Debian Linux vulnerabilities

CVE-2025-38113 [MEDIUM] CWE-476 CVE-2025-38113: In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Fix NULL pointer de In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Fix NULL pointer dereference when nosmp is used With nosmp in cmdline, other CPUs are not brought up, leaving their cpc_desc_ptr NULL. CPU0's iteration via for_each_possible_cpu() dereferences these NULL pointers, causing panic. Panic backtrace: [ 0.401123] Unable to

CVE-2025-38119 [MEDIUM] CVE-2025-38119: In the Linux kernel, the following vulnerability has been resolved: scsi: core: ufs: Fix a hang in In the Linux kernel, the following vulnerability has been resolved: scsi: core: ufs: Fix a hang in the error handler ufshcd_err_handling_prepare() calls ufshcd_rpm_get_sync(). The latter function can only succeed if UFSHCD_EH_IN_PROGRESS is not set because resuming involves submitting a SCSI command and ufshcd_queuecommand() returns SCSI_MLQUEUE_HOST_BUSY i

CVE-2025-38513 [MEDIUM] CWE-476 CVE-2025-38513: In the Linux kernel, the following vulnerability has been resolved: wifi: zd1211rw: Fix potential N In the Linux kernel, the following vulnerability has been resolved: wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() There is a potential NULL pointer dereference in zd_mac_tx_to_dev(). For example, the following is possible: T0 T1 zd_mac_tx_to_dev() /* len == skb_queue_len(q) */ while (len > ZD_MAC_MAX_ACK_WAITERS) {

CVE-2025-38282 [MEDIUM] CVE-2025-38282: In the Linux kernel, the following vulnerability has been resolved: kernfs: Relax constraint in dra In the Linux kernel, the following vulnerability has been resolved: kernfs: Relax constraint in draining guard The active reference lifecycle provides the break/unbreak mechanism but the active reference is not truly active after unbreak -- callers don't use it afterwards but it's important for proper pairing of kn->active counting. Assuming this mechanism

CVE-2025-38712 [MEDIUM] CWE-617 CVE-2025-38712: In the Linux kernel, the following vulnerability has been resolved: hfsplus: don't use BUG_ON() in In the Linux kernel, the following vulnerability has been resolved: hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() When the volume header contains erroneous values that do not reflect the actual state of the filesystem, hfsplus_fill_super() assumes that the attributes file is not yet created, which later results in hitting BUG_ON()

CVE-2025-38671 [MEDIUM] CVE-2025-38671: In the Linux kernel, the following vulnerability has been resolved: i2c: qup: jump out of the loop In the Linux kernel, the following vulnerability has been resolved: i2c: qup: jump out of the loop in case of timeout Original logic only sets the return value but doesn't jump out of the loop if the bus is kept active by a client. This is not expected. A malicious or buggy i2c client can hang the kernel in this case and should be avoided. This is observed

CVE-2025-38602 [MEDIUM] CWE-252 CVE-2025-38602: In the Linux kernel, the following vulnerability has been resolved: iwlwifi: Add missing check for In the Linux kernel, the following vulnerability has been resolved: iwlwifi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue since it may return NULL pointer.

CVE-2025-38588 [MEDIUM] CWE-835 CVE-2025-38588: In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent infinite loop in In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent infinite loop in rt6_nlmsg_size() While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place: list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, fib6_siblings) { rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); }

CVE-2025-39675 [MEDIUM] CWE-476 CVE-2025-39675: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null point In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() The function mod_hdcp_hdcp1_create_session() calls the function get_first_active_display(), but does not check its return value. The return value is a null pointer if the display list is empty. This will lea

CVE-2025-38634 [MEDIUM] CWE-476 CVE-2025-38634: In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-charger: F In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-charger: Fix null check for power_supply_get_by_name In the cpcap_usb_detect() function, the power_supply_get_by_name() function may return `NULL` instead of an error pointer. To prevent potential null pointer dereferences, Added a null check.

CVE-2025-38583 [MEDIUM] CWE-476 CVE-2025-38583: In the Linux kernel, the following vulnerability has been resolved: clk: xilinx: vcu: unregister pl In the Linux kernel, the following vulnerability has been resolved: clk: xilinx: vcu: unregister pll_post only if registered correctly If registration of pll_post is failed, it will be set to NULL or ERR, unregistering same will fail with following call trace: Unable to handle kernel NULL pointer dereference at virtual address 008 pc : clk_hw_unre

CVE-2025-38419 [MEDIUM] CWE-401 CVE-2025-38419: In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Cleanup acqui In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() When rproc->state = RPROC_DETACHED and rproc_attach() is used to attach to the remote processor, if rproc_handle_resources() returns a failure, the resources allocated by imx_rproc_pr

CVE-2025-38418 [MEDIUM] CWE-401 CVE-2025-38418: In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Release rproc In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Release rproc->clean_table after rproc_attach() fails When rproc->state = RPROC_DETACHED is attached to remote processor through rproc_attach(), if rproc_handle_resources() returns failure, then the clean table should be released, otherwise the following memory le

CVE-2025-39920 [MEDIUM] CWE-476 CVE-2025-39920: In the Linux kernel, the following vulnerability has been resolved: pcmcia: Add error handling for In the Linux kernel, the following vulnerability has been resolved: pcmcia: Add error handling for add_interval() in do_validate_mem() In the do_validate_mem(), the call to add_interval() does not handle errors. If kmalloc() fails in add_interval(), it could result in a null pointer being inserted into the linked list, leading to illegal memory acce

CVE-2025-38251 [MEDIUM] CWE-476 CVE-2025-38251: In the Linux kernel, the following vulnerability has been resolved: atm: clip: prevent NULL deref i In the Linux kernel, the following vulnerability has been resolved: atm: clip: prevent NULL deref in clip_push() Blamed commit missed that vcc_destroy_socket() calls clip_push() with a NULL skb. If clip_devs is NULL, clip_push() then crashes when reading skb->truesize.

CVE-2025-38151 [MEDIUM] CVE-2025-38151: In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix hang when cma_net In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work The cited commit fixed a crash when cma_netevent_callback was called for a cma_id while work on that id from a previous call had not yet started. The work item was re-initialized in the second call, which corrupted the work

CVE-2025-39847 [MEDIUM] CWE-401 CVE-2025-39847: In the Linux kernel, the following vulnerability has been resolved: ppp: fix memory leak in pad_com In the Linux kernel, the following vulnerability has been resolved: ppp: fix memory leak in pad_compress_skb If alloc_skb() fails in pad_compress_skb(), it returns NULL without releasing the old skb. The caller does: skb = pad_compress_skb(ppp, skb); if (!skb) goto drop; drop: kfree_skb(skb); When pad_compress_skb() returns NULL, the reference t

CVE-2025-38319 [MEDIUM] CWE-476 CVE-2025-38319: In the Linux kernel, the following vulnerability has been resolved: drm/amd/pp: Fix potential NULL In the Linux kernel, the following vulnerability has been resolved: drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table The function atomctrl_initialize_mc_reg_table() and atomctrl_initialize_mc_reg_table_v2_2() does not check the return value of smu_atom_get_data_table(). If smu_atom_get_data_table() fails to retr

CVE-2025-38300 [MEDIUM] CWE-401 CVE-2025-38300: In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce-cipher - fix e In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() Fix two DMA cleanup issues on the error path in sun8i_ce_cipher_prepare(): 1] If dma_map_sg() fails for areq->dst, the device driver would try to free DMA memory it has not allocated in the first place. To f

CVE-2025-39838 [MEDIUM] CWE-476 CVE-2025-39838: In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dere In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unchecked to cifs_strndup_to_utf16, which in turn passes it to cifs_local_to_utf16_bytes where '*from'