Debian Linux vulnerabilities

CVE-2025-37765 [MEDIUM] CWE-416 CVE-2025-37765: In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: prime: fix ttm_bo_ In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: prime: fix ttm_bo_delayed_delete oops Fix an oops in ttm_bo_delayed_delete which results from dererencing a dangling pointer: Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b7b: 0000 [#1] PREEMPT SMP CPU: 4 UID: 0 PID: 1082 Comm: kwo

CVE-2025-37994 [MEDIUM] CWE-476 CVE-2025-37994: In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix NULL pointer access This patch ensures that the UCSI driver waits for all pending tasks in the ucsi_displayport_work workqueue to finish executing before proceeding with the partner removal.

CVE-2025-37995 [MEDIUM] CWE-824 CVE-2025-37995: In the Linux kernel, the following vulnerability has been resolved: module: ensure that kobject_put In the Linux kernel, the following vulnerability has been resolved: module: ensure that kobject_put() is safe for module type kobjects In 'lookup_or_create_module_kobject()', an internal kobject is created using 'module_ktype'. So call to 'kobject_put()' on error handling path causes an attempt to use an uninitialized completion pointer in 'module_

CVE-2024-35837 [MEDIUM] CVE-2024-35837: In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: clear BM pool befor In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: clear BM pool before initialization Register value persist after booting the kernel using kexec which results in kernel panic. Thus clear the BM pool registers before initialisation to fix the issue.

CVE-2014-2326 [MEDIUM] CWE-79 CVE-2014-2326: Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows rem Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2025-38498 [MEDIUM] CVE-2025-38498: In the Linux kernel, the following vulnerability has been resolved: do_change_type(): refuse to ope In the Linux kernel, the following vulnerability has been resolved: do_change_type(): refuse to operate on unmounted/not ours mounts Ensure that propagation settings can only be changed for mounts located in the caller's mount namespace. This change aligns permission checking with the rest of mount(2).

CVE-2025-38177 [MEDIUM] CWE-459 CVE-2025-38177: In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make hfsc_qlen_notify In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make hfsc_qlen_notify() idempotent hfsc_qlen_notify() is not idempotent either and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers' life: 1. update_vf() decreases cl->cl_nactive, so we can check w

CVE-2025-37992 [MEDIUM] CWE-476 CVE-2025-37992: In the Linux kernel, the following vulnerability has been resolved: net_sched: Flush gso_skb list t In the Linux kernel, the following vulnerability has been resolved: net_sched: Flush gso_skb list too during ->change() Previously, when reducing a qdisc's limit via the ->change() operation, only the main skb queue was trimmed, potentially leaving packets in the gso_skb list. This could result in NULL pointer dereference when we only check sch->li

CVE-2025-23160 [MEDIUM] CWE-401 CVE-2025-23160: In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix a In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization On Mediatek devices with a system companion processor (SCP) the mtk_scp structure has to be removed explicitly to avoid a resource leak. Free the structure in case the allocation of the firmw

CVE-2025-38095 [MEDIUM] CWE-476 CVE-2025-38095: In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert memory barrier In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert memory barrier before updating num_fences smp_store_mb() inserts memory barrier after storing operation. It is different with what the comment is originally aiming so Null pointer dereference can be happened if memory update is reordered.

CVE-2025-38031 [MEDIUM] CVE-2025-38031: In the Linux kernel, the following vulnerability has been resolved: padata: do not leak refcount in In the Linux kernel, the following vulnerability has been resolved: padata: do not leak refcount in reorder_work A recent patch that addressed a UAF introduced a reference count leak: the parallel_data refcount is incremented unconditionally, regardless of the return value of queue_work(). If the work item is already queued, the incremented refcount is nev

CVE-2025-38135 [MEDIUM] CWE-476 CVE-2025-38135: In the Linux kernel, the following vulnerability has been resolved: serial: Fix potential null-ptr- In the Linux kernel, the following vulnerability has been resolved: serial: Fix potential null-ptr-deref in mlb_usio_probe() devm_ioremap() can return NULL on error. Currently, mlb_usio_probe() does not check for this case, which could result in a NULL pointer dereference. Add NULL check after devm_ioremap() to prevent this issue.

CVE-2025-38145 [MEDIUM] CWE-476 CVE-2025-38145: In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: Add NULL check in In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() devm_kasprintf() returns NULL when memory allocation fails. Currently, aspeed_lpc_enable_snoop() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this

CVE-2025-38138 [MEDIUM] CWE-476 CVE-2025-38138: In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: Add NULL check i In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: Add NULL check in udma_probe() devm_kasprintf() returns NULL when memory allocation fails. Currently, udma_probe() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue.

CVE-2025-37829 [MEDIUM] CWE-476 CVE-2025-37829: In the Linux kernel, the following vulnerability has been resolved: cpufreq: scpi: Fix null-ptr-der In the Linux kernel, the following vulnerability has been resolved: cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() cpufreq_cpu_get_raw() can return NULL when the target CPU is not present in the policy->cpus mask. scpi_cpufreq_get_rate() does not check for this case, which results in a NULL pointer dereference.

CVE-2025-38406 [MEDIUM] CVE-2025-38406: In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: remove WARN on ba In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: remove WARN on bad firmware input If the firmware gives bad input, that's nothing to do with the driver's stack at this point etc., so the WARN_ON() doesn't add any value. Additionally, this is one of the top syzbot reports now. Just print a message, and as an added bonus, pr

CVE-2025-38143 [MEDIUM] CWE-476 CVE-2025-38143: In the Linux kernel, the following vulnerability has been resolved: backlight: pm8941: Add NULL che In the Linux kernel, the following vulnerability has been resolved: backlight: pm8941: Add NULL check in wled_configure() devm_kasprintf() returns NULL when memory allocation fails. Currently, wled_configure() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue.

CVE-2025-37938 [MEDIUM] CWE-476 CVE-2025-37938: In the Linux kernel, the following vulnerability has been resolved: tracing: Verify event formats t In the Linux kernel, the following vulnerability has been resolved: tracing: Verify event formats that have "%*p.." The trace event verifier checks the formats of trace events to make sure that they do not point at memory that is not in the trace event itself or in data that will never be freed. If an event references data that was allocated when t

CVE-2025-38097 [MEDIUM] CVE-2025-38097: In the Linux kernel, the following vulnerability has been resolved: espintcp: remove encap socket c In the Linux kernel, the following vulnerability has been resolved: espintcp: remove encap socket caching to avoid reference leak The current scheme for caching the encap socket can lead to reference leaks when we try to delete the netns. The reference chain is: xfrm_state -> enacp_sk -> netns Since the encap socket is a userspace socket, it holds a refe

CVE-2025-38166 [MEDIUM] CVE-2025-38166: In the Linux kernel, the following vulnerability has been resolved: bpf: fix ktls panic with sockma In the Linux kernel, the following vulnerability has been resolved: bpf: fix ktls panic with sockmap [ 2172.936997] ------------[ cut here ]------------ [ 2172.936999] kernel BUG at lib/iov_iter.c:629! ...... [ 2172.944996] PKRU: 55555554 [ 2172.945155] Call Trace: [ 2172.945299] [ 2172.945428] ? die+0x36/0x90 [ 2172.945601] ? do_trap+0xdd/0x100 [ 2172.945