Debian Linux vulnerabilities

CVE-2025-38663 [MEDIUM] CVE-2025-38663: In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid file typ In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid file types when reading inodes To prevent inodes with invalid file types from tripping through the vfs and causing malfunctions or assertion failures, add a missing sanity check when reading an inode from a block device. If the file type is not valid, treat it as a f

CVE-2025-38540 [MEDIUM] CVE-2025-38540: In the Linux kernel, the following vulnerability has been resolved: HID: quirks: Add quirk for 2 Ch In the Linux kernel, the following vulnerability has been resolved: HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras The Chicony Electronics HP 5MP Cameras (USB ID 04F2:B824 & 04F2:B82C) report a HID sensor interface that is not actually implemented. Attempting to access this non-functional sensor via iio_info causes system hangs as runtime

CVE-2025-38528 [MEDIUM] CVE-2025-38528: In the Linux kernel, the following vulnerability has been resolved: bpf: Reject %p% format string i In the Linux kernel, the following vulnerability has been resolved: bpf: Reject %p% format string in bprintf-like helpers static const char fmt[] = "%p%"; bpf_trace_printk(fmt, sizeof(fmt)); The above BPF program isn't rejected and causes a kernel warning at runtime: Please remove unsupported %\x00 in format string WARNING: CPU: 1 PID: 7244 at lib/vsprin

CVE-2025-37997 [MEDIUM] CWE-667 CVE-2025-37997: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix region lo In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix region locking in hash types Region locking introduced in v5.6-rc4 contained three macros to handle the region locks: ahash_bucket_start(), ahash_bucket_end() which gave back the start and end hash bucket values belonging to a given region lock and ahash_regio

CVE-2025-39714 [MEDIUM] CVE-2025-39714: In the Linux kernel, the following vulnerability has been resolved: media: usbtv: Lock resolution w In the Linux kernel, the following vulnerability has been resolved: media: usbtv: Lock resolution while streaming When an program is streaming (ffplay) and another program (qv4l2) changes the TV standard from NTSC to PAL, the kernel crashes due to trying to copy to unmapped memory. Changing from NTSC to PAL increases the resolution in the usbtv struct, bu

CVE-2025-38451 [MEDIUM] CVE-2025-38451: In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: fix GPF in bitmap In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: fix GPF in bitmap_get_stats() The commit message of commit 6ec1f0239485 ("md/md-bitmap: fix stats collection for external bitmaps") states: Remove the external bitmap check as the statistics should be available regardless of bitmap storage location. Return -EINVAL only for

CVE-2025-38237 [MEDIUM] CVE-2025-38237: In the Linux kernel, the following vulnerability has been resolved: media: platform: exynos4-is: Ad In the Linux kernel, the following vulnerability has been resolved: media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() In fimc_is_hw_change_mode(), the function changes camera modes without waiting for hardware completion, risking corrupted data or system hangs if subsequent operations proceed before the hardware is ready. Add

CVE-2025-39808 [MEDIUM] CVE-2025-39808: In the Linux kernel, the following vulnerability has been resolved: HID: hid-ntrig: fix unable to h In the Linux kernel, the following vulnerability has been resolved: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has invalid address(0xffffffff

CVE-2025-39737 [MEDIUM] CWE-401 CVE-2025-39737: In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() A soft lockup warning was observed on a relative small system x86-64 system with 16 GB of memory when running a debug kernel with kmemleak enabled. watchdog: BUG: soft lockup - CPU#8 stuck for 33s! [kworker/8:1:134] The tes

CVE-2025-38304 [MEDIUM] CWE-476 CVE-2025-38304: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix NULL pointer def In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix NULL pointer deference on eir_get_service_data The len parameter is considered optional so it can be NULL so it cannot be used for skipping to next entry of EIR_SERVICE_DATA.

CVE-2025-38094 [MEDIUM] CWE-667 CVE-2025-38094: In the Linux kernel, the following vulnerability has been resolved: net: cadence: macb: Fix a possi In the Linux kernel, the following vulnerability has been resolved: net: cadence: macb: Fix a possible deadlock in macb_halt_tx. There is a situation where after THALT is set high, TGO stays high as well. Because jiffies are never updated, as we are in a context with interrupts disabled, we never exit that loop and have a deadlock. That deadlock w

CVE-2025-38058 [MEDIUM] CWE-667 CVE-2025-38058: In the Linux kernel, the following vulnerability has been resolved: __legitimize_mnt(): check for M In the Linux kernel, the following vulnerability has been resolved: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock ... or we risk stealing final mntput from sync umount - raising mnt_count after umount(2) has verified that victim is not busy, but before it has set MNT_SYNC_UMOUNT; in that case __legitimize_mnt() doesn't se

CVE-2024-26790 [MEDIUM] CWE-667 CVE-2024-26790: In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: fix SoC ma In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read There is chip (ls1028a) errata: The SoC may hang on 16 byte unaligned read transactions by QDMA. Unaligned read transactions initiated by QDMA may stall in the NOC (Network On-Chip), causing a deadlock condition. Sta

CVE-2024-26781 [MEDIUM] CWE-667 CVE-2024-26781: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix possible deadlock in In the Linux kernel, the following vulnerability has been resolved: mptcp: fix possible deadlock in subflow diag Syzbot and Eric reported a lockdep splat in the subflow diag: WARNING: possible circular locking dependency detected 6.8.0-rc4-syzkaller-00212-g40b9385dd8e6 #0 Not tainted syz-executor.2/24141 is trying to acquire lock: ffff88804587013

CVE-2025-39842 [MEDIUM] CVE-2025-39842: In the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal In the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal inode after journal shutdown Before calling ocfs2_delete_osb(), ocfs2_journal_shutdown() has already been executed in ocfs2_dismount_volume(), so osb->journal must be NULL. Therefore, the following calltrace will inevitably fail when it reaches jbd2_journal_re

CVE-2025-38170 [MEDIUM] CVE-2025-38170: In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: Discard stale CPU In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: Discard stale CPU state when handling SME traps The logic for handling SME traps manipulates saved FPSIMD/SVE/SME state incorrectly, and a race with preemption can result in a task having TIF_SME set and TIF_FOREIGN_FPSTATE clear even though the live CPU state is stale (e.g.

CVE-2025-39709 [MEDIUM] CWE-476 CVE-2025-39709: In the Linux kernel, the following vulnerability has been resolved: media: venus: protect against s In the Linux kernel, the following vulnerability has been resolved: media: venus: protect against spurious interrupts during probe Make sure the interrupt handler is initialized before the interrupt is registered. If the IRQ is registered before hfi_create(), it's possible that an interrupt fires before the handler setup is complete, leading to a

CVE-2025-38624 [MEDIUM] CVE-2025-38624: In the Linux kernel, the following vulnerability has been resolved: PCI: pnv_php: Clean up allocate In the Linux kernel, the following vulnerability has been resolved: PCI: pnv_php: Clean up allocated IRQs on unplug When the root of a nested PCIe bridge configuration is unplugged, the pnv_php driver leaked the allocated IRQ resources for the child bridges' hotplug event notifications, resulting in a panic. Fix this by walking all child buses and dealloc

CVE-2025-38610 [MEDIUM] CWE-476 CVE-2025-38610: In the Linux kernel, the following vulnerability has been resolved: powercap: dtpm_cpu: Fix NULL po In the Linux kernel, the following vulnerability has been resolved: powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() The get_pd_power_uw() function can crash with a NULL pointer dereference when em_cpu_get() returns NULL. This occurs when a CPU becomes impossible during runtime, causing get_cpu_device() to return NULL, which pr

CVE-2025-38644 [MEDIUM] CWE-908 CVE-2025-38644: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject TDLS ope In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject TDLS operations when station is not associated syzbot triggered a WARN in ieee80211_tdls_oper() by sending NL80211_TDLS_ENABLE_LINK immediately after NL80211_CMD_CONNECT, before association completed and without prior TDLS setup. This left internal state lik