Debian Linux vulnerabilities

CVE-2024-26855 [MEDIUM] CWE-476 CVE-2024-26855: In the Linux kernel, the following vulnerability has been resolved: net: ice: Fix potential NULL po In the Linux kernel, the following vulnerability has been resolved: net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() The function ice_bridge_setlink() may encounter a NULL pointer dereference if nlmsg_find_attr() returns NULL and br_spec is dereferenced subsequently in nla_for_each_nested(). To address this issue, add a chec

CVE-2024-35813 [MEDIUM] CVE-2024-35813: In the Linux kernel, the following vulnerability has been resolved: mmc: core: Avoid negative index In the Linux kernel, the following vulnerability has been resolved: mmc: core: Avoid negative index with array access Commit 4d0c8d0aef63 ("mmc: core: Use mrq.sbc in close-ended ffu") assigns prev_idata = idatas[i - 1], but doesn't check that the iterator i is greater than zero. Let's fix this by adding a check.

CVE-2023-52619 [MEDIUM] CVE-2023-52619: In the Linux kernel, the following vulnerability has been resolved: pstore/ram: Fix crash when sett In the Linux kernel, the following vulnerability has been resolved: pstore/ram: Fix crash when setting number of cpus to an odd number When the number of cpu cores is adjusted to 7 or other odd numbers, the zone size will become an odd number. The address of the zone will become: addr of zone0 = BASE addr of zone1 = BASE + zone_size addr of zone2 = BASE +

CVE-2025-37790 [MEDIUM] CVE-2025-37790: In the Linux kernel, the following vulnerability has been resolved: net: mctp: Set SOCK_RCU_FREE B In the Linux kernel, the following vulnerability has been resolved: net: mctp: Set SOCK_RCU_FREE Bind lookup runs under RCU, so ensure that a socket doesn't go away in the middle of a lookup.

CVE-2024-26776 [MEDIUM] CWE-476 CVE-2024-26776: In the Linux kernel, the following vulnerability has been resolved: spi: hisi-sfc-v3xx: Return IRQ_ In the Linux kernel, the following vulnerability has been resolved: spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected Return IRQ_NONE from the interrupt handler when no interrupt was detected. Because an empty interrupt will cause a null pointer error: Unable to handle kernel NULL pointer dereference at virtual address 00000000000

CVE-2025-37937 [MEDIUM] CWE-369 CVE-2025-37937: In the Linux kernel, the following vulnerability has been resolved: objtool, media: dib8000: Preven In the Linux kernel, the following vulnerability has been resolved: objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() If dib8000_set_dds()'s call to dib8000_read32() returns zero, the result is a divide-by-zero. Prevent that from happening. Fixes the following warning with an UBSAN kernel: drivers/media/dvb-frontends/dib8000.o:

CVE-2024-36941 [MEDIUM] CWE-476 CVE-2024-36941: In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: don't free NULL In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: don't free NULL coalescing rule If the parsing fails, we can dereference a NULL pointer here.

CVE-2024-26771 [MEDIUM] CWE-476 CVE-2024-26771: In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma: Add some n In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma: Add some null pointer checks to the edma_probe devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity.

CVE-2025-37932 [MEDIUM] CVE-2025-37932: In the Linux kernel, the following vulnerability has been resolved: sch_htb: make htb_qlen_notify() In the Linux kernel, the following vulnerability has been resolved: sch_htb: make htb_qlen_notify() idempotent htb_qlen_notify() always deactivates the HTB class and in fact could trigger a warning if it is already deactivated. Therefore, it is not idempotent and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_

CVE-2024-35879 [MEDIUM] CWE-401 CVE-2024-35879: In the Linux kernel, the following vulnerability has been resolved: of: dynamic: Synchronize of_cha In the Linux kernel, the following vulnerability has been resolved: of: dynamic: Synchronize of_changeset_destroy() with the devlink removals In the following sequence: 1) of_platform_depopulate() 2) of_overlay_remove() During the step 1, devices are destroyed and devlinks are removed. During the step 2, OF nodes are destroyed but __of_changeset_e

CVE-2024-26833 [MEDIUM] CWE-401 CVE-2024-26833: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix memory lea In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix memory leak in dm_sw_fini() After destroying dmub_srv, the memory associated with it is not freed, causing a memory leak: unreferenced object 0xffff896302b45800 (size 1024): comm "(udev-worker)", pid 222, jiffies 4294894636 hex dump (first 32 bytes): 00 00 00

CVE-2025-37912 [MEDIUM] CWE-476 CVE-2025-37912: In the Linux kernel, the following vulnerability has been resolved: ice: Check VF VSI Pointer Value In the Linux kernel, the following vulnerability has been resolved: ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() As mentioned in the commit baeb705fd6a7 ("ice: always check VF VSI pointer values"), we need to perform a null pointer check on the return value of ice_get_vf_vsi() before using it.

CVE-2024-26787 [MEDIUM] CVE-2024-26787: In the Linux kernel, the following vulnerability has been resolved: mmc: mmci: stm32: fix DMA API o In the Linux kernel, the following vulnerability has been resolved: mmc: mmci: stm32: fix DMA API overlapping mappings warning Turning on CONFIG_DMA_API_DEBUG_SG results in the following warning: DMA-API: mmci-pl18x 48220000.mmc: cacheline tracking EEXIST, overlapping mappings aren't supported WARNING: CPU: 1 PID: 51 at kernel/dma/debug.c:568 add_dma_entr

CVE-2024-35922 [MEDIUM] CWE-369 CVE-2024-35922: In the Linux kernel, the following vulnerability has been resolved: fbmon: prevent division by zero In the Linux kernel, the following vulnerability has been resolved: fbmon: prevent division by zero in fb_videomode_from_videomode() The expression htotal * vtotal can have a zero value on overflow. It is necessary to prevent division by zero like in fb_var_to_videomode(). Found by Linux Verification Center (linuxtesting.org) with Svace.

CVE-2024-35930 [MEDIUM] CWE-401 CVE-2024-35930: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix possible memory In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() The call to lpfc_sli4_resume_rpi() in lpfc_rcv_padisc() may return an unsuccessful status. In such cases, the elsiocb is not issued, the completion is not called, and thus the elsiocb resource is leaked. Check return value

CVE-2024-35933 [MEDIUM] CWE-476 CVE-2024-35933: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Fix null pt In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Fix null ptr deref in btintel_read_version If hci_cmd_sync_complete() is triggered and skb is NULL, then hdev->req_skb is NULL, which will cause this issue.

CVE-2024-35828 [MEDIUM] CWE-401 CVE-2024-35828: In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix some memlea In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() In the for statement of lbs_allocate_cmd_buffer(), if the allocation of cmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to be freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer().

CVE-2025-23144 [MEDIUM] CVE-2025-23144: In the Linux kernel, the following vulnerability has been resolved: backlight: led_bl: Hold led_acc In the Linux kernel, the following vulnerability has been resolved: backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() Lockdep detects the following issue on led-backlight removal: [ 142.315935] ------------[ cut here ]------------ [ 142.315954] WARNING: CPU: 2 PID: 292 at drivers/leds/led-core.c:455 led_sysfs_enable+0x54/0x80 ... [ 1

CVE-2025-23140 [MEDIUM] CVE-2025-23140: In the Linux kernel, the following vulnerability has been resolved: misc: pci_endpoint_test: Avoid In the Linux kernel, the following vulnerability has been resolved: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error After devm_request_irq() fails with error in pci_endpoint_test_request_irq(), the pci_endpoint_test_free_irq_vectors() is called assuming that all IRQs have been released. However, some requested IRQs rema

CVE-2025-38044 [MEDIUM] CVE-2025-38044: In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: set device_caps In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: set device_caps for 417 The video_device for the MPEG encoder did not set device_caps. Add this, otherwise the video device can't be registered (you get a WARN_ON instead). Not seen before since currently 417 support is disabled, but I found this while experimenting with