Debian Linux vulnerabilities

CVE-2025-22112 [HIGH] CVE-2025-22112: linux - In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: ... In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix out-of-range access of vnic_info array The bnxt_queue_{start | stop}() access vnic_info as much as allocated, which indicates bp->nr_vnics. So, it should not reach bp->vnic_info[bp->nr_vnics]. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.12.35-1) sid: r

CVE-2025-21985 [HIGH] CVE-2025-21985: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bound accesses [WHAT & HOW] hpo_stream_to_link_encoder_mapping has size MAX_HPO_DP2_ENCODERS(=4), but location can have size up to 6. As a result, it is necessary to check location against MAX_HPO_DP2_ENCODERS. Similiarly, disp_cfg_stream_location can be used as an array in

CVE-2024-45023 [HIGH] CVE-2024-45023: linux - In the Linux kernel, the following vulnerability has been resolved: md/raid1: F... In the Linux kernel, the following vulnerability has been resolved: md/raid1: Fix data corruption for degraded array with slow disk read_balance() will avoid reading from slow disks as much as possible, however, if valid data only lands in slow disks, and a new normal disk is still in recovery, unrecovered data can be read: raid1_read_request read_balance raid1_should

CVE-2023-53136 [HIGH] CVE-2023-53136: linux - In the Linux kernel, the following vulnerability has been resolved: af_unix: fi... In the Linux kernel, the following vulnerability has been resolved: af_unix: fix struct pid leaks in OOB support syzbot reported struct pid leak [1]. Issue is that queue_oob() calls maybe_add_creds() which potentially holds a reference on a pid. But skb->destructor is not set (either directly or by calling unix_scm_to_skb()) This means that subsequent kfree_skb() or c

CVE-2025-38204 [HIGH] CVE-2025-38204: linux - In the Linux kernel, the following vulnerability has been resolved: jfs: fix ar... In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds read in add_missing_indices stbl is s8 but it must contain offsets into slot which can go from 0 to 127. Added a bound check for that error and return -EIO if the check fails. Also make jfs_readdir return with error if add_missing_indices returns with an error. Scope

CVE-2017-11600 [HIGH] CVE-2017-11600: linux - net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGR... net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message. Scope: local bookworm: r

CVE-2022-50333 [HIGH] CVE-2022-50333: linux - In the Linux kernel, the following vulnerability has been resolved: fs: jfs: fi... In the Linux kernel, the following vulnerability has been resolved: fs: jfs: fix shift-out-of-bounds in dbDiscardAG This should be applied to most URSAN bugs found recently by syzbot, by guarding the dbMount. As syzbot feeding rubbish into the bmap descriptor. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (

CVE-2021-4460 [HIGH] CVE-2021-4460: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd:... In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix UBSAN shift-out-of-bounds warning If get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up doing a shift operation where the number of bits shifted equals number of bits in the operand. This behaviour is undefined. Set num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if t

CVE-2025-39744 [HIGH] CVE-2025-39744: linux - In the Linux kernel, the following vulnerability has been resolved: rcu: Fix rc... In the Linux kernel, the following vulnerability has been resolved: rcu: Fix rcu_read_unlock() deadloop due to IRQ work During rcu_read_unlock_special(), if this happens during irq_exit(), we can lockup if an IPI is issued. This is because the IPI itself triggers the irq_exit() path causing a recursive lock up. This is precisely what Xiongfeng found when invoking a BP

CVE-2017-7477 [HIGH] CVE-2017-7477: linux - Heap-based buffer overflow in drivers/net/macsec.c in the MACsec module in the L... Heap-based buffer overflow in drivers/net/macsec.c in the MACsec module in the Linux kernel through 4.10.12 allows attackers to cause a denial of service or possibly have unspecified other impact by leveraging the use of a MAX_SKB_FRAGS+1 size in conjunction with the NETIF_F_FRAGLIST feature, leading to an error in the skb_to_sgvec function. Scope: local bookworm: resol

CVE-2026-23187 [HIGH] CVE-2026-23187: linux - In the Linux kernel, the following vulnerability has been resolved: pmdomain: i... In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains Fix out-of-range access of bc->domains in imx8m_blk_ctrl_remove(). Scope: local bookworm: resolved (fixed in 6.1.164-1) bullseye: resolved forky: resolved (fixed in 6.18.10-1) sid: resolved (fixed in 6.18.10-1) trixie: resolved (fixed in

CVE-2013-4387 [MEDIUM] CVE-2013-4387: linux - net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly deter... net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP Fragmentation Offload (UFO) processing of small packets after the UFO queueing of a large packet, which allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via network traffic that trigger

CVE-2019-13631 [MEDIUM] CVE-2019-13631: linux - In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kerne... In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved (fixed in 5.2.6-1) sid: resolved (fixed in

CVE-2017-6874 [HIGH] CVE-2017-6874: linux - Race condition in kernel/ucount.c in the Linux kernel through 4.10.2 allows loca... Race condition in kernel/ucount.c in the Linux kernel through 4.10.2 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls that leverage certain decrement behavior that causes incorrect interaction between put_ucounts and get_ucounts. Scope: local bookworm: resolved (fixed in

CVE-2024-35919 [HIGH] CVE-2024-35919: linux - In the Linux kernel, the following vulnerability has been resolved: media: medi... In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect encoder context list Add a lock for the ctx_list, to avoid accessing a NULL pointer within the 'vpu_enc_ipi_handler' function when the ctx_list has been deleted due to an unexpected behavior on the SCP IP block. Scope: local bookworm: resolved bullseye:

CVE-2019-14283 [MEDIUM] CVE-2019-14283: linux - In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does no... In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default. Scope: local bookworm: resolved (fixed in 5.2.6-1)

CVE-2024-34027 [HIGH] CVE-2024-34027: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: compr... In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock It needs to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock to avoid racing with checkpoint, otherwise, filesystem metadata including blkaddr in dnode, inode fields and .total_valid_block_count may be corrupte

CVE-2024-39492 [HIGH] CVE-2024-39492: linux - In the Linux kernel, the following vulnerability has been resolved: mailbox: mt... In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-cmdq: Fix pm_runtime_get_sync() warning in mbox shutdown The return value of pm_runtime_get_sync() in cmdq_mbox_shutdown() will return 1 when pm runtime state is active, and we don't want to get the warning message in this case. So we change the return value < 0 for WARN_ON(). Scope: loca

CVE-2020-15436 [MEDIUM] CVE-2020-15436: linux - Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 al... Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field. Scope: local bookworm: resolved (fixed in 5.7.6-1) bullseye: resolved (fixed in 5.7.6-1) forky: resolved (fixed in 5.7.6-1) sid: resolved (fixed in 5.7.6-1) trixie: re

CVE-2014-3182 [MEDIUM] CVE-2014-3182: linux - Array index error in the logi_dj_raw_event function in drivers/hid/hid-logitech-... Array index error in the logi_dj_raw_event function in drivers/hid/hid-logitech-dj.c in the Linux kernel before 3.16.2 allows physically proximate attackers to execute arbitrary code or cause a denial of service (invalid kfree) via a crafted device that provides a malformed REPORT_TYPE_NOTIF_DEVICE_UNPAIRED value. Scope: local bookworm: resolved (fixed in 3.16.2-2) bu