Debian Linux vulnerabilities

CVE-2024-49983 [HIGH] CVE-2024-49983: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: drop ... In the Linux kernel, the following vulnerability has been resolved: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free When calling ext4_force_split_extent_at() in ext4_ext_replay_update_ex(), the 'ppath' is updated but it is the 'path' that is freed, thus potentially triggering a double-free in the following process: ext4_ext_replay_update_ex ppat

CVE-2024-26599 [HIGH] CVE-2024-26599: linux - In the Linux kernel, the following vulnerability has been resolved: pwm: Fix ou... In the Linux kernel, the following vulnerability has been resolved: pwm: Fix out-of-bounds access in of_pwm_single_xlate() With args->args_count == 2 args->args[2] is not defined. Actually the flags are contained in args->args[1]. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: resolved forky: resolved (fixed in 6.6.15-1) sid: resolved (fixed in 6.6.15-1

CVE-2024-26913 [HIGH] CVE-2024-26913: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dcn35 8k30 Underflow/Corruption Issue [why] odm calculation is missing for pipe split policy determination and cause Underflow/Corruption issue. [how] Add the odm calculation. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 6.7.7-1) sid: resolved (fixed in 6.7

CVE-2022-48686 [HIGH] CVE-2022-48686: linux - In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: f... In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix UAF when detecting digest errors We should also bail from the io_work loop when we set rd_enabled to true, so we don't attempt to read data from the socket when the TCP stream is already out-of-sync or corrupted. Scope: local bookworm: resolved (fixed in 5.19.11-1) bullseye: resolved (fi

CVE-2024-56598 [HIGH] CVE-2024-56598: linux - In the Linux kernel, the following vulnerability has been resolved: jfs: array-... In the Linux kernel, the following vulnerability has been resolved: jfs: array-index-out-of-bounds fix in dtReadFirst The value of stbl can be sometimes out of bounds due to a bad filesystem. Added a check with appopriate return of error code in that case. Scope: local bookworm: resolved (fixed in 6.1.123-1) bullseye: resolved (fixed in 5.10.234-1) forky: resolved (fi

CVE-2024-46814 [HIGH] CVE-2024-46814: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check msg_id before processing transcation [WHY & HOW] HDCP_MESSAGE_ID_INVALID (-1) is not a valid msg_id nor is it a valid array index, and it needs checking before used. This fixes 4 OVERRUN issues reported by Coverity. Scope: local bookworm: resolved (fixed in 6.1.112-1) bullseye:

CVE-2024-36914 [HIGH] CVE-2024-36914: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip on writeback when it's not applicable [WHY] dynamic memory safety error detector (KASAN) catches and generates error messages "BUG: KASAN: slab-out-of-bounds" as writeback connector does not support certain features which are not initialized. [HOW] Skip them when connector type i

CVE-2022-48657 [HIGH] CVE-2022-48657: linux - In the Linux kernel, the following vulnerability has been resolved: arm64: topo... In the Linux kernel, the following vulnerability has been resolved: arm64: topology: fix possible overflow in amu_fie_setup() cpufreq_get_hw_max_freq() returns max frequency in kHz as *unsigned int*, while freq_inv_set_max_ratio() gets passed this frequency in Hz as 'u64'. Multiplying max frequency by 1000 can potentially result in overflow -- multiplying by 1000ULL i

CVE-2022-48981 [HIGH] CVE-2022-48981: linux - In the Linux kernel, the following vulnerability has been resolved: drm/shmem-h... In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove errant put in error path drm_gem_shmem_mmap() doesn't own this reference, resulting in the GEM object getting prematurely freed leading to a later use-after-free. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixed in 5.10.162-1) forky: resolved (fixed

CVE-2024-47718 [HIGH] CVE-2024-47718: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88... In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: always wait for both firmware loading attempts In 'rtw_wait_firmware_completion()', always wait for both (regular and wowlan) firmware loading attempts. Otherwise if 'rtw_usb_intf_init()' has failed in 'rtw_usb_probe()', 'rtw_usb_disconnect()' may issue 'ieee80211_free_hw()' when one of '

CVE-2023-52679 [HIGH] CVE-2023-52679: linux - In the Linux kernel, the following vulnerability has been resolved: of: Fix dou... In the Linux kernel, the following vulnerability has been resolved: of: Fix double free in of_parse_phandle_with_args_map In of_parse_phandle_with_args_map() the inner loop that iterates through the map entries calls of_node_put(new) to free the reference acquired by the previous iteration of the inner loop. This assumes that the value of "new" is NULL on the first it

CVE-2021-47058 [HIGH] CVE-2021-47058: linux - In the Linux kernel, the following vulnerability has been resolved: regmap: set... In the Linux kernel, the following vulnerability has been resolved: regmap: set debugfs_name to NULL after it is freed There is a upstream commit cffa4b2122f5("regmap:debugfs: Fix a memory leak when calling regmap_attach_dev") that adds a if condition when create name for debugfs_name. With below function invoking logical, debugfs_name is freed in regmap_debugfs_exit(

CVE-2023-52846 [HIGH] CVE-2023-52846: linux - In the Linux kernel, the following vulnerability has been resolved: hsr: Preven... In the Linux kernel, the following vulnerability has been resolved: hsr: Prevent use after free in prp_create_tagged_frame() The prp_fill_rct() function can fail. In that situation, it frees the skb and returns NULL. Meanwhile on the success path, it returns the original skb. So it's straight forward to fix bug by using the returned value. Scope: local bookworm: resol

CVE-2022-49029 [HIGH] CVE-2022-49029: linux - In the Linux kernel, the following vulnerability has been resolved: hwmon: (ibm... In the Linux kernel, the following vulnerability has been resolved: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails Smatch report warning as follows: drivers/hwmon/ibmpex.c:509 ibmpex_register_bmc() warn: '&data->list' not removed from list If ibmpex_find_sensors() fails in ibmpex_register_bmc(), data will be freed, but data->list will not be removed

CVE-2021-47028 [HIGH] CVE-2021-47028: linux - In the Linux kernel, the following vulnerability has been resolved: mt76: mt791... In the Linux kernel, the following vulnerability has been resolved: mt76: mt7915: fix txrate reporting Properly check rate_info to fix unexpected reporting. [ 1215.161863] Call trace: [ 1215.164307] cfg80211_calculate_bitrate+0x124/0x200 [cfg80211] [ 1215.170139] ieee80211s_update_metric+0x80/0xc0 [mac80211] [ 1215.175624] ieee80211_tx_status_ext+0x508/0x838 [mac80211

CVE-2025-21763 [HIGH] CVE-2025-21763: linux - In the Linux kernel, the following vulnerability has been resolved: neighbour: ... In the Linux kernel, the following vulnerability has been resolved: neighbour: use RCU protection in __neigh_notify() __neigh_notify() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF. Scope: local bookworm: resolved (fixed in 6.1.129-1) bullseye: resolved (fixed in 5.10.237-1) forky: resolved (fixed in 6.12.16-1) sid: resolved (

CVE-2025-21761 [HIGH] CVE-2025-21761: linux - In the Linux kernel, the following vulnerability has been resolved: openvswitch... In the Linux kernel, the following vulnerability has been resolved: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() ovs_vport_cmd_fill_info() can be called without RTNL or RCU. Use RCU protection and dev_net_rcu() to avoid potential UAF. Scope: local bookworm: resolved (fixed in 6.1.129-1) bullseye: resolved (fixed in 5.10.237-1) forky: resolved (fixed in

CVE-2024-42280 [HIGH] CVE-2024-42280: linux - In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix ... In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix a use after free in hfcmulti_tx() Don't dereference *sp after calling dev_kfree_skb(*sp). Scope: local bookworm: resolved (fixed in 6.1.106-1) bullseye: resolved (fixed in 5.10.226-1) forky: resolved (fixed in 6.10.3-1) sid: resolved (fixed in 6.10.3-1) trixie: resolved (fixed in 6.10.3-1)

CVE-2024-26734 [HIGH] CVE-2024-26734: linux - In the Linux kernel, the following vulnerability has been resolved: devlink: fi... In the Linux kernel, the following vulnerability has been resolved: devlink: fix possible use-after-free and memory leaks in devlink_init() The pernet operations structure for the subsystem must be registered before registering the generic netlink family. Make an unregister in case of unsuccessful registration. Scope: local bookworm: resolved bullseye: resolved forky:

CVE-2022-49391 [HIGH] CVE-2022-49391: linux - In the Linux kernel, the following vulnerability has been resolved: remoteproc:... In the Linux kernel, the following vulnerability has been resolved: remoteproc: mtk_scp: Fix a potential double free 'scp->rproc' is allocated using devm_rproc_alloc(), so there is no need to free it explicitly in the remove function. Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved forky: resolved (fixed in 5.18.5-1) sid: resolved (fixed in 5.18