Debian Linux vulnerabilities

CVE-2025-37992 [MEDIUM] CWE-476 CVE-2025-37992: In the Linux kernel, the following vulnerability has been resolved: net_sched: Flush gso_skb list t In the Linux kernel, the following vulnerability has been resolved: net_sched: Flush gso_skb list too during ->change() Previously, when reducing a qdisc's limit via the ->change() operation, only the main skb queue was trimmed, potentially leaving packets in the gso_skb list. This could result in NULL pointer dereference when we only check sch->li

CVE-2010-0003 [MEDIUM] CWE-200 CVE-2010-0003: The print_fatal_signal function in kernel/signal.c in the Linux kernel before 2.6.32.4 on the i386 p The print_fatal_signal function in kernel/signal.c in the Linux kernel before 2.6.32.4 on the i386 platform, when print-fatal-signals is enabled, allows local users to discover the contents of arbitrary memory locations by jumping to an address and then reading a log file, and might allow local users to cause a denial of service (system slowdown or cr

CVE-2025-38382 [MEDIUM] CWE-908 CVE-2025-38382: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix iteration of extrefs In the Linux kernel, the following vulnerability has been resolved: btrfs: fix iteration of extrefs during log replay At __inode_add_ref() when processing extrefs, if we jump into the next label we have an undefined value of victim_name.len, since we haven't initialized it before we did the goto. This results in an invalid memory access in the next

CVE-2025-38344 [MEDIUM] CWE-401 CVE-2025-38344: In the Linux kernel, the following vulnerability has been resolved: ACPICA: fix acpi parse and pars In the Linux kernel, the following vulnerability has been resolved: ACPICA: fix acpi parse and parseext cache leaks ACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5 I'm Seunghun Han, and I work for National Security Research Institute of South Korea. I have been doing a research on ACPI and found an ACPI cache leak in ACPI early abort cases

CVE-2025-38467 [MEDIUM] CWE-476 CVE-2025-38467: In the Linux kernel, the following vulnerability has been resolved: drm/exynos: exynos7_drm_decon: In the Linux kernel, the following vulnerability has been resolved: drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling If there's support for another console device (such as a TTY serial), the kernel occasionally panics during boot. The panic message and a relevant snippet of the call stack is as follows: Unable to handle kernel NULL p

CVE-2025-38347 [MEDIUM] CVE-2025-38347: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on ino and xnid syzbot reported a f2fs bug as below: INFO: task syz-executor140:5308 blocked for more than 143 seconds. Not tainted 6.14.0-rc7-syzkaller-00069-g81e4f8d68c66 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-e

CVE-2025-38007 [MEDIUM] CWE-476 CVE-2025-38007: In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Add NULL check in In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Add NULL check in uclogic_input_configured() devm_kasprintf() returns NULL when memory allocation fails. Currently, uclogic_input_configured() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent

CVE-2025-38122 [MEDIUM] CWE-476 CVE-2025-38122: In the Linux kernel, the following vulnerability has been resolved: gve: add missing NULL check for In the Linux kernel, the following vulnerability has been resolved: gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO gve_alloc_pending_packet() can return NULL, but gve_tx_add_skb_dqo() did not check for this case before dereferencing the returned pointer. Add a missing NULL check to prevent a potential NULL pointer dereference

CVE-2014-4207 [MEDIUM] CVE-2014-4207: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows re Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows remote authenticated users to affect availability via vectors related to SROPTZR.

CVE-2025-39808 [MEDIUM] CVE-2025-39808: In the Linux kernel, the following vulnerability has been resolved: HID: hid-ntrig: fix unable to h In the Linux kernel, the following vulnerability has been resolved: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has invalid address(0xffffffff

CVE-2025-39742 [MEDIUM] CWE-369 CVE-2025-39742: In the Linux kernel, the following vulnerability has been resolved: RDMA: hfi1: fix possible divide In the Linux kernel, the following vulnerability has been resolved: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() The function divides number of online CPUs by num_core_siblings, and later checks the divider by zero. This implies a possibility to get and divide-by-zero runtime error. Fix it by moving the check prior to division.

CVE-2025-38528 [MEDIUM] CVE-2025-38528: In the Linux kernel, the following vulnerability has been resolved: bpf: Reject %p% format string i In the Linux kernel, the following vulnerability has been resolved: bpf: Reject %p% format string in bprintf-like helpers static const char fmt[] = "%p%"; bpf_trace_printk(fmt, sizeof(fmt)); The above BPF program isn't rejected and causes a kernel warning at runtime: Please remove unsupported %\x00 in format string WARNING: CPU: 1 PID: 7244 at lib/vsprin

CVE-2025-38277 [MEDIUM] CWE-908 CVE-2025-38277: In the Linux kernel, the following vulnerability has been resolved: mtd: nand: ecc-mxic: Fix use of In the Linux kernel, the following vulnerability has been resolved: mtd: nand: ecc-mxic: Fix use of uninitialized variable ret If ctx->steps is zero, the loop processing ECC steps is skipped, and the variable ret remains uninitialized. It is later checked and returned, which leads to undefined behavior and may cause unpredictable results in user sp

CVE-2025-38142 [MEDIUM] CWE-476 CVE-2025-38142: In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus-ec-sensors) check In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus-ec-sensors) check sensor index in read_string() Prevent a potential invalid memory access when the requested sensor is not found. find_ec_sensor_index() may return a negative value (e.g. -ENOENT), but its result was used without checking, which could lead to undefined

CVE-2025-39737 [MEDIUM] CWE-401 CVE-2025-39737: In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() A soft lockup warning was observed on a relative small system x86-64 system with 16 GB of memory when running a debug kernel with kmemleak enabled. watchdog: BUG: soft lockup - CPU#8 stuck for 33s! [kworker/8:1:134] The tes

CVE-2025-39709 [MEDIUM] CWE-476 CVE-2025-39709: In the Linux kernel, the following vulnerability has been resolved: media: venus: protect against s In the Linux kernel, the following vulnerability has been resolved: media: venus: protect against spurious interrupts during probe Make sure the interrupt handler is initialized before the interrupt is registered. If the IRQ is registered before hfi_create(), it's possible that an interrupt fires before the handler setup is complete, leading to a

CVE-2025-38441 [MEDIUM] CWE-908 CVE-2025-38441: In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: account f In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() syzbot found a potential access to uninit-value in nf_flow_pppoe_proto() Blamed commit forgot the Ethernet header. BUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_ta

CVE-2025-38166 [MEDIUM] CVE-2025-38166: In the Linux kernel, the following vulnerability has been resolved: bpf: fix ktls panic with sockma In the Linux kernel, the following vulnerability has been resolved: bpf: fix ktls panic with sockmap [ 2172.936997] ------------[ cut here ]------------ [ 2172.936999] kernel BUG at lib/iov_iter.c:629! ...... [ 2172.944996] PKRU: 55555554 [ 2172.945155] Call Trace: [ 2172.945299] [ 2172.945428] ? die+0x36/0x90 [ 2172.945601] ? do_trap+0xdd/0x100 [ 2172.945

CVE-2025-39842 [MEDIUM] CVE-2025-39842: In the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal In the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal inode after journal shutdown Before calling ocfs2_delete_osb(), ocfs2_journal_shutdown() has already been executed in ocfs2_dismount_volume(), so osb->journal must be NULL. Therefore, the following calltrace will inevitably fail when it reaches jbd2_journal_re

CVE-2025-39692 [MEDIUM] CWE-476 CVE-2025-39692: In the Linux kernel, the following vulnerability has been resolved: smb: server: split ksmbd_rdma_s In the Linux kernel, the following vulnerability has been resolved: smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() We can't call destroy_workqueue(smb_direct_wq); before stop_sessions()! Otherwise already existing connections try to use smb_direct_wq as a NULL pointer.