Debian Linux vulnerabilities

CVE-2022-49205 [HIGH] CVE-2022-49205: linux - In the Linux kernel, the following vulnerability has been resolved: bpf, sockma... In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix double uncharge the mem of sk_msg If tcp_bpf_sendmsg is running during a tear down operation, psock may be freed. tcp_bpf_sendmsg() tcp_bpf_send_verdict() sk_msg_return() tcp_bpf_sendmsg_redir() unlikely(!psock)) sk_msg_free() The mem of msg has been uncharged in tcp_bpf_send_verdict

CVE-2023-52649 [HIGH] CVE-2023-52649: linux - In the Linux kernel, the following vulnerability has been resolved: drm/vkms: A... In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Avoid reading beyond LUT array When the floor LUT index (drm_fixp2int(lut_index) is the last index of the array the ceil LUT index will point to an entry beyond the array. Make sure we guard against it and use the value of the floor LUT index. v3: - Drop bits from commit description that did

CVE-2024-26928 [HIGH] CVE-2024-26928: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_debug_files_proc_show() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. Scope: local bookworm: resolved (fixed in 6.1.85-1) bullseye: resolved (fixed in 5.10.237-1) forky: resolved (fixed in 6.8.9-1) sid: resolved (fixed in 6.8.9-1)

CVE-2024-26739 [HIGH] CVE-2024-26739: linux - In the Linux kernel, the following vulnerability has been resolved: net/sched: ... In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: don't override retval if we already lost the skb If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by setting the retcode to SHOT. If we have called tcf_mirred_forward(), however, the skb is out of our hands and

CVE-2023-52664 [HIGH] CVE-2023-52664: linux - In the Linux kernel, the following vulnerability has been resolved: net: atlant... In the Linux kernel, the following vulnerability has been resolved: net: atlantic: eliminate double free in error handling logic Driver has a logic leak in ring data allocation/free, where aq_ring_free could be called multiple times on same ring, if system is under stress and got memory allocation error. Ring pointer was used as an indicator of failure, but this is no

CVE-2021-47600 [HIGH] CVE-2021-47600: linux - In the Linux kernel, the following vulnerability has been resolved: dm btree re... In the Linux kernel, the following vulnerability has been resolved: dm btree remove: fix use after free in rebalance_children() Move dm_tm_unlock() after dm_tm_dec(). Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved (fixed in 5.10.92-1) forky: resolved (fixed in 5.15.15-1) sid: resolved (fixed in 5.15.15-1) trixie: resolved (fixed in 5.15.15-1)

CVE-2024-56538 [HIGH] CVE-2024-56538: linux - In the Linux kernel, the following vulnerability has been resolved: drm: zynqmp... In the Linux kernel, the following vulnerability has been resolved: drm: zynqmp_kms: Unplug DRM device before removal Prevent userspace accesses to the DRM device from causing use-after-frees by unplugging the device before we remove it. This causes any further userspace accesses to result in an error without further calls into this driver's internals. Scope: local bo

CVE-2022-49384 [HIGH] CVE-2022-49384: linux - In the Linux kernel, the following vulnerability has been resolved: md: fix dou... In the Linux kernel, the following vulnerability has been resolved: md: fix double free of io_acct_set bioset Now io_acct_set is alloc and free in personality. Remove the codes that free io_acct_set in md_free and md_stop. Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved forky: resolved (fixed in 5.18.5-1) sid: resolved (fixed in 5.18.5-1) trixie

CVE-2024-46818 [HIGH] CVE-2024-46818: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check gpio_id before used as array index [WHY & HOW] GPIO_ID_UNKNOWN (-1) is not a valid value for array index and therefore should be checked in advance. This fixes 5 OVERRUN issues reported by Coverity. Scope: local bookworm: resolved (fixed in 6.1.112-1) bullseye: resolved (fixed i

CVE-2024-49966 [HIGH] CVE-2024-49966: linux - In the Linux kernel, the following vulnerability has been resolved: ocfs2: canc... In the Linux kernel, the following vulnerability has been resolved: ocfs2: cancel dqi_sync_work before freeing oinfo ocfs2_global_read_info() will initialize and schedule dqi_sync_work at the end, if error occurs after successfully reading global quota, it will trigger the following warning with CONFIG_DEBUG_OBJECTS_* enabled: ODEBUG: free active (active state 0) obje

CVE-2025-40364 [HIGH] CVE-2025-40364: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring: f... In the Linux kernel, the following vulnerability has been resolved: io_uring: fix io_req_prep_async with provided buffers io_req_prep_async() can import provided buffers, commit the ring state by giving up on that before, it'll be reimported later if needed. Scope: local bookworm: resolved (fixed in 6.1.129-1) bullseye: resolved forky: resolved (fixed in 6.12.15-1) si

CVE-2024-50143 [HIGH] CVE-2024-50143: linux - In the Linux kernel, the following vulnerability has been resolved: udf: fix un... In the Linux kernel, the following vulnerability has been resolved: udf: fix uninit-value use in udf_get_fileshortad Check for overflow when computing alen in udf_current_aext to mitigate later uninit-value use in udf_get_fileshortad KMSAN bug[1]. After applying the patch reproducer did not trigger any issue[2]. [1] https://syzkaller.appspot.com/bug?extid=8901c4560b7a

CVE-2024-26704 [HIGH] CVE-2024-26704: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: fix d... In the Linux kernel, the following vulnerability has been resolved: ext4: fix double-free of blocks due to wrong extents moved_len In ext4_move_extents(), moved_len is only updated when all moves are successfully executed, and only discards orig_inode and donor_inode preallocations when moved_len is not zero. When the loop fails to exit after successfully moving some

CVE-2022-48424 [HIGH] CVE-2022-48424: linux - In the Linux kernel before 6.1.3, fs/ntfs3/inode.c does not validate the attribu... In the Linux kernel before 6.1.3, fs/ntfs3/inode.c does not validate the attribute name offset. An unhandled page fault may occur. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved forky: resolved (fixed in 6.1.4-1) sid: resolved (fixed in 6.1.4-1) trixie: resolved (fixed in 6.1.4-1)

CVE-2020-26145 [MEDIUM] CVE-2020-26145: linux - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, ... An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets independent of the network configuration. Scope: local bookworm: reso

CVE-2024-35867 [HIGH] CVE-2024-35867: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_stats_proc_show() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. Scope: local bookworm: resolved (fixed in 6.1.85-1) bullseye: resolved (fixed in 5.10.237-1) forky: resolved (fixed in 6.8.9-1) sid: resolved (fixed in 6.8.9-1) trixi

CVE-2022-49362 [HIGH] CVE-2022-49362: linux - In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix p... In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix potential use-after-free in nfsd_file_put() nfsd_file_put_noref() can free @nf, so don't dereference @nf immediately upon return from nfsd_file_put_noref(). Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved (fixed in 5.10.221-1) forky: resolved (fixed in 5.18.5-1) sid: r

CVE-2022-48425 [HIGH] CVE-2022-48425: linux - In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because... In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved forky: resolved (fixed in 6.3.7-1) sid: resolved (fixed in 6.3.7-1) trixie: resolved (fixed in 6.3.7-1)

CVE-2022-49524 [HIGH] CVE-2022-49524: linux - In the Linux kernel, the following vulnerability has been resolved: media: pci:... In the Linux kernel, the following vulnerability has been resolved: media: pci: cx23885: Fix the error handling in cx23885_initdev() When the driver fails to call the dma_set_mask(), the driver will get the following splat: [ 55.853884] BUG: KASAN: use-after-free in __process_removed_driver+0x3c/0x240 [ 55.854486] Read of size 8 at addr ffff88810de60408 by task modpro

CVE-2025-21791 [HIGH] CVE-2025-21791: linux - In the Linux kernel, the following vulnerability has been resolved: vrf: use RC... In the Linux kernel, the following vulnerability has been resolved: vrf: use RCU protection in l3mdev_l3_out() l3mdev_l3_out() can be called without RCU being held: raw_sendmsg() ip_push_pending_frames() ip_send_skb() ip_local_out() __ip_local_out() l3mdev_ip_out() Add rcu_read_lock() / rcu_read_unlock() pair to avoid a potential UAF. Scope: local bookworm: resolved (