Debian Linux vulnerabilities

CVE-2014-0101 [HIGH] CVE-2014-0101: linux - The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel t... The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH c

CVE-2023-1829 [HIGH] CVE-2023-1829: linux - A use-after-free vulnerability in the Linux Kernel traffic control index filter ... A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure. A local attacker user can use thi

CVE-2022-3910 [HIGH] CVE-2022-3910: linux - Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An imp... Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in io_uring leads to Use-After-Free and Local Privilege Escalation. When io_msg_ring was invoked with a fixed file, it called io_fput_file() which improperly decreased its reference count (leading to Use-After-Free and Local Privilege Escalation). Fixed files

CVE-2020-10757 [HIGH] CVE-2020-10757: linux - A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap... A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.6.14-2) bullseye: resolved (fixed in 5.6.14-2) forky: resolved (fixed in 5.6.14-2) sid: resolved (fixed in

CVE-2016-7039 [HIGH] CVE-2016-7039: linux - The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause ... The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers, a related issue to CVE-2016-8666. Scope: local bookworm: resolved (fixed in 4.7.

CVE-2022-50386 [HIGH] CVE-2022-50386: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref *kref) Bluetooth: chan 0000000023c4974d Bluetooth: parent 00000000ae861c08 ============

CVE-2020-14381 [HIGH] CVE-2020-14381: linux - A flaw was found in the Linux kernel’s futex implementation. This flaw allows a ... A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory or escalate their privileges when creating a futex on a filesystem that is about to be unmounted. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Scope: local bookworm: resolved (fixed in 5

CVE-2022-1679 [HIGH] CVE-2022-1679: linux - A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter d... A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved (fixed in 5.10.140-1)

CVE-2023-0045 [MEDIUM] CVE-2023-0045: linux - The current implementation of the prctl syscall does not issue an IBPB immediate... The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnera

CVE-2019-14835 [HIGH] CVE-2019-14835: linux - A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way L... A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the

CVE-2021-38300 [HIGH] CVE-2021-38300: linux - arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirab... arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when transforming unprivileged cBPF programs, allowing execution of arbitrary code within the kernel context. This occurs because conditional branches can exceed the 128 KB limit of the MIPS architecture. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolve

CVE-2025-38488 [HIGH] CVE-2025-38488: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in crypt_message when using async crypto The CVE-2024-50047 fix removed asynchronous crypto handling from crypt_message(), assuming all crypto operations are synchronous. However, when hardware crypto accelerators are used, this can cause use-after-free crashes: crypt_m

CVE-2023-4206 [HIGH] CVE-2023-4206: linux - A use-after-free vulnerability in the Linux kernel's net/sched: cls_route compon... A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always

CVE-2023-40283 [HIGH] CVE-2023-40283: linux - An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in t... An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled. Scope: local bookworm: resolved (fixed in 6.1.52-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 6.4.11-1) sid: resolved (fixed in 6.4.11-1) trixie: resolved (fixed

CVE-2021-4197 [HIGH] CVE-2021-4197: linux - An unprivileged write to the file handler flaw in the Linux kernel's control gro... An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of control groups. A local user could use this flaw to crash the

CVE-2023-3776 [HIGH] CVE-2023-3776: linux - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component... A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can c

CVE-2023-5345 [HIGH] CVE-2023-5345: linux - A use-after-free vulnerability in the Linux kernel's fs/smb/client component can... A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation. In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead to double free. We recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705. Scope: local bookwo

CVE-2022-4744 [HIGH] CVE-2022-4744: linux - A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functio... A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw allows a local user to crash or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved (fixed in 5.

CVE-2025-38734 [HIGH] CVE-2025-38734: linux - In the Linux kernel, the following vulnerability has been resolved: net/smc: fi... In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on smcsk after smc_listen_out() BPF CI testing report a UAF issue: [ 16.446633] BUG: kernel NULL pointer dereference, address: 000000000000003 0 [ 16.447134] #PF: supervisor read access in kernel mod e [ 16.447516] #PF: error_code(0x0000) - not-present pag e [ 16.447878] PGD 0 P4D 0 [

CVE-2022-36946 [HIGH] CVE-2022-36946: linux - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18... nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len. Scope: local bookworm: resolved (fixed in 5.18.16-1) bullseye: resolved (fixed in 5.10.136-1)