Debian Linux vulnerabilities

CVE-2025-38418 [MEDIUM] CWE-401 CVE-2025-38418: In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Release rproc In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Release rproc->clean_table after rproc_attach() fails When rproc->state = RPROC_DETACHED is attached to remote processor through rproc_attach(), if rproc_handle_resources() returns failure, then the clean table should be released, otherwise the following memory le

CVE-2025-38282 [MEDIUM] CVE-2025-38282: In the Linux kernel, the following vulnerability has been resolved: kernfs: Relax constraint in dra In the Linux kernel, the following vulnerability has been resolved: kernfs: Relax constraint in draining guard The active reference lifecycle provides the break/unbreak mechanism but the active reference is not truly active after unbreak -- callers don't use it afterwards but it's important for proper pairing of kn->active counting. Assuming this mechanism

CVE-2025-38542 [MEDIUM] CVE-2025-38542: In the Linux kernel, the following vulnerability has been resolved: net: appletalk: Fix device refc In the Linux kernel, the following vulnerability has been resolved: net: appletalk: Fix device refcount leak in atrtr_create() When updating an existing route entry in atrtr_create(), the old device reference was not being released before assigning the new device, leading to a device refcount leak. Fix this by calling dev_put() to release the old device re

CVE-2025-37775 [MEDIUM] CVE-2025-37775: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix the warning from __k In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix the warning from __kernel_write_iter [ 2110.972290] ------------[ cut here ]------------ [ 2110.972301] WARNING: CPU: 3 PID: 735 at fs/read_write.c:599 __kernel_write_iter+0x21b/0x280 This patch doesn't allow writing to directory.

CVE-2025-38695 [MEDIUM] CWE-476 CVE-2025-38695: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Check for hdwq null In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure If a call to lpfc_sli4_read_rev() from lpfc_sli4_hba_setup() fails, the resultant cleanup routine lpfc_sli4_vport_delete_fcp_xri_aborted() may occur before sli4_hba.hdwqs are allocated. This may result in a n

CVE-2025-38569 [MEDIUM] CWE-476 CVE-2025-38569: In the Linux kernel, the following vulnerability has been resolved: benet: fix BUG when creating VF In the Linux kernel, the following vulnerability has been resolved: benet: fix BUG when creating VFs benet crashes as soon as SRIOV VFs are created: kernel BUG at mm/vmalloc.c:3457! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 4 UID: 0 PID: 7408 Comm: test.sh Kdump: loaded Not tainted 6.16.0+ #1 PREEMPT(voluntary) [...] RIP: 0010:vunmap+0x

CVE-2023-52583 [MEDIUM] CWE-667 CVE-2023-52583: In the Linux kernel, the following vulnerability has been resolved: ceph: fix deadlock or deadcode In the Linux kernel, the following vulnerability has been resolved: ceph: fix deadlock or deadcode of misusing dget() The lock order is incorrect between denty and its parent, we should always make sure that the parent get the lock first. But since this deadcode is never used and the parent dir will always be set from the callers, let's just remove

CVE-2025-38151 [MEDIUM] CVE-2025-38151: In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix hang when cma_net In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work The cited commit fixed a crash when cma_netevent_callback was called for a cma_id while work on that id from a previous call had not yet started. The work item was re-initialized in the second call, which corrupted the work

CVE-2025-37969 [MEDIUM] CWE-667 CVE-2025-37969: In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix possi In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo Prevent st_lsm6dsx_read_tagged_fifo from falling in an infinite loop in case pattern_len is equal to zero and the device FIFO is not empty.

CVE-2025-38513 [MEDIUM] CWE-476 CVE-2025-38513: In the Linux kernel, the following vulnerability has been resolved: wifi: zd1211rw: Fix potential N In the Linux kernel, the following vulnerability has been resolved: wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() There is a potential NULL pointer dereference in zd_mac_tx_to_dev(). For example, the following is possible: T0 T1 zd_mac_tx_to_dev() /* len == skb_queue_len(q) */ while (len > ZD_MAC_MAX_ACK_WAITERS) {

CVE-2025-37970 [MEDIUM] CWE-667 CVE-2025-37970: In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix possi In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo Prevent st_lsm6dsx_read_fifo from falling in an infinite loop in case pattern_len is equal to zero and the device FIFO is not empty.

CVE-2024-35806 [MEDIUM] CWE-667 CVE-2024-35806: In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: Always disable In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: Always disable interrupts when taking cgr_lock smp_call_function_single disables IRQs when executing the callback. To prevent deadlocks, we must disable IRQs when taking cgr_lock elsewhere. This is already done by qman_update_cgr and qman_delete_cgr; fix the other

CVE-2025-38251 [MEDIUM] CWE-476 CVE-2025-38251: In the Linux kernel, the following vulnerability has been resolved: atm: clip: prevent NULL deref i In the Linux kernel, the following vulnerability has been resolved: atm: clip: prevent NULL deref in clip_push() Blamed commit missed that vcc_destroy_socket() calls clip_push() with a NULL skb. If clip_devs is NULL, clip_push() then crashes when reading skb->truesize.

CVE-2025-38319 [MEDIUM] CWE-476 CVE-2025-38319: In the Linux kernel, the following vulnerability has been resolved: drm/amd/pp: Fix potential NULL In the Linux kernel, the following vulnerability has been resolved: drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table The function atomctrl_initialize_mc_reg_table() and atomctrl_initialize_mc_reg_table_v2_2() does not check the return value of smu_atom_get_data_table(). If smu_atom_get_data_table() fails to retr

CVE-2025-38300 [MEDIUM] CWE-401 CVE-2025-38300: In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce-cipher - fix e In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() Fix two DMA cleanup issues on the error path in sun8i_ce_cipher_prepare(): 1] If dma_map_sg() fails for areq->dst, the device driver would try to free DMA memory it has not allocated in the first place. To f

CVE-2025-38721 [MEDIUM] CVE-2025-38721: In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refco In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res ct_general); // HERE cb->args[1] = (unsigned long)ct; ... While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already in

CVE-2025-39742 [MEDIUM] CWE-369 CVE-2025-39742: In the Linux kernel, the following vulnerability has been resolved: RDMA: hfi1: fix possible divide In the Linux kernel, the following vulnerability has been resolved: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() The function divides number of online CPUs by num_core_siblings, and later checks the divider by zero. This implies a possibility to get and divide-by-zero runtime error. Fix it by moving the check prior to division.

CVE-2025-38723 [MEDIUM] CVE-2025-38723: In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix jump offset In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix jump offset calculation in tailcall The extra pass of bpf_int_jit_compile() skips JIT context initialization which essentially skips offset calculation leaving out_offset = -1, so the jmp_offset in emit_bpf_tail_call is calculated by "#define jmp_offset (out_offset - (

CVE-2025-38630 [MEDIUM] CWE-476 CVE-2025-38630: In the Linux kernel, the following vulnerability has been resolved: fbdev: imxfb: Check fb_add_vide In the Linux kernel, the following vulnerability has been resolved: fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref fb_add_videomode() can fail with -ENOMEM when its internal kmalloc() cannot allocate a struct fb_modelist. If that happens, the modelist stays empty but the driver continues to register. Add a check for its return value

CVE-2025-38167 [MEDIUM] CWE-476 CVE-2025-38167: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle hdr_first_de() In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle hdr_first_de() return value The hdr_first_de() function returns a pointer to a struct NTFS_DE. This pointer may be NULL. To handle the NULL error effectively, it is important to implement an error handler. This will help manage potential errors consistently. Addit