Debian Linux vulnerabilities

CVE-2023-54094 CVE-2023-54094: linux - In the Linux kernel, the following vulnerability has been resolved: net: preven... In the Linux kernel, the following vulnerability has been resolved: net: prevent skb corruption on frag list segmentation Ian reported several skb corruptions triggered by rx-gro-list, collecting different oops alike: [ 62.624003] BUG: kernel NULL pointer dereference, address: 00000000000000c0 [ 62.631083] #PF: supervisor read access in kernel mode [ 62.636312] #PF: error_co

CVE-2017-12762 [CRITICAL] CVE-2017-12762: linux - In /drivers/isdn/i4l/isdn_net.c: A user-controlled buffer is copied into a local... In /drivers/isdn/i4l/isdn_net.c: A user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check which can cause a buffer overflow. This affects the Linux kernel 4.9-stable tree, 4.12-stable tree, 3.18-stable tree, and 4.4-stable tree. Scope: local bookworm: resolved (fixed in 4.13.4-1) bullseye: resolved (fixed in 4.13.

CVE-2024-47659 [HIGH] CVE-2024-47659: linux - In the Linux kernel, the following vulnerability has been resolved: smack: tcp:... In the Linux kernel, the following vulnerability has been resolved: smack: tcp: ipv4, fix incorrect labeling Currently, Smack mirrors the label of incoming tcp/ipv4 connections: when a label 'foo' connects to a label 'bar' with tcp/ipv4, 'foo' always gets 'foo' in returned ipv4 packets. So, 1) returned packets are incorrectly labeled ('foo' instead of 'bar') 2) 'bar'

CVE-2019-15926 [CRITICAL] CVE-2019-15926: linux - An issue was discovered in the Linux kernel before 5.2.3. Out of bounds access e... An issue was discovered in the Linux kernel before 5.2.3. Out of bounds access exists in the functions ath6kl_wmi_pstream_timeout_event_rx and ath6kl_wmi_cac_event_rx in the file drivers/net/wireless/ath/ath6kl/wmi.c. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved (fixed in 5.2.6-1) sid: resolved (fixed in

CVE-2015-8104 [CRITICAL] CVE-2015-8104: linux - The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x... The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c. Scope: local bookworm: resolved (fixed in 4.2.6-2) bullseye: resolved (fixed in 4.2.6-2) forky: resolved (fixed in 4.2.6-2) sid: resolved (fixed i

CVE-2015-3331 [CRITICAL] CVE-2015-3331: linux - The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in t... The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine the memory locations used for encrypted data, which allows context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstr

CVE-2023-25775 [MEDIUM] CVE-2023-25775: linux - Improper access control in the Intel(R) Ethernet Controller RDMA driver for linu... Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30 may allow an unauthenticated user to potentially enable escalation of privilege via network access. Scope: local bookworm: resolved (fixed in 6.1.55-1) bullseye: resolved (fixed in 5.10.205-2) forky: resolved (fixed in 6.5.3-1) sid: resolved (fixed in 6.5.3-1) tri

CVE-2019-15505 [CRITICAL] CVE-2019-15505: linux - drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has... drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB device traffic (which may be remote via usbip or usbredir). Scope: local bookworm: resolved (fixed in 5.2.17-1) bullseye: resolved (fixed in 5.2.17-1) forky: resolved (fixed in 5.2.17-1) sid: resolved (fixed in 5.2.17-1) trixie: resolved (fixed in

CVE-2023-54090 CVE-2023-54090: linux - In the Linux kernel, the following vulnerability has been resolved: ixgbe: Fix ... In the Linux kernel, the following vulnerability has been resolved: ixgbe: Fix panic during XDP_TX with > 64 CPUs Commit 4fe815850bdc ("ixgbe: let the xdpdrv work with more than 64 cpus") adds support to allow XDP programs to run on systems with more than 64 CPUs by locking the XDP TX rings and indexing them using cpu % 64 (IXGBE_MAX_XDP_QS). Upon trying this out patch on a

CVE-2023-54258 [LOW] CVE-2023-54258: linux - In the Linux kernel, the following vulnerability has been resolved: cifs: fix p... In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential oops in cifs_oplock_break With deferred close we can have closes that race with lease breaks, and so with the current checks for whether to send the lease response, oplock_response(), this can mean that an unmount (kill_sb) can occur just before we were checking if the tcon->ses is

CVE-2025-68775 [LOW] CVE-2025-68775: linux - In the Linux kernel, the following vulnerability has been resolved: net/handsha... In the Linux kernel, the following vulnerability has been resolved: net/handshake: duplicate handshake cancellations leak socket When a handshake request is cancelled it is removed from the handshake_net->hn_requests list, but it is still present in the handshake_rhashtbl until it is destroyed. If a second cancellation request arrives for the same handshake request, th

CVE-2025-40212 [LOW] CVE-2025-40212: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: fix r... In the Linux kernel, the following vulnerability has been resolved: nfsd: fix refcount leak in nfsd_set_fh_dentry() nfsd exports a "pseudo root filesystem" which is used by NFSv4 to find the various exported filesystems using LOOKUP requests from a known root filehandle. NFSv3 uses the MOUNT protocol to find those exported filesystems and so is not given access to the

CVE-2014-7822 [HIGH] CVE-2014-7822: linux - The implementation of certain splice_write file operations in the Linux kernel b... The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted splice system call, as demonstrated by use of a file descriptor associated with an ext4

CVE-2019-9500 [HIGH] CVE-2019-9500: linux - The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d... The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results function. This vulnerability can be exploited with compromised chipsets t

CVE-2019-9503 [HIGH] CVE-2019-9503: linux - The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d0403... The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source, the is_wlc_event_frame function will cause this frame to be discarded and unprocessed. If the driver receives the firmware event frame from the host, the approp

CVE-2022-42896 [HIGH] CVE-2022-42896: linux - There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2c... There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within proximity of the victim. We recommend upgrading pa

CVE-2017-16994 [MEDIUM] CVE-2017-16994: linux - The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14... The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call. Scope: local bookworm: resolved (fixed in 4.14.2-1) bullseye: resolved (fixed in 4.14.2-1) forky: resolved (fixed

CVE-2018-11508 [MEDIUM] CVE-2018-11508: linux - The compat_get_timex function in kernel/compat.c in the Linux kernel before 4.16... The compat_get_timex function in kernel/compat.c in the Linux kernel before 4.16.9 allows local users to obtain sensitive information from kernel memory via adjtimex. Scope: local bookworm: resolved (fixed in 4.16.12-1) bullseye: resolved (fixed in 4.16.12-1) forky: resolved (fixed in 4.16.12-1) sid: resolved (fixed in 4.16.12-1) trixie: resolved (fixed in 4.16.12-1

CVE-2025-21796 [HIGH] CVE-2025-21796: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: clear... In the Linux kernel, the following vulnerability has been resolved: nfsd: clear acl_access/acl_default after releasing them If getting acl_default fails, acl_access and acl_default will be released simultaneously. However, acl_access will still retain a pointer pointing to the released posix_acl, which will trigger a WARNING in nfs3svc_release_getacl like this: ------

CVE-2021-47548 [CRITICAL] CVE-2021-47548: linux - In the Linux kernel, the following vulnerability has been resolved: ethernet: h... In the Linux kernel, the following vulnerability has been resolved: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() The if statement: if (port >= DSAF_GE_NUM) return; limits the value of port less than DSAF_GE_NUM (i.e., 8). However, if the value of port is 6 or 7, an array overflow could occur: port_rst_off = d