Debian Linux vulnerabilities

CVE-2022-49917 [HIGH] CVE-2022-49917: linux - In the Linux kernel, the following vulnerability has been resolved: ipvs: fix W... In the Linux kernel, the following vulnerability has been resolved: ipvs: fix WARNING in ip_vs_app_net_cleanup() During the initialization of ip_vs_app_net_init(), if file ip_vs_app fails to be created, the initialization is successful by default. Therefore, the ip_vs_app file doesn't be found during the remove in ip_vs_app_net_cleanup(). It will cause WRNING. The fol

CVE-2024-57849 [HIGH] CVE-2024-57849: linux - In the Linux kernel, the following vulnerability has been resolved: s390/cpum_s... In the Linux kernel, the following vulnerability has been resolved: s390/cpum_sf: Handle CPU hotplug remove during sampling CPU hotplug remove handling triggers the following function call sequence: CPUHP_AP_PERF_S390_SF_ONLINE --> s390_pmu_sf_offline_cpu() ... CPUHP_AP_PERF_ONLINE --> perf_event_exit_cpu() The s390 CPUMF sampling CPU hotplug handler invokes: s390_pmu

CVE-2023-53626 [HIGH] CVE-2023-53626: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: fix p... In the Linux kernel, the following vulnerability has been resolved: ext4: fix possible double unlock when moving a directory Scope: local bookworm: resolved (fixed in 6.1.25-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.25-1) sid: resolved (fixed in 6.1.25-1) trixie: resolved (fixed in 6.1.25-1)

CVE-2022-48854 [HIGH] CVE-2022-48854: linux - In the Linux kernel, the following vulnerability has been resolved: net: arc_em... In the Linux kernel, the following vulnerability has been resolved: net: arc_emac: Fix use after free in arc_mdio_probe() If bus->state is equal to MDIOBUS_ALLOCATED, mdiobus_free(bus) will free the "bus". But bus->name is still used in the next line, which will lead to a use after free. We can fix it by putting the name in a local variable and make the bus->name poin

CVE-2024-56764 [HIGH] CVE-2024-56764: linux - In the Linux kernel, the following vulnerability has been resolved: ublk: detac... In the Linux kernel, the following vulnerability has been resolved: ublk: detach gendisk from ublk device if add_disk() fails Inside ublk_abort_requests(), gendisk is grabbed for aborting all inflight requests. And ublk_abort_requests() is called when exiting the uring context or handling timeout. If add_disk() fails, the gendisk may have been freed when calling ublk_

CVE-2024-38664 [HIGH] CVE-2024-38664: linux - In the Linux kernel, the following vulnerability has been resolved: drm: zynqmp... In the Linux kernel, the following vulnerability has been resolved: drm: zynqmp_dpsub: Always register bridge We must always register the DRM bridge, since zynqmp_dp_hpd_work_func calls drm_bridge_hpd_notify, which in turn expects hpd_mutex to be initialized. We do this before zynqmp_dpsub_drm_init since that calls drm_bridge_attach. This fixes the following lockdep w

CVE-2025-21999 [HIGH] CVE-2025-21999: linux - In the Linux kernel, the following vulnerability has been resolved: proc: fix U... In the Linux kernel, the following vulnerability has been resolved: proc: fix UAF in proc_get_inode() Fix race between rmmod and /proc/XXX's inode instantiation. The bug is that pde->proc_ops don't belong to /proc, it belongs to a module, therefore dereferencing it after /proc entry has been registered is a bug unless use_pde/unuse_pde() pair has been used. use_pde/un

CVE-2025-22067 [HIGH] CVE-2025-22067: linux - In the Linux kernel, the following vulnerability has been resolved: spi: cadenc... In the Linux kernel, the following vulnerability has been resolved: spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() If requested_clk > 128, cdns_mrvl_xspi_setup_clock() iterates over the entire cdns_mrvl_xspi_clk_div_list array without breaking out early, causing 'i' to go beyond the array bounds. Fix that by stopping the loop when it gets

CVE-2024-58004 [HIGH] CVE-2024-58004: linux - In the Linux kernel, the following vulnerability has been resolved: media: inte... In the Linux kernel, the following vulnerability has been resolved: media: intel/ipu6: remove cpu latency qos request on error Fix cpu latency qos list corruption like below. It happens when we do not remove cpu latency request on error path and free corresponding memory. [ 30.634378] l7 kernel: list_add corruption. prev->next should be next (ffffffff9645e960), but wa

CVE-2024-56784 [HIGH] CVE-2024-56784: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Adding array index check to prevent memory corruption [Why & How] Array indices out of bound caused memory corruption. Adding checks to ensure that array index stays in bound. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.12.5-1) sid: resolved (fixed i

CVE-2022-49859 [HIGH] CVE-2022-49859: linux - In the Linux kernel, the following vulnerability has been resolved: net: lapbet... In the Linux kernel, the following vulnerability has been resolved: net: lapbether: fix issue of invalid opcode in lapbeth_open() If lapb_register() failed when lapb device goes to up for the first time, the NAPI is not disabled. As a result, the invalid opcode issue is reported when the lapb device goes to up for the second time. The stack info is as follows: [ 1958.

CVE-2025-38361 [HIGH] CVE-2025-38361: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check dce_hwseq before dereferencing it [WHAT] hws was checked for null earlier in dce110_blank_stream, indicating hws can be null, and should be checked whenever it is used. (cherry picked from commit 79db43611ff61280b6de58ce1305e0b2ecf675ad) Scope: local bookworm: resolved (fixed in

CVE-2025-37803 [HIGH] CVE-2025-37803: linux - In the Linux kernel, the following vulnerability has been resolved: udmabuf: fi... In the Linux kernel, the following vulnerability has been resolved: udmabuf: fix a buf size overflow issue during udmabuf creation by casting size_limit_mb to u64 when calculate pglimit. Scope: local bookworm: resolved (fixed in 6.1.137-1) bullseye: resolved (fixed in 5.10.237-1) forky: resolved (fixed in 6.16.3-1) sid: resolved (fixed in 6.16.3-1) trixie: resolved (f

CVE-2025-38298 [HIGH] CVE-2025-38298: linux - In the Linux kernel, the following vulnerability has been resolved: EDAC/skx_co... In the Linux kernel, the following vulnerability has been resolved: EDAC/skx_common: Fix general protection fault After loading i10nm_edac (which automatically loads skx_edac_common), if unload only i10nm_edac, then reload it and perform error injection testing, a general protection fault may occur: mce: [Hardware Error]: Machine check events logged Oops: general prot

CVE-2022-50067 [HIGH] CVE-2022-50067: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: unse... In the Linux kernel, the following vulnerability has been resolved: btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() In btrfs_relocate_block_group(), the rc is allocated. Then btrfs_relocate_block_group() calls relocate_block_group() prepare_to_relocate() set_reloc_control() that assigns rc to the variable fs_info->reloc_ctl. When prepar

CVE-2026-23001 [HIGH] CVE-2026-23001: linux - In the Linux kernel, the following vulnerability has been resolved: macvlan: fi... In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointer before RCU grace period starts. This allows macvlan_forward_source() to skip over entries queued for freeing.

CVE-2025-22126 [HIGH] CVE-2025-22126: linux - In the Linux kernel, the following vulnerability has been resolved: md: fix mdd... In the Linux kernel, the following vulnerability has been resolved: md: fix mddev uaf while iterating all_mddevs list While iterating all_mddevs list from md_notify_reboot() and md_exit(), list_for_each_entry_safe is used, and this can race with deletint the next mddev, causing UAF: t1: spin_lock //list_for_each_entry_safe(mddev, n, ...) mddev_get(mddev1) // assume md

CVE-2020-0430 [HIGH] CVE-2020-0430: linux - In skb_headlen of /include/linux/skbuff.h, there is a possible out of bounds rea... In skb_headlen of /include/linux/skbuff.h, there is a possible out of bounds read due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-153881554 Scope: local bookworm: resolved (fixed in 4.17.8-1) bul

CVE-2025-21968 [HIGH] CVE-2025-21968: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix slab-use-after-free on hdcp_work [Why] A slab-use-after-free is reported when HDCP is destroyed but the property_validate_dwork queue is still running. [How] Cancel the delayed work when destroying workqueue. (cherry picked from commit 725a04ba5a95e89c89633d4322430cfbca7ce128) Sco

CVE-2025-38403 [HIGH] CVE-2025-38403: linux - In the Linux kernel, the following vulnerability has been resolved: vsock/vmci:... In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: Clear the vmci transport packet properly when initializing it In vmci_transport_packet_init memset the vmci_transport_packet before populating the fields to avoid any uninitialised data being left in the structure. Scope: local bookworm: resolved (fixed in 6.1.147-1) bullseye: resolved (fi