Debian Linux vulnerabilities

CVE-2024-36972 [HIGH] CVE-2024-36972: linux - In the Linux kernel, the following vulnerability has been resolved: af_unix: Up... In the Linux kernel, the following vulnerability has been resolved: af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock. Billy Jheng Bing-Jhong reported a race between __unix_gc() and queue_oob(). __unix_gc() tries to garbage-collect close()d inflight sockets, and then if the socket has MSG_OOB in unix_sk(sk)->oob_skb, GC will drop the reference and set N

CVE-2026-31409 CVE-2026-31409: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: unse... In the Linux kernel, the following vulnerability has been resolved: ksmbd: unset conn->binding on failed binding request When a multichannel SMB2_SESSION_SETUP request with SMB2_SESSION_REQ_FLAG_BINDING fails ksmbd sets conn->binding = true but never clears it on the error path. This leaves the connection in a binding state where all subsequent ksmbd_session_lookup_all() cal

CVE-2018-12904 [MEDIUM] CVE-2018-12904: linux - In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualizat... In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local attackers could cause L1 KVM guests to VMEXIT, potentially allowing privilege escalations and denial of service attacks due to lack of checking of CPL. Scope: local bookworm: resolved (fixed in 4.16.16-1) bullseye: resolved (fixed in 4.16.16-1) forky: resolved (fixed i

CVE-2023-38431 [CRITICAL] CVE-2023-38431: linux - An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connecti... An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connection.c in ksmbd does not validate the relationship between the NetBIOS header's length field and the SMB header sizes, via pdu_size in ksmbd_conn_handler_loop, leading to an out-of-bounds read. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved forky: resolved (fixed

CVE-2018-18559 [HIGH] CVE-2018-18559: linux - In the Linux kernel through 4.19, a use-after-free can occur due to a race condi... In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain multithreaded case involving a packet_do_bind unregister action followed by

CVE-2023-1380 [HIGH] CVE-2023-1380: linux - A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net... A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service. Scope: local bookworm: resolved (fixed in 6.1.27-1) bullseye: resolve

CVE-2020-29569 [HIGH] CVE-2020-29569: linux - An issue was discovered in the Linux kernel through 5.10.1, as used with Xen thr... An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the states connect and disconnect. As a consequence, the block backend may re-

CVE-2018-16882 [HIGH] CVE-2018-16882: linux - A use-after-free issue was found in the way the Linux kernel's KVM hypervisor pr... A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor address, which is later used in pi_test_and_clear_on(). A gu

CVE-2021-4440 [HIGH] CVE-2021-4440: linux - In the Linux kernel, the following vulnerability has been resolved: x86/xen: Dr... In the Linux kernel, the following vulnerability has been resolved: x86/xen: Drop USERGS_SYSRET64 paravirt call commit afd30525a659ac0ae0904f0cb4a2ca75522c3123 upstream. USERGS_SYSRET64 is used to return from a syscall via SYSRET, but a Xen PV guest will nevertheless use the IRET hypercall, as there is no sysret PV hypercall defined. So instead of testing all the prereq

CVE-2020-25643 [HIGH] CVE-2020-25643: linux - A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5... A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system avail

CVE-2021-47368 [HIGH] CVE-2021-47368: linux - In the Linux kernel, the following vulnerability has been resolved: enetc: Fix ... In the Linux kernel, the following vulnerability has been resolved: enetc: Fix illegal access when reading affinity_hint irq_set_affinity_hit() stores a reference to the cpumask_t parameter in the irq descriptor, and that reference can be accessed later from irq_affinity_hint_proc_show(). Since the cpu_mask parameter passed to irq_set_affinity_hit() has only temporary

CVE-2024-36912 [HIGH] CVE-2024-36912: linux - In the Linux kernel, the following vulnerability has been resolved: Drivers: hv... In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid ret

CVE-2023-39176 [MEDIUM] CVE-2023-39176: linux - A flaw was found within the parsing of SMB2 requests that have a transform heade... A flaw was found within the parsing of SMB2 requests that have a transform header in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with

CVE-2023-35001 [HIGH] CVE-2023-35001: linux - Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poor... Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace Scope: local bookworm: resolved (fixed in 6.1.38-1) bullseye: resolved (fixed in 5.10.179-2) forky: resolved (fixed in 6.4.4-1) sid: resolved (fixed in 6.4.4-1) trixie: resolved (fixed in 6.4.4-1)

CVE-2025-22037 [MEDIUM] CVE-2025-22037: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send malformed smb2 negotiate request. ksmbd return error response. Subsequently, the client can send smb2 session setup even thought conn->preauth_info is not allocated. This patch add KSMBD_SESS_NEED_SETUP status of connection

CVE-2025-38501 [HIGH] CVE-2025-38501: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: limi... In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit repeated connections from clients with the same IP Repeated connections from clients with the same IP address may exhaust the max connections and prevent other normal client connections. This patch limit repeated connections from clients with the same IP. Scope: local bookworm: resolved (

CVE-2022-3640 [MEDIUM] CVE-2022-3640: linux - A vulnerability, which was classified as critical, was found in Linux Kernel. Af... A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211944. Scope: local bookworm: resolved (fixe

CVE-2022-1786 [HIGH] CVE-2022-1786: linux - A use-after-free flaw was found in the Linux kernel’s io_uring subsystem in the ... A use-after-free flaw was found in the Linux kernel’s io_uring subsystem in the way a user sets up a ring with IORING_SETUP_IOPOLL with more than one task completing submissions on this ring. This flaw allows a local user to crash or escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.120-1) fork

CVE-2023-4004 [HIGH] CVE-2023-4004: linux - A use-after-free flaw was found in the Linux kernel's netfilter in the way a use... A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 6.1.52-1) bullseye: resolved (fixed in 5.10.191

CVE-2021-29154 [HIGH] CVE-2021-29154: linux - BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation... BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c. Scope: local bookworm: resolved (fixed in 5.10.28-1) bullseye: resolved (fixed in 5.10.28-1) forky: resolved (fixed in 5.