Debian Linux vulnerabilities

CVE-2025-38521 [HIGH] CVE-2025-38521: linux - In the Linux kernel, the following vulnerability has been resolved: drm/imagina... In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix kernel crash when hard resetting the GPU The GPU hard reset sequence calls pm_runtime_force_suspend() and pm_runtime_force_resume(), which according to their documentation should only be used during system-wide PM transitions to sleep states. The main issue though is that dependin

CVE-2022-50270 [HIGH] CVE-2022-50270: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: fix t... In the Linux kernel, the following vulnerability has been resolved: f2fs: fix the assign logic of iocb commit 18ae8d12991b ("f2fs: show more DIO information in tracepoint") introduces iocb field in 'f2fs_direct_IO_enter' trace event And it only assigns the pointer and later it accesses its field in trace print log. Unable to handle kernel paging request at virtual add

CVE-2025-38088 [HIGH] CVE-2025-38088: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/pow... In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap memtrace mmap issue has an out of bounds issue. This patch fixes the by checking that the requested mapping region size should stay within the allocated region size. Scope: local bookworm: resolved (fixed in 6.1.147-1) bullseye: resolv

CVE-2025-38159 [HIGH] CVE-2025-38159: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88... In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtw_fw_bt_wifi_control(rtwdev, para[0], ¶[1])', which reads 5 bytes: void rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data) { ... SET_BT_WIFI_CONTR

CVE-2023-53675 [HIGH] CVE-2023-53675: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: ses: ... In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix possible desc_ptr out-of-bounds accesses Sanitize possible desc_ptr out-of-bounds accesses in ses_enclosure_data_process(). Scope: local bookworm: resolved (fixed in 6.1.20-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.20-1) sid: resolved (fixed in 6.1.20-1)

CVE-2023-53600 [HIGH] CVE-2023-53600: linux - In the Linux kernel, the following vulnerability has been resolved: tunnels: fi... In the Linux kernel, the following vulnerability has been resolved: tunnels: fix kasan splat when generating ipv4 pmtu error If we try to emit an icmp error in response to a nonliner skb, we get BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220 Read of size 4 at addr ffff88811c50db00 by task iperf3/1691 CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+

CVE-2023-53321 [HIGH] CVE-2023-53321: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80... In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: drop short frames While technically some control frames like ACK are shorter and end after Address 1, such frames shouldn't be forwarded through wmediumd or similar userspace, so require the full 3-address header to avoid accessing invalid memory if shorter frames are passed in.

CVE-2023-53521 [HIGH] CVE-2023-53521: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: ses: ... In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() A fix for: BUG: KASAN: slab-out-of-bounds in ses_intf_remove+0x23f/0x270 [ses] Read of size 8 at addr ffff88a10d32e5d8 by task rmmod/12013 When edev->components is zero, accessing edev->component[0] members is wrong. Scope: local bookworm: resolve

CVE-2023-53301 [HIGH] CVE-2023-53301: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: fix k... In the Linux kernel, the following vulnerability has been resolved: f2fs: fix kernel crash due to null io->bio We should return when io->bio is null before doing anything. Otherwise, panic. BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: 0010:__submit_merged_write_cond+0x164/0x240 [f2fs] Call Trace: f2fs_submit_merged_write+0x1d/0x30 [f2fs] commit

CVE-2017-15265 [HIGH] CVE-2017-15265: linux - Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows lo... Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c. Scope: local bookworm: resolved (fixed in 4.13.4-2) bullseye: resolved (fixed in

CVE-2025-71136 [HIGH] CVE-2025-71136: linux - In the Linux kernel, the following vulnerability has been resolved: media: adv7... In the Linux kernel, the following vulnerability has been resolved: media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() It's possible for cp_read() and hdmi_read() to return -EIO. Those values are further used as indexes for accessing arrays. Fix that by checking return values where it's needed. Found by Linux Verification Center (li

CVE-2024-24857 [MEDIUM] CVE-2024-24857: linux - A race condition was found in the Linux kernel's net/bluetooth device driver in ... A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service. Scope: local bookworm: resolved (fixed in 6.1.85-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.8.9-1)

CVE-2017-6346 [HIGH] CVE-2017-6346: linux - Race condition in net/packet/af_packet.c in the Linux kernel before 4.9.13 allow... Race condition in net/packet/af_packet.c in the Linux kernel before 4.9.13 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application that makes PACKET_FANOUT setsockopt system calls. Scope: local bookworm: resolved (fixed in 4.9.13-1) bullseye: resolved (fixed in 4.9.13-1) forky: resolved (

CVE-2020-25212 [HIGH] CVE-2020-25212: linux - A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could ... A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452. Scope: local bookworm: resolved (fixed in 5.7.17-1) bullseye: resolved (fixed in 5.7.17-1) forky: resolved

CVE-2023-4611 [HIGH] CVE-2023-4611: linux - A use-after-free flaw was found in mm/mempolicy.c in the memory management subsy... A use-after-free flaw was found in mm/mempolicy.c in the memory management subsystem in the Linux Kernel. This issue is caused by a race between mbind() and VMA-locked page fault, and may allow a local attacker to crash the system or lead to a kernel information leak. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.4.11-1) sid: resolved (f

CVE-2024-50036 [HIGH] CVE-2024-50036: linux - In the Linux kernel, the following vulnerability has been resolved: net: do not... In the Linux kernel, the following vulnerability has been resolved: net: do not delay dst_entries_add() in dst_release() dst_entries_add() uses per-cpu data that might be freed at netns dismantle from ip6_route_net_exit() calling dst_entries_destroy() Before ip6_route_net_exit() can be called, we release all the dsts associated with this netns, via calls to dst_releas

CVE-2024-42228 [HIGH] CVE-2024-42228: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc Initialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001. V2: To really improve the handling we would actually need to have a separate value of 0xffffffff.(Christian) Scope: local bookworm: resolved (fi

CVE-2021-47281 [HIGH] CVE-2021-47281: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: ... In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix race of snd_seq_timer_open() The timer instance per queue is exclusive, and snd_seq_timer_open() should have managed the concurrent accesses. It looks as if it's checking the already existing timer instance at the beginning, but it's not right, because there is no protection, hence any

CVE-2023-52480 [HIGH] CVE-2023-52480: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix race condition between session lookup and expire Thread A + Thread B ksmbd_session_lookup | smb2_sess_setup sess = xa_load | | | xa_erase(&conn->sessions, sess->id); | | ksmbd_session_destroy(sess) --> kfree(sess) | // UAF! | sess->last_active = jiffies | + This patch add rwsem to fix race

CVE-2024-57876 [HIGH] CVE-2024-57876: linux - In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst:... In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Fix resetting msg rx state after topology removal If the MST topology is removed during the reception of an MST down reply or MST up request sideband message, the drm_dp_mst_topology_mgr::up_req_recv/down_rep_recv states could be reset from one thread via drm_dp_mst_topology_mgr_set_mst(fa