Debian Linux vulnerabilities

CVE-2023-53538 [MEDIUM] CVE-2023-53538: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: inse... In the Linux kernel, the following vulnerability has been resolved: btrfs: insert tree mod log move in push_node_left There is a fairly unlikely race condition in tree mod log rewind that can result in a kernel panic which has the following trace: [530.569] BTRFS critical (device sda3): unable to find logical 0 length 4096 [530.585] BTRFS critical (device sda3): una

CVE-2024-45004 [MEDIUM] CVE-2024-45004: linux - In the Linux kernel, the following vulnerability has been resolved: KEYS: trust... In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix leak of blob encryption key Trusted keys unseal the key blob on load, but keep the sealed payload in the blob field so that every subsequent read (export) will simply convert this field to hex and send it to userspace. With DCP-based trusted keys, we decrypt the blob encrypti

CVE-2018-16862 [MEDIUM] CVE-2018-16862: linux - A security flaw was found in the Linux kernel in a way that the cleancache subsy... A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one. Scope: local bookworm: resolved (fixed in 4.19.9-1) bullseye: resolved (fixed in 4.19.9-1) for

CVE-2020-35513 [MEDIUM] CVE-2020-35513: linux - A flaw incorrect umask during file or directory modification in the Linux kernel... A flaw incorrect umask during file or directory modification in the Linux kernel NFS (network file system) functionality was found in the way user create and delete object using NFSv4.2 or newer if both simultaneously accessing the NFS by the other process that is not using new NFSv4.2. A user with access to the NFS could use this flaw to starve the resources causin

CVE-2022-50778 CVE-2022-50778: linux - In the Linux kernel, the following vulnerability has been resolved: fortify: Fi... In the Linux kernel, the following vulnerability has been resolved: fortify: Fix __compiletime_strlen() under UBSAN_BOUNDS_LOCAL With CONFIG_FORTIFY=y and CONFIG_UBSAN_LOCAL_BOUNDS=y enabled, we observe a runtime panic while running Android's Compatibility Test Suite's (CTS) android.hardware.input.cts.tests. This is stemming from a strlen() call in hidinput_allocate(). __com

CVE-2025-40341 CVE-2025-40341: linux - In the Linux kernel, the following vulnerability has been resolved: futex: Don'... In the Linux kernel, the following vulnerability has been resolved: futex: Don't leak robust_list pointer on exec race sys_get_robust_list() and compat_get_robust_list() use ptrace_may_access() to check if the calling task is allowed to access another task's robust_list pointer. This check is racy against a concurrent exec() in the target process. During exec(), a task may t

CVE-2022-50876 CVE-2022-50876: linux - In the Linux kernel, the following vulnerability has been resolved: usb: musb: ... In the Linux kernel, the following vulnerability has been resolved: usb: musb: Fix musb_gadget.c rxstate overflow bug The usb function device call musb_gadget_queue() adds the passed request to musb_ep::req_list,If the (request->length > musb_ep->packet_sz) and (is_buffer_mapped(req) return false),the rxstate() will copy all data in fifo to request->buf which may cause reque

CVE-2025-40246 [LOW] CVE-2025-40246: linux - In the Linux kernel, the following vulnerability has been resolved: xfs: fix ou... In the Linux kernel, the following vulnerability has been resolved: xfs: fix out of bounds memory read error in symlink repair xfs/286 produced this report on my test fleet: ================================================================== BUG: KFENCE: out-of-bounds read in memcpy_orig+0x54/0x110 Out-of-bounds read at 0xffff88843fe9e038 (184B right of kfence-#184): me

CVE-2025-40275 CVE-2025-40275: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-a... In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd In snd_usb_create_streams(), for UAC version 3 devices, the Interface Association Descriptor (IAD) is retrieved via usb_ifnum_to_if(). If this call fails, a fallback routine attempts to obtain the IAD from the next interface and set

CVE-2025-40071 CVE-2025-40071: linux - In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm:... In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: Don't block input queue by waiting MSC Currently gsm_queue() processes incoming frames and when opening a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update(). If basic mode is used it calls gsm_modem_upd_via_msc() and it cannot block the input queue by waiting the response to come

CVE-2025-68788 CVE-2025-68788: linux - In the Linux kernel, the following vulnerability has been resolved: fsnotify: d... In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users with no read access to a file to subscribe to events (e.g. IN_ACCESS/IN_MODIFY), but they do allow the same user to subscribe for watching events on children when the user has access to the parent di

CVE-2026-23050 CVE-2026-23050: linux - In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix a... In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix a deadlock when returning a delegation during open() Ben Coddington reports seeing a hang in the following stack trace: 0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415 1 [ffffd0b50e177548] schedule at ffffffff9ca05717 2 [ffffd0b50e177558] bit_wait at ffffffff9ca061e1 3 [ffffd0b50e177568] __wait

CVE-2025-68378 CVE-2025-68378: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix st... In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check in __bpf_get_stackid() Syzkaller reported a KASAN slab-out-of-bounds write in __bpf_get_stackid() when copying stack trace data. The issue occurs when the perf trace contains more stack entries than the stack map bucket can hold, leading to an out-of-bounds write in the bucke

CVE-2013-1797 [MEDIUM] CVE-2013-1797: linux - Use-after-free vulnerability in arch/x86/kvm/x86.c in the Linux kernel through 3... Use-after-free vulnerability in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 allows guest OS users to cause a denial of service (host OS memory corruption) or possibly have unspecified other impact via a crafted application that triggers use of a guest physical address (GPA) in (1) movable or (2) removable memory during an MSR_KVM_SYSTEM_TIME kvm_set_msr_commo

CVE-2013-6383 [MEDIUM] CVE-2013-6383: linux - The aac_compat_ioctl function in drivers/scsi/aacraid/linit.c in the Linux kerne... The aac_compat_ioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not require the CAP_SYS_RAWIO capability, which allows local users to bypass intended access restrictions via a crafted ioctl call. Scope: local bookworm: resolved (fixed in 3.11.8-1) bullseye: resolved (fixed in 3.11.8-1) forky: resolved (fixed in 3.11.8-1) sid: resol

CVE-2013-1929 [MEDIUM] CVE-2013-1929: linux - Heap-based buffer overflow in the tg3_read_vpd function in drivers/net/ethernet/... Heap-based buffer overflow in the tg3_read_vpd function in drivers/net/ethernet/broadcom/tg3.c in the Linux kernel before 3.8.6 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via crafted firmware that specifies a long string in the Vital Product Data (VPD) data structure. Scope: local bookworm: reso

CVE-2015-8553 [LOW] CVE-2015-8553: linux - Xen allows guest OS users to obtain sensitive information from uninitialized loc... Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control bits. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0777. Scope: local bookworm: resolved (fixed in 4.19.37-1) bullseye: resolved (fixed in 4.19.37-1) forky: resolved (fixed in 4.19.37-

CVE-2022-42432 [MEDIUM] CVE-2022-42432: linux - This vulnerability allows local attackers to disclose sensitive information on a... This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the nft_osf_eval function. The issue results from the lack of proper i

CVE-2014-9529 [MEDIUM] CVE-2014-9529: linux - Race condition in the key_gc_unused_keys function in security/keys/gc.c in the L... Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key structure member during garbage collection of a key. Scope: local bookworm: resolved (fixed in

CVE-2014-9710 [MEDIUM] CVE-2014-9710: linux - The Btrfs implementation in the Linux kernel before 3.19 does not ensure that th... The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window, related to a race condition, or (2) after an xattr-replacement atte