Debian Linux vulnerabilities

CVE-2017-2671 [MEDIUM] CVE-2017-2671: linux - The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 i... The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call. Scope: local bookworm: resolved (

CVE-2022-49093 [HIGH] CVE-2022-49093: linux - In the Linux kernel, the following vulnerability has been resolved: skbuff: fix... In the Linux kernel, the following vulnerability has been resolved: skbuff: fix coalescing for page_pool fragment recycling Fix a use-after-free when using page_pool with page fragments. We encountered this problem during normal RX in the hns3 driver: (1) Initially we have three descriptors in the RX queue. The first one allocates PAGE1 through page_pool, and the othe

CVE-2023-3812 [HIGH] CVE-2023-3812: linux - An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP devi... An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 6.0.8-1) bullseye: resolved (fixed in 5

CVE-2023-38427 [CRITICAL] CVE-2023-38427: linux - An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.... An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.c in ksmbd has an integer underflow and out-of-bounds read in deassemble_neg_contexts. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved forky: resolved (fixed in 6.3.11-1) sid: resolved (fixed in 6.3.11-1) trixie: resolved (fixed in 6.3.11-1)

CVE-2024-38541 [CRITICAL] CVE-2024-38541: linux - In the Linux kernel, the following vulnerability has been resolved: of: module:... In the Linux kernel, the following vulnerability has been resolved: of: module: add buffer overflow check in of_modalias() In of_modalias(), if the buffer happens to be too small even for the 1st snprintf() call, the len parameter will become negative and str parameter (if not NULL initially) will point beyond the buffer's end. Add the buffer overflow check after

CVE-2023-53794 CVE-2023-53794: linux - In the Linux kernel, the following vulnerability has been resolved: cifs: fix s... In the Linux kernel, the following vulnerability has been resolved: cifs: fix session state check in reconnect to avoid use-after-free issue Don't collect exiting session in smb2_reconnect_server(), because it will be released soon. Note that the exiting session will stay in server->smb_ses_list until it complete the cifs_free_ipc() and logoff() and then delete itself from t

CVE-2025-68726 [LOW] CVE-2025-68726: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: aea... In the Linux kernel, the following vulnerability has been resolved: crypto: aead - Fix reqsize handling Commit afddce13ce81d ("crypto: api - Add reqsize to crypto_alg") introduced cra_reqsize field in crypto_alg struct to replace type specific reqsize fields. It looks like this was introduced specifically for ahash and acomp from the commit description as subsequent co

CVE-2025-68818 CVE-2025-68818: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: Rever... In the Linux kernel, the following vulnerability has been resolved: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" This reverts commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9. The commit being reverted added code to __qla2x00_abort_all_cmds() to call sp->done() without holding a spinlock. But unlike the older code below it, this new code fai

CVE-2016-5244 [HIGH] CVE-2016-5244: linux - The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6... The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message. Scope: local bookworm: resolved (fixed in 4.6.2-1) bullseye: resolved (fixed in 4.6.2-1) forky: resolved (fixed in 4.6.2-1) sid

CVE-2025-68736 CVE-2025-68736: linux - In the Linux kernel, the following vulnerability has been resolved: landlock: F... In the Linux kernel, the following vulnerability has been resolved: landlock: Fix handling of disconnected directories Disconnected files or directories can appear when they are visible and opened from a bind mount, but have been renamed or moved from the source of the bind mount in a way that makes them inaccessible from the mount point (i.e. out of scope). Previously, acce

CVE-2024-0646 [HIGH] CVE-2024-0646: linux - An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Lay... An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 6.1.69-1) bullseye: resolved (fixed in 5.10.209-1) f

CVE-2019-10125 [CRITICAL] CVE-2019-10125: linux - An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.... An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.0.4. A file may be released by aio_poll_wake() if an expected event is triggered immediately (e.g., by the close of a pair of pipes) after the return of vfs_poll(), and this will cause a use-after-free. Scope: local bookworm: resolved (fixed in 4.19.37-1) bullseye: resolved (fixed in 4

CVE-2021-4154 [HIGH] CVE-2021-4154: linux - A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v... A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a container breakout and a denial of service on the system. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullse

CVE-2023-52798 [HIGH] CVE-2023-52798: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ath11... In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix dfs radar event locking The ath11k active pdevs are protected by RCU but the DFS radar event handling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section. Mark the code in question as an RCU read-side critical section to avoid any potential use-

CVE-2025-22041 [HIGH] CVE-2025-22041: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_sessions_deregister() In multichannel mode, UAF issue can occur in session_deregister when the second channel sets up a session through the connection of the first channel. session that is freed through the global session table can be accessed again through ->session

CVE-2024-35869 [HIGH] CVE-2024-35869: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: guarantee refcounted children from parent session Avoid potential use-after-free bugs when walking DFS referrals, mounting and performing DFS failover by ensuring that all children from parent @tcon->ses are also refcounted. They're all needed across the entire DFS mount. Get rid of @tcon

CVE-2022-36946 [HIGH] CVE-2022-36946: linux - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18... nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len. Scope: local bookworm: resolved (fixed in 5.18.16-1) bullseye: resolved (fixed in 5.10.136-1)

CVE-2023-0179 [HIGH] CVE-2023-0179: linux - A buffer overflow vulnerability was found in the Netfilter subsystem in the Linu... A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution. Scope: local bookworm: resolved (fixed in 6.1.7-1) bullseye: resolved (fixed in 5.10.162-1) forky: resolved (fixed in

CVE-2014-3687 [HIGH] CVE-2014-3687: linux - The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP im... The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter. Scope: local bookworm: resolved (fixed in 3.16.7-1) bullseye: resolved (fixed in 3.16.

CVE-2020-25645 [HIGH] CVE-2020-25645: linux - A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between... A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality. Scope: loc