Debian Linux vulnerabilities

CVE-2025-38382 [MEDIUM] CWE-908 CVE-2025-38382: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix iteration of extrefs In the Linux kernel, the following vulnerability has been resolved: btrfs: fix iteration of extrefs during log replay At __inode_add_ref() when processing extrefs, if we jump into the next label we have an undefined value of victim_name.len, since we haven't initialized it before we did the goto. This results in an invalid memory access in the next

CVE-2025-37792 [MEDIUM] CWE-476 CVE-2025-37792: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Prevent poten In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Prevent potential NULL dereference The btrtl_initialize() function checks that rtl_load_file() either had an error or it loaded a zero length file. However, if it loaded a zero length file then the error code is not set correctly. It results in an error pointer vs

CVE-2025-37773 [MEDIUM] CVE-2025-37773: In the Linux kernel, the following vulnerability has been resolved: virtiofs: add filesystem contex In the Linux kernel, the following vulnerability has been resolved: virtiofs: add filesystem context source name check In certain scenarios, for example, during fuzz testing, the source name may be NULL, which could lead to a kernel panic. Therefore, an extra check for the source name should be added.

CVE-2025-37740 [MEDIUM] CWE-369 CVE-2025-37740: In the Linux kernel, the following vulnerability has been resolved: jfs: add sanity check for agwid In the Linux kernel, the following vulnerability has been resolved: jfs: add sanity check for agwidth in dbMount The width in dmapctl of the AG is zero, it trigger a divide error when calculating the control page level in dbAllocAG. To avoid this issue, add a check for agwidth in dbAllocAG.

CVE-2025-38467 [MEDIUM] CWE-476 CVE-2025-38467: In the Linux kernel, the following vulnerability has been resolved: drm/exynos: exynos7_drm_decon: In the Linux kernel, the following vulnerability has been resolved: drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling If there's support for another console device (such as a TTY serial), the kernel occasionally panics during boot. The panic message and a relevant snippet of the call stack is as follows: Unable to handle kernel NULL p

CVE-2025-38696 [MEDIUM] CWE-476 CVE-2025-38696: In the Linux kernel, the following vulnerability has been resolved: MIPS: Don't crash in stack_top( In the Linux kernel, the following vulnerability has been resolved: MIPS: Don't crash in stack_top() for tasks without ABI or vDSO Not all tasks have an ABI associated or vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_top(), it will derefence the NULL ABI pointer and crash. This can for example happen when us

CVE-2025-38344 [MEDIUM] CWE-401 CVE-2025-38344: In the Linux kernel, the following vulnerability has been resolved: ACPICA: fix acpi parse and pars In the Linux kernel, the following vulnerability has been resolved: ACPICA: fix acpi parse and parseext cache leaks ACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5 I'm Seunghun Han, and I work for National Security Research Institute of South Korea. I have been doing a research on ACPI and found an ACPI cache leak in ACPI early abort cases

CVE-2025-38007 [MEDIUM] CWE-476 CVE-2025-38007: In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Add NULL check in In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Add NULL check in uclogic_input_configured() devm_kasprintf() returns NULL when memory allocation fails. Currently, uclogic_input_configured() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent

CVE-2025-38460 [MEDIUM] CWE-476 CVE-2025-38460: In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix potential null-p In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix potential null-ptr-deref in to_atmarpd(). atmarpd is protected by RTNL since commit f3a0592b37b8 ("[ATM]: clip causes unregister hang"). However, it is not enough because to_atmarpd() is called without RTNL, especially clip_neigh_solicit() / neigh_ops->solicit() is

CVE-2025-38122 [MEDIUM] CWE-476 CVE-2025-38122: In the Linux kernel, the following vulnerability has been resolved: gve: add missing NULL check for In the Linux kernel, the following vulnerability has been resolved: gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO gve_alloc_pending_packet() can return NULL, but gve_tx_add_skb_dqo() did not check for this case before dereferencing the returned pointer. Add a missing NULL check to prevent a potential NULL pointer dereference

CVE-2025-38142 [MEDIUM] CWE-476 CVE-2025-38142: In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus-ec-sensors) check In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus-ec-sensors) check sensor index in read_string() Prevent a potential invalid memory access when the requested sensor is not found. find_ec_sensor_index() may return a negative value (e.g. -ENOENT), but its result was used without checking, which could lead to undefined

CVE-2025-38347 [MEDIUM] CVE-2025-38347: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on ino and xnid syzbot reported a f2fs bug as below: INFO: task syz-executor140:5308 blocked for more than 143 seconds. Not tainted 6.14.0-rc7-syzkaller-00069-g81e4f8d68c66 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-e

CVE-2025-38173 [MEDIUM] CVE-2025-38173: In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/cesa - Handle z In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/cesa - Handle zero-length skcipher requests Do not access random memory for zero-length skcipher requests. Just return 0.

CVE-2014-4207 [MEDIUM] CVE-2014-4207: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows re Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows remote authenticated users to affect availability via vectors related to SROPTZR.

CVE-2025-38441 [MEDIUM] CWE-908 CVE-2025-38441: In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: account f In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() syzbot found a potential access to uninit-value in nf_flow_pppoe_proto() Blamed commit forgot the Ethernet header. BUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_ta

CVE-2025-38474 [MEDIUM] CVE-2025-38474: In the Linux kernel, the following vulnerability has been resolved: usb: net: sierra: check for no In the Linux kernel, the following vulnerability has been resolved: usb: net: sierra: check for no status endpoint The driver checks for having three endpoints and having bulk in and out endpoints, but not that the third endpoint is interrupt input. Rectify the omission.

CVE-2025-38277 [MEDIUM] CWE-908 CVE-2025-38277: In the Linux kernel, the following vulnerability has been resolved: mtd: nand: ecc-mxic: Fix use of In the Linux kernel, the following vulnerability has been resolved: mtd: nand: ecc-mxic: Fix use of uninitialized variable ret If ctx->steps is zero, the loop processing ECC steps is skipped, and the variable ret remains uninitialized. It is later checked and returned, which leads to undefined behavior and may cause unpredictable results in user sp

CVE-2025-37830 [MEDIUM] CWE-476 CVE-2025-37830: In the Linux kernel, the following vulnerability has been resolved: cpufreq: scmi: Fix null-ptr-der In the Linux kernel, the following vulnerability has been resolved: cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() cpufreq_cpu_get_raw() can return NULL when the target CPU is not present in the policy->cpus mask. scmi_cpufreq_get_rate() does not check for this case, which results in a NULL pointer dereference. Add NULL check after c

CVE-2025-38539 [MEDIUM] CVE-2025-38539: In the Linux kernel, the following vulnerability has been resolved: tracing: Add down_write(trace_e In the Linux kernel, the following vulnerability has been resolved: tracing: Add down_write(trace_event_sem) when adding trace event When a module is loaded, it adds trace events defined by the module. It may also need to modify the modules trace printk formats to replace enum names with their values. If two modules are loaded at the same time, the adding

CVE-2025-38481 [MEDIUM] CVE-2025-38481: In the Linux kernel, the following vulnerability has been resolved: comedi: Fail COMEDI_INSNLIST io In the Linux kernel, the following vulnerability has been resolved: comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large The handling of the `COMEDI_INSNLIST` ioctl allocates a kernel buffer to hold the array of `struct comedi_insn`, getting the length from the `n_insns` member of the `struct comedi_insnlist` supplied by the user. The allocation will