Debian Linux vulnerabilities

CVE-2011-1490 [MEDIUM] CWE-772 CVE-2011-1490: A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset

CVE-2005-2456 [MEDIUM] CWE-667 CVE-2005-2456: Array index overflow in the xfrm_sk_policy_insert function in xfrm_user.c in Linux kernel 2.6 allows Array index overflow in the xfrm_sk_policy_insert function in xfrm_user.c in Linux kernel 2.6 allows local users to cause a denial of service (oops or deadlock) and possibly execute arbitrary code via a p->dir value that is larger than XFRM_POLICY_OUT, which is used as an index in the sock->sk_policy array.

CVE-2019-9705 [MEDIUM] CWE-770 CVE-2019-9705: Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (mem Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (memory consumption) via a large crontab file because an unlimited number of lines is accepted.

CVE-2019-17350 [MEDIUM] CWE-835 CVE-2019-17350: An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of servi An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a compare-and-exchange operation.

CVE-2019-17349 [MEDIUM] CWE-835 CVE-2019-17349: An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of servi An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a LoadExcl or StoreExcl operation.

CVE-2021-1093 [MEDIUM] CWE-404 CVE-2021-1093: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in firmware where the drive NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in firmware where the driver contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary, and may lead to denial of service or system crash.

CVE-2005-2351 [MEDIUM] CWE-668 CVE-2005-2351: Mutt before 1.5.20 patch 7 allows an attacker to cause a denial of service via a series of requests Mutt before 1.5.20 patch 7 allows an attacker to cause a denial of service via a series of requests to mutt temporary files.

CVE-2020-8002 [MEDIUM] CWE-476 CVE-2020-8002: A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to ca A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service via commands that attempt to launch a grid without previously providing a Compute Shader (CS).

CVE-2020-36311 [MEDIUM] CVE-2020-36311: An issue was discovered in the Linux kernel before 5.9. arch/x86/kvm/svm/sev.c allows attackers to c An issue was discovered in the Linux kernel before 5.9. arch/x86/kvm/svm/sev.c allows attackers to cause a denial of service (soft lockup) by triggering destruction of a large SEV VM (which requires unregistering many encrypted regions), aka CID-7be74942f184.

CVE-2018-3174 [MEDIUM] CVE-2018-3174: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Support Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Serv

CVE-2025-37836 [MEDIUM] CVE-2025-37836: In the Linux kernel, the following vulnerability has been resolved: PCI: Fix reference leak in pci_ In the Linux kernel, the following vulnerability has been resolved: PCI: Fix reference leak in pci_register_host_bridge() If device_register() fails, call put_device() to give up the reference to avoid a memory leak, per the comment at device_register(). Found by code review. [bhelgaas: squash Dan Carpenter's double free fix from https://lore.kernel.org/

CVE-2024-27417 [MEDIUM] CWE-401 CVE-2024-27417: In the Linux kernel, the following vulnerability has been resolved: ipv6: fix potential "struct net In the Linux kernel, the following vulnerability has been resolved: ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() It seems that if userspace provides a correct IFA_TARGET_NETNSID value but no IFA_ADDRESS and IFA_LOCAL attributes, inet6_rtm_getaddr() returns -EINVAL with an elevated "struct net" refcount.

CVE-2024-26839 [MEDIUM] CWE-401 CVE-2024-26839: In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix a memleak in init_ In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix a memleak in init_credit_return When dma_alloc_coherent fails to allocate dd->cr_base[i].va, init_credit_return should deallocate dd->cr_base and dd->cr_base[i] that allocated before. Or those resources would be never freed and a memleak is triggered.

CVE-2025-37990 [MEDIUM] CWE-908 CVE-2025-37990: In the Linux kernel, the following vulnerability has been resolved: wifi: brcm80211: fmac: Add erro In the Linux kernel, the following vulnerability has been resolved: wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() The function brcmf_usb_dl_writeimage() calls the function brcmf_usb_dl_cmd() but dose not check its return value. The 'state.state' and the 'state.bytes' are uninitialized if the function brcmf_usb_dl_cmd() fai

CVE-2025-37909 [MEDIUM] CWE-401 CVE-2025-37909: In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Fix memleak issue In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Fix memleak issue when GSO enabled Always map the `skb` to the LS descriptor. Previously skb was mapped to EXT descriptor when the number of fragments is zero with GSO enabled. Mapping the skb to EXT descriptor prevents it from being freed, leading to a memory leak

CVE-2023-52690 [MEDIUM] CWE-476 CVE-2023-52690: In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv: Add a null poi In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv: Add a null pointer check to scom_debug_init_one() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Add a null pointer check, and release 'ent' to avoid memory leaks.

CVE-2024-35925 [MEDIUM] CWE-369 CVE-2024-35925: In the Linux kernel, the following vulnerability has been resolved: block: prevent division by zero In the Linux kernel, the following vulnerability has been resolved: block: prevent division by zero in blk_rq_stat_sum() The expression dst->nr_samples + src->nr_samples may have zero value on overflow. It is necessary to add a check to avoid division by zero. Found by Linux Verification Center (linuxtesting.org) with Svace.

CVE-2024-26684 [MEDIUM] CVE-2024-26684: In the Linux kernel, the following vulnerability has been resolved: net: stmmac: xgmac: fix handlin In the Linux kernel, the following vulnerability has been resolved: net: stmmac: xgmac: fix handling of DPP safety error for DMA channels Commit 56e58d6c8a56 ("net: stmmac: Implement Safety Features in XGMAC core") checks and reports safety errors, but leaves the Data Path Parity Errors for each channel in DMA unhandled at all, lead to a storm of interrupt

CVE-2025-23148 [MEDIUM] CWE-476 CVE-2025-23148: In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-chipid: Ad In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() soc_dev_attr->revision could be NULL, thus, a pointer check is added to prevent potential NULL pointer dereference. This is similar to the fix in commit 3027e7b15b02 ("ice: Fix some null pointer dereferenc

CVE-2025-37884 [MEDIUM] CWE-667 CVE-2025-37884: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock between rcu_t In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock between rcu_tasks_trace and event_mutex. Fix the following deadlock: CPU A _free_event() perf_kprobe_destroy() mutex_lock(&event_mutex) perf_trace_event_unreg() synchronize_rcu_tasks_trace() There are several paths where _free_event() grabs event_mutex and calls