Debian Linux vulnerabilities

CVE-2021-29266 [HIGH] CVE-2021-29266: linux - An issue was discovered in the Linux kernel before 5.11.9. drivers/vhost/vdpa.c ... An issue was discovered in the Linux kernel before 5.11.9. drivers/vhost/vdpa.c has a use-after-free because v->config_ctx has an invalid value upon re-opening a character device, aka CID-f6bbf0010ba0. Scope: local bookworm: resolved (fixed in 5.10.26-1) bullseye: resolved (fixed in 5.10.26-1) forky: resolved (fixed in 5.10.26-1) sid: resolved (fixed in 5.10.26-1) tri

CVE-2023-52927 [HIGH] CVE-2023-52927: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the created ct will not be confirmed, like in OVS and TC conntrack

CVE-2022-48626 [HIGH] CVE-2022-48626: linux - In the Linux kernel, the following vulnerability has been resolved: moxart: fix... In the Linux kernel, the following vulnerability has been resolved: moxart: fix potential use-after-free on remove path It was reported that the mmc host structure could be accessed after it was freed in moxart_remove(), so fix this by saving the base register of the device and using it instead of the pointer dereference. Scope: local bookworm: resolved (fixed in 5.16

CVE-2022-48964 [HIGH] CVE-2022-48964: linux - In the Linux kernel, the following vulnerability has been resolved: ravb: Fix p... In the Linux kernel, the following vulnerability has been resolved: ravb: Fix potential use-after-free in ravb_rx_gbeth() The skb is delivered to napi_gro_receive() which may free it, after calling this, dereferencing skb may trigger use-after-free. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved forky: resolved (fixed in 6.1.4-1) sid: resolved (

CVE-2017-13215 [HIGH] CVE-2017-13215: linux - A elevation of privilege vulnerability in the Upstream kernel skcipher. Product:... A elevation of privilege vulnerability in the Upstream kernel skcipher. Product: Android. Versions: Android kernel. Android ID: A-64386293. References: Upstream kernel. Scope: local bookworm: resolved (fixed in 4.4.2-1) bullseye: resolved (fixed in 4.4.2-1) forky: resolved (fixed in 4.4.2-1) sid: resolved (fixed in 4.4.2-1) trixie: resolved (fixed in 4.4.2-1)

CVE-2024-39494 [HIGH] CVE-2024-39494: linux - In the Linux kernel, the following vulnerability has been resolved: ima: Fix us... In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name ->d_name.name can change on rename and the earlier value can be freed; there are conditions sufficient to stabilize it (->d_lock on dentry, ->d_lock on its parent, ->i_rwsem exclusive on the parent's inode, rename_lock), but none of those are met at any

CVE-2023-53680 [HIGH] CVE-2023-53680: linux - In the Linux kernel, the following vulnerability has been resolved: NFSD: Avoid... In the Linux kernel, the following vulnerability has been resolved: NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL OPDESC() simply indexes into nfsd4_ops[] by the op's operation number, without range checking that value. It assumes callers are careful to avoid calling it with an out-of-bounds opnum value. nfsd4_decode_compound() is not so careful, and can

CVE-2022-48782 [HIGH] CVE-2022-48782: linux - In the Linux kernel, the following vulnerability has been resolved: mctp: fix u... In the Linux kernel, the following vulnerability has been resolved: mctp: fix use after free Clang static analysis reports this problem route.c:425:4: warning: Use of memory after it is freed trace_mctp_key_acquire(key); ^~~~~~~~~~~~~~~~~~~~~~~~~~~ When mctp_key_add() fails, key is freed but then is later used in trace_mctp_key_acquire(). Add an else statement to use

CVE-2025-37882 [HIGH] CVE-2025-37882: linux - In the Linux kernel, the following vulnerability has been resolved: usb: xhci: ... In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix isochronous Ring Underrun/Overrun event handling The TRB pointer of these events points at enqueue at the time of error occurrence on xHCI 1.1+ HCs or it's NULL on older ones. By the time we are handling the event, a new TD may be queued at this ring position. I can trigger this race by

CVE-2016-10044 [HIGH] CVE-2016-10044: linux - The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not pro... The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call. Scope: local bookworm: resolved (fixed in 4.7.8-1) bullseye: resolved (fixed in 4.7.8-1) forky: resolved (

CVE-2024-46744 [HIGH] CVE-2024-46744: linux - In the Linux kernel, the following vulnerability has been resolved: Squashfs: s... In the Linux kernel, the following vulnerability has been resolved: Squashfs: sanity check symbolic link size Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately caused by a corrupted symbolic link size read from disk. The reason why the corrupted symlink size causes an uninitialised page is due to t

CVE-2024-40989 [HIGH] CVE-2024-40989: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: arm64:... In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Disassociate vcpus from redistributor region on teardown When tearing down a redistributor region, make sure we don't have any dangling pointer to that region stored in a vcpu. Scope: local bookworm: resolved (fixed in 6.1.99-1) bullseye: resolved forky: resolved (fixed in 6.9.7-1) sid: re

CVE-2024-38552 [HIGH] CVE-2024-38552: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential index out of bounds in color transformation function Fixes index out of bounds issue in the color transformation function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS). The fix adds a check to ensure 'i' i

CVE-2022-49720 [HIGH] CVE-2022-49720: linux - In the Linux kernel, the following vulnerability has been resolved: block: Fix ... In the Linux kernel, the following vulnerability has been resolved: block: Fix handling of offline queues in blk_mq_alloc_request_hctx() This patch prevents that test nvme/004 triggers the following: UBSAN: array-index-out-of-bounds in block/blk-mq.h:135:9 index 512 is out of range for type 'long unsigned int [512]' Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x49

CVE-2022-49548 [HIGH] CVE-2022-49548: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix po... In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential array overflow in bpf_trampoline_get_progs() The cnt value in the 'cnt >= BPF_MAX_TRAMP_PROGS' check does not include BPF_TRAMP_MODIFY_RETURN bpf programs, so the number of the attached BPF_TRAMP_MODIFY_RETURN bpf programs in a trampoline can exceed BPF_MAX_TRAMP_PROGS. When this ha

CVE-2022-49388 [HIGH] CVE-2022-49388: linux - In the Linux kernel, the following vulnerability has been resolved: ubi: ubi_cr... In the Linux kernel, the following vulnerability has been resolved: ubi: ubi_create_volume: Fix use-after-free when volume creation failed There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s error handling path: ubi_eba_replace_table(vol, eba_tbl) vol->eba_tbl = tbl out_mapping: ubi_eba_destroy_table(eba_tbl) // Free 'eba_tbl' out_unlock: put_dev

CVE-2022-49053 [HIGH] CVE-2022-49053: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: targe... In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcmu: Fix possible page UAF tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not take refcount properly and just returns page pointer. When tcmu_try_get_data_page() returns, the returned page may have been freed by tcmu_blocks_release(). We need to get_page() under cm

CVE-2024-49960 [HIGH] CVE-2024-49960: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: fix t... In the Linux kernel, the following vulnerability has been resolved: ext4: fix timer use-after-free on failed mount Syzbot has found an ODEBUG bug in ext4_fill_super The del_timer_sync function cancels the s_err_report timer, which reminds about filesystem errors daily. We should guarantee the timer is no longer active before kfree(sbi). When filesystem mounting fails,

CVE-2024-53239 [HIGH] CVE-2024-53239: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire... In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Release resources at card release The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might be still in use (as we're calling snd_card_free_when_closed()). For avoid potential UAFs, move the release of re

CVE-2022-49426 [HIGH] CVE-2022-49426: linux - In the Linux kernel, the following vulnerability has been resolved: iommu/arm-s... In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-sva: Fix mm use-after-free We currently call arm64_mm_context_put() without holding a reference to the mm, which can result in use-after-free. Call mmgrab()/mmdrop() to ensure the mm only gets freed after we unpinned the ASID. Scope: local bookworm: resolved (fixed in 5.18.5-1) bulls