Debian Linux vulnerabilities

CVE-2019-11085 [HIGH] CVE-2019-11085: linux - Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics fo... Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Scope: local bookworm: resolved (fixed in 4.19.20-1) bullseye: resolved (fixed in 4.19.20-1) forky: resolved (fixed in 4.19.20-1) sid: resolved (fixed in 4.19.20-1) tr

CVE-2020-29534 [HIGH] CVE-2020-29534: linux - An issue was discovered in the Linux kernel before 5.9.3. io_uring takes a non-r... An issue was discovered in the Linux kernel before 5.9.3. io_uring takes a non-refcounted reference to the files_struct of the process that submitted a request, causing execve() to incorrectly optimize unshare_fd(), aka CID-0f2122045b94. Scope: local bookworm: resolved (fixed in 5.9.6-1) bullseye: resolved (fixed in 5.9.6-1) forky: resolved (fixed in 5.9.6-1) sid: res

CVE-2018-14619 [HIGH] CVE-2018-14619: linux - A flaw was found in the crypto subsystem of the Linux kernel before version kern... A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was being dropped when each af_alg_ctx was freed instead of when the aead_tfm was freed. This can cause the null skcipher to be freed while it is still in use leading to a local user being able to crash the system or possibly escalate privileges. Scope: loc

CVE-2017-17805 [HIGH] CVE-2017-17805: linux - The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not corr... The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system

CVE-2018-14678 [HIGH] CVE-2018-14678: linux - An issue was discovered in the Linux kernel through 4.17.11, as used in Xen thro... An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xen_failsafe_callback entry point in arch/x86/entry/entry_64.S does not properly maintain RBX, which allows local users to cause a denial of service (uninitialized memory usage and system crash). Within Xen, 64-bit x86 PV Linux guest OS users can trigger a guest OS crash or

CVE-2016-8632 [HIGH] CVE-2016-8632: linux - The tipc_msg_build function in net/tipc/msg.c in the Linux kernel through 4.8.11... The tipc_msg_build function in net/tipc/msg.c in the Linux kernel through 4.8.11 does not validate the relationship between the minimum fragment length and the maximum packet size, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN capability. Scope: local bookworm: resolved (fixed in 4.8

CVE-2023-53516 [MEDIUM] CVE-2023-53516: linux - In the Linux kernel, the following vulnerability has been resolved: macvlan: ad... In the Linux kernel, the following vulnerability has been resolved: macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF The previous commit 954d1fa1ac93 ("macvlan: Add netlink attribute for broadcast cutoff") added one additional attribute named IFLA_MACVLAN_BC_CUTOFF to allow broadcast cutfoff. However, it forgot to describe the nla_policy at macvlan_polic

CVE-2017-1000111 [HIGH] CVE-2017-1000111: linux - Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogo... Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a socket option that changes socket state may race with safety checks in packet_set_ring. Previously with PACKET_VERSION. This time with PACKET_RESERVE. The solution is similar: lock the socket for the update. This issue may be e

CVE-2022-29156 [HIGH] CVE-2022-29156: linux - drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel before 5.16.12 has a ... drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel before 5.16.12 has a double free related to rtrs_clt_dev_release. Scope: local bookworm: resolved (fixed in 5.16.12-1) bullseye: resolved (fixed in 5.10.103-1) forky: resolved (fixed in 5.16.12-1) sid: resolved (fixed in 5.16.12-1) trixie: resolved (fixed in 5.16.12-1)

CVE-2017-17052 [HIGH] CVE-2017-17052: linux - The mm_init function in kernel/fork.c in the Linux kernel before 4.12.10 does no... The mm_init function in kernel/fork.c in the Linux kernel before 4.12.10 does not clear the ->exe_file member of a new process's mm_struct, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program. Scope: local bookworm: resolved (fixed in 4.12.12-1) bullseye: resolved (fixed in 4.12.12-1) f

CVE-2022-28390 [HIGH] CVE-2022-28390: linux - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through ... ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed in 5.17.3-1) sid: resolved (fixed in 5.17.3-1) trixie: resolved (fixed in 5.17.3-1)

CVE-2020-12362 [HIGH] CVE-2020-12362: firmware-nonfree - Integer overflow in the firmware for some Intel(R) Graphics Drivers for Windows ... Integer overflow in the firmware for some Intel(R) Graphics Drivers for Windows * before version 26.20.100.7212 and before Linux kernel version 5.5 may allow a privileged user to potentially enable an escalation of privilege via local access. Scope: local bookworm: resolved (fixed in 20210208-1) bullseye: resolved (fixed in 20210208-1) forky: resolved (fixe

CVE-2017-18595 [HIGH] CVE-2017-18595: linux - An issue was discovered in the Linux kernel before 4.14.11. A double free may be... An issue was discovered in the Linux kernel before 4.14.11. A double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c. Scope: local bookworm: resolved (fixed in 4.14.12-1) bullseye: resolved (fixed in 4.14.12-1) forky: resolved (fixed in 4.14.12-1) sid: resolved (fixed in 4.14.12-1) trixie: resolved (fixed in 4.14.12-1)

CVE-2024-27024 [HIGH] CVE-2024-27024: linux - In the Linux kernel, the following vulnerability has been resolved: net/rds: fi... In the Linux kernel, the following vulnerability has been resolved: net/rds: fix WARNING in rds_conn_connect_if_down If connection isn't established yet, get_mr() will fail, trigger connection after get_mr(). Scope: local bookworm: resolved (fixed in 6.1.82-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.7.12-1) sid: resolved (fixed in 6.7.12-1

CVE-2023-52436 [HIGH] CVE-2023-52436: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: expli... In the Linux kernel, the following vulnerability has been resolved: f2fs: explicitly null-terminate the xattr list When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: resolved (fixed in 5.10.209-1) forky: resol

CVE-2024-41046 [HIGH] CVE-2024-41046: linux - In the Linux kernel, the following vulnerability has been resolved: net: ethern... In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix double free in detach The number of the currently released descriptor is never incremented which results in the same skb being released multiple times. Scope: local bookworm: resolved (fixed in 6.1.106-1) bullseye: resolved (fixed in 5.10.223-1) forky: resolved (fixed i

CVE-2022-49541 [HIGH] CVE-2022-49541: linux - In the Linux kernel, the following vulnerability has been resolved: cifs: fix p... In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential double free during failed mount RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=2088799 Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved forky: resolved (fixed in 5.18.5-1) sid: resolved (fixed in 5.18.5-1) trixie: resolved (fixed in 5.18.5-1)

CVE-2022-49410 [HIGH] CVE-2022-49410: linux - In the Linux kernel, the following vulnerability has been resolved: tracing: Fi... In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in create_var_ref() In create_var_ref(), init_var_ref() is called to initialize the fields of variable ref_field, which is allocated in the previous function call to create_hist_field(). Function init_var_ref() allocates the corresponding fields such as ref_field->sy

CVE-2025-21703 [HIGH] CVE-2025-21703: linux - In the Linux kernel, the following vulnerability has been resolved: netem: Upda... In the Linux kernel, the following vulnerability has been resolved: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() qdisc_tree_reduce_backlog() notifies parent qdisc only if child qdisc becomes empty, therefore we need to reduce the backlog of the child qdisc before calling it. Otherwise it would miss the opportunity to call cops->qlen_notify(), in the ca

CVE-2024-46759 [HIGH] CVE-2024-46759: linux - In the Linux kernel, the following vulnerability has been resolved: hwmon: (adc... In the Linux kernel, the following vulnerability has been resolved: hwmon: (adc128d818) Fix underflows seen when writing limit attributes DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Scope: local bookworm: