Debian Linux vulnerabilities

CVE-2023-53388 [HIGH] CVE-2023-53388: linux - In the Linux kernel, the following vulnerability has been resolved: drm/mediate... In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Clean dangling pointer on bind error path mtk_drm_bind() can fail, in which case drm_dev_put() is called, destroying the drm_device object. However a pointer to it was still being held in the private object, and that pointer would be passed along to DRM in mtk_drm_sys_prepare() if a susp

CVE-2023-53504 [HIGH] CVE-2023-53504: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_r... In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAF ib_dealloc_device() should be called only after device cleanup. Fix the dealloc sequence. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.4.11-1) sid: resolved (fixed in 6.4.11-1) trixie: resolved (fixed in 6.

CVE-2022-50413 [HIGH] CVE-2022-50413: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80... In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix use-after-free We've already freed the assoc_data at this point, so need to use another copy of the AP (MLD) address instead. Scope: local bookworm: resolved (fixed in 6.0.3-1) bullseye: resolved forky: resolved (fixed in 6.0.3-1) sid: resolved (fixed in 6.0.3-1) trixie: resolved (

CVE-2023-53522 [HIGH] CVE-2023-53522: linux - In the Linux kernel, the following vulnerability has been resolved: cgroup,free... In the Linux kernel, the following vulnerability has been resolved: cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex syzbot is reporting circular locking dependency between cpu_hotplug_lock and freezer_mutex, for commit f5d39b020809 ("freezer,sched: Rewrite core freezer logic") replaced atomic_inc() in freezer_apply_state() with static_branch_inc() which hol

CVE-2026-23083 [HIGH] CVE-2026-23083: linux - In the Linux kernel, the following vulnerability has been resolved: fou: Don't ... In the Linux kernel, the following vulnerability has been resolved: fou: Don't allow 0 for FOU_ATTR_IPPROTO. fou_udp_recv() has the same problem mentioned in the previous patch. If FOU_ATTR_IPPROTO is set to 0, skb is not freed by fou_udp_recv() nor "resubmit"-ted in ip_protocol_deliver_rcu(). Let's forbid 0 for FOU_ATTR_IPPROTO. Scope: local bookworm: resolved (fixed

CVE-2022-20368 [HIGH] CVE-2022-20368: linux - Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstr... Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel Scope: local bookworm: resolved (fixed in 5.16.18-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed in 5.16.18-1) sid: resolved (fixed in 5.16.18-1) trixie: resolved (fixed in 5.16.18-1)

CVE-2026-23272 [HIGH] CVE-2026-23272: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unconditionally bump set->nelems before insertion In case that the set is full, a new element gets published then removed without waiting for the RCU grace period, while RCU reader can be walking over it already. To address this issue, add the element transaction even if set is f

CVE-2026-23156 [HIGH] CVE-2026-23156: linux - In the Linux kernel, the following vulnerability has been resolved: efivarfs: f... In the Linux kernel, the following vulnerability has been resolved: efivarfs: fix error propagation in efivar_entry_get() efivar_entry_get() always returns success even if the underlying __efivar_entry_get() fails, masking errors. This may result in uninitialized heap memory being copied to userspace in the efivarfs_file_read() path. Fix it by returning the error from

CVE-2026-23223 [HIGH] CVE-2026-23223: linux - In the Linux kernel, the following vulnerability has been resolved: xfs: fix UA... In the Linux kernel, the following vulnerability has been resolved: xfs: fix UAF in xchk_btree_check_block_owner We cannot dereference bs->cur when trying to determine if bs->cur aliases bs->sc->sa.{bno,rmap}_cur after the latter has been freed. Fix this by sampling before type before any freeing could happen. The correct temporal ordering was broken when we removed x

CVE-2026-23392 [HIGH] CVE-2026-23392: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtable can be already registered, exposing this flowtable to packet path and nfnetlink_hook control plane. This erro

CVE-2025-71157 [HIGH] CVE-2025-71157: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/core: ... In the Linux kernel, the following vulnerability has been resolved: RDMA/core: always drop device refcount in ib_del_sub_device_and_put() Since nldev_deldev() (introduced by commit 060c642b2ab8 ("RDMA/nldev: Add support to add/delete a sub IB device through netlink") grabs a reference using ib_device_get_by_index() before calling ib_del_sub_device_and_put(), we need t

CVE-2026-23393 [HIGH] CVE-2026-23393: linux - In the Linux kernel, the following vulnerability has been resolved: bridge: cfm... In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peer_mep deletion When a peer MEP is being deleted, cancel_delayed_work_sync() is called on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in softirq context under rcu_read_lock (without RTNL) and can re-schedule ccm_rx_dwork via ccm_rx_timer_start() be

CVE-2024-42225 [HIGH] CVE-2024-42225: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mt76:... In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: replace skb_put with skb_put_zero Avoid potentially reusing uninitialized data Scope: local bookworm: resolved (fixed in 6.1.98-1) bullseye: open forky: resolved (fixed in 6.9.9-1) sid: resolved (fixed in 6.9.9-1) trixie: resolved (fixed in 6.9.9-1)

CVE-2014-6417 [HIGH] CVE-2014-6417: linux - net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, does not p... net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly consider the possibility of kmalloc failure, which allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a long unencrypted auth ticket. Scope: local bookworm: resolved (fixed in 3.16.3-1) bullseye: resolved (fixed in 3.16.3

CVE-2019-2213 [HIGH] CVE-2019-2213: linux - In binder_free_transaction of binder.c, there is a possible use-after-free due t... In binder_free_transaction of binder.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-133758011References: Upstream kernel Scope: local bookworm: resolved (fix

CVE-2019-8980 [HIGH] CVE-2019-8980: linux - A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel ... A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures. Scope: local bookworm: resolved (fixed in 4.19.28-1) bullseye: resolved (fixed in 4.19.28-1) forky: resolved (fixed in 4.19.28-1) sid: resolved (fixed in 4.19.28-1) trixie: res

CVE-2025-40240 CVE-2025-40240: linux - In the Linux kernel, the following vulnerability has been resolved: sctp: avoid... In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL dereference when chunk data buffer is missing chunk->skb pointer is dereferenced in the if-block where it's supposed to be NULL only. chunk->skb can only be NULL if chunk->head_skb is not. Check for frag_list instead and do it just before replacing chunk->skb. We're sure that otherwise chunk

CVE-2025-68774 CVE-2025-68774: linux - In the Linux kernel, the following vulnerability has been resolved: hfsplus: fi... In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create When sync() and link() are called concurrently, both threads may enter hfs_bnode_find() without finding the node in the hash table and proceed to create it. Thread A: hfsplus_write_inode() -> hfsplus_write_system_inode() -> hfs_btree_write() -> hfs_b

CVE-2021-47441 [HIGH] CVE-2021-47441: linux - In the Linux kernel, the following vulnerability has been resolved: mlxsw: ther... In the Linux kernel, the following vulnerability has been resolved: mlxsw: thermal: Fix out-of-bounds memory accesses Currently, mlxsw allows cooling states to be set above the maximum cooling state supported by the driver: # cat /sys/class/thermal/thermal_zone2/cdev0/type mlxsw_fan # cat /sys/class/thermal/thermal_zone2/cdev0/max_state 10 # echo 18 > /sys/class/therm

CVE-2025-68246 CVE-2025-68246: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: clos... In the Linux kernel, the following vulnerability has been resolved: ksmbd: close accepted socket when per-IP limit rejects connection When the per-IP connection limit is exceeded in ksmbd_kthread_fn(), the code sets ret = -EAGAIN and continues the accept loop without closing the just-accepted socket. That leaks one socket per rejected attempt from a single IP and enables a t