38578: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid UAF in f2fs_ In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid UAF in f2fs_sync_inode_meta() syzbot reported an UAF issue as below: [1] [2] [1] https://syzkaller.appspot.com/text?tag=CrashReport&x=16594c60580000 BUG: KASAN: use-after-free in __list_del_entry_valid+0xa6/0x130 lib/list_debug.c:62 Read of size 8 at addr ffff8

CVE-2025-38163 [MEDIUM] CWE-476 CVE-2025-38163: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on sbi->total_valid_block_count syzbot reported a f2fs bug as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/f2fs.h:2521! RIP: 0010:dec_valid_block_count+0x3b2/0x3c0 fs/f2fs/f2fs.h:2521 Call Trace: f2fs_truncate_data_blocks_range+0xc

CVE-2025-38499 [MEDIUM] CVE-2025-38499: In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo" may be a result of MNT_LOCKED on a child, but it may also come from

CVE-2024-26999 [MEDIUM] CWE-667 CVE-2024-26999: In the Linux kernel, the following vulnerability has been resolved: serial/pmac_zilog: Remove flawe In the Linux kernel, the following vulnerability has been resolved: serial/pmac_zilog: Remove flawed mitigation for rx irq flood The mitigation was intended to stop the irq completely. That may be better than a hard lock-up but it turns out that you get a crash anyway if you're using pmac_zilog as a serial console: ttyPZ0: pmz: rx irq flood ! BUG:

CVE-2025-38698 [MEDIUM] CVE-2025-38698: In the Linux kernel, the following vulnerability has been resolved: jfs: Regular file corruption ch In the Linux kernel, the following vulnerability has been resolved: jfs: Regular file corruption check The reproducer builds a corrupted file on disk with a negative i_size value. Add a check when opening this file to avoid subsequent operation failures.