Debian Linux vulnerabilities

CVE-2023-22995 [HIGH] CVE-2023-22995: linux - In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core i... In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: open forky: resolved (fixed in 5.17.3-1) sid: resolved (fixed in 5.17.3-1) trixie: resolved (fixed in 5.17.3-1)

CVE-2023-1872 [HIGH] CVE-2023-1872: linux - A use-after-free vulnerability in the Linux Kernel io_uring system can be exploi... A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local privilege escalation. The io_file_get_fixed function lacks the presence of ctx->uring_lock which can lead to a Use-After-Free vulnerability due a race condition with fixed files getting unregistered. We recommend upgrading past commit da24142b1ef9fd5d36b76e36bab328a5b275

CVE-2024-36973 [HIGH] CVE-2024-36973: linux - In the Linux kernel, the following vulnerability has been resolved: misc: micro... In the Linux kernel, the following vulnerability has been resolved: misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe() When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), callback function gp_auxiliary_device_release() calls ida_free() and kfree(aux_device_wrapper) to free memory. We should't call the

CVE-2024-46820 [HIGH] CVE-2024-46820: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: remove irq disabling in vcn 5 suspend We do not directly enable/disable VCN IRQ in vcn 5.0.0. And we do not handle the IRQ state as well. So the calls to disable IRQ and set state are removed. This effectively gets rid of the warining of "WARN_ON(!amdgpu_irq_enabled(adev, src, type))"

CVE-2017-11089 [HIGH] CVE-2017-11089: linux - In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases f... In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observed in nl80211_set_station when user space application sends attribute NL80211_ATTR_LOCAL_MESH_POWER_MODE with data of size less than 4 bytes Scope: local bookworm: resolved (fixed in 4.12.6-1) bullseye: resolved (fixed in 4.12.6-1)

CVE-2025-38206 [HIGH] CVE-2025-38206: linux - In the Linux kernel, the following vulnerability has been resolved: exfat: fix ... In the Linux kernel, the following vulnerability has been resolved: exfat: fix double free in delayed_free The double free could happen in the following path. exfat_create_upcase_table() exfat_create_upcase_table() : return error exfat_free_upcase_table() : free ->vol_utbl exfat_load_default_upcase_table : return error exfat_kill_sb() delayed_free() exfat_free_upcase_

CVE-2016-6516 [HIGH] CVE-2016-6516: linux - Race condition in the ioctl_file_dedupe_range function in fs/ioctl.c in the Linu... Race condition in the ioctl_file_dedupe_range function in fs/ioctl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (heap-based buffer overflow) or possibly gain privileges by changing a certain count value, aka a "double fetch" vulnerability. Scope: local bookworm: resolved (fixed in 4.7.2-1) bullseye: resolved (fixed in 4.7.2-1) forky:

CVE-2024-21823 [HIGH] CVE-2024-21823: linux - Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA... Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors may allow an authorized user to potentially enable escalation of privilege local access Scope: local bookworm: resolved (fixed in 6.1.94-1) bullseye: open forky: resolved (fixed in 6.8.11-1) sid: resolved (fixed in 6.8.11-1) trixi

CVE-2020-25668 [HIGH] CVE-2020-25668: linux - A flaw was found in Linux Kernel because access to the global variable fg_consol... A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free in con_font_op. Scope: local bookworm: resolved (fixed in 5.9.6-1) bullseye: resolved (fixed in 5.9.6-1) forky: resolved (fixed in 5.9.6-1) sid: resolved (fixed in 5.9.6-1) trixie: resolved (fixed in 5.9.6-1)

CVE-2021-3743 [HIGH] CVE-2021-3743: linux - An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router pro... An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a local attacker to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability. Scope: local bookworm: resolved (fixed i

CVE-2025-40347 CVE-2025-40347: linux - In the Linux kernel, the following vulnerability has been resolved: net: enetc:... In the Linux kernel, the following vulnerability has been resolved: net: enetc: fix the deadlock of enetc_mdio_lock After applying the workaround for err050089, the LS1028A platform experiences RCU stalls on RT kernel. This issue is caused by the recursive acquisition of the read lock enetc_mdio_lock. Here list some of the call stacks identified under the enetc_poll path tha

CVE-2025-68336 CVE-2025-68336: linux - In the Linux kernel, the following vulnerability has been resolved: locking/spi... In the Linux kernel, the following vulnerability has been resolved: locking/spinlock/debug: Fix data-race in do_raw_write_lock KCSAN reports: BUG: KCSAN: data-race in do_raw_write_lock / do_raw_write_lock write (marked) to 0xffff800009cf504c of 4 bytes by task 1102 on cpu 1: do_raw_write_lock+0x120/0x204 _raw_write_lock_irq do_exit call_usermodehelper_exec_async ret_from_for

CVE-2022-2590 [HIGH] CVE-2022-2590: linux - A race condition was found in the way the Linux kernel's memory subsystem handle... A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shared memory mappings. This flaw allows an unprivileged, local user to gain write access to read-only memory mappings, increasing their privileges on the system. Scope: local bookworm: resolved (fixed in 5.18.16-1) bullseye: resolved f

CVE-2025-68369 CVE-2025-68369: linux - In the Linux kernel, the following vulnerability has been resolved: ntfs3: init... In the Linux kernel, the following vulnerability has been resolved: ntfs3: init run lock for extend inode After setting the inode mode of $Extend to a regular file, executing the truncate system call will enter the do_truncate() routine, causing the run_lock uninitialized error reported by syzbot. Prior to patch 4e8011ffec79, if the inode mode of $Extend was not set to a reg

CVE-2025-68250 [LOW] CVE-2025-68250: linux - In the Linux kernel, the following vulnerability has been resolved: hung_task: ... In the Linux kernel, the following vulnerability has been resolved: hung_task: fix warnings caused by unaligned lock pointers The blocker tracking mechanism assumes that lock pointers are at least 4-byte aligned to use their lower bits for type encoding. However, as reported by Eero Tamminen, some architectures like m68k only guarantee 2-byte alignment of 32-bit values

CVE-2025-40047 [LOW] CVE-2025-40047: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/wa... In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: always prune wait queue entry in io_waitid_wait() For a successful return, always remove our entry from the wait queue entry list. Previously this was skipped if a cancelation was in progress, but this can race with another invocation of the wait queue entry callback. Scope: local book

CVE-2025-40167 CVE-2025-40167: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: detec... In the Linux kernel, the following vulnerability has been resolved: ext4: detect invalid INLINE_DATA + EXTENTS flag combination syzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity file on a corrupted ext4 filesystem mounted without a journal. The issue is that the filesystem has an inode with both the INLINE_DATA and EXTENTS flags set: EXT4-fs error (dev

CVE-2025-39994 CVE-2025-39994: linux - In the Linux kernel, the following vulnerability has been resolved: media: tune... In the Linux kernel, the following vulnerability has been resolved: media: tuner: xc5000: Fix use-after-free in xc5000_release The original code uses cancel_delayed_work() in xc5000_release(), which does not guarantee that the delayed work item timer_sleep has fully completed if it was already running. This leads to use-after-free scenarios where xc5000_release() may free th

CVE-2025-40093 CVE-2025-40093: linux - In the Linux kernel, the following vulnerability has been resolved: usb: gadget... In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ecm: Refactor bind path to use __free() After an bind/unbind cycle, the ecm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request. Refactor the error handlin

CVE-2025-40170 CVE-2025-40170: linux - In the Linux kernel, the following vulnerability has been resolved: net: use ds... In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size(). Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip_dst_mtu_maybe_forward(). ip4_dst_hoplimit() can use dst_dev_net_rcu(). Scope: local bookworm: open bullseye: open for