Debian Linux vulnerabilities

CVE-2025-37962 [MEDIUM] CWE-401 CVE-2025-37962: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix memory leak in parse In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix memory leak in parse_lease_state() The previous patch that added bounds check for create lease context introduced a memory leak. When the bounds check fails, the function returns NULL without freeing the previously allocated lease_ctx_info structure. This patch fixes th

CVE-2025-37951 [MEDIUM] CWE-401 CVE-2025-37951: In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Add job to pending lis In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Add job to pending list if the reset was skipped When a CL/CSD job times out, we check if the GPU has made any progress since the last timeout. If so, instead of resetting the hardware, we skip the reset and let the timer get rearmed. This gives long-running jobs a chance

CVE-2025-37811 [MEDIUM] CWE-476 CVE-2025-37811: In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: ci_hdrc_imx: fix In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: ci_hdrc_imx: fix usbmisc handling usbmisc is an optional device property so it is totally valid for the corresponding data->usbmisc_data to have a NULL value. Check that before dereferencing the pointer. Found by Linux Verification Center (linuxtesting.org) with Sv

CVE-2015-0505 [LOW] CVE-2015-0505: Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.

CVE-2025-38364 [MEDIUM] CWE-476 CVE-2025-38364: In the Linux kernel, the following vulnerability has been resolved: maple_tree: fix MA_STATE_PREALL In the Linux kernel, the following vulnerability has been resolved: maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() Temporarily clear the preallocation flag when explicitly requesting allocations. Pre-existing allocations are already counted against the request through mas_node_count_gfp(), but the allocations will not happen if the MA_

CVE-2025-38231 [MEDIUM] CWE-476 CVE-2025-38231: In the Linux kernel, the following vulnerability has been resolved: nfsd: Initialize ssc before lau In the Linux kernel, the following vulnerability has been resolved: nfsd: Initialize ssc before laundromat_work to prevent NULL dereference In nfs4_state_start_net(), laundromat_work may access nfsd_ssc through nfs4_laundromat -> nfsd4_ssc_expire_umount. If nfsd_ssc isn't initialized, this can cause NULL pointer dereference. Normally the delayed s

CVE-2025-38071 [MEDIUM] CVE-2025-38071: In the Linux kernel, the following vulnerability has been resolved: x86/mm: Check return value from In the Linux kernel, the following vulnerability has been resolved: x86/mm: Check return value from memblock_phys_alloc_range() At least with CONFIG_PHYSICAL_START=0x100000, if there is < 4 MiB of contiguous free memory available at this point, the kernel will crash and burn because memblock_phys_alloc_range() returns 0 on failure, which leads memblock_phy

CVE-2025-37818 [MEDIUM] CWE-476 CVE-2025-37818: In the Linux kernel, the following vulnerability has been resolved: LoongArch: Return NULL from hug In the Linux kernel, the following vulnerability has been resolved: LoongArch: Return NULL from huge_pte_offset() for invalid PMD LoongArch's huge_pte_offset() currently returns a pointer to a PMD slot even if the underlying entry points to invalid_pte_table (indicating no mapping). Callers like smaps_hugetlb_range() fetch this invalid entry value

CVE-2025-37748 [MEDIUM] CWE-476 CVE-2025-37748: In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: Fix NULL pointe In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group Currently, mtk_iommu calls during probe iommu_device_register before the hw_list from driver data is initialized. Since iommu probing issue fix, it leads to NULL pointer dereference in mtk_iommu_device_group when

CVE-2025-39684 [MEDIUM] CWE-908 CVE-2025-39684: In the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialize In the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() syzbot reports a KMSAN kernel-infoleak in `do_insn_ioctl()`. A kernel buffer is allocated to hold `insn->n` samples (each of which is an `unsigned int`). For some instruction types, `insn->n` samples

CVE-2025-38639 [MEDIUM] CVE-2025-38639: In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nfacct: don't ass In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nfacct: don't assume acct name is null-terminated BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721 Read of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851 [..] string+0x231/0x2b0 lib/vsprintf.c:721 vsnprintf+0x739/0xf00 lib/vsprintf.c:2874 [..] nfacct_mt_c

CVE-2025-38202 [MEDIUM] CVE-2025-38202: In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcu_read_lock_trace_ In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() bpf_map_lookup_percpu_elem() helper is also available for sleepable bpf program. When BPF JIT is disabled or under 32-bit host, bpf_map_lookup_percpu_elem() will not be inlined. Using it in a sleepable bpf program will t

CVE-2024-26679 [MEDIUM] CWE-667 CVE-2024-26679: In the Linux kernel, the following vulnerability has been resolved: inet: read sk->sk_family once i In the Linux kernel, the following vulnerability has been resolved: inet: read sk->sk_family once in inet_recv_error() inet_recv_error() is called without holding the socket lock. IPv6 socket could mutate to IPv4 with IPV6_ADDRFORM socket option and trigger a KCSAN warning.

CVE-2025-39681 [MEDIUM] CVE-2025-39681: In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resc In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Since 923f3a2b48bd ("x86/resctrl: Query LLC monitoring properties once during boot") resctrl_cpu_detect() has been moved from common CPU initialization code to the vendor-specific BSP init helper, while Hygon didn't put t

CVE-2025-38732 [MEDIUM] CVE-2025-38732: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject: don't lea In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject: don't leak dst refcount for loopback packets recent patches to add a WARN() when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skb_dst_set i

CVE-2025-38693 [MEDIUM] CWE-476 CVE-2025-38693: In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: w7090p: f In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2

CVE-2025-38700 [MEDIUM] CWE-476 CVE-2025-38700: In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Initialize iscs In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated In case of an ib_fast_reg_mr allocation failure during iSER setup, the machine hits a panic because iscsi_conn->dd_data is initialized unconditionally, even when no memory is allocated (dd_size == 0). This l

CVE-2025-38312 [MEDIUM] CWE-369 CVE-2025-38312: In the Linux kernel, the following vulnerability has been resolved: fbdev: core: fbcvt: avoid divis In the Linux kernel, the following vulnerability has been resolved: fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() In fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000, cvt.f_refresh will become 0 when multiplying it by 2 due to overflow. It's then passed to fb_cvt_hperiod(), where it's used as a divider -- divisio

CVE-2025-38160 [MEDIUM] CWE-476 CVE-2025-38160: In the Linux kernel, the following vulnerability has been resolved: clk: bcm: rpi: Add NULL check i In the Linux kernel, the following vulnerability has been resolved: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() devm_kasprintf() returns NULL when memory allocation fails. Currently, raspberrypi_clk_register() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent

CVE-2025-38635 [MEDIUM] CWE-476 CVE-2025-38635: In the Linux kernel, the following vulnerability has been resolved: clk: davinci: Add NULL check in In the Linux kernel, the following vulnerability has been resolved: clk: davinci: Add NULL check in davinci_lpsc_clk_register() devm_kasprintf() returns NULL when memory allocation fails. Currently, davinci_lpsc_clk_register() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to preven