Debian Linux vulnerabilities

CVE-2025-38712 [MEDIUM] CWE-617 CVE-2025-38712: In the Linux kernel, the following vulnerability has been resolved: hfsplus: don't use BUG_ON() in In the Linux kernel, the following vulnerability has been resolved: hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() When the volume header contains erroneous values that do not reflect the actual state of the filesystem, hfsplus_fill_super() assumes that the attributes file is not yet created, which later results in hitting BUG_ON()

CVE-2025-38225 [MEDIUM] CWE-908 CVE-2025-38225: In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Cleanup after In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Cleanup after an allocation error When allocation failures are not cleaned up by the driver, further allocation errors will be false-positives, which will cause buffers to remain uninitialized and cause NULL pointer dereferences. Ensure proper cleanup of failed allo

CVE-2025-38671 [MEDIUM] CVE-2025-38671: In the Linux kernel, the following vulnerability has been resolved: i2c: qup: jump out of the loop In the Linux kernel, the following vulnerability has been resolved: i2c: qup: jump out of the loop in case of timeout Original logic only sets the return value but doesn't jump out of the loop if the bus is kept active by a client. This is not expected. A malicious or buggy i2c client can hang the kernel in this case and should be avoided. This is observed

CVE-2025-38602 [MEDIUM] CWE-252 CVE-2025-38602: In the Linux kernel, the following vulnerability has been resolved: iwlwifi: Add missing check for In the Linux kernel, the following vulnerability has been resolved: iwlwifi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue since it may return NULL pointer.

CVE-2025-39675 [MEDIUM] CWE-476 CVE-2025-39675: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null point In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() The function mod_hdcp_hdcp1_create_session() calls the function get_first_active_display(), but does not check its return value. The return value is a null pointer if the display list is empty. This will lea

CVE-2025-39692 [MEDIUM] CWE-476 CVE-2025-39692: In the Linux kernel, the following vulnerability has been resolved: smb: server: split ksmbd_rdma_s In the Linux kernel, the following vulnerability has been resolved: smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() We can't call destroy_workqueue(smb_direct_wq); before stop_sessions()! Otherwise already existing connections try to use smb_direct_wq as a NULL pointer.

CVE-2025-38588 [MEDIUM] CWE-835 CVE-2025-38588: In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent infinite loop in In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent infinite loop in rt6_nlmsg_size() While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place: list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, fib6_siblings) { rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); }

CVE-2025-38587 [MEDIUM] CWE-835 CVE-2025-38587: In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loo In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6_info_uses_dev() fib6_info_uses_dev() seems to rely on RCU without an explicit protection. Like the prior fix in rt6_nlmsg_size(), we need to make sure fib6_del_route() or fib6_add_rt2node() have not removed the anchor from the list, or we r

CVE-2025-39920 [MEDIUM] CWE-476 CVE-2025-39920: In the Linux kernel, the following vulnerability has been resolved: pcmcia: Add error handling for In the Linux kernel, the following vulnerability has been resolved: pcmcia: Add error handling for add_interval() in do_validate_mem() In the do_validate_mem(), the call to add_interval() does not handle errors. If kmalloc() fails in add_interval(), it could result in a null pointer being inserted into the linked list, leading to illegal memory acce

CVE-2025-38634 [MEDIUM] CWE-476 CVE-2025-38634: In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-charger: F In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-charger: Fix null check for power_supply_get_by_name In the cpcap_usb_detect() function, the power_supply_get_by_name() function may return `NULL` instead of an error pointer. To prevent potential null pointer dereferences, Added a null check.

CVE-2025-38583 [MEDIUM] CWE-476 CVE-2025-38583: In the Linux kernel, the following vulnerability has been resolved: clk: xilinx: vcu: unregister pl In the Linux kernel, the following vulnerability has been resolved: clk: xilinx: vcu: unregister pll_post only if registered correctly If registration of pll_post is failed, it will be set to NULL or ERR, unregistering same will fail with following call trace: Unable to handle kernel NULL pointer dereference at virtual address 008 pc : clk_hw_unre

CVE-2025-38510 [MEDIUM] CWE-476 CVE-2025-38510: In the Linux kernel, the following vulnerability has been resolved: kasan: remove kasan_find_vm_are In the Linux kernel, the following vulnerability has been resolved: kasan: remove kasan_find_vm_area() to prevent possible deadlock find_vm_area() couldn't be called in atomic_context. If find_vm_area() is called to reports vm area information, kasan can trigger deadlock like: CPU0 CPU1 vmalloc(); alloc_vmap_area(); spin_lock(&vn->busy.lock) spin_

CVE-2025-39847 [MEDIUM] CWE-401 CVE-2025-39847: In the Linux kernel, the following vulnerability has been resolved: ppp: fix memory leak in pad_com In the Linux kernel, the following vulnerability has been resolved: ppp: fix memory leak in pad_compress_skb If alloc_skb() fails in pad_compress_skb(), it returns NULL without releasing the old skb. The caller does: skb = pad_compress_skb(ppp, skb); if (!skb) goto drop; drop: kfree_skb(skb); When pad_compress_skb() returns NULL, the reference t

CVE-2025-39838 [MEDIUM] CWE-476 CVE-2025-39838: In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dere In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unchecked to cifs_strndup_to_utf16, which in turn passes it to cifs_local_to_utf16_bytes where '*from'

CVE-2025-37967 [MEDIUM] CWE-667 CVE-2025-37967: In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix deadlock This patch introduces the ucsi_con_mutex_lock / ucsi_con_mutex_unlock functions to the UCSI driver. ucsi_con_mutex_lock ensures the connector mutex is only locked if a connection is established and the partner pointer is valid. This resolv

CVE-2025-39800 [MEDIUM] CVE-2025-39800: In the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on une In the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() If we find an unexpected generation for the extent buffer we are cloning at btrfs_copy_root(), we just WARN_ON() and don't error out and abort the transaction, meaning we allow to persist metadata with an unexpected

CVE-2025-38404 [MEDIUM] CWE-667 CVE-2025-38404: In the Linux kernel, the following vulnerability has been resolved: usb: typec: displayport: Fix po In the Linux kernel, the following vulnerability has been resolved: usb: typec: displayport: Fix potential deadlock The deadlock can occur due to a recursive lock acquisition of `cros_typec_altmode_data::mutex`. The call chain is as follows: 1. cros_typec_altmode_work() acquires the mutex 2. typec_altmode_vdm() -> dp_altmode_vdm() -> 3. typec_altmo

CVE-2025-6966 [MEDIUM] CWE-476 CVE-2025-6966: NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a loca NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.

CVE-2025-39734 [MEDIUM] CVE-2025-39734: In the Linux kernel, the following vulnerability has been resolved: Revert "fs/ntfs3: Replace inode In the Linux kernel, the following vulnerability has been resolved: Revert "fs/ntfs3: Replace inode_trylock with inode_lock" This reverts commit 69505fe98f198ee813898cbcaf6770949636430b. Initially, conditional lock acquisition was removed to fix an xfstest bug that was observed during internal testing. The deadlock reported by syzbot is resolved by reintr

CVE-2025-39876 [MEDIUM] CWE-476 CVE-2025-39876: In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix possible NPD in f In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() The function of_phy_find_device may return NULL, so we need to take care before dereferencing phy_dev.