Debian Linux vulnerabilities

CVE-2015-1421 [CRITICAL] CVE-2015-1421: linux - Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/assoc... Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data. Scope: local bookworm: resolved (fixed i

CVE-2024-43847 [HIGH] CVE-2024-43847: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12... In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix invalid memory access while processing fragmented packets The monitor ring and the reo reinject ring share the same ring mask index. When the driver receives an interrupt for the reo reinject ring, the monitor ring is also processed, leading to invalid memory access. Since monitor su

CVE-2012-6712 [CRITICAL] CVE-2012-6712: linux - In the Linux kernel before 3.4, a buffer overflow occurs in drivers/net/wireless... In the Linux kernel before 3.4, a buffer overflow occurs in drivers/net/wireless/iwlwifi/iwl-agn-sta.c, which will cause at least memory corruption. Scope: local bookworm: resolved (fixed in 3.8.11-1) bullseye: resolved (fixed in 3.8.11-1) forky: resolved (fixed in 3.8.11-1) sid: resolved (fixed in 3.8.11-1) trixie: resolved (fixed in 3.8.11-1)

CVE-2025-21759 [HIGH] CVE-2025-21759: linux - In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast... In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: extend RCU protection in igmp6_send() igmp6_send() can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a potential UAF. Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocatio

CVE-2021-41073 [HIGH] CVE-2021-41073: linux - loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows loc... loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc//maps for exploitation. Scope: local bookworm: resolved (fixed in 5.14.6-2) bullseye: resolved (fixed in 5.10.46-5) forky: resolved (fixed in 5.14.6-2) sid: r

CVE-2013-2850 [HIGH] CVE-2013-2850: linux - Heap-based buffer overflow in the iscsi_add_notunderstood_response function in d... Heap-based buffer overflow in the iscsi_add_notunderstood_response function in drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target subsystem in the Linux kernel through 3.9.4 allows remote attackers to cause a denial of service (memory corruption and OOPS) or possibly execute arbitrary code via a long key that is not properly handled during construction o

CVE-2016-2384 [MEDIUM] CVE-2016-2384: linux - Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c... Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor. Scope: local bookworm: resolved (fixed in 4.4.2-1) bullseye: resolved (fixed in 4.4.2-1) for

CVE-2023-4147 [HIGH] CVE-2023-4147: linux - A use-after-free flaw was found in the Linux kernel’s Netfilter functionality wh... A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 6.1.52-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 6.4.11-1) sid: resolved (fixed in 6.4.11-1) trix

CVE-2024-53177 [HIGH] CVE-2024-53177: linux - In the Linux kernel, the following vulnerability has been resolved: smb: preven... In the Linux kernel, the following vulnerability has been resolved: smb: prevent use-after-free due to open_cached_dir error paths If open_cached_dir() encounters an error parsing the lease from the server, the error handling may race with receiving a lease break, resulting in open_cached_dir() freeing the cfid while the queued work is pending. Update open_cached_dir(

CVE-2022-49238 [HIGH] CVE-2022-49238: linux - In the Linux kernel, the following vulnerability has been resolved: ath11k: fre... In the Linux kernel, the following vulnerability has been resolved: ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855 Commit b4a0f54156ac ("ath11k: move peer delete after vdev stop of station for QCA6390 and WCN6855") is to fix firmware crash by changing the WMI command sequence, but actually skip all the peer delete operation, then it lead com

CVE-2020-8835 [HIGH] CVE-2020-8835: linux - In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) di... In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fix

CVE-2016-2117 [HIGH] CVE-2016-2117: linux - The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux... The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from kernel memory by reading packet data. Scope: local bookworm: resolved (fixed in 4.5.2-1) bullseye: resolved (fixed in 4.5.2-1) forky: resolved (fixed in 4.5.2-1) s

CVE-2023-1194 [HIGH] CVE-2023-1194: linux - An out-of-bounds (OOB) memory read flaw was found in parse_lease_state in the KS... An out-of-bounds (OOB) memory read flaw was found in parse_lease_state in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. When an attacker sends the CREATE command with a malformed payload to KSMBD, due to a missing check of `NameOffset` in the `parse_lease_state()` function, the `create_context` object can access invalid memory. Sco

CVE-2022-50717 CVE-2022-50717: linux - In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: ... In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds check on Transfer Tag ttag is used as an index to get cmd in nvmet_tcp_handle_h2c_data_pdu(), add a bounds check to avoid out-of-bounds access. Scope: local bookworm: resolved (fixed in 6.0.3-1) bullseye: resolved (fixed in 5.10.158-1) forky: resolved (fixed in 6.0.3-1) sid: resolved (f

CVE-2025-68192 CVE-2025-68192: linux - In the Linux kernel, the following vulnerability has been resolved: net: usb: q... In the Linux kernel, the following vulnerability has been resolved: net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup Raw IP packets have no MAC header, leaving skb->mac_header uninitialized. This can trigger kernel panics on ARM64 when xfrm or other subsystems access the offset due to strict alignment checks. Initialize the MAC header to prevent such crash

CVE-2025-40252 CVE-2025-40252: linux - In the Linux kernel, the following vulnerability has been resolved: net: qlogic... In the Linux kernel, the following vulnerability has been resolved: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() The loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate over 'cqe->len_list[]' using only a zero-length terminator as the stopping condition. If the terminator was missing or malformed, the loop could run past the e

CVE-2025-68285 CVE-2025-68285: linux - In the Linux kernel, the following vulnerability has been resolved: libceph: fi... In the Linux kernel, the following vulnerability has been resolved: libceph: fix potential use-after-free in have_mon_and_osd_map() The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both ceph_monc_handle_map() and handle_one_map() install a new map immediately after freeing the old one

CVE-2023-54292 CVE-2023-54292: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma:... In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix data race on CQP request done KCSAN detects a data race on cqp_request->request_done memory location which is accessed locklessly in irdma_handle_cqp_op while being updated in irdma_cqp_ce_handler. Annotate lockless intent with READ_ONCE/WRITE_ONCE to avoid any compiler optimizations like loa

CVE-2025-68809 CVE-2025-68809: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: vfs:... In the Linux kernel, the following vulnerability has been resolved: ksmbd: vfs: fix race on m_flags in vfs_cache ksmbd maintains delete-on-close and pending-delete state in ksmbd_inode->m_flags. In vfs_cache.c this field is accessed under inconsistent locking: some paths read and modify m_flags under ci->m_lock while others do so without taking the lock at all. Examples: - k

CVE-2022-41674 [HIGH] CVE-2022-41674: linux - An issue was discovered in the Linux kernel before 5.19.16. Attackers able to in... An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: resolved (fixed in 5.10.149-1) forky: resolved (fixed in 6.0.2-1) sid: resolved (fixed in 6.0.2-1) trixie: resolved