Debian Linux vulnerabilities

CVE-2019-14821 [HIGH] CVE-2019-14821: linux - An out-of-bounds access issue was found in the Linux kernel, all versions throug... An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged h

CVE-2016-9555 [CRITICAL] CVE-2016-9555: linux - The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before ... The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data. Scope: local bookworm: resolved (fixed in 4.8.11-1) bullseye: resolved (fixed in

CVE-2022-25636 [HIGH] CVE-2022-25636: linux - net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows loca... net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload. Scope: local bookworm: resolved (fixed in 5.16.11-1) bullseye: resolved (fixed in 5.10.103-1) forky: resolved (fixed in 5.16.11-1) sid: resolved (fixed in 5.16.11-1) trixie: resolved (fi

CVE-2013-0268 [MEDIUM] CVE-2013-0268: linux - The msr_open function in arch/x86/kernel/msr.c in the Linux kernel before 3.7.6 ... The msr_open function in arch/x86/kernel/msr.c in the Linux kernel before 3.7.6 allows local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c. Scope: local bookworm: resolved (fixed in 3.2.39-1) bullseye: resolved (fixed in 3.2.39-1) forky: resolved (fixed in 3.2.39-1) sid: resolved (fixed in 3.2.3

CVE-2019-10220 [HIGH] CVE-2019-10220: linux - Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative path... Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists. Scope: local bookworm: resolved (fixed in 5.3.9-1) bullseye: resolved (fixed in 5.3.9-1) forky: resolved (fixed in 5.3.9-1) sid: resolved (fixed in 5.3.9-1) trixie: resolved (fixed in 5.3.9-1)

CVE-2017-7472 [MEDIUM] CVE-2017-7472: linux - The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to caus... The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls. Scope: local bookworm: resolved (fixed in 4.9.25-1) bullseye: resolved (fixed in 4.9.25-1) forky: resolved (fixed in 4.9.25-1) sid: resolved (fixed in 4.9.25-1) trixie

CVE-2021-3491 [HIGH] CVE-2021-3491: linux - The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be ... The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc//mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b ("io_uring: truncate lengths larger th

CVE-2016-6828 [MEDIUM] CVE-2016-6828: linux - The tcp_check_send_head function in include/net/tcp.h in the Linux kernel before... The tcp_check_send_head function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after a failed data copy, which allows local users to cause a denial of service (tcp_xmit_retransmit_queue use-after-free and system crash) via a crafted SACK option. Scope: local bookworm: resolved (fixed in 4.7.2-1) bullseye: resolved

CVE-2022-4379 [HIGH] CVE-2022-4379: linux - A use-after-free vulnerability was found in __nfs42_ssc_open() in fs/nfs/nfs4fil... A use-after-free vulnerability was found in __nfs42_ssc_open() in fs/nfs/nfs4file.c in the Linux kernel. This flaw allows an attacker to conduct a remote denial Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.4-1) sid: resolved (fixed in 6.1.4-1) trixie: resolved (fixed in 6.1.4-1)

CVE-2022-27666 [HIGH] CVE-2022-27666: linux - A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ip... A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat. Scope: local bookworm: resolved (fixed in 5.16.18-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (f

CVE-2026-23112 [CRITICAL] CVE-2026-23112: linux - In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: ... In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU length or offset exceeds sg_cnt and then use bogus sg->length/offset values, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining entries, and sg->length/offset bef

CVE-2025-68794 CVE-2025-68794: linux - In the Linux kernel, the following vulnerability has been resolved: iomap: adju... In the Linux kernel, the following vulnerability has been resolved: iomap: adjust read range correctly for non-block-aligned positions iomap_adjust_read_range() assumes that the position and length passed in are block-aligned. This is not always the case however, as shown in the syzbot generated case for erofs. This causes too many bytes to be skipped for uptodate blocks, wh

CVE-2025-40343 CVE-2025-40343: linux - In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: a... In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: avoid scheduling association deletion twice When forcefully shutting down a port via the configfs interface, nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and then nvmet_disable_port(). Both functions will eventually schedule all remaining associations for deletion. The current i

CVE-2023-54257 CVE-2023-54257: linux - In the Linux kernel, the following vulnerability has been resolved: net: macb: ... In the Linux kernel, the following vulnerability has been resolved: net: macb: fix a memory corruption in extended buffer descriptor mode For quite some time we were chasing a bug which looked like a sudden permanent failure of networking and mmc on some of our devices. The bug was very sensitive to any software changes and even more to any kernel debug options. Finally we g

CVE-2025-68284 CVE-2025-68284: linux - In the Linux kernel, the following vulnerability has been resolved: libceph: pr... In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() The len field originates from untrusted network packets. Boundary checks have been added to prevent potential out-of-bounds writes when decrypting the connection secret or processing service tickets. [ idryomov: changelog ] Scope: l

CVE-2023-54237 CVE-2023-54237: linux - In the Linux kernel, the following vulnerability has been resolved: net/smc: fi... In the Linux kernel, the following vulnerability has been resolved: net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() There is a certain chance to trigger the following panic: PID: 5900 TASK: ffff88c1c8af4100 CPU: 1 COMMAND: "kworker/1:48" #0 [ffff9456c1cc79a0] machine_kexec at ffffffff870665b7 #1 [ffff9456c1cc79f0] __crash_kexec at ffffffff871b4c7a #2

CVE-2023-54269 CVE-2023-54269: linux - In the Linux kernel, the following vulnerability has been resolved: SUNRPC: dou... In the Linux kernel, the following vulnerability has been resolved: SUNRPC: double free xprt_ctxt while still in use When an RPC request is deferred, the rq_xprt_ctxt pointer is moved out of the svc_rqst into the svc_deferred_req. When the deferred request is revisited, the pointer is copied into the new svc_rqst - and also remains in the svc_deferred_req. In the (rare?) cas

CVE-2025-40273 CVE-2025-40273: linux - In the Linux kernel, the following vulnerability has been resolved: NFSD: free ... In the Linux kernel, the following vulnerability has been resolved: NFSD: free copynotify stateid in nfs4_free_ol_stateid() Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't been used in a lease period. However, in case when the server got an OPEN (which created a parent stateid), followed by

CVE-2024-36896 [CRITICAL] CVE-2024-36896: linux - In the Linux kernel, the following vulnerability has been resolved: USB: core: ... In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix access violation during port device removal Testing with KASAN and syzkaller revealed a bug in port.c:disable_store(): usb_hub_to_struct_hub() can return NULL if the hub that the port belongs to is concurrently removed, but the function does not check for this possibility before der

CVE-2018-1000026 [HIGH] CVE-2018-1000026: linux - Linux Linux kernel version at least v4.8 onwards, probably well before contains ... Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnerability in bnx2x network card driver that can result in DoS: Network card firmware assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pass a very large, specially crafted packet to the bnx2x card. This can