Debian Linux vulnerabilities

CVE-2024-49928 [HIGH] CVE-2024-49928: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89... In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: avoid reading out of bounds when loading TX power FW elements Because the loop-expression will do one more time before getting false from cond-expression, the original code copied one more entry size beyond valid region. Fix it by moving the entry copy to loop-body. Scope: local bookworm:

CVE-2024-39471 [HIGH] CVE-2024-39471: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: add error handle to avoid out-of-bounds if the sdma_v4_0_irq_id_to_seq return -EINVAL, the process should be stop to avoid out-of-bounds read, so directly return -EINVAL. Scope: local bookworm: resolved (fixed in 6.1.94-1) bullseye: resolved (fixed in 5.10.221-1) forky: resolved (fixed in

CVE-2024-26673 [HIGH] CVE-2024-26673: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations - Disallow families other than NFPROTO_{IPV4,IPV6,INET}. - Disallow layer 4 protocol with no ports, since destination port is a mandatory attribute for this object. Scope: local bookworm: resolved (fixed in 6.1.82-1) bull

CVE-2024-53155 [HIGH] CVE-2024-53155: linux - In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix ... In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix uninitialized value in ocfs2_file_read_iter() Syzbot has reported the following KMSAN splat: BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80 ocfs2_file_read_iter+0x9a4/0xf80 __io_read+0x8d4/0x20f0 io_read+0x3e/0xf0 io_issue_sqe+0x42b/0x22c0 io_wq_submit_work+0xaf9/0xdc0 io_work

CVE-2024-53082 [HIGH] CVE-2024-53082: linux - In the Linux kernel, the following vulnerability has been resolved: virtio_net:... In the Linux kernel, the following vulnerability has been resolved: virtio_net: Add hash_key_length check Add hash_key_length check in virtnet_probe() to avoid possible out of bound errors when setting/reading the hash key. Scope: local bookworm: resolved (fixed in 6.1.119-1) bullseye: resolved forky: resolved (fixed in 6.11.9-1) sid: resolved (fixed in 6.11.9-1) trix

CVE-2021-47004 [HIGH] CVE-2021-47004: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: fix t... In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid touching checkpointed data in get_victim() In CP disabling mode, there are two issues when using LFS or SSR | AT_SSR mode to select victim: 1. LFS is set to find source section during GC, the victim should have no checkpointed data, since after GC, section could not be set free for

CVE-2022-48738 [HIGH] CVE-2022-48738: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: ... In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() We don't currently validate that the values being set are within the range we advertised to userspace as being valid, do so and reject any values that are out of range. Scope: local bookworm: resolved (fixed in 5.16.10-1) bullseye: resolved

CVE-2024-38585 [HIGH] CVE-2024-38585: linux - In the Linux kernel, the following vulnerability has been resolved: tools/nolib... In the Linux kernel, the following vulnerability has been resolved: tools/nolibc/stdlib: fix memory error in realloc() Pass user_p_len to memcpy() instead of heap->len to prevent realloc() from copying an extra sizeof(heap) bytes from beyond the allocated region. Scope: local bookworm: resolved (fixed in 6.1.94-1) bullseye: resolved forky: resolved (fixed in 6.8.12-1)

CVE-2022-48739 [HIGH] CVE-2022-48739: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: hdmi-... In the Linux kernel, the following vulnerability has been resolved: ASoC: hdmi-codec: Fix OOB memory accesses Correct size of iec_status array by changing it to the size of status array of the struct snd_aes_iec958. This fixes out-of-bounds slab read accesses made by memcpy() of the hdmi-codec driver. This problem is reported by KASAN. Scope: local bookworm: resolved

CVE-2024-56721 [HIGH] CVE-2024-56721: linux - In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD... In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Terminate the erratum_1386_microcode array The erratum_1386_microcode array requires an empty entry at the end. Otherwise x86_match_cpu_with_stepping() will continue iterate the array after it ended. Add an empty entry to erratum_1386_microcode to its end. Scope: local bookworm: resolved

CVE-2024-57928 [HIGH] CVE-2024-57928: linux - In the Linux kernel, the following vulnerability has been resolved: netfs: Fix ... In the Linux kernel, the following vulnerability has been resolved: netfs: Fix enomem handling in buffered reads If netfs_read_to_pagecache() gets an error from either ->prepare_read() or from netfs_prepare_read_iterator(), it needs to decrement ->nr_outstanding, cancel the subrequest and break out of the issuing loop. Currently, it only does this for two of the cases

CVE-2024-46865 [HIGH] CVE-2024-46865: linux - In the Linux kernel, the following vulnerability has been resolved: fou: fix in... In the Linux kernel, the following vulnerability has been resolved: fou: fix initialization of grc The grc must be initialize first. There can be a condition where if fou is NULL, goto out will be executed and grc would be used uninitialized. Scope: local bookworm: resolved (fixed in 6.1.112-1) bullseye: resolved (fixed in 5.10.234-1) forky: resolved (fixed in 6.10.11

CVE-2024-53062 [HIGH] CVE-2024-53062: linux - In the Linux kernel, the following vulnerability has been resolved: media: mgb4... In the Linux kernel, the following vulnerability has been resolved: media: mgb4: protect driver against spectre Frequency range is set from sysfs via frequency_range_store(), being vulnerable to spectre, as reported by smatch: drivers/media/pci/mgb4/mgb4_cmt.c:231 mgb4_cmt_set_vin_freq_range() warn: potential spectre issue 'cmt_vals_in' [r] drivers/media/pci/mgb4/mgb4

CVE-2025-21741 [HIGH] CVE-2025-21741: linux - In the Linux kernel, the following vulnerability has been resolved: usbnet: iph... In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: fix DPE OoB read Fix an out-of-bounds DPE read, limit the number of processed DPEs to the amount that fits into the fixed-size NDP16 header. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.12.15-1) sid: resolved (fixed in 6.12.15-1) trixie: resolved (fixe

CVE-2024-35939 [HIGH] CVE-2024-35939: linux - In the Linux kernel, the following vulnerability has been resolved: dma-direct:... In the Linux kernel, the following vulnerability has been resolved: dma-direct: Leak pages on dma_set_decrypted() failure On TDX it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning de

CVE-2024-50193 [HIGH] CVE-2024-50193: linux - In the Linux kernel, the following vulnerability has been resolved: x86/entry_3... In the Linux kernel, the following vulnerability has been resolved: x86/entry_32: Clear CPU buffers after register restore in NMI return CPU buffers are currently cleared after call to exc_nmi, but before register state is restored. This may be okay for MDS mitigation but not for RDFS. Because RDFS mitigation requires CPU buffers to be cleared when registers don't hav

CVE-2022-50169 [HIGH] CVE-2022-50169: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: wil62... In the Linux kernel, the following vulnerability has been resolved: wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi() The simple_write_to_buffer() function will succeed if even a single byte is initialized. However, we need to initialize the whole buffer to prevent information leaks. Just use memdup_user(). Scope: local bookworm: resolved (fixed in 6.0.2-1

CVE-2022-49870 [HIGH] CVE-2022-49870: linux - In the Linux kernel, the following vulnerability has been resolved: capabilitie... In the Linux kernel, the following vulnerability has been resolved: capabilities: fix undefined behavior in bit shift for CAP_TO_MASK Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in security/commoncap.c:1252:2 left shift of 1 by 31 places cannot be repr

CVE-2021-47371 [HIGH] CVE-2021-47371: linux - In the Linux kernel, the following vulnerability has been resolved: nexthop: Fi... In the Linux kernel, the following vulnerability has been resolved: nexthop: Fix memory leaks in nexthop notification chain listeners syzkaller discovered memory leaks [1] that can be reduced to the following commands: # ip nexthop add id 1 blackhole # devlink dev reload pci/0000:06:00.0 As part of the reload flow, mlxsw will unregister its netdevs and then unregister

CVE-2022-49792 [HIGH] CVE-2022-49792: linux - In the Linux kernel, the following vulnerability has been resolved: iio: adc: m... In the Linux kernel, the following vulnerability has been resolved: iio: adc: mp2629: fix potential array out of bound access Add sentinel at end of maps to avoid potential array out of bound access in iio core. Scope: local bookworm: resolved (fixed in 6.0.10-1) bullseye: resolved (fixed in 5.10.158-1) forky: resolved (fixed in 6.0.10-1) sid: resolved (fixed in 6.0.1