Debian Linux vulnerabilities

CVE-2025-39826 [HIGH] CVE-2025-39826: linux - In the Linux kernel, the following vulnerability has been resolved: net: rose: ... In the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths. For example, when rose_neigh->use becomes zero

CVE-2024-36899 [HIGH] CVE-2024-36899: linux - In the Linux kernel, the following vulnerability has been resolved: gpiolib: cd... In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Fix use after free in lineinfo_changed_notify The use-after-free issue occurs as follows: when the GPIO chip device file is being closed by invoking gpio_chrdev_release(), watched_lines is freed by bitmap_free(), but the unregistration of lineinfo_changed_nb notifier chain failed due to

CVE-2022-48858 [HIGH] CVE-2022-48858: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: F... In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix a race on command flush flow Fix a refcount use after free warning due to a race on command entry. Such race occurs when one of the commands releases its last refcount and frees its index and entry while another process running command flush flow takes refcount to this command entry. The

CVE-2015-2666 [MEDIUM] CVE-2015-2666: linux - Stack-based buffer overflow in the get_matching_model_microcode function in arch... Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to the initrd. Scope: local bookworm: resolved (fixed in 3.16.7-ckt9-1) bu

CVE-2025-39749 [HIGH] CVE-2025-39749: linux - In the Linux kernel, the following vulnerability has been resolved: rcu: Protec... In the Linux kernel, the following vulnerability has been resolved: rcu: Protect ->defer_qs_iw_pending from data race On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is invoked within an interrupts-disabled region of code [1], it will invoke rcu_read_unlock_special(), which uses an irq-work handler to force the system to notice when the RCU read-side c

CVE-2022-20422 [HIGH] CVE-2022-20422: linux - In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corr... In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-237540956References: Upstream kernel Scope: local bookw

CVE-2021-39686 [HIGH] CVE-2021-39686: linux - In several functions of binder.c, there is a possible way to represent the wrong... In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-200688826References: Upstream kernel Scope: loc

CVE-2022-50014 [HIGH] CVE-2022-50014: linux - In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix... In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know that FOLL_FORCE can be possibly dangerous, especially if there are races that can be exploited by user space. Right now, it would be sufficient to have some code that

CVE-2022-20141 [HIGH] CVE-2022-20141: linux - In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper... In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-112551163References: Upstream kernel Scope:

CVE-2026-23180 [HIGH] CVE-2026-23180: linux - In the Linux kernel, the following vulnerability has been resolved: dpaa2-switc... In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: add bounds check for if_id in IRQ handler The IRQ handler extracts if_id from the upper 16 bits of the hardware status register and uses it to index into ethsw->ports[] without validation. Since if_id can be any 16-bit value (0-65535) but the ports array is only allocated with sw_attr.nu

CVE-2022-2503 [MEDIUM] CVE-2022-2503: linux - Dm-verity is used for extending root-of-trust to root filesystems. LoadPin build... Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass Load

CVE-2025-39966 [HIGH] CVE-2025-39966: linux - In the Linux kernel, the following vulnerability has been resolved: iommufd: Fi... In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix race during abort for file descriptors fput() doesn't actually call file_operations release() synchronously, it puts the file on a work queue and it will be released eventually. This is normally fine, except for iommufd the file and the iommufd_object are tied to gether. The file has the

CVE-2026-23294 [HIGH] CVE-2026-23294: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix ra... In the Linux kernel, the following vulnerability has been resolved: bpf: Fix race in devmap on PREEMPT_RT On PREEMPT_RT kernels, the per-CPU xdp_dev_bulk_queue (bq) can be accessed concurrently by multiple preemptible tasks on the same CPU. The original code assumes bq_enqueue() and __dev_flush() run atomically with respect to each other on the same CPU, relying on lo

CVE-2021-31916 [MEDIUM] CVE-2021-31916: linux - An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md... An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel before 5.12. A bound check failure allows an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threa

CVE-2021-43975 [MEDIUM] CVE-2021-43975: linux - In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethe... In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. Scope: local bookworm: resolved (fixed in 5.15.5-2) bullseye: resolved (fixed in 5.10.84-1) forky: resolved (fixed in 5.15.5-

CVE-2024-47693 [MEDIUM] CVE-2024-47693: linux - In the Linux kernel, the following vulnerability has been resolved: IB/core: Fi... In the Linux kernel, the following vulnerability has been resolved: IB/core: Fix ib_cache_setup_one error flow cleanup When ib_cache_update return an error, we exit ib_cache_setup_one instantly with no proper cleanup, even though before this we had already successfully done gid_table_setup_one, that results in the kernel WARN below. Do proper cleanup using gid_table

CVE-2012-4530 [LOW] CVE-2012-4530: linux - The load_script function in fs/binfmt_script.c in the Linux kernel before 3.7.2 ... The load_script function in fs/binfmt_script.c in the Linux kernel before 3.7.2 does not properly handle recursion, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. Scope: local bookworm: resolved (fixed in 3.2.35-1) bullseye: resolved (fixed in 3.2.35-1) forky: resolved (fixed in 3.2.35-1) sid: resolved (fixed

CVE-2024-26890 [MEDIUM] CVE-2024-26890: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: fix out of bounds memory access The problem is detected by KASAN. btrtl driver uses private hci data to store 'struct btrealtek_data'. If btrtl driver is used with btusb, then memory for private hci data is allocated in btusb. But no private data is allocated after hci_dev, when bt

CVE-2024-0775 [MEDIUM] CVE-2024-0775: linux - A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4... A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a local user to cause an information leak problem while freeing the old quota file names before a potential failure, leading to a use-after-free. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved (fixed in 5.10.191-1) forky: resol

CVE-2019-19069 [HIGH] CVE-2019-19069: linux - A memory leak in the fastrpc_dma_buf_attach() function in drivers/misc/fastrpc.c... A memory leak in the fastrpc_dma_buf_attach() function in drivers/misc/fastrpc.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering dma_get_sgtable() failures, aka CID-fc739a058d99. Scope: local bookworm: resolved (fixed in 5.3.9-1) bullseye: resolved (fixed in 5.3.9-1) forky: resolved (fixed in 5.3.9-1) s