Debian Linux vulnerabilities

CVE-2024-36954 [MEDIUM] CWE-401 CVE-2024-36954: In the Linux kernel, the following vulnerability has been resolved: tipc: fix a possible memleak in In the Linux kernel, the following vulnerability has been resolved: tipc: fix a possible memleak in tipc_buf_append __skb_linearize() doesn't free the skb when it fails, so move '*buf = NULL' after __skb_linearize(), so that the skb can be freed on the err path.

CVE-2023-52693 [MEDIUM] CVE-2023-52693: In the Linux kernel, the following vulnerability has been resolved: ACPI: video: check for error wh In the Linux kernel, the following vulnerability has been resolved: ACPI: video: check for error while searching for backlight device parent If acpi_get_parent() called in acpi_video_dev_register_backlight() fails, for example, because acpi_ut_acquire_mutex() fails inside acpi_get_parent), this can lead to incorrect (uninitialized) acpi_parent handle being

CVE-2024-26997 [MEDIUM] CWE-476 CVE-2024-26997: In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: host: Fix dereferenc In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: host: Fix dereference issue in DDMA completion flow. Fixed variable dereference issue in DDMA completion flow.

CVE-2024-27413 [MEDIUM] CVE-2024-27413: In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorre In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect allocation size gcc-14 notices that the allocation with sizeof(void) on 32-bit architectures is not enough for a 64-bit phys_addr_t: drivers/firmware/efi/capsule-loader.c: In function 'efi_capsule_open': drivers/firmware/efi/capsule-loader.c:295:24: error

CVE-2023-52880 [MEDIUM] CVE-2023-52880: In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: require CAP_NET_ADM In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc Any unprivileged user can attach N_GSM0710 ldisc, but it requires CAP_NET_ADMIN to create a GSM network anyway. Require initial namespace CAP_NET_ADMIN to do that.

CVE-2024-26751 [MEDIUM] CVE-2024-26751: In the Linux kernel, the following vulnerability has been resolved: ARM: ep93xx: Add terminator to In the Linux kernel, the following vulnerability has been resolved: ARM: ep93xx: Add terminator to gpiod_lookup_table Without the terminator, if a con_id is passed to gpio_find() that does not exist in the lookup table the function will not stop looping correctly, and eventually cause an oops.

CVE-2024-26659 [MEDIUM] CWE-787 CVE-2024-26659: In the Linux kernel, the following vulnerability has been resolved: xhci: handle isoc Babble and Bu In the Linux kernel, the following vulnerability has been resolved: xhci: handle isoc Babble and Buffer Overrun events properly xHCI 4.9 explicitly forbids assuming that the xHC has released its ownership of a multi-TRB TD when it reports an error on one of the early TRBs. Yet the driver makes such assumption and releases the TD, allowing the remai

CVE-2023-52616 [MEDIUM] CVE-2023-52616: In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - Fix unexpecte In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init When the mpi_ec_ctx structure is initialized, some fields are not cleared, causing a crash when referencing the field when the structure was released. Initially, this issue was ignored because memory for mpi_ec_ctx is allocated

CVE-2024-26820 [MEDIUM] CVE-2024-26820: In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Register VF in netvs In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed If hv_netvsc driver is unloaded and reloaded, the NET_DEVICE_REGISTER handler cannot perform VF register successfully as the register call is received before netvsc_probe is finished. This is because we register register_

CVE-2024-27414 [MEDIUM] CVE-2024-27414: In the Linux kernel, the following vulnerability has been resolved: rtnetlink: fix error logic of I In the Linux kernel, the following vulnerability has been resolved: rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back In the commit d73ef2d69c0d ("rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length"), an adjustment was made to the old loop logic in the function `rtnl_bridge_setlink` to enable the loop to also check the length of t

CVE-2024-35819 [MEDIUM] CVE-2024-35819: In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: Use raw spinlo In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: Use raw spinlock for cgr_lock smp_call_function always runs its callback in hard IRQ context, even on PREEMPT_RT, where spinlocks can sleep. So we need to use a raw spinlock for cgr_lock to ensure we aren't waiting on a sleeping task. Although this bug has existed for a w

CVE-2024-35936 [MEDIUM] CVE-2024-35936: In the Linux kernel, the following vulnerability has been resolved: btrfs: handle chunk tree lookup In the Linux kernel, the following vulnerability has been resolved: btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() The unhandled case in btrfs_relocate_sys_chunks() loop is a corruption, as it could be caused only by two impossible conditions: - at first the search key is set up to look for a chunk tree item, with offset -1, this is

CVE-2025-37930 [MEDIUM] CWE-617 CVE-2025-37930: In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix WARN_ON in nou In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() Nouveau is mostly designed in a way that it's expected that fences only ever get signaled through nouveau_fence_signal(). However, in at least one other place, nouveau_fence_done(), can signal fences, too. If that happens (ra

CVE-2024-36953 [MEDIUM] CWE-476 CVE-2024-36953: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v2: Check for In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() vgic_v2_parse_attr() is responsible for finding the vCPU that matches the user-provided CPUID, which (of course) may not be valid. If the ID is invalid, kvm_get_vcpu_by_id() returns NULL, which isn't handled gracef

CVE-2025-38065 [MEDIUM] CVE-2025-38065: In the Linux kernel, the following vulnerability has been resolved: orangefs: Do not truncate file In the Linux kernel, the following vulnerability has been resolved: orangefs: Do not truncate file size 'len' is used to store the result of i_size_read(), so making 'len' a size_t results in truncation to 4GiB on 32-bit systems.

CVE-2023-52694 [MEDIUM] CVE-2023-52694: In the Linux kernel, the following vulnerability has been resolved: drm/bridge: tpd12s015: Drop bug In the Linux kernel, the following vulnerability has been resolved: drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function With tpd12s015_remove() marked with __exit this function is discarded when the driver is compiled as a built-in. The result is that when the driver unbinds there is no cleanup done which results in resource leakage or

CVE-2024-35900 [MEDIUM] CVE-2024-35900: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject ne In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject new basechain after table flag update When dormant flag is toggled, hooks are disabled in the commit phase by iterating over current chains in table (existing and new). The following configuration allows for an inconsistent state: add table x add chain x y {

CVE-2024-26970 [MEDIUM] CWE-125 CVE-2024-26970: In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq6018: fix ter In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed b

CVE-2024-26788 [MEDIUM] CWE-908 CVE-2024-26788: In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: init irq a In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: init irq after reg initialization Initialize the qDMA irqs after the registers are configured so that interrupts that may have been pending from a primary kernel don't get processed by the irq handler before it is ready to and cause panic with the following tra

CVE-2024-26707 [MEDIUM] CWE-770 CVE-2024-26707: In the Linux kernel, the following vulnerability has been resolved: net: hsr: remove WARN_ONCE() in In the Linux kernel, the following vulnerability has been resolved: net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame() Syzkaller reported [1] hitting a warning after failing to allocate resources for skb in hsr_init_skb(). Since a WARN_ONCE() call will not help much in this case, it might be prudent to switch to netdev_warn_once(). At the