Debian Linux vulnerabilities

CVE-2025-38694 [MEDIUM] CWE-476 CVE-2025-38694: In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib7090p: In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() In dib7090p_rw_on_apb, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer de

CVE-2025-38622 [MEDIUM] CVE-2025-38622: In the Linux kernel, the following vulnerability has been resolved: net: drop UFO packets in udp_rc In the Linux kernel, the following vulnerability has been resolved: net: drop UFO packets in udp_rcv_segment() When sending a packet with virtio_net_hdr to tun device, if the gso_type in virtio_net_hdr is SKB_GSO_UDP and the gso_size is less than udphdr size, below crash may happen. ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:4572

CVE-2025-38487 [MEDIUM] CWE-476 CVE-2025-38487: In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Don't d In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled Mitigate e.g. the following: # echo 1e789080.lpc-snoop > /sys/bus/platform/drivers/aspeed-lpc-snoop/unbind ... [ 120.363594] Unable to handle kernel NULL pointer dereference at virtual address 00000004 when write [

CVE-2024-35895 [MEDIUM] CWE-667 CVE-2024-35895: In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Prevent lock inve In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Prevent lock inversion deadlock in map delete elem syzkaller started using corpuses where a BPF tracing program deletes elements from a sockmap/sockhash map. Because BPF tracing programs can be invoked from any interrupt context, locks taken during a map_delete_elem o

CVE-2025-38444 [MEDIUM] CWE-401 CVE-2025-38444: In the Linux kernel, the following vulnerability has been resolved: raid10: cleanup memleak at raid In the Linux kernel, the following vulnerability has been resolved: raid10: cleanup memleak at raid10_make_request If raid10_read_request or raid10_write_request registers a new request and the REQ_NOWAIT flag is set, the code does not free the malloc from the mempool. unreferenced object 0xffff8884802c3200 (size 192): comm "fio", pid 9197, jiffie

CVE-2025-38604 [MEDIUM] CWE-476 CVE-2025-38604: In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Kill URBs before In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Kill URBs before clearing tx status queue In rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing b_tx_status.queue. This change prevents callbacks from using already freed skb due to anchor was not killed before freeing such skb. BUG: kernel NUL

CVE-2025-38560 [MEDIUM] CVE-2025-38560: In the Linux kernel, the following vulnerability has been resolved: x86/sev: Evict cache lines duri In the Linux kernel, the following vulnerability has been resolved: x86/sev: Evict cache lines during SNP memory validation An SNP cache coherency vulnerability requires a cache line eviction mitigation when validating memory after a page state change to private. The specific mitigation is to touch the first and last byte of each 4K page that is being vali

CVE-2025-38305 [MEDIUM] CVE-2025-38305: In the Linux kernel, the following vulnerability has been resolved: ptp: remove ptp->n_vclocks chec In the Linux kernel, the following vulnerability has been resolved: ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() There is no disagreement that we should check both ptp->is_virtual_clock and ptp->n_vclocks to check if the ptp virtual clock is in use. However, when we acquire ptp->n_vclocks_mux to read ptp->n_vclocks in ptp_vclock_in_use(),

CVE-2025-38263 [MEDIUM] CWE-476 CVE-2025-38263: In the Linux kernel, the following vulnerability has been resolved: bcache: fix NULL pointer in cac In the Linux kernel, the following vulnerability has been resolved: bcache: fix NULL pointer in cache_set_flush() 1. LINE#1794 - LINE#1887 is some codes about function of bch_cache_set_alloc(). 2. LINE#2078 - LINE#2142 is some codes about function of register_cache_set(). 3. register_cache_set() will call bch_cache_set_alloc() in LINE#2098. 1794 s

CVE-2025-38727 [MEDIUM] CWE-835 CVE-2025-38727: In the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry l In the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry looping in netlink_unicast() netlink_attachskb() checks for the socket's read memory allocation constraints. Firstly, it has: rmem sk_rcvbuf) to check if the just increased rmem value fits into the socket's receive buffer. If not, it proceeds and tri

CVE-2025-38735 [MEDIUM] CWE-476 CVE-2025-38735: In the Linux kernel, the following vulnerability has been resolved: gve: prevent ethtool ops after In the Linux kernel, the following vulnerability has been resolved: gve: prevent ethtool ops after shutdown A crash can occur if an ethtool operation is invoked after shutdown() is called. shutdown() is invoked during system shutdown to stop DMA operations without performing expensive deallocations. It is discouraged to unregister the netdev in thi

CVE-2025-39812 [MEDIUM] CWE-908 CVE-2025-39812: In the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in In the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in sctp_v6_from_sk() syzbot found that sin6_scope_id was not properly initialized, leading to undefined behavior. Clear sin6_scope_id and sin6_flowinfo. BUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 __sctp_v6_cmp_addr+

CVE-2025-38334 [MEDIUM] CWE-754 CVE-2025-38334: In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Prevent attempts to re In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Prevent attempts to reclaim poisoned pages TL;DR: SGX page reclaim touches the page to copy its contents to secondary storage. SGX instructions do not gracefully handle machine checks. Despite this, the existing SGX code will try to reclaim pages that it _knows_ are poison

CVE-2025-38215 [MEDIUM] CWE-476 CVE-2025-38215: In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix do_register_framebuf In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var If fb_add_videomode() in do_register_framebuffer() fails to allocate memory for fb_videomode, it will later lead to a null-ptr dereference in fb_videomode_to_var(), as the fb_info is registered whil

CVE-2025-39787 [MEDIUM] CVE-2025-39787: In the Linux kernel, the following vulnerability has been resolved: soc: qcom: mdt_loader: Ensure w In the Linux kernel, the following vulnerability has been resolved: soc: qcom: mdt_loader: Ensure we don't read past the ELF header When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients. Validate the size of the firmware buffer to ensure that we don't read past the end as we

CVE-2025-39694 [MEDIUM] CWE-476 CVE-2025-39694: In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix SCCB present che In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix SCCB present check Tracing code called by the SCLP interrupt handler contains early exits if the SCCB address associated with an interrupt is NULL. This check is performed after physical to virtual address translation. If the kernel identity mapping does not start a

CVE-2025-38576 [MEDIUM] CVE-2025-38576: In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: Make EEH driver de In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: Make EEH driver device hotplug safe Multiple race conditions existed between the PCIe hotplug driver and the EEH driver, leading to a variety of kernel oopses of the same general nature: A second class of oops is also seen when the underlying bus disappears during device rec

CVE-2025-39795 [MEDIUM] CWE-674 CVE-2025-39795: In the Linux kernel, the following vulnerability has been resolved: block: avoid possible overflow In the Linux kernel, the following vulnerability has been resolved: block: avoid possible overflow for chunk_sectors check in blk_stack_limits() In blk_stack_limits(), we check that the t->chunk_sectors value is a multiple of the t->physical_block_size value. However, by finding the chunk_sectors value in bytes, we may overflow the unsigned int whi

CVE-2025-38623 [MEDIUM] CVE-2025-38623: In the Linux kernel, the following vulnerability has been resolved: PCI: pnv_php: Fix surprise plug In the Linux kernel, the following vulnerability has been resolved: PCI: pnv_php: Fix surprise plug detection and recovery The existing PowerNV hotplug code did not handle surprise plug events correctly, leading to a complete failure of the hotplug system after device removal and a required reboot to detect new devices. This comes down to two issues: 1)

CVE-2025-38668 [MEDIUM] CWE-476 CVE-2025-38668: In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix NULL deref In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix NULL dereference on unbind due to stale coupling data Failing to reset coupling_desc.n_coupled after freeing coupled_rdevs can lead to NULL pointer dereference when regulators are accessed post-unbind. This can happen during runtime PM or other regulator opera