Debian Linux vulnerabilities

CVE-2022-3061 [MEDIUM] CWE-369 CVE-2022-3061: Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the drive Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by zero error.

CVE-2025-37883 [MEDIUM] CWE-476 CVE-2025-37883: In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Add check for get_ze In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Add check for get_zeroed_page() Add check for the return value of get_zeroed_page() in sclp_console_init() to prevent null pointer dereference. Furthermore, to solve the memory leak caused by the loop allocation, add a free helper to do the free job.

CVE-2023-52670 [MEDIUM] CWE-401 CVE-2023-52670: In the Linux kernel, the following vulnerability has been resolved: rpmsg: virtio: Free driver_over In the Linux kernel, the following vulnerability has been resolved: rpmsg: virtio: Free driver_override when rpmsg_remove() Free driver_override when rpmsg_remove(), otherwise the following memory leak will occur: unreferenced object 0xffff0000d55d7080 (size 128): comm "kworker/u8:2", pid 56, jiffies 4294893188 (age 214.272s) hex dump (first 32 by

CVE-2024-26870 [MEDIUM] CVE-2024-26870: In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix nfs4_listxattr ker In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 A call to listxattr() with a buffer size = 0 returns the actual size of the buffer needed for a subsequent call. When size > 0, nfs4_listxattr() does not return an error because either generic_listxattr() or nfs4_listxattr_nfs4_la

CVE-2024-27044 [MEDIUM] CWE-476 CVE-2024-27044: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()' The 'stream' pointer is used in dcn10_set_output_transfer_func() before the check if 'stream' is NULL. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn10/dcn10_hwseq.c:1

CVE-2023-6915 [MEDIUM] CWE-476 CVE-2023-6915: A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issu A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return.

CVE-2022-34680 [MEDIUM] CWE-197 CVE-2022-34680: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an integer truncation can lead to an out-of-bounds read, which may lead to denial of service.

CVE-2024-26735 [MEDIUM] CWE-416 CVE-2024-26735: In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix possible use-afte In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix possible use-after-free and null-ptr-deref The pernet operations structure for the subsystem must be registered before registering the generic netlink family.

CVE-2023-52882 [MEDIUM] CVE-2023-52882: In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-ng: h6: Reparent CPU In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change While PLL CPUX clock rate change when CPU is running from it works in vast majority of cases, now and then it causes instability. This leads to system crashes and other undefined behaviour. After a lot of testing (30+ hours) whil

CVE-2024-56705 [MEDIUM] CWE-617 CVE-2024-56705: In the Linux kernel, the following vulnerability has been resolved: media: atomisp: Add check for r In the Linux kernel, the following vulnerability has been resolved: media: atomisp: Add check for rgby_data memory allocation failure In ia_css_3a_statistics_allocate(), there is no check on the allocation result of the rgby_data memory. If rgby_data is not successfully allocated, it may trigger the assert(host_stats->rgby_data) assertion in ia_css

CVE-2024-26642 [MEDIUM] CVE-2024-26642: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow anonymous set with timeout flag Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work.

CVE-2024-26925 [MEDIUM] CWE-667 CVE-2024-26925: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release m In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path The commit mutex should not be released during the critical section between nft_gc_seq_begin() and nft_gc_seq_end(), otherwise, async GC worker could collect expired objects and get the released commit lock wi

CVE-2015-2697 [MEDIUM] CWE-125 CVE-2015-2697: The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.

CVE-2024-36946 [MEDIUM] CWE-401 CVE-2024-36946: In the Linux kernel, the following vulnerability has been resolved: phonet: fix rtm_phonet_notify() In the Linux kernel, the following vulnerability has been resolved: phonet: fix rtm_phonet_notify() skb allocation fill_route() stores three components in the skb: - struct rtmsg - RTA_DST (u8) - RTA_OIF (u32) Therefore, rtm_phonet_notify() should use NLMSG_ALIGN(sizeof(struct rtmsg)) + nla_total_size(1) + nla_total_size(4)

CVE-2024-26697 [MEDIUM] CWE-787 CVE-2024-26697: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix data corruption in In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix data corruption in dsync block recovery for small block sizes The helper function nilfs_recovery_copy_block() of nilfs_recovery_dsync_blocks(), which recovers data from logs created by data sync writes during a mount after an unclean shutdown, incorrectly calculates the

CVE-2024-35950 [MEDIUM] CVE-2024-35950: In the Linux kernel, the following vulnerability has been resolved: drm/client: Fully protect modes In the Linux kernel, the following vulnerability has been resolved: drm/client: Fully protect modes[] with dev->mode_config.mutex The modes[] array contains pointers to modes on the connectors' mode lists, which are protected by dev->mode_config.mutex. Thus we need to extend modes[] the same protection or by the time we use it the elements may already be p

CVE-2023-52672 [MEDIUM] CWE-400 CVE-2023-52672: In the Linux kernel, the following vulnerability has been resolved: pipe: wakeup wr_wait after sett In the Linux kernel, the following vulnerability has been resolved: pipe: wakeup wr_wait after setting max_usage Commit c73be61cede5 ("pipe: Add general notification queue support") a regression was introduced that would lock up resized pipes under certain conditions. See the reproducer in [1]. The commit resizing the pipe ring size was moved to a

CVE-2023-52683 [MEDIUM] CVE-2023-52683: In the Linux kernel, the following vulnerability has been resolved: ACPI: LPIT: Avoid u32 multiplic In the Linux kernel, the following vulnerability has been resolved: ACPI: LPIT: Avoid u32 multiplication overflow In lpit_update_residency() there is a possibility of overflow in multiplication, if tsc_khz is large enough (> UINT_MAX/1000). Change multiplication to mul_u32_u32(). Found by Linux Verification Center (linuxtesting.org) with SVACE.

CVE-2024-35897 [MEDIUM] CVE-2024-35897: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: discard t In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: discard table flag update with pending basechain deletion Hook unregistration is deferred to the commit phase, same occurs with hook updates triggered by the table dormant flag. When both commands are combined, this results in deleting a basechain while leaving its ho

CVE-2024-26663 [MEDIUM] CWE-476 CVE-2024-26663: In the Linux kernel, the following vulnerability has been resolved: tipc: Check the bearer type bef In the Linux kernel, the following vulnerability has been resolved: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() syzbot reported the following general protection fault [1]: general protection fault, probably for non-canonical address 0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000