Debian Linux vulnerabilities

CVE-2022-50333 [HIGH] CVE-2022-50333: linux - In the Linux kernel, the following vulnerability has been resolved: fs: jfs: fi... In the Linux kernel, the following vulnerability has been resolved: fs: jfs: fix shift-out-of-bounds in dbDiscardAG This should be applied to most URSAN bugs found recently by syzbot, by guarding the dbMount. As syzbot feeding rubbish into the bmap descriptor. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (

CVE-2017-11600 [HIGH] CVE-2017-11600: linux - net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGR... net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message. Scope: local bookworm: r

CVE-2021-4460 [HIGH] CVE-2021-4460: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd:... In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix UBSAN shift-out-of-bounds warning If get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up doing a shift operation where the number of bits shifted equals number of bits in the operand. This behaviour is undefined. Set num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if t

CVE-2025-39744 [HIGH] CVE-2025-39744: linux - In the Linux kernel, the following vulnerability has been resolved: rcu: Fix rc... In the Linux kernel, the following vulnerability has been resolved: rcu: Fix rcu_read_unlock() deadloop due to IRQ work During rcu_read_unlock_special(), if this happens during irq_exit(), we can lockup if an IPI is issued. This is because the IPI itself triggers the irq_exit() path causing a recursive lock up. This is precisely what Xiongfeng found when invoking a BP

CVE-2017-7477 [HIGH] CVE-2017-7477: linux - Heap-based buffer overflow in drivers/net/macsec.c in the MACsec module in the L... Heap-based buffer overflow in drivers/net/macsec.c in the MACsec module in the Linux kernel through 4.10.12 allows attackers to cause a denial of service or possibly have unspecified other impact by leveraging the use of a MAX_SKB_FRAGS+1 size in conjunction with the NETIF_F_FRAGLIST feature, leading to an error in the skb_to_sgvec function. Scope: local bookworm: resol

CVE-2026-23187 [HIGH] CVE-2026-23187: linux - In the Linux kernel, the following vulnerability has been resolved: pmdomain: i... In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains Fix out-of-range access of bc->domains in imx8m_blk_ctrl_remove(). Scope: local bookworm: resolved (fixed in 6.1.164-1) bullseye: resolved forky: resolved (fixed in 6.18.10-1) sid: resolved (fixed in 6.18.10-1) trixie: resolved (fixed in

CVE-2013-4387 [MEDIUM] CVE-2013-4387: linux - net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly deter... net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP Fragmentation Offload (UFO) processing of small packets after the UFO queueing of a large packet, which allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via network traffic that trigger

CVE-2019-13631 [MEDIUM] CVE-2019-13631: linux - In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kerne... In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved (fixed in 5.2.6-1) sid: resolved (fixed in

CVE-2017-6874 [HIGH] CVE-2017-6874: linux - Race condition in kernel/ucount.c in the Linux kernel through 4.10.2 allows loca... Race condition in kernel/ucount.c in the Linux kernel through 4.10.2 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls that leverage certain decrement behavior that causes incorrect interaction between put_ucounts and get_ucounts. Scope: local bookworm: resolved (fixed in

CVE-2019-14283 [MEDIUM] CVE-2019-14283: linux - In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does no... In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default. Scope: local bookworm: resolved (fixed in 5.2.6-1)

CVE-2024-39492 [HIGH] CVE-2024-39492: linux - In the Linux kernel, the following vulnerability has been resolved: mailbox: mt... In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-cmdq: Fix pm_runtime_get_sync() warning in mbox shutdown The return value of pm_runtime_get_sync() in cmdq_mbox_shutdown() will return 1 when pm runtime state is active, and we don't want to get the warning message in this case. So we change the return value < 0 for WARN_ON(). Scope: loca

CVE-2020-15436 [MEDIUM] CVE-2020-15436: linux - Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 al... Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field. Scope: local bookworm: resolved (fixed in 5.7.6-1) bullseye: resolved (fixed in 5.7.6-1) forky: resolved (fixed in 5.7.6-1) sid: resolved (fixed in 5.7.6-1) trixie: re

CVE-2014-3182 [MEDIUM] CVE-2014-3182: linux - Array index error in the logi_dj_raw_event function in drivers/hid/hid-logitech-... Array index error in the logi_dj_raw_event function in drivers/hid/hid-logitech-dj.c in the Linux kernel before 3.16.2 allows physically proximate attackers to execute arbitrary code or cause a denial of service (invalid kfree) via a crafted device that provides a malformed REPORT_TYPE_NOTIF_DEVICE_UNPAIRED value. Scope: local bookworm: resolved (fixed in 3.16.2-2) bu

CVE-2022-49919 [HIGH] CVE-2022-49919: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flow rule object from commit path No need to postpone this to the commit release path, since no packets are walking over this object, this is accessed from control plane only. This helped uncovered UAF triggered by races with the netlink notifier. Scope: local bookworm: r

CVE-2021-33656 [MEDIUM] CVE-2021-33656: linux - When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write mem... When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.127-1) forky: resolved (fixed in 5.14.6-1) sid: resolved (fixed in 5.14.6-1) trixie: resolved (fixed in 5.14.6-1)

CVE-2019-19532 [MEDIUM] CVE-2019-19532: linux - In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs th... In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs that can be caused by a malicious USB device in the Linux kernel HID drivers, aka CID-d9d4b1e46d95. This affects drivers/hid/hid-axff.c, drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c, drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c, drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c, driv

CVE-2019-19527 [MEDIUM] CVE-2019-19527: linux - In the Linux kernel before 5.2.10, there is a use-after-free bug that can be cau... In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/hid/usbhid/hiddev.c driver, aka CID-9c09b214f30e. Scope: local bookworm: resolved (fixed in 5.2.17-1) bullseye: resolved (fixed in 5.2.17-1) forky: resolved (fixed in 5.2.17-1) sid: resolved (fixed in 5.2.17-1) trixie: resolved (fixed in 5.2.1

CVE-2020-12770 [MEDIUM] CVE-2020-12770: linux - An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg... An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a certain failure case, aka CID-83c6f2390040. Scope: local bookworm: resolved (fixed in 5.6.14-1) bullseye: resolved (fixed in 5.6.14-1) forky: resolved (fixed in 5.6.14-1) sid: resolved (fixed in 5.6.14-1) trixie: resolved (fixed in 5.6.14-1)

CVE-2020-0465 [MEDIUM] CVE-2020-0465: linux - In various methods of hid-multitouch.c, there is a possible out of bounds write ... In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-162844689References: Upstream kernel Scope: local bookworm:

CVE-2018-1068 [MEDIUM] CVE-2018-1068: linux - A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall inte... A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory. Scope: local bookworm: resolved (fixed in 4.15.11-1) bullseye: resolved (fixed in 4.15.11-1) forky: resolved (fixed in 4.15.11-1) sid: resolved (fixed in 4.15.11-1) trixie: resolved