Debian Linux vulnerabilities

CVE-2022-50719 CVE-2022-50719: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: line6... In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: fix stack overflow in line6_midi_transmit Correctly calculate available space including the size of the chunk buffer. This fixes a buffer overflow when multiple MIDI sysex messages are sent to a PODxt device. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixed in 5.10.17

CVE-2022-50818 CVE-2022-50818: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: pm800... In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix running_req for internal abort commands Disabling the remote phy for a SATA disk causes a hang: root@(none)$ more /sys/class/sas_phy/phy-0:0:8/target_port_protocols sata root@(none)$ echo 0 > sys/class/sas_phy/phy-0:0:8/enable root@(none)$ [ 67.855950] sas: ex 500e004aaaaaaa1f phy08 change

CVE-2025-68346 CVE-2025-68346: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: dice:... In the Linux kernel, the following vulnerability has been resolved: ALSA: dice: fix buffer overflow in detect_stream_formats() The function detect_stream_formats() reads the stream_count value directly from a FireWire device without validating it. This can lead to out-of-bounds writes when a malicious device provides a stream_count value greater than MAX_STREAMS. Fix by appl

CVE-2025-71197 CVE-2025-71197: linux - In the Linux kernel, the following vulnerability has been resolved: w1: therm: ... In the Linux kernel, the following vulnerability has been resolved: w1: therm: Fix off-by-one buffer overflow in alarms_store The sysfs buffer passed to alarms_store() is allocated with 'size + 1' bytes and a NUL terminator is appended. However, the 'size' argument does not account for this extra byte. The original code then allocated 'size' bytes and used strcpy() to copy '

CVE-2025-68217 CVE-2025-68217: linux - In the Linux kernel, the following vulnerability has been resolved: Input: pega... In the Linux kernel, the following vulnerability has been resolved: Input: pegasus-notetaker - fix potential out-of-bounds access In the pegasus_notetaker driver, the pegasus_probe() function allocates the URB transfer buffer using the wMaxPacketSize value from the endpoint descriptor. An attacker can use a malicious USB descriptor to force the allocation of a very small buf

CVE-2025-40220 CVE-2025-40220: linux - In the Linux kernel, the following vulnerability has been resolved: fuse: fix l... In the Linux kernel, the following vulnerability has been resolved: fuse: fix livelock in synchronous file put from fuseblk workers I observed a hang when running generic/323 against a fuseblk server. This test opens a file, initiates a lot of AIO writes to that file descriptor, and closes the file descriptor before the writes complete. Unsurprisingly, the AIO exerciser thre

CVE-2025-40084 CVE-2025-40084: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: tran... In the Linux kernel, the following vulnerability has been resolved: ksmbd: transport_ipc: validate payload size before reading handle handle_response() dereferences the payload as a 4-byte handle without verifying that the declared payload size is at least 4 bytes. A malformed or truncated message from ksmbd.mountd can lead to a 4-byte read past the declared payload size. Va

CVE-2026-23325 [LOW] CVE-2026-23325: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mt76:... In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() Check frame length before accessing the mgmt fields in mt7996_mac_write_txwi_80211 in order to avoid a possible oob access. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.19.8-1) sid: resolved (

CVE-2026-23363 [LOW] CVE-2026-23363: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mt76:... In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211() Check frame length before accessing the mgmt fields in mt7925_mac_write_txwi_80211 in order to avoid a possible oob access. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.19.8-1) sid: resolved (

CVE-2025-68215 [LOW] CVE-2025-68215: linux - In the Linux kernel, the following vulnerability has been resolved: ice: fix PT... In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP cleanup on driver removal in error path Improve the cleanup on releasing PTP resources in error path. The error case might happen either at the driver probe and PTP feature initialization or on PTP restart (errors in reset handling, NVM update etc). In both cases, calls to PF PTP cleanup (

CVE-2026-23305 [LOW] CVE-2026-23305: linux - In the Linux kernel, the following vulnerability has been resolved: accel/rocke... In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix unwinding in error path in rocket_probe When rocket_core_init() fails (as could be the case with EPROBE_DEFER), we need to properly unwind by decrementing the counter we just incremented and if this is the first core we failed to probe, remove the rocket DRM device with rocket_device_

CVE-2022-48820 [HIGH] CVE-2022-48820: linux - In the Linux kernel, the following vulnerability has been resolved: phy: stm32:... In the Linux kernel, the following vulnerability has been resolved: phy: stm32: fix a refcount leak in stm32_usbphyc_pll_enable() This error path needs to decrement "usbphyc->n_pll_cons.counter" before returning. Scope: local bookworm: resolved (fixed in 5.16.10-1) bullseye: resolved forky: resolved (fixed in 5.16.10-1) sid: resolved (fixed in 5.16.10-1) trixie: resol

CVE-2019-3874 [MEDIUM] CVE-2019-3874: linux - The SCTP socket buffer used by a userspace application is not accounted by the c... The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a denial of service attack. Kernel 3.10.x and 4.18.x branches are believed to be vulnerable. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved (fixed in 5.2.6-1) sid: resolved (f

CVE-2022-49278 [HIGH] CVE-2022-49278: linux - In the Linux kernel, the following vulnerability has been resolved: remoteproc:... In the Linux kernel, the following vulnerability has been resolved: remoteproc: Fix count check in rproc_coredump_write() Check count for 0, to avoid a potential underflow. Make the check the same as the one in rproc_recovery_write(). Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed in 5.17.3-1) sid: r

CVE-2023-52571 [HIGH] CVE-2023-52571: linux - In the Linux kernel, the following vulnerability has been resolved: power: supp... In the Linux kernel, the following vulnerability has been resolved: power: supply: rk817: Fix node refcount leak Dan Carpenter reports that the Smatch static checker warning has found that there is another refcount leak in the probe function. While of_node_put() was added in one of the return paths, it should in fact be added for ALL return paths that return an error

CVE-2017-18202 [HIGH] CVE-2017-18202: linux - The __oom_reap_task_mm function in mm/oom_kill.c in the Linux kernel before 4.14... The __oom_reap_task_mm function in mm/oom_kill.c in the Linux kernel before 4.14.4 mishandles gather operations, which allows attackers to cause a denial of service (TLB entry leak or use-after-free) or possibly have unspecified other impact by triggering a copy_to_user call within a certain time window. Scope: local bookworm: resolved (fixed in 4.14.7-1) bullseye: re

CVE-2013-4511 [MEDIUM] CVE-2013-4511: linux - Multiple integer overflows in Alchemy LCD frame-buffer drivers in the Linux kern... Multiple integer overflows in Alchemy LCD frame-buffer drivers in the Linux kernel before 3.12 allow local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted mmap operations, related to the (1) au1100fb_fb_mmap function in drivers/video/au1100fb.c and the (2) au1200fb_fb_mmap function in drivers

CVE-2013-4470 [MEDIUM] CVE-2013-4470: linux - The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, d... The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDP_CORK option in a setsockopt system call and sends both short and long pack

CVE-2017-18249 [HIGH] CVE-2017-18249: linux - The add_free_nid function in fs/f2fs/node.c in the Linux kernel before 4.12 does... The add_free_nid function in fs/f2fs/node.c in the Linux kernel before 4.12 does not properly track an allocated nid, which allows local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads. Scope: local bookworm: resolved (fixed in 4.12.6-1) bullseye: resolved (fixed in 4.12.6-1) forky: resolved (fixed i

CVE-2015-7613 [MEDIUM] CVE-2015-7613: linux - Race condition in the IPC object implementation in the Linux kernel through 4.2.... Race condition in the IPC object implementation in the Linux kernel through 4.2.3 allows local users to gain privileges by triggering an ipc_addid call that leads to uid and gid comparisons against uninitialized data, related to msg.c, shm.c, and util.c. Scope: local bookworm: resolved (fixed in 4.2.3-1) bullseye: resolved (fixed in 4.2.3-1) forky: resolved (fixed in