Debian Linux vulnerabilities

CVE-2025-38639 [MEDIUM] CVE-2025-38639: In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nfacct: don't ass In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nfacct: don't assume acct name is null-terminated BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721 Read of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851 [..] string+0x231/0x2b0 lib/vsprintf.c:721 vsnprintf+0x739/0xf00 lib/vsprintf.c:2874 [..] nfacct_mt_c

CVE-2025-39684 [MEDIUM] CWE-908 CVE-2025-39684: In the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialize In the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() syzbot reports a KMSAN kernel-infoleak in `do_insn_ioctl()`. A kernel buffer is allocated to hold `insn->n` samples (each of which is an `unsigned int`). For some instruction types, `insn->n` samples

CVE-2025-38145 [MEDIUM] CWE-476 CVE-2025-38145: In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: Add NULL check in In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() devm_kasprintf() returns NULL when memory allocation fails. Currently, aspeed_lpc_enable_snoop() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this

CVE-2024-26781 [MEDIUM] CWE-667 CVE-2024-26781: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix possible deadlock in In the Linux kernel, the following vulnerability has been resolved: mptcp: fix possible deadlock in subflow diag Syzbot and Eric reported a lockdep splat in the subflow diag: WARNING: possible circular locking dependency detected 6.8.0-rc4-syzkaller-00212-g40b9385dd8e6 #0 Not tainted syz-executor.2/24141 is trying to acquire lock: ffff88804587013

CVE-2025-38732 [MEDIUM] CVE-2025-38732: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject: don't lea In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject: don't leak dst refcount for loopback packets recent patches to add a WARN() when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skb_dst_set i

CVE-2025-38700 [MEDIUM] CWE-476 CVE-2025-38700: In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Initialize iscs In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated In case of an ib_fast_reg_mr allocation failure during iSER setup, the machine hits a panic because iscsi_conn->dd_data is initialized unconditionally, even when no memory is allocated (dd_size == 0). This l

CVE-2025-38138 [MEDIUM] CWE-476 CVE-2025-38138: In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: Add NULL check i In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: Add NULL check in udma_probe() devm_kasprintf() returns NULL when memory allocation fails. Currently, udma_probe() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue.

CVE-2025-38693 [MEDIUM] CWE-476 CVE-2025-38693: In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: w7090p: f In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2

CVE-2025-38635 [MEDIUM] CWE-476 CVE-2025-38635: In the Linux kernel, the following vulnerability has been resolved: clk: davinci: Add NULL check in In the Linux kernel, the following vulnerability has been resolved: clk: davinci: Add NULL check in davinci_lpsc_clk_register() devm_kasprintf() returns NULL when memory allocation fails. Currently, davinci_lpsc_clk_register() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to preven

CVE-2025-38498 [MEDIUM] CVE-2025-38498: In the Linux kernel, the following vulnerability has been resolved: do_change_type(): refuse to ope In the Linux kernel, the following vulnerability has been resolved: do_change_type(): refuse to operate on unmounted/not ours mounts Ensure that propagation settings can only be changed for mounts located in the caller's mount namespace. This change aligns permission checking with the rest of mount(2).

CVE-2025-38406 [MEDIUM] CVE-2025-38406: In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: remove WARN on ba In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: remove WARN on bad firmware input If the firmware gives bad input, that's nothing to do with the driver's stack at this point etc., so the WARN_ON() doesn't add any value. Additionally, this is one of the top syzbot reports now. Just print a message, and as an added bonus, pr

CVE-2025-38143 [MEDIUM] CWE-476 CVE-2025-38143: In the Linux kernel, the following vulnerability has been resolved: backlight: pm8941: Add NULL che In the Linux kernel, the following vulnerability has been resolved: backlight: pm8941: Add NULL check in wled_configure() devm_kasprintf() returns NULL when memory allocation fails. Currently, wled_configure() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue.

CVE-2025-38097 [MEDIUM] CVE-2025-38097: In the Linux kernel, the following vulnerability has been resolved: espintcp: remove encap socket c In the Linux kernel, the following vulnerability has been resolved: espintcp: remove encap socket caching to avoid reference leak The current scheme for caching the encap socket can lead to reference leaks when we try to delete the netns. The reference chain is: xfrm_state -> enacp_sk -> netns Since the encap socket is a userspace socket, it holds a refe

CVE-2025-38031 [MEDIUM] CVE-2025-38031: In the Linux kernel, the following vulnerability has been resolved: padata: do not leak refcount in In the Linux kernel, the following vulnerability has been resolved: padata: do not leak refcount in reorder_work A recent patch that addressed a UAF introduced a reference count leak: the parallel_data refcount is incremented unconditionally, regardless of the return value of queue_work(). If the work item is already queued, the incremented refcount is nev

CVE-2025-38072 [MEDIUM] CWE-908 CVE-2025-38072: In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Fix divide er In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Fix divide error in nd_label_data_init() If a faulty CXL memory device returns a broken zero LSA size in its memory device information (Identify Memory Device (Opcode 4000h), CXL spec. 3.1, 8.2.9.9.1.1), a divide error occurs in the libnvdimm driver: Oops: divide

CVE-2025-37994 [MEDIUM] CWE-476 CVE-2025-37994: In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix NULL pointer access This patch ensures that the UCSI driver waits for all pending tasks in the ucsi_displayport_work workqueue to finish executing before proceeding with the partner removal.

CVE-2025-37995 [MEDIUM] CWE-824 CVE-2025-37995: In the Linux kernel, the following vulnerability has been resolved: module: ensure that kobject_put In the Linux kernel, the following vulnerability has been resolved: module: ensure that kobject_put() is safe for module type kobjects In 'lookup_or_create_module_kobject()', an internal kobject is created using 'module_ktype'. So call to 'kobject_put()' on error handling path causes an attempt to use an uninitialized completion pointer in 'module_

CVE-2025-37938 [MEDIUM] CWE-476 CVE-2025-37938: In the Linux kernel, the following vulnerability has been resolved: tracing: Verify event formats t In the Linux kernel, the following vulnerability has been resolved: tracing: Verify event formats that have "%*p.." The trace event verifier checks the formats of trace events to make sure that they do not point at memory that is not in the trace event itself or in data that will never be freed. If an event references data that was allocated when t

CVE-2025-38539 [MEDIUM] CVE-2025-38539: In the Linux kernel, the following vulnerability has been resolved: tracing: Add down_write(trace_e In the Linux kernel, the following vulnerability has been resolved: tracing: Add down_write(trace_event_sem) when adding trace event When a module is loaded, it adds trace events defined by the module. It may also need to modify the modules trace printk formats to replace enum names with their values. If two modules are loaded at the same time, the adding

CVE-2025-39714 [MEDIUM] CVE-2025-39714: In the Linux kernel, the following vulnerability has been resolved: media: usbtv: Lock resolution w In the Linux kernel, the following vulnerability has been resolved: media: usbtv: Lock resolution while streaming When an program is streaming (ffplay) and another program (qv4l2) changes the TV standard from NTSC to PAL, the kernel crashes due to trying to copy to unmapped memory. Changing from NTSC to PAL increases the resolution in the usbtv struct, bu