Debian Linux vulnerabilities

CVE-2026-23245 [HIGH] CVE-2026-23245: linux - In the Linux kernel, the following vulnerability has been resolved: net/sched: ... In the Linux kernel, the following vulnerability has been resolved: net/sched: act_gate: snapshot parameters with RCU on replace The gate action can be replaced while the hrtimer callback or dump path is walking the schedule list. Convert the parameters to an RCU-protected snapshot and swap updates under tcf_lock, freeing the previous snapshot via call_rcu(). When REP

CVE-2026-23275 [HIGH] CVE-2026-23275: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring: e... In the Linux kernel, the following vulnerability has been resolved: io_uring: ensure ctx->rings is stable for task work flags manipulation If DEFER_TASKRUN | SETUP_TASKRUN is used and task work is added while the ring is being resized, it's possible for the OR'ing of IORING_SQ_TASKRUN to happen in the small window of swapping into the new rings and the old rings being

CVE-2026-23158 [HIGH] CVE-2026-23158: linux - In the Linux kernel, the following vulnerability has been resolved: gpio: virtu... In the Linux kernel, the following vulnerability has been resolved: gpio: virtuser: fix UAF in configfs release path The gpio-virtuser configfs release path uses guard(mutex) to protect the device structure. However, the device is freed before the guard cleanup runs, causing mutex_unlock() to operate on freed memory. Specifically, gpio_virtuser_device_config_group_rel

CVE-2026-23162 [HIGH] CVE-2026-23162: linux - In the Linux kernel, the following vulnerability has been resolved: drm/xe/nvm:... In the Linux kernel, the following vulnerability has been resolved: drm/xe/nvm: Fix double-free on aux add failure After a successful auxiliary_device_init(), aux_dev->dev.release (xe_nvm_release_dev()) is responsible for the kfree(nvm). When there is failure with auxiliary_device_add(), driver will call auxiliary_device_uninit(), which call put_device(). So that the

CVE-2026-23239 [HIGH] CVE-2026-23239: linux - In the Linux kernel, the following vulnerability has been resolved: espintcp: F... In the Linux kernel, the following vulnerability has been resolved: espintcp: Fix race condition in espintcp_close() This issue was discovered during a code audit. After cancel_work_sync() is called from espintcp_close(), espintcp_tx_work() can still be scheduled from paths such as the Delayed ACK handler or ksoftirqd. As a result, the espintcp_tx_work() worker may de

CVE-2026-23271 [HIGH] CVE-2026-23271: linux - In the Linux kernel, the following vulnerability has been resolved: perf: Fix _... In the Linux kernel, the following vulnerability has been resolved: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race Make sure that __perf_event_overflow() runs with IRQs disabled for all possible callchains. Specifically the software events can end up running it with only preemption disabled. This opens up a race vs perf_event_exit_event() and fri

CVE-2021-47356 [HIGH] CVE-2021-47356: linux - In the Linux kernel, the following vulnerability has been resolved: mISDN: fix ... In the Linux kernel, the following vulnerability has been resolved: mISDN: fix possible use-after-free in HFC_cleanup() This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-af

CVE-2022-48651 [HIGH] CVE-2022-48651: linux - In the Linux kernel, the following vulnerability has been resolved: ipvlan: Fix... In the Linux kernel, the following vulnerability has been resolved: ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header If an AF_PACKET socket is used to send packets through ipvlan and the default xmit function of the AF_PACKET socket is changed from dev_queue_xmit() to packet_direct_xmit() via setsockopt() with the option name of PACKET_QDISC_BYPASS, the s

CVE-2021-3752 [HIGH] CVE-2021-3752: linux - A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the... A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Scope: local boo

CVE-2024-26854 [HIGH] CVE-2024-26854: linux - In the Linux kernel, the following vulnerability has been resolved: ice: fix un... In the Linux kernel, the following vulnerability has been resolved: ice: fix uninitialized dplls mutex usage The pf->dplls.lock mutex is initialized too late, after its first use. Move it to the top of ice_dpll_init. Note that the "err_exit" error path destroys the mutex. And the mutex is the last thing destroyed in ice_dpll_deinit. This fixes the following warning wi

CVE-2015-4003 [HIGH] CVE-2015-4003: linux - The oz_usb_handle_ep_data function in drivers/staging/ozwpan/ozusbsvc1.c in the ... The oz_usb_handle_ep_data function in drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (divide-by-zero error and system crash) via a crafted packet. Scope: local bookworm: resolved (fixed in 4.1.3-1) bullseye: resolved (fixed in 4.1.3-1) forky: resolved (fixed in 4.1.3-1) sid:

CVE-2023-45871 [HIGH] CVE-2023-45871: linux - An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB ... An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. Scope: local bookworm: resolved (fixed in 6.1.55-1) bullseye: resolved (fixed in 5.10.197-1) forky: resolved (fixed in 6.5.3-1) sid: resolved (fixed in 6.5.3-1) trixie: resolved (fixe

CVE-2026-23242 [HIGH] CVE-2026-23242: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: F... In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix potential NULL pointer dereference in header processing If siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(), qp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data() dereferences qp->rx_fpdu->more_ddp_segs without checking, which may lead to a NULL pointer deref. Only check

CVE-2021-29657 [HIGH] CVE-2021-29657: linux - arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-fre... arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when there are nested guests, aka CID-a58d9166a756. This occurs because of a TOCTOU race condition associated with a VMCB12 double fetch in nested_svm_vmrun. Scope: local bookworm: resolved (fixed in 5.10.28-1) bullseye:

CVE-2016-2069 [HIGH] CVE-2016-2069: linux - Race condition in arch/x86/mm/tlb.c in the Linux kernel before 4.4.1 allows loca... Race condition in arch/x86/mm/tlb.c in the Linux kernel before 4.4.1 allows local users to gain privileges by triggering access to a paging structure by a different CPU. Scope: local bookworm: resolved (fixed in 4.3.5-1) bullseye: resolved (fixed in 4.3.5-1) forky: resolved (fixed in 4.3.5-1) sid: resolved (fixed in 4.3.5-1) trixie: resolved (fixed in 4.3.5-1)

CVE-2016-8633 [MEDIUM] CVE-2016-8633: linux - drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hard... drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations, allows remote attackers to execute arbitrary code via crafted fragmented packets. Scope: local bookworm: resolved (fixed in 4.8.7-1) bullseye: resolved (fixed in 4.8.7-1) forky: resolved (fixed in 4.8.7-1) sid: resolved (fixed in 4.8.7-1) trixie: resolved (fixed in 4.8

CVE-2024-27394 [HIGH] CVE-2024-27394: linux - In the Linux kernel, the following vulnerability has been resolved: tcp: Fix Us... In the Linux kernel, the following vulnerability has been resolved: tcp: Fix Use-After-Free in tcp_ao_connect_init Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal of tcp_ao_connect_init, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent th

CVE-2021-3178 [MEDIUM] CVE-2021-3178: linux - fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS expor... fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a subdirectory of a filesystem, allows remote attackers to traverse to other parts of the filesystem via READDIRPLUS. NOTE: some parties argue that such a subdirectory export is not intended to prevent this attack; see also the exports(5) no_subtree_check default behavior Scope: local

CVE-2024-42093 [HIGH] CVE-2024-42093: linux - In the Linux kernel, the following vulnerability has been resolved: net/dpaa2: ... In the Linux kernel, the following vulnerability has been resolved: net/dpaa2: Avoid explicit cpumask var allocation on stack For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask variable on stack is not recommended since it can cause potential stack overflow. Instead, kernel code should always use *cpumask_var API(s) to allocate cpumask var in config-

CVE-2025-68261 CVE-2025-68261: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: add i... In the Linux kernel, the following vulnerability has been resolved: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() Fix a race between inline data destruction and block mapping. The function ext4_destroy_inline_data_nolock() changes the inode data layout by clearing EXT4_INODE_INLINE_DATA and setting EXT4_INODE_EXTENTS. At the same time, another thread m