Debian Linux vulnerabilities

CVE-2023-52501 [HIGH] CVE-2023-52501: linux - In the Linux kernel, the following vulnerability has been resolved: ring-buffer... In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not attempt to read past "commit" When iterating over the ring buffer while the ring buffer is active, the writer can corrupt the reader. There's barriers to help detect this and handle it, but that code missed the case where the last event was at the very end of the page and has only

CVE-2025-39806 [HIGH] CVE-2025-39806: linux - In the Linux kernel, the following vulnerability has been resolved: HID: multit... In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller than 607 bytes. mt_report_fixup() attempts to patch byte offset 607 of the descriptor with 0x25 by first checking

CVE-2022-1015 [MEDIUM] CVE-2022-1015: linux - A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of t... A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue. Scope: local bookworm: resolved (fixed in 5.16.18-1) bullseye: resolved forky: resolved (fixed in 5.16.18-1) sid: resolved (fixed in 5.16.18-1) trixie: resolved (fixed in 5.16.18-1)

CVE-2025-21920 [HIGH] CVE-2025-21920: linux - In the Linux kernel, the following vulnerability has been resolved: vlan: enfor... In the Linux kernel, the following vulnerability has been resolved: vlan: enforce underlying device type Currently, VLAN devices can be created on top of non-ethernet devices. Besides the fact that it doesn't make much sense, this also causes a bug which leaks the address of a kernel function to usermode. When creating a VLAN device, we initialize GARP (garp_init_appl

CVE-2019-11811 [HIGH] CVE-2019-11811: linux - An issue was discovered in the Linux kernel before 5.0.4. There is a use-after-f... An issue was discovered in the Linux kernel before 5.0.4. There is a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module is removed, related to drivers/char/ipmi/ipmi_si_intf.c, drivers/char/ipmi/ipmi_si_mem_io.c, and drivers/char/ipmi/ipmi_si_port_io.c. Scope: local bookworm: resolved (fixed in 4.19.37-1) bullseye: resolved (fixed in 4

CVE-2023-45896 [HIGH] CVE-2023-45896: linux - ntfs3 in the Linux kernel through 6.8.0 allows a physically proximate attacker t... ntfs3 in the Linux kernel through 6.8.0 allows a physically proximate attacker to read kernel memory by mounting a filesystem (e.g., if a Linux distribution is configured to allow unprivileged mounts of removable media) and then leveraging local access to trigger an out-of-bounds read. A length value can be larger than the amount of memory allocated. NOTE: the supplie

CVE-2023-53024 [HIGH] CVE-2023-53024: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix po... In the Linux kernel, the following vulnerability has been resolved: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation") inserts lfence instructions after 1) initializing a stack slot and 2) spilling a pointer to the stack. However

CVE-2025-22104 [HIGH] CVE-2025-22104: linux - In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Us... In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Use kernel helpers for hex dumps Previously, when the driver was printing hex dumps, the buffer was cast to an 8 byte long and printed using string formatters. If the buffer size was not a multiple of 8 then a read buffer overflow was possible. Therefore, create a new ibmvnic function that lo

CVE-2025-38027 [HIGH] CVE-2025-38027: linux - In the Linux kernel, the following vulnerability has been resolved: regulator: ... In the Linux kernel, the following vulnerability has been resolved: regulator: max20086: fix invalid memory access max20086_parse_regulators_dt() calls of_regulator_match() using an array of struct of_regulator_match allocated on the stack for the matches argument. of_regulator_match() calls devm_of_regulator_put_matches(), which calls devres_alloc() to allocate a str

CVE-2025-38670 [HIGH] CVE-2025-38670: linux - In the Linux kernel, the following vulnerability has been resolved: arm64/entry... In the Linux kernel, the following vulnerability has been resolved: arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() `cpu_switch_to()` and `call_on_irq_stack()` manipulate SP to change to different stacks along with the Shadow Call Stack if it is enabled. Those two stack changes cannot be done atomically and both functions can be interrupted by SErrors o

CVE-2022-50307 [HIGH] CVE-2022-50307: linux - In the Linux kernel, the following vulnerability has been resolved: s390/cio: f... In the Linux kernel, the following vulnerability has been resolved: s390/cio: fix out-of-bounds access on cio_ignore free The channel-subsystem-driver scans for newly available devices whenever device-IDs are removed from the cio_ignore list using a command such as: echo free >/proc/cio_ignore Since an I/O device scan might interfer with running I/Os, commit 172da89ed

CVE-2023-53333 [HIGH] CVE-2023-53333: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one Eric Dumazet says: nf_conntrack_dccp_packet() has an unique: dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); And nothing more is 'pulled' from the packet, depending on the content. dh->dccph_doff, and/or dh->d

CVE-2026-23269 [HIGH] CVE-2026-23269: linux - In the Linux kernel, the following vulnerability has been resolved: apparmor: v... In the Linux kernel, the following vulnerability has been resolved: apparmor: validate DFA start states are in bounds in unpack_pdb Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call in unpack_pdb() will access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds the number of states in

CVE-2025-71112 [HIGH] CVE-2025-71112: linux - In the Linux kernel, the following vulnerability has been resolved: net: hns3: ... In the Linux kernel, the following vulnerability has been resolved: net: hns3: add VLAN id validation before using Currently, the VLAN id may be used without validation when receive a VLAN configuration mailbox from VF. The length of vlan_del_fail_bmap is BITS_TO_LONGS(VLAN_N_VID). It may cause out-of-bounds memory access once the VLAN id is bigger than or equal to VL

CVE-2014-3185 [MEDIUM] CVE-2014-3185: linux - Multiple buffer overflows in the command_port_read_callback function in drivers/... Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel before 3.16.2 allow physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2)

CVE-2022-48790 [HIGH] CVE-2022-48790: linux - In the Linux kernel, the following vulnerability has been resolved: nvme: fix a... In the Linux kernel, the following vulnerability has been resolved: nvme: fix a possible use-after-free in controller reset during load Unlike .queue_rq, in .submit_async_event drivers may not check the ctrl readiness for AER submission. This may lead to a use-after-free condition that was observed with nvme-tcp. The race condition may happen in the following scenario

CVE-2023-51043 [HIGH] CVE-2023-51043: linux - In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-f... In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race condition between a nonblocking atomic commit and a driver unload. Scope: local bookworm: resolved (fixed in 6.1.52-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 6.4.11-1) sid: resolved (fixed in 6.4.11-1) trixie: resolved (fixed in 6.4.11-1)

CVE-2022-1048 [HIGH] CVE-2022-1048: linux - A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way... A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.16.18-1) bulls

CVE-2022-3028 [HIGH] CVE-2022-3028: linux - A race condition was found in the Linux kernel's IP framework for transforming p... A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket. Scope: local bookworm: res

CVE-2024-50234 [HIGH] CVE-2024-50234: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: iwleg... In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: Clear stale interrupts before resuming device iwl4965 fails upon resume from hibernation on my laptop. The reason seems to be a stale interrupt which isn't being cleared out before interrupts are enabled. We end up with a race beween the resume trying to bring things back up, and the r