Debian Linux vulnerabilities

CVE-2020-10766 [MEDIUM] CVE-2020-10766: linux - A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation ... A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top

CVE-2023-52699 [MEDIUM] CVE-2023-52699: linux - In the Linux kernel, the following vulnerability has been resolved: sysv: don't... In the Linux kernel, the following vulnerability has been resolved: sysv: don't call sb_bread() with pointers_lock held syzbot is reporting sleep in atomic context in SysV filesystem [1], for sb_bread() is called with rw_spinlock held. A "write_lock(&pointers_lock) => read_lock(&pointers_lock) deadlock" bug and a "sb_bread() with write_lock(&pointers_lock)" bug were

CVE-2020-10942 [MEDIUM] CVE-2020-10942: linux - In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks va... In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls. Scope: local bookworm: resolved (fixed in 5.5.13-1) bullseye: resolved (fixed in 5.5.13-1) forky: resolved (fixed in 5.5.13-1) sid: resolved (fixed in 5.5.13-1) trixie

CVE-2020-12912 [MEDIUM] CVE-2020-12912: linux - A potential vulnerability in the AMD extension to Linux "hwmon" service may allo... A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit (RAPL) interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require privileged access. Scope: local bookworm: resolved (fixed in 5.9.9-1) bullseye: resolved (

CVE-2022-3523 [MEDIUM] CVE-2022-3523: linux - A vulnerability was found in Linux Kernel. It has been classified as problematic... A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown function of the file mm/memory.c of the component Driver Handler. The manipulation leads to use after free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211020. Scope

CVE-2022-0382 [MEDIUM] CVE-2022-0382: linux - An information leak flaw was found due to uninitialized memory in the Linux kern... An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem, in the way a user sends a TIPC datagram to one or more destinations. This flaw allows a local user to read some kernel memory. This issue is limited to no more than 7 bytes, and the user cannot control what is read. This flaw affects the Linux kernel versions

CVE-2020-10767 [MEDIUM] CVE-2020-10767: linux - A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the... A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation (IBRS) is available. This flaw allows a local attacker to perform a Spectre V2 style attack when this configur

CVE-2025-39770 [MEDIUM] CVE-2025-39770: linux - In the Linux kernel, the following vulnerability has been resolved: net: gso: F... In the Linux kernel, the following vulnerability has been resolved: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM When performing Generic Segmentation Offload (GSO) on an IPv6 packet that contains extension headers, the kernel incorrectly requests checksum offload if the egress device only advertises NETIF_F_IPV6_CSUM feature, which has a

CVE-2024-26731 [MEDIUM] CVE-2024-26731: linux - In the Linux kernel, the following vulnerability has been resolved: bpf, sockma... In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready() syzbot reported the following NULL pointer dereference issue [1]: BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:0x0 [...] Call Trace: sk_psock_verdict_data_ready+0x232/0x340 net/core/skmsg.c

CVE-2021-31829 [MEDIUM] CVE-2021-31829: linux - kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable sp... kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading to disclosure of stack content via side-channel attacks, aka CID-801c6058d14a. The specific concern is not protecting the BPF stack area against speculative loads. Also, the BPF stack can contain uninitialized data that might represent sensitive information previ

CVE-2023-0597 [MEDIUM] CVE-2023-0597: linux - A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of ... A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exception stack(s) or other important data. A local user could use this flaw to get access to some important data with expected location in memory. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 6.

CVE-2023-52738 [MEDIUM] CVE-2023-52738: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini Currently amdgpu calls drm_sched_fini() from the fence driver sw fini routine - such function is expected to be called only after the respective init function - drm_sched_init() - was executed successfully. Happens that we faced a dr

CVE-2021-47064 [MEDIUM] CVE-2021-47064: linux - In the Linux kernel, the following vulnerability has been resolved: mt76: fix p... In the Linux kernel, the following vulnerability has been resolved: mt76: fix potential DMA mapping leak With buf uninitialized in mt76_dma_tx_queue_skb_raw, its field skip_unmap could potentially inherit a non-zero value from stack garbage. If this happens, it will cause DMA mappings for MCU command frames to not be unmapped after completion Scope: local bookworm:

CVE-2023-3006 [MEDIUM] CVE-2023-3006: linux - A known cache speculation vulnerability, known as Branch History Injection (BHI)... A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's hardware context. Once th

CVE-2025-71128 [MEDIUM] CVE-2025-71128: linux - In the Linux kernel, the following vulnerability has been resolved: erspan: Ini... In the Linux kernel, the following vulnerability has been resolved: erspan: Initialize options_len before referencing options. The struct ip_tunnel_info has a flexible array member named options that is protected by a counted_by(options_len) attribute. The compiler will use this information to enforce runtime bounds checking deployed by FORTIFY_SOURCE string helpers

CVE-2023-1076 [MEDIUM] CVE-2023-1076: linux - A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID ... A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in f

CVE-2021-20320 [MEDIUM] CVE-2021-20320: linux - A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.... A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a local attacker with special user privilege can circumvent the verifier and may lead to a confidentiality problem. Scope: local bookworm: resolved (fixed in 5.14.9-1) bullseye: resolved (fixed in 5.10.70-1) forky: resolved (fixed in 5.14.9-1) sid: re

CVE-2024-50110 [MEDIUM] CVE-2024-50110: linux - In the Linux kernel, the following vulnerability has been resolved: xfrm: fix o... In the Linux kernel, the following vulnerability has been resolved: xfrm: fix one more kernel-infoleak in algo dumping During fuzz testing, the following issue was discovered: BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x598/0x2a30 _copy_to_iter+0x598/0x2a30 __skb_datagram_iter+0x168/0x1060 skb_copy_datagram_iter+0x5b/0x220 netlink_recvmsg+0x362/0x1700 sock_recvms

CVE-2024-44931 [MEDIUM] CVE-2024-44931: linux - In the Linux kernel, the following vulnerability has been resolved: gpio: preve... In the Linux kernel, the following vulnerability has been resolved: gpio: prevent potential speculation leaks in gpio_device_get_desc() Userspace may trigger a speculative read of an address outside the gpio descriptor array. Users can do that by calling gpio_ioctl() with an offset out of range. Offset is copied from user and then used as an array index to get the g

CVE-2024-50039 [MEDIUM] CVE-2024-50039: linux - In the Linux kernel, the following vulnerability has been resolved: net/sched: ... In the Linux kernel, the following vulnerability has been resolved: net/sched: accept TCA_STAB only for root qdisc Most qdiscs maintain their backlog using qdisc_pkt_len(skb) on the assumption it is invariant between the enqueue() and dequeue() handlers. Unfortunately syzbot can crash a host rather easily using a TBF + SFQ combination, with an STAB on SFQ [1] We can