Debian Linux vulnerabilities

CVE-2025-37881 [MEDIUM] CWE-476 CVE-2025-37881: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed: Add NULL p In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() The variable d->name, returned by devm_kasprintf(), could be NULL. A pointer check is added to prevent potential NULL pointer dereference. This is similar to the fix in commit 3027e7b15b02 ("ice: Fix some null point

CVE-2025-37857 [MEDIUM] CWE-190 CVE-2025-37857: In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix array overflow in In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix array overflow in st_setup() Change the array size to follow parms size instead of a fixed value.

CVE-2023-52650 [MEDIUM] CWE-476 CVE-2023-52650: In the Linux kernel, the following vulnerability has been resolved: drm/tegra: dsi: Add missing che In the Linux kernel, the following vulnerability has been resolved: drm/tegra: dsi: Add missing check for of_find_device_by_node Add check for the return value of of_find_device_by_node() and return the error if it fails in order to avoid NULL pointer dereference.

CVE-2020-35533 [MEDIUM] CWE-125 CVE-2020-35533: In LibRaw, an out-of-bounds read vulnerability exists within the "LibRaw::adobe_copy_pixel()" functi In LibRaw, an out-of-bounds read vulnerability exists within the "LibRaw::adobe_copy_pixel()" function (libraw\src\decoders\dng.cpp) when reading data from the image file.

CVE-2020-35531 [MEDIUM] CWE-125 CVE-2020-35531: In LibRaw, an out-of-bounds read vulnerability exists within the get_huffman_diff() function (libraw In LibRaw, an out-of-bounds read vulnerability exists within the get_huffman_diff() function (libraw\src\x3f\x3f_utils_patched.cpp) when reading data from an image file.

CVE-2025-37844 [MEDIUM] CWE-476 CVE-2025-37844: In the Linux kernel, the following vulnerability has been resolved: cifs: avoid NULL pointer derefe In the Linux kernel, the following vulnerability has been resolved: cifs: avoid NULL pointer dereference in dbg call cifs_server_dbg() implies server to be non-NULL so move call under condition to avoid NULL pointer dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE.

CVE-2025-37850 [MEDIUM] CWE-369 CVE-2025-37850: In the Linux kernel, the following vulnerability has been resolved: pwm: mediatek: Prevent divide-b In the Linux kernel, the following vulnerability has been resolved: pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() With CONFIG_COMPILE_TEST && !CONFIG_HAVE_CLK, pwm_mediatek_config() has a divide-by-zero in the following line: do_div(resolution, clk_get_rate(pc->clk_pwms[pwm->hwpwm])); due to the fact that the !CONFIG_HAVE_CLK ver

CVE-2025-37841 [MEDIUM] CWE-476 CVE-2025-37841: In the Linux kernel, the following vulnerability has been resolved: pm: cpupower: bench: Prevent NU In the Linux kernel, the following vulnerability has been resolved: pm: cpupower: bench: Prevent NULL dereference on malloc failure If malloc returns NULL due to low memory, 'config' pointer can be NULL. Add a check to prevent NULL dereference.

CVE-2024-46955 [MEDIUM] CWE-125 CVE-2024-46955: An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. There is an out-of-bo An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. There is an out-of-bounds read when reading color in Indexed color space.

CVE-2016-9811 [MEDIUM] CWE-125 CVE-2016-9811: The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is s The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is set to always-malloc, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ico file.

CVE-2024-27077 [MEDIUM] CWE-401 CVE-2024-27077: In the Linux kernel, the following vulnerability has been resolved: media: v4l2-mem2mem: fix a meml In the Linux kernel, the following vulnerability has been resolved: media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity The entity->name (i.e. name) is allocated in v4l2_m2m_register_entity but isn't freed in its following error-handling paths. This patch adds such deallocation to prevent memleak of entity->name.

CVE-2024-27074 [MEDIUM] CWE-401 CVE-2024-27074: In the Linux kernel, the following vulnerability has been resolved: media: go7007: fix a memleak in In the Linux kernel, the following vulnerability has been resolved: media: go7007: fix a memleak in go7007_load_encoder In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without a deallocation thereafter. After the following call chain: saa7134_go7007_init |-> go7007_boot_encoder |-> go7007_load_encoder |-> kfree(go) go is freed and

CVE-2023-23455 [MEDIUM] CWE-843 CVE-2023-23455: atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).

CVE-2025-37852 [MEDIUM] CWE-476 CVE-2025-37852: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: handle amdgpu_cgs_c In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() Add error handling to propagate amdgpu_cgs_create_device() failures to the caller. When amdgpu_cgs_create_device() fails, release hwmgr and return -ENOMEM to prevent null pointer dereference. [v1]->[v2]

CVE-2025-39798 [MEDIUM] CVE-2025-39798: In the Linux kernel, the following vulnerability has been resolved: NFS: Fix the setting of capabil In the Linux kernel, the following vulnerability has been resolved: NFS: Fix the setting of capabilities when automounting a new filesystem Capabilities cannot be inherited when we cross into a new filesystem. They need to be reset to the minimal defaults, and then probed for again.

CVE-2025-37998 [MEDIUM] CVE-2025-37998: In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix unsafe attribu In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix unsafe attribute parsing in output_userspace() This patch replaces the manual Netlink attribute iteration in output_userspace() with nla_for_each_nested(), which ensures that only well-formed attributes are processed.

CVE-2023-52585 [MEDIUM] CWE-476 CVE-2023-52585: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix possible NULL d In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper() Return invalid error code -EINVAL for invalid block id. Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c:1183 amdgpu_ras_query_error_status_helper() error: we previously assumed 'info' cou

CVE-2024-35947 [MEDIUM] CVE-2024-35947: In the Linux kernel, the following vulnerability has been resolved: dyndbg: fix old BUG_ON in >cont In the Linux kernel, the following vulnerability has been resolved: dyndbg: fix old BUG_ON in >control parser Fix a BUG_ON from 2009. Even if it looks "unreachable" (I didn't really look), lets make sure by removing it, doing pr_err and return -EINVAL instead.

CVE-2023-4569 [MEDIUM] CWE-402 CVE-2023-4569: A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which can result in a memory leak.

CVE-2023-52686 [MEDIUM] CWE-476 CVE-2023-52686: In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv: Add a null poi In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv: Add a null pointer check in opal_event_init() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.