Debian Linux vulnerabilities

CVE-2025-68174 [LOW] CVE-2025-68174: linux - In the Linux kernel, the following vulnerability has been resolved: amd/amdkfd:... In the Linux kernel, the following vulnerability has been resolved: amd/amdkfd: enhance kfd process check in switch partition current switch partition only check if kfd_processes_table is empty. kfd_prcesses_table entry is deleted in kfd_process_notifier_release, but kfd_process tear down is in kfd_process_wq_release. consider two processes: Process A (workqueue) -> kf

CVE-2025-68303 CVE-2025-68303: linux - In the Linux kernel, the following vulnerability has been resolved: platform/x8... In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel: punit_ipc: fix memory corruption This passes the address of the pointer "&punit_ipcdev" when the intent was to pass the pointer itself "punit_ipcdev" (without the ampersand). This means that the: complete(&ipcdev->cmd_complete); in intel_punit_ioc() will write to a wrong memory address c

CVE-2025-68748 [LOW] CVE-2025-68748: linux - In the Linux kernel, the following vulnerability has been resolved: drm/panthor... In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF race between device unplug and FW event processing The function panthor_fw_unplug() will free the FW memory sections. The problem is that there could still be pending FW events which are yet not handled at this point. process_fw_events_work() can in this case try to access said fre

CVE-2025-68822 CVE-2025-68822: linux - In the Linux kernel, the following vulnerability has been resolved: Input: alps... In the Linux kernel, the following vulnerability has been resolved: Input: alps - fix use-after-free bugs caused by dev3_register_work The dev3_register_work delayed work item is initialized within alps_reconnect() and scheduled upon receipt of the first bare PS/2 packet from an external PS/2 device connected to the ALPS touchpad. During device detachment, the original imple

CVE-2026-23422 CVE-2026-23422: linux - In the Linux kernel, the following vulnerability has been resolved: dpaa2-switc... In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler Commit 31a7a0bbeb00 ("dpaa2-switch: add bounds check for if_id in IRQ handler") introduces a range check for if_id to avoid an out-of-bounds access. If an out-of-bounds if_id is detected, the interrupt status is not cleared. This may

CVE-2026-31396 CVE-2026-31396: linux - In the Linux kernel, the following vulnerability has been resolved: net: macb: ... In the Linux kernel, the following vulnerability has been resolved: net: macb: fix use-after-free access to PTP clock PTP clock is registered on every opening of the interface and destroyed on every closing. However it may be accessed via get_ts_info ethtool call which is possible while the interface is just present in the kernel. BUG: KASAN: use-after-free in ptp_clock_inde

CVE-2026-31392 CVE-2026-31392: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: fix krb5 mount with username option Customer reported that some of their krb5 mounts were failing against a single server as the client was trying to mount the shares with wrong credentials. It turned out the client was reusing SMB session from first mount to try mounting the other shares, even

CVE-2026-31404 [LOW] CVE-2026-31404: linux - In the Linux kernel, the following vulnerability has been resolved: NFSD: Defer... In the Linux kernel, the following vulnerability has been resolved: NFSD: Defer sub-object cleanup in export put callbacks svc_export_put() calls path_put() and auth_domain_put() immediately when the last reference drops, before the RCU grace period. RCU readers in e_show() and c_show() access both ex_path (via seq_path/d_path) and ex_client->name (via seq_escape) with

CVE-2026-31398 [LOW] CVE-2026-31398: linux - In the Linux kernel, the following vulnerability has been resolved: mm/rmap: fi... In the Linux kernel, the following vulnerability has been resolved: mm/rmap: fix incorrect pte restoration for lazyfree folios We batch unmap anonymous lazyfree folios by folio_unmap_pte_batch. If the batch has a mix of writable and non-writable bits, we may end up setting the entire batch writable. Fix this by respecting writable bit during batching. Although on a suc

CVE-2026-31389 CVE-2026-31389: linux - In the Linux kernel, the following vulnerability has been resolved: spi: fix us... In the Linux kernel, the following vulnerability has been resolved: spi: fix use-after-free on controller registration failure Make sure to deregister from driver core also in the unlikely event that per-cpu statistics allocation fails during controller registration to avoid use-after-free (of driver resources) and unclocked register accesses. Scope: local bookworm: open bul

CVE-2021-4090 [HIGH] CVE-2021-4090: linux - An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kern... An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. Scope: local bookworm: resolved (fi

CVE-2014-8160 [MEDIUM] CVE-2014-8160: linux - net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 gener... net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols, which allows remote attackers to bypass intended access restrictions via packets with disallowed port numbers. Scope: local bookworm: resolved (fixed in 3.16.7-ck

CVE-2019-3896 [HIGH] CVE-2019-3896: linux - A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.... A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacker can use this flaw for a privilege escalation or for a system crash and a denial of service (DoS). Scope: local bookworm: resolved (fixed in 3.2.41-1) bullseye: resolved (fixed in 3.2.41-1) forky: resolved (fixed in 3.2.41-1) sid: resolved (fixed in 3.

CVE-2025-39901 [HIGH] CVE-2025-39901: linux - In the Linux kernel, the following vulnerability has been resolved: i40e: remov... In the Linux kernel, the following vulnerability has been resolved: i40e: remove read access to debugfs files The 'command' and 'netdev_ops' debugfs files are a legacy debugging interface supported by the i40e driver since its early days by commit 02e9c290814c ("i40e: debugfs interface"). Both of these debugfs files provide a read handler which is mostly useless, and

CVE-2022-3625 [MEDIUM] CVE-2022-3625: linux - A vulnerability was found in Linux Kernel. It has been classified as critical. T... A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211929 was assigned to this vulnerability. Scope: local boo

CVE-2013-2017 [HIGH] CVE-2013-2017: linux - The veth (aka virtual Ethernet) driver in the Linux kernel before 2.6.34 does no... The veth (aka virtual Ethernet) driver in the Linux kernel before 2.6.34 does not properly manage skbs during congestion, which allows remote attackers to cause a denial of service (system crash) by leveraging lack of skb consumption in conjunction with a double-free error. Scope: local bookworm: resolved (fixed in 2.6.34-1) bullseye: resolved (fixed in 2.6.34-1) forky:

CVE-2018-10879 [MEDIUM] CVE-2018-10879: linux - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a... A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image. Scope: local bookworm: resolved (fixed in 4.17.3-1) bullseye: resolved (fixed in 4.17.3-1) forky: resolved (fixed in 4.17.

CVE-2021-23133 [MEDIUM] CVE-2021-23133: linux - A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc... A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the auto_asconf_splist list without any proper locking. This can be exploited

CVE-2019-19074 [HIGH] CVE-2019-19074: linux - A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/... A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-728c1e2a05e4. Scope: local bookworm: resolved (fixed in 5.4.6-1) bullseye: resolved (fixed in 5.4.6-1) forky: resolved (fixed in 5.4.6-1) sid: resolved (fixed in 5.4.6-1) tr

CVE-2017-5970 [HIGH] CVE-2017-5970: linux - The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel ... The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel through 4.9.9 allows attackers to cause a denial of service (system crash) via (1) an application that makes crafted system calls or possibly (2) IPv4 traffic with invalid IP options. Scope: local bookworm: resolved (fixed in 4.9.10-1) bullseye: resolved (fixed in 4.9.10-1) forky: resolved (