Debian Linux vulnerabilities

CVE-2019-25162 [HIGH] CVE-2019-25162: linux - In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a ... In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. [wsa: added comment to the code, added Fixes tag] Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved (fixed in

CVE-2017-17448 [HIGH] CVE-2017-17448: linux - net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not r... net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for new, get, and del operations, which allows local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces. Scope: local bookworm: resolved (fixed in 4.14.7-1) bullseye: resolved (f

CVE-2022-49519 [HIGH] CVE-2022-49519: linux - In the Linux kernel, the following vulnerability has been resolved: ath10k: ski... In the Linux kernel, the following vulnerability has been resolved: ath10k: skip ath10k_halt during suspend for driver state RESTARTING Double free crash is observed when FW recovery(caused by wmi timeout/crash) is followed by immediate suspend event. The FW recovery is triggered by ath10k_core_restart() which calls driver clean up via ath10k_halt(). When the suspend

CVE-2022-49015 [HIGH] CVE-2022-49015: linux - In the Linux kernel, the following vulnerability has been resolved: net: hsr: F... In the Linux kernel, the following vulnerability has been resolved: net: hsr: Fix potential use-after-free The skb is delivered to netif_rx() which may free it, after calling this, dereferencing skb may trigger use-after-free. Scope: local bookworm: resolved (fixed in 6.0.12-1) bullseye: resolved (fixed in 5.10.158-1) forky: resolved (fixed in 6.0.12-1) sid: resolved

CVE-2023-52846 [HIGH] CVE-2023-52846: linux - In the Linux kernel, the following vulnerability has been resolved: hsr: Preven... In the Linux kernel, the following vulnerability has been resolved: hsr: Prevent use after free in prp_create_tagged_frame() The prp_fill_rct() function can fail. In that situation, it frees the skb and returns NULL. Meanwhile on the success path, it returns the original skb. So it's straight forward to fix bug by using the returned value. Scope: local bookworm: resol

CVE-2024-58240 [HIGH] CVE-2024-58240: linux - In the Linux kernel, the following vulnerability has been resolved: tls: separa... In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to wake us up and return its result. We should preferably also use a separate crypto_wait. I'm not seeing a UAF a

CVE-2023-52530 [HIGH] CVE-2023-52530: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80... In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix potential key use-after-free When ieee80211_key_link() is called by ieee80211_gtk_rekey_add() but returns 0 due to KRACK protection (identical key reinstall), ieee80211_gtk_rekey_add() will still return a pointer into the key, in a potential use-after-free. This normally doesn't ha

CVE-2022-39189 [HIGH] CVE-2022-39189: linux - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17... An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED situations. Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 5.19.6-1) sid: resolved (f

CVE-2021-47017 [HIGH] CVE-2021-47017: linux - In the Linux kernel, the following vulnerability has been resolved: ath10k: Fix... In the Linux kernel, the following vulnerability has been resolved: ath10k: Fix a use after free in ath10k_htc_send_bundle In ath10k_htc_send_bundle, the bundle_skb could be freed by dev_kfree_skb_any(bundle_skb). But the bundle_skb is used later by bundle_skb->len. As skb_len = bundle_skb->len, my patch replaces bundle_skb->len to skb_len after the bundle_skb was fre

CVE-2021-47520 [HIGH] CVE-2021-47520: linux - In the Linux kernel, the following vulnerability has been resolved: can: pch_ca... In the Linux kernel, the following vulnerability has been resolved: can: pch_can: pch_can_rx_normal: fix use after free After calling netif_receive_skb(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is dereferenced just after the call netif_receive_skb(skb). Reordering the lines solves the issue. Scope: local bookworm: resolve

CVE-2020-15852 [HIGH] CVE-2020-15852: linux - An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen th... An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. An attacker may be granted the I/O port permissions of an unrelated task. This occurs because tss_invalidate_io_bitmap mishandling causes a loss of synchronization between the I/O bitmaps of TSS and Xen, aka CID-cadfad870154. Scope: local bookworm: resolved

CVE-2025-37839 [HIGH] CVE-2025-37839: linux - In the Linux kernel, the following vulnerability has been resolved: jbd2: remov... In the Linux kernel, the following vulnerability has been resolved: jbd2: remove wrong sb->s_sequence check Journal emptiness is not determined by sb->s_sequence == 0 but rather by sb->s_start == 0 (which is set a few lines above). Furthermore 0 is a valid transaction ID so the check can spuriously trigger. Remove the invalid WARN_ON. Scope: local bookworm: resolved (

CVE-2022-48962 [HIGH] CVE-2022-48962: linux - In the Linux kernel, the following vulnerability has been resolved: net: hisili... In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() The skb is delivered to napi_gro_receive() which may free it, after calling this, dereferencing skb may trigger use-after-free. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixed in 5.10.162-1) forky: resolved (f

CVE-2022-48960 [HIGH] CVE-2022-48960: linux - In the Linux kernel, the following vulnerability has been resolved: net: hisili... In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() The skb is delivered to napi_gro_receive() which may free it, after calling this, dereferencing skb may trigger use-after-free. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixed in 5.10.162-1) forky: resolved (fixe

CVE-2025-39880 [HIGH] CVE-2025-39880: linux - In the Linux kernel, the following vulnerability has been resolved: libceph: fi... In the Linux kernel, the following vulnerability has been resolved: libceph: fix invalid accesses to ceph_connection_v1_info There is a place where generic code in messenger.c is reading and another place where it is writing to con->v1 union member without checking that the union member is active (i.e. msgr1 is in use). On 64-bit systems, con->v1.auth_retry overlaps w

CVE-2024-56651 [HIGH] CVE-2024-56651: linux - In the Linux kernel, the following vulnerability has been resolved: can: hi311x... In the Linux kernel, the following vulnerability has been resolved: can: hi311x: hi3110_can_ist(): fix potential use-after-free The commit a22bd630cfff ("can: hi311x: do not report txerr and rxerr during bus-off") removed the reporting of rxerr and txerr even in case of correct operation (i. e. not bus-off). The error count information added to the CAN frame after net

CVE-2018-15471 [HIGH] CVE-2018-15471: linux - An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/ha... An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overfl

CVE-2017-7889 [HIGH] CVE-2017-7889: linux - The mm subsystem in the Linux kernel through 3.2 does not properly enforce the C... The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file, related to arch/x86/mm/init.c and drivers/char/mem.c. Scope:

CVE-2024-49882 [HIGH] CVE-2024-49882: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: fix d... In the Linux kernel, the following vulnerability has been resolved: ext4: fix double brelse() the buffer of the extents path In ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been released, otherwise it may be released twice. An example of what triggers this is as follows: split2 map split1 |--------|-------|--------| ext4_ext_map_blocks ext4_ext_ha

CVE-2024-57899 [HIGH] CVE-2024-57899: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80... In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mbss changed flags corruption on 32 bit systems On 32-bit systems, the size of an unsigned long is 4 bytes, while a u64 is 8 bytes. Therefore, when using or_each_set_bit(bit, &bits, sizeof(changed) * BITS_PER_BYTE), the code is incorrectly searching for a bit in a 32-bit variable t