Debian Linux vulnerabilities

CVE-2022-48851 [HIGH] CVE-2022-48851: linux - In the Linux kernel, the following vulnerability has been resolved: staging: gd... In the Linux kernel, the following vulnerability has been resolved: staging: gdm724x: fix use after free in gdm_lte_rx() The netif_rx_ni() function frees the skb so we can't dereference it to save the skb->len. Scope: local bookworm: resolved (fixed in 5.16.18-1) bullseye: resolved (fixed in 5.10.106-1) forky: resolved (fixed in 5.16.18-1) sid: resolved (fixed in 5.16

CVE-2024-56652 [HIGH] CVE-2024-56652: linux - In the Linux kernel, the following vulnerability has been resolved: drm/xe/reg_... In the Linux kernel, the following vulnerability has been resolved: drm/xe/reg_sr: Remove register pool That pool implementation doesn't really work: if the krealloc happens to move the memory and return another address, the entries in the xarray become invalid, leading to use-after-free later: BUG: KASAN: slab-use-after-free in xe_reg_sr_apply_mmio+0x570/0x760 [xe] R

CVE-2024-56554 [HIGH] CVE-2024-56554: linux - In the Linux kernel, the following vulnerability has been resolved: binder: fix... In the Linux kernel, the following vulnerability has been resolved: binder: fix freeze UAF in binder_release_work() When a binder reference is cleaned up, any freeze work queued in the associated process should also be removed. Otherwise, the reference is freed while its ref->freeze.work is still queued in proc->work leading to a use-after-free issue as shown by the f

CVE-2022-50192 [HIGH] CVE-2022-50192: linux - In the Linux kernel, the following vulnerability has been resolved: spi: tegra2... In the Linux kernel, the following vulnerability has been resolved: spi: tegra20-slink: fix UAF in tegra_slink_remove() After calling spi_unregister_master(), the refcount of master will be decrease to 0, and it will be freed in spi_controller_release(), the device data also will be freed, so it will lead a UAF when using 'tspi'. To fix this, get the master before unr

CVE-2025-21671 [HIGH] CVE-2025-21671: linux - In the Linux kernel, the following vulnerability has been resolved: zram: fix p... In the Linux kernel, the following vulnerability has been resolved: zram: fix potential UAF of zram table If zram_meta_alloc failed early, it frees allocated zram->table without setting it NULL. Which will potentially cause zram_meta_free to access the table if user reset an failed and uninitialized device. Scope: local bookworm: resolved (fixed in 6.1.128-1) bullseye

CVE-2024-36012 [HIGH] CVE-2024-36012: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: msft: fix slab-use-after-free in msft_do_close() Tying the msft->data lifetime to hdev by freeing it in hci_release_dev() to fix the following case: [use] msft_do_close() msft = hdev->msft_data; if (!msft) ...(1) filter_lock); ...(4) msft_data; hdev->msft_data = NULL; ...(2) kfree(msft); ..

CVE-2024-35932 [HIGH] CVE-2024-35932: linux - In the Linux kernel, the following vulnerability has been resolved: drm/vc4: do... In the Linux kernel, the following vulnerability has been resolved: drm/vc4: don't check if plane->state->fb == state->fb Currently, when using non-blocking commits, we can see the following kernel warning: [ 110.908514] ------------[ cut here ]------------ [ 110.908529] refcount_t: underflow; use-after-free. [ 110.908620] WARNING: CPU: 0 PID: 1866 at lib/refcount.c:8

CVE-2024-53143 [HIGH] CVE-2024-53143: linux - In the Linux kernel, the following vulnerability has been resolved: fsnotify: F... In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix ordering of iput() and watched_objects decrement Ensure the superblock is kept alive until we're done with iput(). Holding a reference to an inode is not allowed unless we ensure the superblock stays alive, which fsnotify does by keeping the watched_objects count elevated, so iput() must

CVE-2022-49770 [HIGH] CVE-2022-49770: linux - In the Linux kernel, the following vulnerability has been resolved: ceph: avoid... In the Linux kernel, the following vulnerability has been resolved: ceph: avoid putting the realm twice when decoding snaps fails When decoding the snaps fails it maybe leaving the 'first_realm' and 'realm' pointing to the same snaprealm memory. And then it'll put it twice and could cause random use-after-free, BUG_ON, etc issues. Scope: local bookworm: resolved (fixe

CVE-2024-50129 [HIGH] CVE-2024-50129: linux - In the Linux kernel, the following vulnerability has been resolved: net: pse-pd... In the Linux kernel, the following vulnerability has been resolved: net: pse-pd: Fix out of bound for loop Adjust the loop limit to prevent out-of-bounds access when iterating over PI structures. The loop should not reach the index pcdev->nr_lines since we allocate exactly pcdev->nr_lines number of PI structures. This fix ensures proper bounds are maintained during it

CVE-2025-21856 [HIGH] CVE-2025-21856: linux - In the Linux kernel, the following vulnerability has been resolved: s390/ism: a... In the Linux kernel, the following vulnerability has been resolved: s390/ism: add release function for struct device According to device_release() in /drivers/base/core.c, a device without a release function is a broken device and must be fixed. The current code directly frees the device after calling device_add() without waiting for other kernel parts to release thei

CVE-2025-21800 [HIGH] CVE-2025-21800: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: H... In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, fix definer's HWS_SET32 macro for negative offset When bit offset for HWS_SET32 macro is negative, UBSAN complains about the shift-out-of-bounds: UBSAN: shift-out-of-bounds in drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c:177:2 shift exponent -8 is negative Scope: local

CVE-2024-49852 [HIGH] CVE-2024-49852: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: elx: ... In the Linux kernel, the following vulnerability has been resolved: scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del() The kref_put() function will call nport->release if the refcount drops to zero. The nport->release release function is _efc_nport_free() which frees "nport". But then we dereference "nport" on the next line which is a use after f

CVE-2024-52319 [HIGH] CVE-2024-52319: linux - In the Linux kernel, the following vulnerability has been resolved: mm: use ali... In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in clear_gigantic_page() In current kernel, hugetlb_no_page() calls folio_zero_user() with the fault address. Where the fault address may be not aligned with the huge page size. Then, folio_zero_user() may call clear_gigantic_page() with the address, while clear_gigantic_page()

CVE-2024-51729 [HIGH] CVE-2024-51729: linux - In the Linux kernel, the following vulnerability has been resolved: mm: use ali... In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in copy_user_gigantic_page() In current kernel, hugetlb_wp() calls copy_user_large_folio() with the fault address. Where the fault address may be not aligned with the huge page size. Then, copy_user_large_folio() may call copy_user_gigantic_page() with the address, while copy_u

CVE-2025-21631 [HIGH] CVE-2025-21631: linux - In the Linux kernel, the following vulnerability has been resolved: block, bfq:... In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() Our syzkaller report a following UAF for v6.6: BUG: KASAN: slab-use-after-free in bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958 Read of size 8 at addr ffff8881b57147d8 by task fsstress/232726 CPU: 2 PID: 232726 Comm: fsstress Not tainted 6.6.0

CVE-2022-50367 [HIGH] CVE-2022-50367: linux - In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF... In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uni

CVE-2022-49995 [HIGH] CVE-2022-49995: linux - In the Linux kernel, the following vulnerability has been resolved: writeback: ... In the Linux kernel, the following vulnerability has been resolved: writeback: avoid use-after-free after removing device When a disk is removed, bdi_unregister gets called to stop further writeback and wait for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation dwork after this has completed, which can result in t

CVE-2025-37789 [HIGH] CVE-2025-37789: linux - In the Linux kernel, the following vulnerability has been resolved: net: openvs... In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix nested key length validation in the set() action It's not safe to access nla_len(ovs_key) if the data is smaller than the netlink header. Check that the attribute is OK first. Scope: local bookworm: resolved (fixed in 6.1.135-1) bullseye: resolved (fixed in 5.10.237-1) forky: res

CVE-2022-50229 [HIGH] CVE-2022-50229: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd20... In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix a UAF bug on the error path of probing When the driver fails in snd_card_register() at probe time, it will free the 'bcd2k->midi_out_urb' before killing it, which may cause a UAF bug. The following log can reveal it: [ 50.727020] BUG: KASAN: use-after-free in bcd2000_input_complete+