Debian Linux vulnerabilities

CVE-2021-47023 [HIGH] CVE-2021-47023: linux - In the Linux kernel, the following vulnerability has been resolved: net: marvel... In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: fix port event handling on init For some reason there might be a crash during ports creation if port events are handling at the same time because fw may send initial port event with down state. The crash points to cancel_delayed_work() which is called when port went is down. Cu

CVE-2018-6412 [HIGH] CVE-2018-6412: linux - In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Li... In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands. Scope: local bookworm: resolved (fixed in 4.16.5-1) bullseye: resolved (fixed in 4.16.5-1) forky: resolved (fixed in 4.16.5-1) sid: resolved (fi

CVE-2019-18814 [CRITICAL] CVE-2019-18814: linux - An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-... An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse() fails in aa_audit_rule_init() in security/apparmor/audit.c. Scope: local bookworm: resolved (fixed in 5.7.6-1) bullseye: resolved (fixed in 5.7.6-1) forky: resolved (fixed in 5.7.6-1) sid: resolved (fixed in 5.7.6-1) trixie: resolved (fixed in 5.7.6-1)

CVE-2021-3347 [HIGH] CVE-2021-3347: linux - An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a k... An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458. Scope: local bookworm: resolved (fixed in 5.10.12-1) bullseye: resolved (fixed in 5.10.12-1) forky: resolved (fixed in 5.10.12-1) sid: resolved (fixed in 5.10.12-1) tri

CVE-2022-1011 [HIGH] CVE-2022-1011: linux - A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way... A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation. Scope: local bookworm: resolved (fixed in 5.16.18-1) bullseye: resolved (fixed in 5.10.106-1) forky: resolved (fixed in 5.16.18-1) sid: res

CVE-2026-31788 [HIGH] CVE-2026-31788: linux - In the Linux kernel, the following vulnerability has been resolved: xen/privcmd... In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: restrict usage in unprivileged domU The Xen privcmd driver allows to issue arbitrary hypercalls from user space processes. This is normally no problem, as access is usually limited to root and the hypervisor will deny any hypercalls affecting other domains. In case the guest is booted usi

CVE-2014-0101 [HIGH] CVE-2014-0101: linux - The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel t... The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH c

CVE-2023-1829 [HIGH] CVE-2023-1829: linux - A use-after-free vulnerability in the Linux Kernel traffic control index filter ... A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure. A local attacker user can use thi

CVE-2022-3910 [HIGH] CVE-2022-3910: linux - Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An imp... Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in io_uring leads to Use-After-Free and Local Privilege Escalation. When io_msg_ring was invoked with a fixed file, it called io_fput_file() which improperly decreased its reference count (leading to Use-After-Free and Local Privilege Escalation). Fixed files

CVE-2020-10757 [HIGH] CVE-2020-10757: linux - A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap... A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.6.14-2) bullseye: resolved (fixed in 5.6.14-2) forky: resolved (fixed in 5.6.14-2) sid: resolved (fixed in

CVE-2016-7039 [HIGH] CVE-2016-7039: linux - The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause ... The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers, a related issue to CVE-2016-8666. Scope: local bookworm: resolved (fixed in 4.7.

CVE-2022-50386 [HIGH] CVE-2022-50386: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref *kref) Bluetooth: chan 0000000023c4974d Bluetooth: parent 00000000ae861c08 ============

CVE-2020-14381 [HIGH] CVE-2020-14381: linux - A flaw was found in the Linux kernel’s futex implementation. This flaw allows a ... A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory or escalate their privileges when creating a futex on a filesystem that is about to be unmounted. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Scope: local bookworm: resolved (fixed in 5

CVE-2022-1679 [HIGH] CVE-2022-1679: linux - A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter d... A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved (fixed in 5.10.140-1)

CVE-2023-0045 [MEDIUM] CVE-2023-0045: linux - The current implementation of the prctl syscall does not issue an IBPB immediate... The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnera

CVE-2019-14835 [HIGH] CVE-2019-14835: linux - A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way L... A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the

CVE-2021-38300 [HIGH] CVE-2021-38300: linux - arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirab... arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when transforming unprivileged cBPF programs, allowing execution of arbitrary code within the kernel context. This occurs because conditional branches can exceed the 128 KB limit of the MIPS architecture. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolve

CVE-2023-4206 [HIGH] CVE-2023-4206: linux - A use-after-free vulnerability in the Linux kernel's net/sched: cls_route compon... A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always

CVE-2023-40283 [HIGH] CVE-2023-40283: linux - An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in t... An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled. Scope: local bookworm: resolved (fixed in 6.1.52-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 6.4.11-1) sid: resolved (fixed in 6.4.11-1) trixie: resolved (fixed

CVE-2021-4197 [HIGH] CVE-2021-4197: linux - An unprivileged write to the file handler flaw in the Linux kernel's control gro... An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of control groups. A local user could use this flaw to crash the