Debian Linux vulnerabilities

CVE-2025-39842 [MEDIUM] CVE-2025-39842: In the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal In the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal inode after journal shutdown Before calling ocfs2_delete_osb(), ocfs2_journal_shutdown() has already been executed in ocfs2_dismount_volume(), so osb->journal must be NULL. Therefore, the following calltrace will inevitably fail when it reaches jbd2_journal_re

CVE-2025-39692 [MEDIUM] CWE-476 CVE-2025-39692: In the Linux kernel, the following vulnerability has been resolved: smb: server: split ksmbd_rdma_s In the Linux kernel, the following vulnerability has been resolved: smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() We can't call destroy_workqueue(smb_direct_wq); before stop_sessions()! Otherwise already existing connections try to use smb_direct_wq as a NULL pointer.

CVE-2025-38645 [MEDIUM] CWE-476 CVE-2025-38645: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Check device memory p In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Check device memory pointer before usage Add a NULL check before accessing device memory to prevent a crash if dev->dm allocation in mlx5_init_once() fails.

CVE-2025-38610 [MEDIUM] CWE-476 CVE-2025-38610: In the Linux kernel, the following vulnerability has been resolved: powercap: dtpm_cpu: Fix NULL po In the Linux kernel, the following vulnerability has been resolved: powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() The get_pd_power_uw() function can crash with a NULL pointer dereference when em_cpu_get() returns NULL. This occurs when a CPU becomes impossible during runtime, causing get_cpu_device() to return NULL, which pr

CVE-2025-38587 [MEDIUM] CWE-835 CVE-2025-38587: In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loo In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6_info_uses_dev() fib6_info_uses_dev() seems to rely on RCU without an explicit protection. Like the prior fix in rt6_nlmsg_size(), we need to make sure fib6_del_route() or fib6_add_rt2node() have not removed the anchor from the list, or we r

CVE-2025-38609 [MEDIUM] CWE-476 CVE-2025-38609: In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Check governor be In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Check governor before using governor->name Commit 96ffcdf239de ("PM / devfreq: Remove redundant governor_name from struct devfreq") removes governor_name and uses governor->name to replace it. But devfreq->governor may be NULL and directly using devfreq->governor->nam

CVE-2025-38474 [MEDIUM] CVE-2025-38474: In the Linux kernel, the following vulnerability has been resolved: usb: net: sierra: check for no In the Linux kernel, the following vulnerability has been resolved: usb: net: sierra: check for no status endpoint The driver checks for having three endpoints and having bulk in and out endpoints, but not that the third endpoint is interrupt input. Rectify the omission.

CVE-2025-38481 [MEDIUM] CVE-2025-38481: In the Linux kernel, the following vulnerability has been resolved: comedi: Fail COMEDI_INSNLIST io In the Linux kernel, the following vulnerability has been resolved: comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large The handling of the `COMEDI_INSNLIST` ioctl allocates a kernel buffer to hold the array of `struct comedi_insn`, getting the length from the `n_insns` member of the `struct comedi_insnlist` supplied by the user. The allocation will

CVE-2025-38364 [MEDIUM] CWE-476 CVE-2025-38364: In the Linux kernel, the following vulnerability has been resolved: maple_tree: fix MA_STATE_PREALL In the Linux kernel, the following vulnerability has been resolved: maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() Temporarily clear the preallocation flag when explicitly requesting allocations. Pre-existing allocations are already counted against the request through mas_node_count_gfp(), but the allocations will not happen if the MA_

CVE-2025-38071 [MEDIUM] CVE-2025-38071: In the Linux kernel, the following vulnerability has been resolved: x86/mm: Check return value from In the Linux kernel, the following vulnerability has been resolved: x86/mm: Check return value from memblock_phys_alloc_range() At least with CONFIG_PHYSICAL_START=0x100000, if there is < 4 MiB of contiguous free memory available at this point, the kernel will crash and burn because memblock_phys_alloc_range() returns 0 on failure, which leads memblock_phy

CVE-2025-38312 [MEDIUM] CWE-369 CVE-2025-38312: In the Linux kernel, the following vulnerability has been resolved: fbdev: core: fbcvt: avoid divis In the Linux kernel, the following vulnerability has been resolved: fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() In fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000, cvt.f_refresh will become 0 when multiplying it by 2 due to overflow. It's then passed to fb_cvt_hperiod(), where it's used as a divider -- divisio

CVE-2025-38231 [MEDIUM] CWE-476 CVE-2025-38231: In the Linux kernel, the following vulnerability has been resolved: nfsd: Initialize ssc before lau In the Linux kernel, the following vulnerability has been resolved: nfsd: Initialize ssc before laundromat_work to prevent NULL dereference In nfs4_state_start_net(), laundromat_work may access nfsd_ssc through nfs4_laundromat -> nfsd4_ssc_expire_umount. If nfsd_ssc isn't initialized, this can cause NULL pointer dereference. Normally the delayed s

CVE-2025-38202 [MEDIUM] CVE-2025-38202: In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcu_read_lock_trace_ In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() bpf_map_lookup_percpu_elem() helper is also available for sleepable bpf program. When BPF JIT is disabled or under 32-bit host, bpf_map_lookup_percpu_elem() will not be inlined. Using it in a sleepable bpf program will t

CVE-2025-38160 [MEDIUM] CWE-476 CVE-2025-38160: In the Linux kernel, the following vulnerability has been resolved: clk: bcm: rpi: Add NULL check i In the Linux kernel, the following vulnerability has been resolved: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() devm_kasprintf() returns NULL when memory allocation fails. Currently, raspberrypi_clk_register() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent

CVE-2025-39846 [MEDIUM] CWE-476 CVE-2025-39846: In the Linux kernel, the following vulnerability has been resolved: pcmcia: Fix a NULL pointer dere In the Linux kernel, the following vulnerability has been resolved: pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() In __iodyn_find_io_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There is a dereference of res in pci_bus_alloc_resource(), which could lead to a NULL pointer dereference

CVE-2025-38304 [MEDIUM] CWE-476 CVE-2025-38304: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix NULL pointer def In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix NULL pointer deference on eir_get_service_data The len parameter is considered optional so it can be NULL so it cannot be used for skipping to next entry of EIR_SERVICE_DATA.

CVE-2015-1247 [MEDIUM] CWE-200 CVE-2015-1247: The SearchEngineTabHelper::OnPageHasOSDD function in browser/ui/search_engines/search_engine_tab_hel The SearchEngineTabHelper::OnPageHasOSDD function in browser/ui/search_engines/search_engine_tab_helper.cc in Google Chrome before 42.0.2311.90 does not prevent use of a file: URL for an OpenSearch descriptor XML document, which might allow remote attackers to obtain sensitive information from local files via a crafted (1) http or (2) https web site.

CVE-2025-39706 [MEDIUM] CWE-476 CVE-2025-39706: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Destroy KFD debugfs In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq Since KFD proc content was moved to kernel debugfs, we can't destroy KFD debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior to kfd_debugfs_fini to fix a kernel NULL pointer problem. It happens when /sys/kern

CVE-2025-38665 [MEDIUM] CWE-476 CVE-2025-38665: In the Linux kernel, the following vulnerability has been resolved: can: netlink: can_changelink(): In the Linux kernel, the following vulnerability has been resolved: can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode Andrei Lalaev reported a NULL pointer deref when a CAN device is restarted from Bus Off and the driver does not implement the struct can_priv::do_set_mode callback. There are 2 code path that ca

CVE-2025-6966 [MEDIUM] CWE-476 CVE-2025-6966: NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a loca NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.