Debian Linux vulnerabilities

CVE-2017-9076 [HIGH] CVE-2017-9076: linux - The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel th... The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. Scope: local bookworm: resolved (fixed in 4.9.30-1) bullseye: resolved (fixed in 4.9.30-1) forky: r

CVE-2017-9075 [HIGH] CVE-2017-9075: linux - The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel thr... The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. Scope: local bookworm: resolved (fixed in 4.9.30-1) bullseye: resolved (fixed in 4.9.30-1) forky: re

CVE-2016-4568 [HIGH] CVE-2016-4568: linux - drivers/media/v4l2-core/videobuf2-v4l2.c in the Linux kernel before 4.5.3 allows... drivers/media/v4l2-core/videobuf2-v4l2.c in the Linux kernel before 4.5.3 allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a crafted number of planes in a VIDIOC_DQBUF ioctl call. Scope: local bookworm: resolved (fixed in 4.5.3-1) bullseye: resolved (fixed in 4.5.3-1) forky: resolved (fixed in

CVE-2012-6703 [HIGH] CVE-2012-6703: linux - Integer overflow in the snd_compr_allocate_buffer function in sound/core/compres... Integer overflow in the snd_compr_allocate_buffer function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.6-rc6-next-20120917 allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call. Scope: local bookworm: resolved (f

CVE-2020-26141 [MEDIUM] CVE-2020-26141: linux - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. ... An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol. Scope: local bookworm: resolved (

CVE-2017-6001 [HIGH] CVE-2017-6001: linux - Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows l... Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain privileges via a crafted application that makes concurrent perf_event_open system calls for moving a software group into a hardware context. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-6786. Scope: local bookworm: resolved (fixed in 4.9.10-1)

CVE-2021-47464 [HIGH] CVE-2021-47464: linux - In the Linux kernel, the following vulnerability has been resolved: audit: fix ... In the Linux kernel, the following vulnerability has been resolved: audit: fix possible null-pointer dereference in audit_filter_rules Fix possible null-pointer dereference in audit_filter_rules. audit_filter_rules() error: we previously assumed 'ctx' could be null Scope: local bookworm: resolved (fixed in 5.14.16-1) bullseye: resolved (fixed in 5.10.84-1) forky: reso

CVE-2017-2636 [HIGH] CVE-2017-2636: linux - Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows... Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline. Scope: local bookworm: resolved (fixed in 4.9.16-1) bullseye: resolved (fixed in 4.9.16-1) forky: resolved (fixed in 4.9.16-1) sid: resolved (fixed in 4.9.16-1) trixie: resolved (f

CVE-2014-1737 [HIGH] CVE-2014-1737: linux - The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel throug... The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device. Scope: local bookworm: resolved (fixed in 3.14.4-1) bullseye: resolved (fix

CVE-2025-68218 CVE-2025-68218: linux - In the Linux kernel, the following vulnerability has been resolved: nvme-multip... In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix lockdep WARN due to partition scan work Blktests test cases nvme/014, 057 and 058 fail occasionally due to a lockdep WARN. As reported in the Closes tag URL, the WARN indicates that a deadlock can happen due to the dependency among disk->open_mutex, kblockd workqueue completion and partit

CVE-2023-52628 [HIGH] CVE-2023-52628: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: exthdr: fix 4-byte stack OOB write If priv->len is a multiple of 4, then dst[len / 4] can write past the destination array which leads to stack corruption. This construct is necessary to clean the remainder of the register in case ->len is NOT a multiple of the register size, so m

CVE-2020-8648 [HIGH] CVE-2020-8648: linux - There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the... There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c. Scope: local bookworm: resolved (fixed in 5.5.13-1) bullseye: resolved (fixed in 5.5.13-1) forky: resolved (fixed in 5.5.13-1) sid: resolved (fixed in 5.5.13-1) trixie: resolved (fixed in 5.5.13-1)

CVE-2025-40324 CVE-2025-40324: linux - In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix c... In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix crash in nfsd4_read_release() When tracing is enabled, the trace_nfsd_read_done trace point crashes during the pynfs read.testNoFh test. Scope: local bookworm: resolved (fixed in 6.1.159-1) bullseye: resolved (fixed in 5.10.247-1) forky: resolved (fixed in 6.17.8-1) sid: resolved (fixed in 6.17.8-1

CVE-2025-68302 CVE-2025-68302: linux - In the Linux kernel, the following vulnerability has been resolved: net: sxgbe:... In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: fix potential NULL dereference in sxgbe_rx() Currently, when skb is null, the driver prints an error and then dereferences skb on the next line. To fix this, let's add a 'break' after the error message to switch to sxgbe_rx_refill(), which is similar to the approach taken by the other drivers in

CVE-2023-24023 [MEDIUM] CVE-2023-24023: linux - Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairi... Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 through 5.4 allow certain man-in-the-middle attacks that force a short key length, and might lead to discovery of the encryption key and live injection, aka BLUFFS. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: open forky: resolved (

CVE-2022-48502 [HIGH] CVE-2022-48502: linux - An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does... An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c. Scope: local bookworm: resolved (fixed in 6.1.52-1) bullseye: resolved forky: resolved (fixed in 6.3.7-1) sid: resolved (fixed in 6.3.7-1) trixie: resolved (fixed in

CVE-2023-3268 [HIGH] CVE-2023-3268: linux - An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay... An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 6.3.7-1) sid: resolved

CVE-2021-44733 [HIGH] CVE-2021-44733: linux - A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Lin... A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object. Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved (fixed in 5.10.92-1) forky: resolved (fixed in 5.15.15-1) sid: resolved (fixed

CVE-2023-3141 [HIGH] CVE-2023-3141: linux - A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c i... A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 6.3.7-1) sid:

CVE-2025-40155 [LOW] CVE-2025-40155: linux - In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d:... In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: debugfs: Fix legacy mode page table dump logic In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR maybe uninitialized or zero in that case and may cause oops like: Oops: general protection fault, probably for non-canonical address 0xf00087d3f000f000: 0000 [#1] SMP NOPTI CPU