Debian Linux vulnerabilities

CVE-2025-39710 [HIGH] CVE-2025-39710: linux - In the Linux kernel, the following vulnerability has been resolved: media: venu... In the Linux kernel, the following vulnerability has been resolved: media: venus: Add a check for packet size after reading from shared memory Add a check to ensure that the packet size does not exceed the number of available words after reading the packet header from shared memory. This ensures that the size provided by the firmware is safe to process and prevent pot

CVE-2022-50394 [HIGH] CVE-2022-50394: linux - In the Linux kernel, the following vulnerability has been resolved: i2c: ismt: ... In the Linux kernel, the following vulnerability has been resolved: i2c: ismt: Fix an out-of-bounds bug in ismt_access() When the driver does not check the data from the user, the variable 'data->block[0]' may be very large to cause an out-of-bounds bug. The following log can reveal it: [ 33.995542] i2c i2c-1: ioctl, cmd=0x720, arg=0x7ffcb3dc3a20 [ 33.995978] ismt_smb

CVE-2025-38679 [HIGH] CVE-2025-38679: linux - In the Linux kernel, the following vulnerability has been resolved: media: venu... In the Linux kernel, the following vulnerability has been resolved: media: venus: Fix OOB read due to missing payload bound check Currently, The event_seq_changed() handler processes a variable number of properties sent by the firmware. The number of properties is indicated by the firmware and used to iterate over the payload. However, the payload size is not being va

CVE-2025-39869 [HIGH] CVE-2025-39869: linux - In the Linux kernel, the following vulnerability has been resolved: dmaengine: ... In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map Fix a critical memory allocation bug in edma_setup_from_hw() where queue_priority_map was allocated with insufficient memory. The code declared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8), but allocated memory using

CVE-2023-53272 [HIGH] CVE-2023-53272: linux - In the Linux kernel, the following vulnerability has been resolved: net: ena: f... In the Linux kernel, the following vulnerability has been resolved: net: ena: fix shift-out-of-bounds in exponential backoff The ENA adapters on our instances occasionally reset. Once recently logged a UBSAN failure to console in the process: UBSAN: shift-out-of-bounds in build/linux/drivers/net/ethernet/amazon/ena/ena_com.c:540:13 shift exponent 32 is too large for 3

CVE-2023-53668 [HIGH] CVE-2023-53668: linux - In the Linux kernel, the following vulnerability has been resolved: ring-buffer... In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix deadloop issue on reading trace_pipe Soft lockup occurs when reading file 'trace_pipe': watchdog: BUG: soft lockup - CPU#6 stuck for 22s! [cat:4488] [...] RIP: 0010:ring_buffer_empty_cpu+0xed/0x170 RSP: 0018:ffff88810dd6fc48 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000246

CVE-2025-39922 [HIGH] CVE-2025-39922: linux - In the Linux kernel, the following vulnerability has been resolved: ixgbe: fix ... In the Linux kernel, the following vulnerability has been resolved: ixgbe: fix incorrect map used in eee linkmode incorrectly used ixgbe_lp_map in loops intended to populate the supported and advertised EEE linkmode bitmaps based on ixgbe_ls_map. This results in incorrect bit setting and potential out-of-bounds access, since ixgbe_lp_map and ixgbe_ls_map have differen

CVE-2023-1989 [HIGH] CVE-2023-1989: linux - A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c i... A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. In this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on hdev devices. Scope: local bookworm: resolved (fixed in 6.1.52-1) bullseye: resolved (fixed in 5.10.197-1) forky: resolved (fixed in 6.3.7-1) sid: resolved (fixed in

CVE-2026-23076 [HIGH] CVE-2026-23076: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi... In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix potential OOB access in audio mixer handling In the audio mixer handling code of ctxfi driver, the conf field is used as a kind of loop index, and it's referred in the index callbacks (amixer_index() and sum_index()). As spotted recently by fuzzers, the current code causes OOB access

CVE-2025-71101 [HIGH] CVE-2025-71101: linux - In the Linux kernel, the following vulnerability has been resolved: platform/x8... In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing The hp_populate_*_elements_from_package() functions in the hp-bioscfg driver contain out-of-bounds array access vulnerabilities. These functions parse ACPI packages into internal data structures using a for loop with inde

CVE-2022-45886 [HIGH] CVE-2022-45886: linux - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-cor... An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dvb_device_open race condition that leads to a use-after-free. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 6.3.7-1) sid: resolved (fixed in 6.3.7-1) trixie: resolved (fixed in 6.

CVE-2023-51781 [HIGH] CVE-2023-51781: linux - An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/app... An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-after-free because of an atalk_recvmsg race condition. Scope: local bookworm: resolved (fixed in 6.1.69-1) bullseye: resolved (fixed in 5.10.205-2) forky: resolved (fixed in 6.6.8-1) sid: resolved (fixed in 6.6.8-1) trixie: resolved (fixed in 6.6.8-1)

CVE-2023-51782 [HIGH] CVE-2023-51782: linux - An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose... An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-after-free because of a rose_accept race condition. Scope: local bookworm: resolved (fixed in 6.1.69-1) bullseye: resolved (fixed in 5.10.205-2) forky: resolved (fixed in 6.6.8-1) sid: resolved (fixed in 6.6.8-1) trixie: resolved (fixed in 6.6.8-1)

CVE-2017-12146 [HIGH] CVE-2017-12146: linux - The driver_override implementation in drivers/base/platform.c in the Linux kerne... The driver_override implementation in drivers/base/platform.c in the Linux kernel before 4.12.1 allows local users to gain privileges by leveraging a race condition between a read operation and a store operation that involve different overrides. Scope: local bookworm: resolved (fixed in 4.11.11-1) bullseye: resolved (fixed in 4.11.11-1) forky: resolved (fixed in 4.11.

CVE-2016-10200 [HIGH] CVE-2016-10200: linux - Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before... Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c. Scope: local bookworm: resolved

CVE-2024-41057 [HIGH] CVE-2024-41057: linux - In the Linux kernel, the following vulnerability has been resolved: cachefiles:... In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() We got the following issue in our fault injection stress test: ================================================================== BUG: KASAN: slab-use-after-free in cachefiles_withdraw_cookie+0x4d9/0x600 Read of size 8 at addr ffff888

CVE-2023-28466 [HIGH] CVE-2023-28466: linux - do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks ... do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference). Scope: local bookworm: resolved (fixed in 6.1.20-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.20-1) sid: resolved (fixed in 6.1.20-1) trixie: resolved (

CVE-2024-56672 [HIGH] CVE-2024-56672: linux - In the Linux kernel, the following vulnerability has been resolved: blk-cgroup:... In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix UAF in blkcg_unpin_online() blkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To walk up, it uses blkcg_parent(blkcg) but it was calling that after blkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the following UAF: =============================

CVE-2024-26976 [HIGH] CVE-2024-26976: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: Always... In the Linux kernel, the following vulnerability has been resolved: KVM: Always flush async #PF workqueue when vCPU is being destroyed Always flush the per-vCPU async #PF workqueue when a vCPU is clearing its completion queue, e.g. when a VM and all its vCPUs is being destroyed. KVM must ensure that none of its workqueue callbacks is running when the last reference to

CVE-2023-52503 [HIGH] CVE-2023-52503: linux - In the Linux kernel, the following vulnerability has been resolved: tee: amdtee... In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fix use-after-free vulnerability in amdtee_close_session There is a potential race condition in amdtee_close_session that may cause use-after-free in amdtee_open_session. For instance, if a session has refcount == 1, and one thread tries to free this session via: kref_put(&sess->refcount,