Debian Linux vulnerabilities

CVE-2025-40317 CVE-2025-40317: linux - In the Linux kernel, the following vulnerability has been resolved: regmap: sli... In the Linux kernel, the following vulnerability has been resolved: regmap: slimbus: fix bus_context pointer in regmap init calls Commit 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()") revealed the problem in the slimbus regmap. That commit breaks audio playback, for instance, on sdm845 Thundercomm Dragonboard 845c board: Unable to handle ker

CVE-2025-40304 CVE-2025-40304: linux - In the Linux kernel, the following vulnerability has been resolved: fbdev: Add ... In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is off-screen and clip image height to screen boundary. Break from the rendering loop if the X position

CVE-2026-23322 [LOW] CVE-2026-23322: linux - In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix u... In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free and list corruption on sender error The analysis from Breno: When the SMI sender returns an error, smi_work() delivers an error response but then jumps back to restart without cleaning up properly: 1. intf->curr_msg is not cleared, so no new message is pulled 2. newmsg still po

CVE-2025-68370 [LOW] CVE-2025-68370: linux - In the Linux kernel, the following vulnerability has been resolved: coresight: ... In the Linux kernel, the following vulnerability has been resolved: coresight: tmc: add the handle of the event to the path The handle is essential for retrieving the AUX_EVENT of each CPU and is required in perf mode. It has been added to the coresight_path so that dependent devices can access it from the path when needed. The existing bug can be reproduced with: perf

CVE-2025-40303 CVE-2025-40303: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: ensu... In the Linux kernel, the following vulnerability has been resolved: btrfs: ensure no dirty metadata is written back for an fs with errors [BUG] During development of a minor feature (make sure all btrfs_bio::end_io() is called in task context), I noticed a crash in generic/388, where metadata writes triggered new works after btrfs_stop_all_workers(). It turns out that it can

CVE-2025-68317 [LOW] CVE-2025-68317: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/zc... In the Linux kernel, the following vulnerability has been resolved: io_uring/zctx: check chained notif contexts Send zc only links ubuf_info for requests coming from the same context. There are some ambiguous syz reports, so let's check the assumption on notification completion. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.17.8-1) sid:

CVE-2026-23344 [LOW] CVE-2026-23344: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: ccp... In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix use-after-free on error path In the error path of sev_tsm_init_locked(), the code dereferences 't' after it has been freed with kfree(). The pr_err() statement attempts to access t->tio_en and t->tio_init_done after the memory has been released. Move the pr_err() call before kfree(t)

CVE-2025-68793 [LOW] CVE-2025-68793: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix a job->pasid access race in gpu recovery Avoid a possible UAF in GPU recovery due to a race between the sched timeout callback and the tdr work queue. The gpu recovery function calls drm_sched_stop() and later drm_sched_start(). drm_sched_start() restarts the tdr queue which will eventu

CVE-2026-23413 [LOW] CVE-2026-23413: linux - In the Linux kernel, the following vulnerability has been resolved: clsact: Fix... In the Linux kernel, the following vulnerability has been resolved: clsact: Fix use-after-free in init/destroy rollback asymmetry Fix a use-after-free in the clsact qdisc upon init/destroy rollback asymmetry. The latter is achieved by first fully initializing a clsact instance, and then in a second step having a replacement failure for the new clsact qdisc instance. cl

CVE-2026-31397 [LOW] CVE-2026-31397: linux - In the Linux kernel, the following vulnerability has been resolved: mm/huge_mem... In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix use of NULL folio in move_pages_huge_pmd() move_pages_huge_pmd() handles UFFDIO_MOVE for both normal THPs and huge zero pages. For the huge zero page path, src_folio is explicitly set to NULL, and is used as a sentinel to skip folio operations like lock and rmap. In the huge zero pa

CVE-2026-23412 [LOW] CVE-2026-23412: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: defer hook memory release until rcu readers are done Yiming Qian reports UaF when concurrent process is dumping hooks via nfnetlink_hooks: BUG: KASAN: slab-use-after-free in nfnl_hook_dump_one.isra.0+0xe71/0x10f0 Read of size 8 at addr ffff888003edbf88 by task poc/79 Call Trace: nfnl_ho

CVE-2013-1059 [HIGH] CVE-2013-1059: linux - net/ceph/auth_none.c in the Linux kernel through 3.10 allows remote attackers to... net/ceph/auth_none.c in the Linux kernel through 3.10 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an auth_reply message that triggers an attempted build_request operation. Scope: local bookworm: resolved (fixed in 3.10.1-1) bullseye: resolved (fixed in 3.10.1-1) forky: res

CVE-2012-2744 [HIGH] CVE-2012-2744: linux - net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when ... net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when the nf_conntrack_ipv6 module is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via certain types of fragmented IPv6 packets. Scope: local bookworm: resolved (fixed in 2.6.34-1) bullseye: resolved (fixed in 2.6.34-1) forky: resolved (

CVE-2026-23102 [HIGH] CVE-2026-23102: linux - In the Linux kernel, the following vulnerability has been resolved: arm64/fpsim... In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Fix restoration of SVE context When SME is supported, Restoring SVE signal context can go wrong in a few ways, including placing the task into an invalid state where the kernel may read from out-of-bounds memory (and may potentially take a fatal fault) and/or may kill the task wi

CVE-2019-19050 [HIGH] CVE-2019-19050: linux - A memory leak in the crypto_reportstat() function in crypto/crypto_user_stat.c i... A memory leak in the crypto_reportstat() function in crypto/crypto_user_stat.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_reportstat_alg() failures, aka CID-c03b04dcdba1. Scope: local bookworm: resolved (fixed in 5.4.6-1) bullseye: resolved (fixed in 5.4.6-1) forky: resolved (fixed in 5.4.

CVE-2024-43882 [HIGH] CVE-2024-43882: linux - In the Linux kernel, the following vulnerability has been resolved: exec: Fix T... In the Linux kernel, the following vulnerability has been resolved: exec: Fix ToCToU between perm check and set-uid/gid usage When opening a file for exec via do_filp_open(), permission checking is done against the file's metadata at that moment, and on success, a file pointer is passed back. Much later in the execve() code path, the file metadata (specifically mode,

CVE-2022-48988 [HIGH] CVE-2022-48988: linux - In the Linux kernel, the following vulnerability has been resolved: memcg: fix ... In the Linux kernel, the following vulnerability has been resolved: memcg: fix possible use-after-free in memcg_write_event_control() memcg_write_event_control() accesses the dentry->d_name of the specified control fd to route the write call. As a cgroup interface file can't be renamed, it's safe to access d_name as long as the specified file is a regular cgroup file.

CVE-2014-5077 [HIGH] CVE-2014-5077: linux - The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel throu... The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association

CVE-2014-8369 [MEDIUM] CVE-2014-8369: linux - The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through... The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.17.2 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges. NOTE: this vulnerability exists because of an i

CVE-2013-4247 [HIGH] CVE-2013-4247: linux - Off-by-one error in the build_unc_path_to_root function in fs/cifs/connect.c in ... Off-by-one error in the build_unc_path_to_root function in fs/cifs/connect.c in the Linux kernel before 3.9.6 allows remote attackers to cause a denial of service (memory corruption and system crash) via a DFS share mount operation that triggers use of an unexpected DFS referral name length. Scope: local bookworm: resolved (fixed in 3.9.6-1) bullseye: resolved (fixed in