Debian Linux vulnerabilities

CVE-2017-18270 [HIGH] CVE-2017-18270: linux - In the Linux kernel before 4.13.5, a local user could create keyrings for other ... In the Linux kernel before 4.13.5, a local user could create keyrings for other users via keyctl commands, setting unwanted defaults or causing a denial of service. Scope: local bookworm: resolved (fixed in 4.13.10-1) bullseye: resolved (fixed in 4.13.10-1) forky: resolved (fixed in 4.13.10-1) sid: resolved (fixed in 4.13.10-1) trixie: resolved (fixed in 4.13.10-1)

CVE-2025-68308 CVE-2025-68308: linux - In the Linux kernel, the following vulnerability has been resolved: can: kvaser... In the Linux kernel, the following vulnerability has been resolved: can: kvaser_usb: leaf: Fix potential infinite loop in command parsers The `kvaser_usb_leaf_wait_cmd()` and `kvaser_usb_leaf_read_bulk_callback` functions contain logic to zero-length commands. These commands are used to align data to the USB endpoint's wMaxPacketSize boundary. The driver attempts to skip the

CVE-2022-0850 [HIGH] CVE-2022-0850: linux - A vulnerability was found in linux kernel, where an information leak occurs via ... A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.70-1) forky: resolved (fixed in 5.14.6-1) sid: resolved (fixed in 5.14.6-1) trixie: resolved (fixed in 5.14.6-1)

CVE-2025-68184 [LOW] CVE-2025-68184: linux - In the Linux kernel, the following vulnerability has been resolved: drm/mediate... In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Disable AFBC support on Mediatek DRM driver Commit c410fa9b07c3 ("drm/mediatek: Add AFBC support to Mediatek DRM driver") added AFBC support to Mediatek DRM and enabled the 32x8/split/sparse modifier. However, this is currently broken on Mediatek MT8188 (Genio 700 EVK platform); tested us

CVE-2025-40358 CVE-2025-40358: linux - In the Linux kernel, the following vulnerability has been resolved: riscv: stac... In the Linux kernel, the following vulnerability has been resolved: riscv: stacktrace: Disable KASAN checks for non-current tasks Unwinding the stack of a task other than current, KASAN would report "BUG: KASAN: out-of-bounds in walk_stackframe+0x41c/0x460" There is a same issue on x86 and has been resolved by the commit 84936118bdf3 ("x86/unwind: Disable KASAN checks for no

CVE-2025-40322 CVE-2025-40322: linux - In the Linux kernel, the following vulnerability has been resolved: fbdev: bitb... In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the built-in font array. Clamp the index to the actual glyph count before comp

CVE-2026-23397 CVE-2026-23397: linux - In the Linux kernel, the following vulnerability has been resolved: nfnetlink_o... In the Linux kernel, the following vulnerability has been resolved: nfnetlink_osf: validate individual option lengths in fingerprints nfnl_osf_add_callback() validates opt_num bounds and string NUL-termination but does not check individual option length fields. A zero-length option causes nf_osf_match_one() to enter the option matching loop even when foptsize sums to zero, w

CVE-2026-23244 [LOW] CVE-2026-23244: linux - In the Linux kernel, the following vulnerability has been resolved: nvme: fix m... In the Linux kernel, the following vulnerability has been resolved: nvme: fix memory allocation in nvme_pr_read_keys() nvme_pr_read_keys() takes num_keys from userspace and uses it to calculate the allocation size for rse via struct_size(). The upper limit is PR_KEYS_MAX (64K). A malicious or buggy userspace can pass a large num_keys value that results in a 4MB allocat

CVE-2025-40063 [LOW] CVE-2025-40063: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: com... In the Linux kernel, the following vulnerability has been resolved: crypto: comp - Use same definition of context alloc and free ops In commit 42d9f6c77479 ("crypto: acomp - Move scomp stream allocation code into acomp"), the crypto_acomp_streams struct was made to rely on having the alloc_ctx and free_ctx operations defined in the same order as the scomp_alg struct. B

CVE-2025-68753 CVE-2025-68753: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: firew... In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-motu: add bounds check in put_user loop for DSP events In the DSP event handling code, a put_user() loop copies event data. When the user buffer size is not aligned to 4 bytes, it could overwrite beyond the buffer boundary. Fix by adding a bounds check before put_user(). Scope: local bookworm:

CVE-2025-71192 CVE-2025-71192: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97:... In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: fix a double free in snd_ac97_controller_register() If ac97_add_adapter() fails, put_device() is the correct way to drop the device reference. kfree() is not required. Add kfree() if idr_alloc() fails and in ac97_adapter_release() to do the cleanup. Found by code review. Scope: local bookworm: re

CVE-2025-68243 [LOW] CVE-2025-68243: linux - In the Linux kernel, the following vulnerability has been resolved: NFS: Check ... In the Linux kernel, the following vulnerability has been resolved: NFS: Check the TLS certificate fields in nfs_match_client() If the TLS security policy is of type RPC_XPRTSEC_TLS_X509, then the cert_serial and privkey_serial fields need to match as well since they define the client's identity, as presented to the server. Scope: local bookworm: resolved bullseye: res

CVE-2018-14656 [HIGH] CVE-2018-14656: linux - A missing address check in the callers of the show_opcodes() in the Linux kernel... A missing address check in the callers of the show_opcodes() in the Linux kernel allows an attacker to dump the kernel memory at an arbitrary kernel address into the dmesg log. Scope: local bookworm: resolved (fixed in 4.18.6-1) bullseye: resolved (fixed in 4.18.6-1) forky: resolved (fixed in 4.18.6-1) sid: resolved (fixed in 4.18.6-1) trixie: resolved (fixed in 4.18.

CVE-2024-53162 [HIGH] CVE-2024-53162: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: qat... In the Linux kernel, the following vulnerability has been resolved: crypto: qat/qat_4xxx - fix off by one in uof_get_name() The fw_objs[] array has "num_objs" elements so the > needs to be >= to prevent an out of bounds read. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.12.3-1) sid: resolved (fixed in 6.12.3-1) trixie: resolved (fixed

CVE-2024-46723 [HIGH] CVE-2024-46723: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ucode out-of-bounds read warning Clear warning that read ucode[] may out-of-bounds. Scope: local bookworm: resolved (fixed in 6.1.112-1) bullseye: resolved (fixed in 5.10.226-1) forky: resolved (fixed in 6.10.9-1) sid: resolved (fixed in 6.10.9-1) trixie: resolved (fixed in 6.10.9-1)

CVE-2024-46722 [HIGH] CVE-2024-46722: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix mc_data out-of-bounds read warning Clear warning that read mc_data[i-1] may out-of-bounds. Scope: local bookworm: resolved (fixed in 6.1.112-1) bullseye: resolved (fixed in 5.10.226-1) forky: resolved (fixed in 6.10.9-1) sid: resolved (fixed in 6.10.9-1) trixie: resolved (fixed in 6.10

CVE-2021-47403 [HIGH] CVE-2021-47403: linux - In the Linux kernel, the following vulnerability has been resolved: ipack: ipoc... In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix module reference leak A reference to the carrier module was taken on every open but was only released once when the final reference to the tty struct was dropped. Fix this by taking the module reference and initialising the tty driver data when installing the tty. Scope: local book

CVE-2024-36033 [HIGH] CVE-2024-36033: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix info leak when fetching board id Add the missing sanity check when fetching the board id to avoid leaking slab data when later requesting the firmware. Scope: local bookworm: resolved (fixed in 6.1.94-1) bullseye: resolved forky: resolved (fixed in 6.8.11-1) sid: resolved (fixed in

CVE-2024-39469 [HIGH] CVE-2024-39469: linux - In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix... In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors The error handling in nilfs_empty_dir() when a directory folio/page read fails is incorrect, as in the old ext2 implementation, and if the folio/page cannot be read or nilfs_check_folio() fails, it will falsely determine the directo

CVE-2022-3202 [HIGH] CVE-2022-3202: linux - A NULL pointer dereference flaw in diFree in fs/jfs/inode.c in Journaled File Sy... A NULL pointer dereference flaw in diFree in fs/jfs/inode.c in Journaled File System (JFS)in the Linux kernel. This could allow a local attacker to crash the system or leak kernel internal information. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed in 5.17.3-1) sid: resolved (fixed in 5.17.3-1) trixie: