Debian Linux vulnerabilities

CVE-2024-38629 [HIGH] CVE-2024-38629: linux - In the Linux kernel, the following vulnerability has been resolved: dmaengine: ... In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Avoid unnecessary destruction of file_ida file_ida is allocated during cdev open and is freed accordingly during cdev release. This sequence is guaranteed by driver file operations. Therefore, there is no need to destroy an already empty file_ida when the WQ cdev is removed. Worse, id

CVE-2024-42112 [HIGH] CVE-2024-42112: linux - In the Linux kernel, the following vulnerability has been resolved: net: txgbe:... In the Linux kernel, the following vulnerability has been resolved: net: txgbe: free isb resources at the right time When using MSI/INTx interrupt, the shared interrupts are still being handled in the device remove routine, before free IRQs. So isb memory is still read after it is freed. Thus move wx_free_isb_resources() from txgbe_close() to txgbe_remove(). And fix t

CVE-2024-42117 [HIGH] CVE-2024-42117: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: ASSERT when failing to find index by plane/stream id [WHY] find_disp_cfg_idx_by_plane_id and find_disp_cfg_idx_by_stream_id returns an array index and they return -1 when not found; however, -1 is not a valid index number. [HOW] When this happens, call ASSERT(), and return a positive

CVE-2024-50159 [HIGH] CVE-2024-50159: linux - In the Linux kernel, the following vulnerability has been resolved: firmware: a... In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup() Clang static checker(scan-build) throws below warning： | drivers/firmware/arm_scmi/driver.c:line 2915, column 2 | Attempt to free released memory. When devm_add_action_or_reset() fails, scmi_debugfs_common_cleanup() will run twice

CVE-2023-52921 [HIGH] CVE-2023-52921: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix possible UAF in amdgpu_cs_pass1() Since the gang_size check is outside of chunk parsing loop, we need to reset i before we free the chunk data. Suggested by Ye Zhang (@VAR10CK) of Baidu Security. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.4.11-1) sid

CVE-2021-47306 [HIGH] CVE-2021-47306: linux - In the Linux kernel, the following vulnerability has been resolved: net: fddi: ... In the Linux kernel, the following vulnerability has been resolved: net: fddi: fix UAF in fza_probe fp is netdev private data and it cannot be used after free_netdev() call. Using fp after free_netdev() can cause UAF bug. Fix it by moving free_netdev() after error message. TURBOchannel adapter") Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (f

CVE-2021-47251 [HIGH] CVE-2021-47251: linux - In the Linux kernel, the following vulnerability has been resolved: mac80211: f... In the Linux kernel, the following vulnerability has been resolved: mac80211: fix skb length check in ieee80211_scan_rx() Replace hard-coded compile-time constants for header length check with dynamic determination based on the frame type. Otherwise, we hit a validation WARN_ON in cfg80211 later. [style fixes, reword commit message] Scope: local bookworm: resolved (fi

CVE-2024-56675 [HIGH] CVE-2024-56675: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UA... In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors Uprobes always use bpf_prog_run_array_uprobe() under tasks-trace-RCU protection. But it is possible to attach a non-sleepable BPF program to a uprobe, and non-sleepable BPF programs are freed via normal RCU (see __bpf_prog_put_noref()). This

CVE-2024-50030 [HIGH] CVE-2024-50030: linux - In the Linux kernel, the following vulnerability has been resolved: drm/xe/ct: ... In the Linux kernel, the following vulnerability has been resolved: drm/xe/ct: prevent UAF in send_recv() Ensure we serialize with completion side to prevent UAF with fence going out of scope on the stack, since we have no clue if it will fire after the timeout before we can erase from the xa. Also we have some dependent loads and stores for which we need the correct

CVE-2021-47483 [HIGH] CVE-2021-47483: linux - In the Linux kernel, the following vulnerability has been resolved: regmap: Fix... In the Linux kernel, the following vulnerability has been resolved: regmap: Fix possible double-free in regcache_rbtree_exit() In regcache_rbtree_insert_to_block(), when 'present' realloc failed, the 'blk' which is supposed to assign to 'rbnode->block' will be freed, so 'rbnode->block' points a freed memory, in the error handling path of regcache_rbtree_init(), 'rbnod

CVE-2024-50242 [HIGH] CVE-2024-50242: linux - In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: A... In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Additional check in ntfs_file_release Scope: local bookworm: resolved (fixed in 6.1.119-1) bullseye: resolved forky: resolved (fixed in 6.11.7-1) sid: resolved (fixed in 6.11.7-1) trixie: resolved (fixed in 6.11.7-1)

CVE-2022-48783 [HIGH] CVE-2022-48783: linux - In the Linux kernel, the following vulnerability has been resolved: net: dsa: l... In the Linux kernel, the following vulnerability has been resolved: net: dsa: lantiq_gswip: fix use after free in gswip_remove() of_node_put(priv->ds->slave_mii_bus->dev.of_node) should be done before mdiobus_free(priv->ds->slave_mii_bus). Scope: local bookworm: resolved (fixed in 5.16.11-1) bullseye: resolved (fixed in 5.10.103-1) forky: resolved (fixed in 5.16.11-1)

CVE-2024-50051 [HIGH] CVE-2024-50051: linux - In the Linux kernel, the following vulnerability has been resolved: spi: mpc52x... In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: Add cancel_work_sync before module remove If we remove the module which will call mpc52xx_spi_remove it will free 'ms' through spi_unregister_controller. while the work ms->work will be used. The sequence of operations that may lead to a UAF bug. Fix it by ensuring that the work is cance

CVE-2022-48964 [HIGH] CVE-2022-48964: linux - In the Linux kernel, the following vulnerability has been resolved: ravb: Fix p... In the Linux kernel, the following vulnerability has been resolved: ravb: Fix potential use-after-free in ravb_rx_gbeth() The skb is delivered to napi_gro_receive() which may free it, after calling this, dereferencing skb may trigger use-after-free. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved forky: resolved (fixed in 6.1.4-1) sid: resolved (

CVE-2024-56678 [HIGH] CVE-2024-56678: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/mm/... In the Linux kernel, the following vulnerability has been resolved: powerpc/mm/fault: Fix kfence page fault reporting copy_from_kernel_nofault() can be called when doing read of /proc/kcore. /proc/kcore can have some unmapped kfence objects which when read via copy_from_kernel_nofault() can cause page faults. Since *_nofault() functions define their own fixup table fo

CVE-2024-42159 [HIGH] CVE-2024-42159: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3m... In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Sanitise num_phys Information is stored in mr_sas_port->phy_mask, values larger then size of this field shouldn't be allowed. Scope: local bookworm: resolved (fixed in 6.1.98-1) bullseye: resolved forky: resolved (fixed in 6.9.9-1) sid: resolved (fixed in 6.9.9-1) trixie: resolved (fixed

CVE-2025-21863 [HIGH] CVE-2025-21863: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring: p... In the Linux kernel, the following vulnerability has been resolved: io_uring: prevent opcode speculation sqe->opcode is used for different tables, make sure we santitise it against speculations. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 6.12.17-1) sid: resolved (fixed in 6.12.17-1) trixie: resolved (fixed in 6.12.17-1)

CVE-2024-41011 [HIGH] CVE-2024-41011: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd:... In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: don't allow mapping the MMIO HDP page with large pages We don't get the right offset in that case. The GPU has an unused 4K area of the register BAR space into which you can remap registers. We remap the HDP flush registers into this space to allow userspace (CPU or GPU) to flush the HDP w

CVE-2024-39479 [HIGH] CVE-2024-39479: linux - In the Linux kernel, the following vulnerability has been resolved: drm/i915/hw... In the Linux kernel, the following vulnerability has been resolved: drm/i915/hwmon: Get rid of devm When both hwmon and hwmon drvdata (on which hwmon depends) are device managed resources, the expectation, on device unbind, is that hwmon will be released before drvdata. However, in i915 there are two separate code paths, which both release either drvdata or hwmon and

CVE-2024-49570 [HIGH] CVE-2024-49570: linux - In the Linux kernel, the following vulnerability has been resolved: drm/xe/trac... In the Linux kernel, the following vulnerability has been resolved: drm/xe/tracing: Fix a potential TP_printk UAF The commit afd2627f727b ("tracing: Check "%s" dereference via the field and not the TP_printk format") exposes potential UAFs in the xe_bo_move trace event. Fix those by avoiding dereferencing the xe_mem_type_to_name[] array at TP_printk time. Since some c