Debian Linux vulnerabilities

CVE-2023-52694 [MEDIUM] CVE-2023-52694: In the Linux kernel, the following vulnerability has been resolved: drm/bridge: tpd12s015: Drop bug In the Linux kernel, the following vulnerability has been resolved: drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function With tpd12s015_remove() marked with __exit this function is discarded when the driver is compiled as a built-in. The result is that when the driver unbinds there is no cleanup done which results in resource leakage or

CVE-2024-26970 [MEDIUM] CWE-125 CVE-2024-26970: In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq6018: fix ter In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed b

CVE-2024-26788 [MEDIUM] CWE-908 CVE-2024-26788: In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: init irq a In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: init irq after reg initialization Initialize the qDMA irqs after the registers are configured so that interrupts that may have been pending from a primary kernel don't get processed by the irq handler before it is ready to and cause panic with the following tra

CVE-2024-26707 [MEDIUM] CWE-770 CVE-2024-26707: In the Linux kernel, the following vulnerability has been resolved: net: hsr: remove WARN_ONCE() in In the Linux kernel, the following vulnerability has been resolved: net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame() Syzkaller reported [1] hitting a warning after failing to allocate resources for skb in hsr_init_skb(). Since a WARN_ONCE() call will not help much in this case, it might be prudent to switch to netdev_warn_once(). At the

CVE-2024-35922 [MEDIUM] CWE-369 CVE-2024-35922: In the Linux kernel, the following vulnerability has been resolved: fbmon: prevent division by zero In the Linux kernel, the following vulnerability has been resolved: fbmon: prevent division by zero in fb_videomode_from_videomode() The expression htotal * vtotal can have a zero value on overflow. It is necessary to prevent division by zero like in fb_var_to_videomode(). Found by Linux Verification Center (linuxtesting.org) with Svace.

CVE-2024-35837 [MEDIUM] CVE-2024-35837: In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: clear BM pool befor In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: clear BM pool before initialization Register value persist after booting the kernel using kexec which results in kernel panic. Thus clear the BM pool registers before initialisation to fix the issue.

CVE-2014-2326 [MEDIUM] CWE-79 CVE-2014-2326: Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows rem Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2025-37773 [MEDIUM] CVE-2025-37773: In the Linux kernel, the following vulnerability has been resolved: virtiofs: add filesystem contex In the Linux kernel, the following vulnerability has been resolved: virtiofs: add filesystem context source name check In certain scenarios, for example, during fuzz testing, the source name may be NULL, which could lead to a kernel panic. Therefore, an extra check for the source name should be added.

CVE-2025-37792 [MEDIUM] CWE-476 CVE-2025-37792: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Prevent poten In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Prevent potential NULL dereference The btrtl_initialize() function checks that rtl_load_file() either had an error or it loaded a zero length file. However, if it loaded a zero length file then the error code is not set correctly. It results in an error pointer vs

CVE-2025-37740 [MEDIUM] CWE-369 CVE-2025-37740: In the Linux kernel, the following vulnerability has been resolved: jfs: add sanity check for agwid In the Linux kernel, the following vulnerability has been resolved: jfs: add sanity check for agwidth in dbMount The width in dmapctl of the AG is zero, it trigger a divide error when calculating the control page level in dbAllocAG. To avoid this issue, add a check for agwidth in dbAllocAG.

CVE-2024-26679 [MEDIUM] CWE-667 CVE-2024-26679: In the Linux kernel, the following vulnerability has been resolved: inet: read sk->sk_family once i In the Linux kernel, the following vulnerability has been resolved: inet: read sk->sk_family once in inet_recv_error() inet_recv_error() is called without holding the socket lock. IPv6 socket could mutate to IPv4 with IPV6_ADDRFORM socket option and trigger a KCSAN warning.

CVE-2025-38696 [MEDIUM] CWE-476 CVE-2025-38696: In the Linux kernel, the following vulnerability has been resolved: MIPS: Don't crash in stack_top( In the Linux kernel, the following vulnerability has been resolved: MIPS: Don't crash in stack_top() for tasks without ABI or vDSO Not all tasks have an ABI associated or vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_top(), it will derefence the NULL ABI pointer and crash. This can for example happen when us

CVE-2025-38095 [MEDIUM] CWE-476 CVE-2025-38095: In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert memory barrier In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert memory barrier before updating num_fences smp_store_mb() inserts memory barrier after storing operation. It is different with what the comment is originally aiming so Null pointer dereference can be happened if memory update is reordered.

CVE-2025-38074 [MEDIUM] CVE-2025-38074: In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: protect vq->log_use In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: protect vq->log_used with vq->mutex The vhost-scsi completion path may access vq->log_base when vq->log_used is already set to false. vhost-thread QEMU-thread vhost_scsi_complete_cmd_work() -> vhost_add_used() -> vhost_add_used_n() if (unlikely(vq->log_used)) QEMU disables vq

CVE-2025-37830 [MEDIUM] CWE-476 CVE-2025-37830: In the Linux kernel, the following vulnerability has been resolved: cpufreq: scmi: Fix null-ptr-der In the Linux kernel, the following vulnerability has been resolved: cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() cpufreq_cpu_get_raw() can return NULL when the target CPU is not present in the policy->cpus mask. scmi_cpufreq_get_rate() does not check for this case, which results in a NULL pointer dereference. Add NULL check after c

CVE-2025-37930 [MEDIUM] CWE-617 CVE-2025-37930: In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix WARN_ON in nou In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() Nouveau is mostly designed in a way that it's expected that fences only ever get signaled through nouveau_fence_signal(). However, in at least one other place, nouveau_fence_done(), can signal fences, too. If that happens (ra

CVE-2025-38135 [MEDIUM] CWE-476 CVE-2025-38135: In the Linux kernel, the following vulnerability has been resolved: serial: Fix potential null-ptr- In the Linux kernel, the following vulnerability has been resolved: serial: Fix potential null-ptr-deref in mlb_usio_probe() devm_ioremap() can return NULL on error. Currently, mlb_usio_probe() does not check for this case, which could result in a NULL pointer dereference. Add NULL check after devm_ioremap() to prevent this issue.

CVE-2025-38023 [MEDIUM] CWE-476 CVE-2025-38023: In the Linux kernel, the following vulnerability has been resolved: nfs: handle failure of nfs_get_ In the Linux kernel, the following vulnerability has been resolved: nfs: handle failure of nfs_get_lock_context in unlock path When memory is insufficient, the allocation of nfs_lock_context in nfs_get_lock_context() fails and returns -ENOMEM. If we mistakenly treat an nfs4_unlockdata structure (whose l_ctx member has been set to -ENOMEM) as valid

CVE-2025-37811 [MEDIUM] CWE-476 CVE-2025-37811: In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: ci_hdrc_imx: fix In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: ci_hdrc_imx: fix usbmisc handling usbmisc is an optional device property so it is totally valid for the corresponding data->usbmisc_data to have a NULL value. Check that before dereferencing the pointer. Found by Linux Verification Center (linuxtesting.org) with Sv

CVE-2025-37748 [MEDIUM] CWE-476 CVE-2025-37748: In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: Fix NULL pointe In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group Currently, mtk_iommu calls during probe iommu_device_register before the hw_list from driver data is initialized. Since iommu probing issue fix, it leads to NULL pointer dereference in mtk_iommu_device_group when