Debian Linux vulnerabilities

CVE-2024-26777 [MEDIUM] CVE-2024-26777: In the Linux kernel, the following vulnerability has been resolved: fbdev: sis: Error out if pixclo In the Linux kernel, the following vulnerability has been resolved: fbdev: sis: Error out if pixclock equals zero The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may cause divide-by-zero error. In sisfb_check_var(), var->pixclock is used as a divisor to caculate dra

CVE-2025-39798 [MEDIUM] CVE-2025-39798: In the Linux kernel, the following vulnerability has been resolved: NFS: Fix the setting of capabil In the Linux kernel, the following vulnerability has been resolved: NFS: Fix the setting of capabilities when automounting a new filesystem Capabilities cannot be inherited when we cross into a new filesystem. They need to be reset to the minimal defaults, and then probed for again.

CVE-2023-52683 [MEDIUM] CVE-2023-52683: In the Linux kernel, the following vulnerability has been resolved: ACPI: LPIT: Avoid u32 multiplic In the Linux kernel, the following vulnerability has been resolved: ACPI: LPIT: Avoid u32 multiplication overflow In lpit_update_residency() there is a possibility of overflow in multiplication, if tsc_khz is large enough (> UINT_MAX/1000). Change multiplication to mul_u32_u32(). Found by Linux Verification Center (linuxtesting.org) with SVACE.

CVE-2025-37883 [MEDIUM] CWE-476 CVE-2025-37883: In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Add check for get_ze In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Add check for get_zeroed_page() Add check for the return value of get_zeroed_page() in sclp_console_init() to prevent null pointer dereference. Furthermore, to solve the memory leak caused by the loop allocation, add a free helper to do the free job.

CVE-2024-36954 [MEDIUM] CWE-401 CVE-2024-36954: In the Linux kernel, the following vulnerability has been resolved: tipc: fix a possible memleak in In the Linux kernel, the following vulnerability has been resolved: tipc: fix a possible memleak in tipc_buf_append __skb_linearize() doesn't free the skb when it fails, so move '*buf = NULL' after __skb_linearize(), so that the skb can be freed on the err path.

CVE-2024-35897 [MEDIUM] CVE-2024-35897: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: discard t In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: discard table flag update with pending basechain deletion Hook unregistration is deferred to the commit phase, same occurs with hook updates triggered by the table dormant flag. When both commands are combined, this results in deleting a basechain while leaving its ho

CVE-2023-52693 [MEDIUM] CVE-2023-52693: In the Linux kernel, the following vulnerability has been resolved: ACPI: video: check for error wh In the Linux kernel, the following vulnerability has been resolved: ACPI: video: check for error while searching for backlight device parent If acpi_get_parent() called in acpi_video_dev_register_backlight() fails, for example, because acpi_ut_acquire_mutex() fails inside acpi_get_parent), this can lead to incorrect (uninitialized) acpi_parent handle being

CVE-2024-26997 [MEDIUM] CWE-476 CVE-2024-26997: In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: host: Fix dereferenc In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: host: Fix dereference issue in DDMA completion flow. Fixed variable dereference issue in DDMA completion flow.

CVE-2023-52880 [MEDIUM] CVE-2023-52880: In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: require CAP_NET_ADM In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc Any unprivileged user can attach N_GSM0710 ldisc, but it requires CAP_NET_ADMIN to create a GSM network anyway. Require initial namespace CAP_NET_ADMIN to do that.

CVE-2024-26751 [MEDIUM] CVE-2024-26751: In the Linux kernel, the following vulnerability has been resolved: ARM: ep93xx: Add terminator to In the Linux kernel, the following vulnerability has been resolved: ARM: ep93xx: Add terminator to gpiod_lookup_table Without the terminator, if a con_id is passed to gpio_find() that does not exist in the lookup table the function will not stop looping correctly, and eventually cause an oops.

CVE-2024-27413 [MEDIUM] CVE-2024-27413: In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorre In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect allocation size gcc-14 notices that the allocation with sizeof(void) on 32-bit architectures is not enough for a 64-bit phys_addr_t: drivers/firmware/efi/capsule-loader.c: In function 'efi_capsule_open': drivers/firmware/efi/capsule-loader.c:295:24: error

CVE-2024-26697 [MEDIUM] CWE-787 CVE-2024-26697: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix data corruption in In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix data corruption in dsync block recovery for small block sizes The helper function nilfs_recovery_copy_block() of nilfs_recovery_dsync_blocks(), which recovers data from logs created by data sync writes during a mount after an unclean shutdown, incorrectly calculates the

CVE-2023-52619 [MEDIUM] CVE-2023-52619: In the Linux kernel, the following vulnerability has been resolved: pstore/ram: Fix crash when sett In the Linux kernel, the following vulnerability has been resolved: pstore/ram: Fix crash when setting number of cpus to an odd number When the number of cpu cores is adjusted to 7 or other odd numbers, the zone size will become an odd number. The address of the zone will become: addr of zone0 = BASE addr of zone1 = BASE + zone_size addr of zone2 = BASE +

CVE-2024-26659 [MEDIUM] CWE-787 CVE-2024-26659: In the Linux kernel, the following vulnerability has been resolved: xhci: handle isoc Babble and Bu In the Linux kernel, the following vulnerability has been resolved: xhci: handle isoc Babble and Buffer Overrun events properly xHCI 4.9 explicitly forbids assuming that the xHC has released its ownership of a multi-TRB TD when it reports an error on one of the early TRBs. Yet the driver makes such assumption and releases the TD, allowing the remai

CVE-2023-52616 [MEDIUM] CVE-2023-52616: In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - Fix unexpecte In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init When the mpi_ec_ctx structure is initialized, some fields are not cleared, causing a crash when referencing the field when the structure was released. Initially, this issue was ignored because memory for mpi_ec_ctx is allocated

CVE-2024-26820 [MEDIUM] CVE-2024-26820: In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Register VF in netvs In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed If hv_netvsc driver is unloaded and reloaded, the NET_DEVICE_REGISTER handler cannot perform VF register successfully as the register call is received before netvsc_probe is finished. This is because we register register_

CVE-2024-27414 [MEDIUM] CVE-2024-27414: In the Linux kernel, the following vulnerability has been resolved: rtnetlink: fix error logic of I In the Linux kernel, the following vulnerability has been resolved: rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back In the commit d73ef2d69c0d ("rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length"), an adjustment was made to the old loop logic in the function `rtnl_bridge_setlink` to enable the loop to also check the length of t

CVE-2024-35819 [MEDIUM] CVE-2024-35819: In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: Use raw spinlo In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: Use raw spinlock for cgr_lock smp_call_function always runs its callback in hard IRQ context, even on PREEMPT_RT, where spinlocks can sleep. So we need to use a raw spinlock for cgr_lock to ensure we aren't waiting on a sleeping task. Although this bug has existed for a w

CVE-2024-36953 [MEDIUM] CWE-476 CVE-2024-36953: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v2: Check for In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() vgic_v2_parse_attr() is responsible for finding the vCPU that matches the user-provided CPUID, which (of course) may not be valid. If the ID is invalid, kvm_get_vcpu_by_id() returns NULL, which isn't handled gracef

CVE-2024-35900 [MEDIUM] CVE-2024-35900: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject ne In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject new basechain after table flag update When dormant flag is toggled, hooks are disabled in the commit phase by iterating over current chains in table (existing and new). The following configuration allows for an inconsistent state: add table x add chain x y {