Debian Linux vulnerabilities

CVE-2015-4002 [CRITICAL] CVE-2015-4002: linux - drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel thro... drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure that certain length values are sufficiently large, which allows remote attackers to cause a denial of service (system crash or large loop) or possibly execute arbitrary code via a crafted packet, related to the (1) oz_usb_rx and (2) oz_usb_handle_ep_data functio

CVE-2025-68745 CVE-2025-68745: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: qla2x... In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clear cmds after chip reset Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling and host reset handling") caused two problems: 1. Commands sent to FW, after chip reset got stuck and never freed as FW is not going to respond to them anymore. 2. BUG_ON(cmd->sg_mapped) in qlt_f

CVE-2025-68301 CVE-2025-68301: linux - In the Linux kernel, the following vulnerability has been resolved: net: atlant... In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix fragment overflow handling in RX path The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This causes an out-of-bounds write in skb_add_rx_frag_netmem() leading to kernel panic. The issue occurs because the drive

CVE-2017-1000410 [HIGH] CVE-2017-1000410: linux - The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies i... The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. This info leak is a result of uninitialized stack variables that may be returned to an attacker in their uninitialized state. By manipulating the code flows that precede the handling of these conf

CVE-2021-47323 [HIGH] CVE-2021-47323: linux - In the Linux kernel, the following vulnerability has been resolved: watchdog: s... In the Linux kernel, the following vulnerability has been resolved: watchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff() This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would resu

CVE-2021-47324 [HIGH] CVE-2021-47324: linux - In the Linux kernel, the following vulnerability has been resolved: watchdog: F... In the Linux kernel, the following vulnerability has been resolved: watchdog: Fix possible use-after-free in wdt_startup() This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use

CVE-2026-23246 [HIGH] CVE-2026-23246: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80... In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration link_id is taken from the ML Reconfiguration element (control & 0x000f), so it can be 0..15. link_removal_timeout[] has IEEE80211_MLD_MAX_NUM_LINKS (15) elements, so index 15 is out-of-bounds. Skip subelements with link_id >= IEEE802

CVE-2014-5207 [MEDIUM] CVE-2014-5207: linux - fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict cle... fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NOEXEC and changing MNT_ATIME_MASK during a remount of a bind mount, which allows local users to gain privileges, interfere with backups and auditing on systems that had atime enabled, or cause a denial of service (excessive filesystem updating) on syst

CVE-2023-6200 [HIGH] CVE-2023-6200: linux - A race condition was found in the Linux Kernel. Under certain conditions, an una... A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an ICMPv6 router advertisement packet, causing arbitrary code execution. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.6.9-1) sid: resolved (fixed in 6.6.9-1) trixie: resolved (fixed in 6.6.9-1)

CVE-2016-4578 [MEDIUM] CVE-2016-4578: linux - sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r... sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions. Scope: local bookworm: resolved (fixed in 4.5.5-1) bull

CVE-2023-38426 [CRITICAL] CVE-2023-38426: linux - An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bo... An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in smb2_find_context_vals when create_context's name_len is larger than the tag length. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved forky: resolved (fixed in 6.3.7-1) sid: resolved (fixed in 6.3.7-1) trixie: resolved (fixed in 6.3.7-1)

CVE-2019-17666 [HIGH] CVE-2019-17666: linux - rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel ... rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow. Scope: local bookworm: resolved (fixed in 5.3.9-1) bullseye: resolved (fixed in 5.3.9-1) forky: resolved (fixed in 5.3.9-1) sid: resolved (fixed in 5.3.9-1) trixie: resolved (fixed in 5.3.9-1)

CVE-2023-2156 [HIGH] CVE-2023-2156: linux - A flaw was found in the networking subsystem of the Linux kernel within the hand... A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the system. Scope: local bookworm: resolved (fixed in 6.1.

CVE-2025-40261 CVE-2025-40261: linux - In the Linux kernel, the following vulnerability has been resolved: nvme: nvme-... In the Linux kernel, the following vulnerability has been resolved: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() nvme_fc_delete_assocation() waits for pending I/O to complete before returning, and an error can cause ->ioerr_work to be queued after cancel_work_sync() had been called. Move the call to cancel_work_sync() to be after nvme_fc_delete_as

CVE-2025-68341 [LOW] CVE-2025-68341: linux - In the Linux kernel, the following vulnerability has been resolved: veth: reduc... In the Linux kernel, the following vulnerability has been resolved: veth: reduce XDP no_direct return section to fix race As explain in commit fa349e396e48 ("veth: Fix race with AF_XDP exposing old or uninitialized descriptors") for veth there is a chance after napi_complete_done() that another CPU can manage start another NAPI instance running veth_pool(). For NAPI th

CVE-2024-27053 [CRITICAL] CVE-2024-27053: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1... In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RCU usage in connect path With lockdep enabled, calls to the connect function from cfg802.11 layer lead to the following warning: ============================= WARNING: suspicious RCU usage 6.7.0-rc1-wt+ #333 Not tainted ----------------------------- drivers/net/wireless/microc

CVE-2024-47685 [CRITICAL] CVE-2024-47685: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending garbage on the four reserved tcp bits (th->res1) Use skb_put_zero() to clear the whole TCP header, as done in nf_reject_ip_tcphdr_put() BUG: KMSAN: uninit-value in nf_reje

CVE-2013-3301 [HIGH] CVE-2013-3301: linux - The ftrace implementation in the Linux kernel before 3.8.8 allows local users to... The ftrace implementation in the Linux kernel before 3.8.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for write access to the (1) set_ftrace_pid or (2) set_graph_function file, and then making an lseek system call. Scope: local bookworm:

CVE-2014-3631 [HIGH] CVE-2014-3631: linux - The assoc_array_gc function in the associative-array implementation in lib/assoc... The assoc_array_gc function in the associative-array implementation in lib/assoc_array.c in the Linux kernel before 3.16.3 does not properly implement garbage collection, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via multiple "keyctl newring" operations followed by a "keyct

CVE-2016-3707 [HIGH] CVE-2016-3707: linux - The icmp_check_sysrq function in net/ipv4/icmp.c in the kernel.org projects/rt p... The icmp_check_sysrq function in net/ipv4/icmp.c in the kernel.org projects/rt patches for the Linux kernel, as used in the kernel-rt package before 3.10.0-327.22.1 in Red Hat Enterprise Linux for Real Time 7 and other products, allows remote attackers to execute SysRq commands via crafted ICMP Echo Request packets, as demonstrated by a brute-force attack to discover a