Debian Linux vulnerabilities

CVE-2018-1129 [MEDIUM] CVE-2018-1129: ceph - A flaw was found in the way signature calculation was handled by cephx authentic... A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable. Scope: local bookworm: resolved (fixed in 12.

CVE-2025-40198 CVE-2025-40198: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: avoid... In the Linux kernel, the following vulnerability has been resolved: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() Unlike other strings in the ext4 superblock, we rely on tune2fs to make sure s_mount_opts is NUL terminated. Harden parse_apply_sb_mount_options() by treating s_mount_opts as a potential __nonstring. Scope: local bookworm: resolved (fix

CVE-2025-39976 [LOW] CVE-2025-39976: linux - In the Linux kernel, the following vulnerability has been resolved: futex: Use ... In the Linux kernel, the following vulnerability has been resolved: futex: Use correct exit on failure from futex_hash_allocate_default() copy_process() uses the wrong error exit path from futex_hash_allocate_default(). After exiting from futex_hash_allocate_default(), neither tasklist_lock nor siglock has been acquired. The exit label bad_fork_core_free unlocks both o

CVE-2021-3501 [HIGH] CVE-2021-3501: linux - A flaw was found in the Linux kernel in versions before 5.12. The value of inter... A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-of-bounds write. The highest threat from this vulnerability is to data integrity and system availability. Scope: local bookworm: resolved (fixed in 5.10.38-1)

CVE-2021-3506 [HIGH] CVE-2021-3506: linux - An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2f... An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability. Scope: l

CVE-2025-71116 [HIGH] CVE-2025-71116: linux - In the Linux kernel, the following vulnerability has been resolved: libceph: ma... In the Linux kernel, the following vulnerability has been resolved: libceph: make decode_pool() more resilient against corrupted osdmaps If the osdmap is (maliciously) corrupted such that the encoded length of ceph_pg_pool envelope is less than what is expected for a particular encoding version, out-of-bounds reads may ensue because the only bounds check that is there

CVE-2018-16880 [HIGH] CVE-2018-16880: linux - A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] d... A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions fro

CVE-2023-35828 [HIGH] CVE-2023-35828: linux - An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was f... An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 6.3.7-1) sid: resolved (fixed in 6.3.7-1) trixie: resolved (fixed in 6.3.7-1)

CVE-2025-21647 [HIGH] CVE-2025-21647: linux - In the Linux kernel, the following vulnerability has been resolved: sched: sch_... In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out of bounds memory access. To avoid any such logic errors causing out of b

CVE-2022-3621 [MEDIUM] CVE-2022-3621: linux - A vulnerability was found in Linux Kernel. It has been classified as problematic... A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_bmap_lookup_at_level of the file fs/nilfs2/inode.c of the component nilfs2. The manipulation leads to null pointer dereference. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulner

CVE-2022-48827 [HIGH] CVE-2022-48827: linux - In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix t... In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix the behavior of READ near OFFSET_MAX Dan Aloni reports: > Due to commit 8cfb9015280d ("NFS: Always provide aligned buffers to > the RPC read layers") on the client, a read of 0xfff is aligned up > to server rsize of 0x1000. > > As a result, in a test where the server has a file of size > 0x7

CVE-2023-51780 [HIGH] CVE-2023-51780: linux - An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/at... An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition. Scope: local bookworm: resolved (fixed in 6.1.69-1) bullseye: resolved (fixed in 5.10.205-2) forky: resolved (fixed in 6.6.8-1) sid: resolved (fixed in 6.6.8-1) trixie: resolved (fixed in 6.6.8-1)

CVE-2021-47277 [HIGH] CVE-2021-47277: linux - In the Linux kernel, the following vulnerability has been resolved: kvm: avoid ... In the Linux kernel, the following vulnerability has been resolved: kvm: avoid speculation-based attacks from out-of-range memslot accesses KVM's mechanism for accessing guest memory translates a guest physical address (gpa) to a host virtual address using the right-shifted gpa (also known as gfn) and a struct kvm_memory_slot. The translation is performed in __gfn_to_

CVE-2018-5873 [HIGH] CVE-2018-5873: linux - An issue was discovered in the __ns_get_path function in fs/nsfs.c in the Linux ... An issue was discovered in the __ns_get_path function in fs/nsfs.c in the Linux kernel before 4.11. Due to a race condition when accessing files, a Use After Free condition can occur. This also affects all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-07-05. Scope: local bookworm: res

CVE-2024-38576 [HIGH] CVE-2024-38576: linux - In the Linux kernel, the following vulnerability has been resolved: rcu: Fix bu... In the Linux kernel, the following vulnerability has been resolved: rcu: Fix buffer overflow in print_cpu_stall_info() The rcuc-starvation output from print_cpu_stall_info() might overflow the buffer if there is a huge difference in jiffies difference. The situation might seem improbable, but computers sometimes get very confused about time, which can result in full-s

CVE-2024-38659 [HIGH] CVE-2024-38659: linux - In the Linux kernel, the following vulnerability has been resolved: enic: Valid... In the Linux kernel, the following vulnerability has been resolved: enic: Validate length of nl attributes in enic_set_vf_port enic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE is of length PORT_PROFILE_MAX and that the nl attributes IFLA_PORT_INSTANCE_UUID, IFLA_PORT_HOST_UUID are of length PORT_UUID_MAX. These attributes are validated (in the function

CVE-2023-4387 [HIGH] CVE-2023-4387: linux - A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet... A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a kernel information leak problem. Scope: local bookworm: resolved

CVE-2024-47757 [HIGH] CVE-2024-47757: linux - In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix... In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential oob read in nilfs_btree_check_delete() The function nilfs_btree_check_delete(), which checks whether degeneration to direct mapping occurs before deleting a b-tree entry, causes memory access outside the block buffer when retrieving the maximum key if the root node has no entries

CVE-2025-39839 [HIGH] CVE-2025-39839: linux - In the Linux kernel, the following vulnerability has been resolved: batman-adv:... In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small

CVE-2024-42094 [HIGH] CVE-2024-42094: linux - In the Linux kernel, the following vulnerability has been resolved: net/iucv: A... In the Linux kernel, the following vulnerability has been resolved: net/iucv: Avoid explicit cpumask var allocation on stack For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask variable on stack is not recommended since it can cause potential stack overflow. Instead, kernel code should always use *cpumask_var API(s) to allocate cpumask var in config-n