Debian Linux vulnerabilities

CVE-2025-38326 [MEDIUM] CVE-2025-38326: In the Linux kernel, the following vulnerability has been resolved: aoe: clean device rq_list in ao In the Linux kernel, the following vulnerability has been resolved: aoe: clean device rq_list in aoedev_downdev() An aoe device's rq_list contains accepted block requests that are waiting to be transmitted to the aoe target. This queue was added as part of the conversion to blk_mq. However, the queue was not cleaned out when an aoe device is downed which c

CVE-2023-52583 [MEDIUM] CWE-667 CVE-2023-52583: In the Linux kernel, the following vulnerability has been resolved: ceph: fix deadlock or deadcode In the Linux kernel, the following vulnerability has been resolved: ceph: fix deadlock or deadcode of misusing dget() The lock order is incorrect between denty and its parent, we should always make sure that the parent get the lock first. But since this deadcode is never used and the parent dir will always be set from the callers, let's just remove

CVE-2024-35806 [MEDIUM] CWE-667 CVE-2024-35806: In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: Always disable In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: Always disable interrupts when taking cgr_lock smp_call_function_single disables IRQs when executing the callback. To prevent deadlocks, we must disable IRQs when taking cgr_lock elsewhere. This is already done by qman_update_cgr and qman_delete_cgr; fix the other

CVE-2025-37948 [MEDIUM] CVE-2025-37948: In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Add BHB mitigation In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs A malicious BPF program may manipulate the branch history to influence what the hardware speculates will happen next. On exit from a BPF program, emit the BHB mititgation sequence. This is only applied for 'classic' cBPF pro

CVE-2025-37912 [MEDIUM] CWE-476 CVE-2025-37912: In the Linux kernel, the following vulnerability has been resolved: ice: Check VF VSI Pointer Value In the Linux kernel, the following vulnerability has been resolved: ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() As mentioned in the commit baeb705fd6a7 ("ice: always check VF VSI pointer values"), we need to perform a null pointer check on the return value of ice_get_vf_vsi() before using it.

CVE-2025-37818 [MEDIUM] CWE-476 CVE-2025-37818: In the Linux kernel, the following vulnerability has been resolved: LoongArch: Return NULL from hug In the Linux kernel, the following vulnerability has been resolved: LoongArch: Return NULL from huge_pte_offset() for invalid PMD LoongArch's huge_pte_offset() currently returns a pointer to a PMD slot even if the underlying entry points to invalid_pte_table (indicating no mapping). Callers like smaps_hugetlb_range() fetch this invalid entry value

CVE-2025-37775 [MEDIUM] CVE-2025-37775: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix the warning from __k In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix the warning from __kernel_write_iter [ 2110.972290] ------------[ cut here ]------------ [ 2110.972301] WARNING: CPU: 3 PID: 735 at fs/read_write.c:599 __kernel_write_iter+0x21b/0x280 This patch doesn't allow writing to directory.

CVE-2025-38275 [MEDIUM] CWE-476 CVE-2025-38275: In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp-usb: Fix an NULL In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug The qmp_usb_iomap() helper function currently returns the raw result of devm_ioremap() for non-exclusive mappings. Since devm_ioremap() may return a NULL pointer and the caller only checks error pointers with IS_ERR(), NULL could bypass

CVE-2025-38044 [MEDIUM] CVE-2025-38044: In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: set device_caps In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: set device_caps for 417 The video_device for the MPEG encoder did not set device_caps. Add this, otherwise the video device can't be registered (you get a WARN_ON instead). Not seen before since currently 417 support is disabled, but I found this while experimenting with

CVE-2025-38695 [MEDIUM] CWE-476 CVE-2025-38695: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Check for hdwq null In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure If a call to lpfc_sli4_read_rev() from lpfc_sli4_hba_setup() fails, the resultant cleanup routine lpfc_sli4_vport_delete_fcp_xri_aborted() may occur before sli4_hba.hdwqs are allocated. This may result in a n

CVE-2025-38569 [MEDIUM] CWE-476 CVE-2025-38569: In the Linux kernel, the following vulnerability has been resolved: benet: fix BUG when creating VF In the Linux kernel, the following vulnerability has been resolved: benet: fix BUG when creating VFs benet crashes as soon as SRIOV VFs are created: kernel BUG at mm/vmalloc.c:3457! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 4 UID: 0 PID: 7408 Comm: test.sh Kdump: loaded Not tainted 6.16.0+ #1 PREEMPT(voluntary) [...] RIP: 0010:vunmap+0x

CVE-2025-38190 [MEDIUM] CVE-2025-38190: In the Linux kernel, the following vulnerability has been resolved: atm: Revert atm_account_tx() if In the Linux kernel, the following vulnerability has been resolved: atm: Revert atm_account_tx() if copy_from_iter_full() fails. In vcc_sendmsg(), we account skb->truesize to sk->sk_wmem_alloc by atm_account_tx(). It is expected to be reverted by atm_pop_raw() later called by vcc->dev->ops->send(vcc, skb). However, vcc_sendmsg() misses the same revert wh

CVE-2025-38542 [MEDIUM] CVE-2025-38542: In the Linux kernel, the following vulnerability has been resolved: net: appletalk: Fix device refc In the Linux kernel, the following vulnerability has been resolved: net: appletalk: Fix device refcount leak in atrtr_create() When updating an existing route entry in atrtr_create(), the old device reference was not being released before assigning the new device, leading to a device refcount leak. Fix this by calling dev_put() to release the old device re

CVE-2025-38721 [MEDIUM] CVE-2025-38721: In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refco In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res ct_general); // HERE cb->args[1] = (unsigned long)ct; ... While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already in

CVE-2025-38630 [MEDIUM] CWE-476 CVE-2025-38630: In the Linux kernel, the following vulnerability has been resolved: fbdev: imxfb: Check fb_add_vide In the Linux kernel, the following vulnerability has been resolved: fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref fb_add_videomode() can fail with -ENOMEM when its internal kmalloc() cannot allocate a struct fb_modelist. If that happens, the modelist stays empty but the driver continues to register. Add a check for its return value

CVE-2025-38412 [MEDIUM] CVE-2025-38412: In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks After retrieving WMI data blocks in sysfs callbacks, check for the validity of them before dereferencing their content.

CVE-2025-38723 [MEDIUM] CVE-2025-38723: In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix jump offset In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix jump offset calculation in tailcall The extra pass of bpf_int_jit_compile() skips JIT context initialization which essentially skips offset calculation leaving out_offset = -1, so the jmp_offset in emit_bpf_tail_call is calculated by "#define jmp_offset (out_offset - (

CVE-2025-38460 [MEDIUM] CWE-476 CVE-2025-38460: In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix potential null-p In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix potential null-ptr-deref in to_atmarpd(). atmarpd is protected by RTNL since commit f3a0592b37b8 ("[ATM]: clip causes unregister hang"). However, it is not enough because to_atmarpd() is called without RTNL, especially clip_neigh_solicit() / neigh_ops->solicit() is

CVE-2025-38177 [MEDIUM] CWE-459 CVE-2025-38177: In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make hfsc_qlen_notify In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make hfsc_qlen_notify() idempotent hfsc_qlen_notify() is not idempotent either and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers' life: 1. update_vf() decreases cl->cl_nactive, so we can check w

CVE-2025-38173 [MEDIUM] CVE-2025-38173: In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/cesa - Handle z In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/cesa - Handle zero-length skcipher requests Do not access random memory for zero-length skcipher requests. Just return 0.