Debian Linux vulnerabilities

CVE-2024-28956 [MEDIUM] CVE-2024-28956: intel-microcode - Exposure of Sensitive Information in Shared Microarchitectural Structures during... Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Scope: local bookworm: resolved (fixed in 3.20250512.1~deb12u1) bullseye: resolved (fixed in 3.20250512.1~deb11u1) forky: resolved (f

CVE-2019-11091 [MEDIUM] CVE-2019-11091: intel-microcode - Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory ... Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents

CVE-2016-4569 [MEDIUM] CVE-2016-4569: linux - The snd_timer_user_params function in sound/core/timer.c in the Linux kernel thr... The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface. Scope: local bookworm: resolved (fixed in 4.5.5-1) bullseye: resolved (fixed in 4.5.5-1) forky: resolved (fi

CVE-2014-0077 [MEDIUM] CVE-2014-0077: linux - drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers a... drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions. Scope: local bookworm:

CVE-2020-27825 [MEDIUM] CVE-2020-27825: linux - A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (b... A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel information leak threat. Scope: local boo

CVE-2021-47168 [MEDIUM] CVE-2021-47168: linux - In the Linux kernel, the following vulnerability has been resolved: NFS: fix an... In the Linux kernel, the following vulnerability has been resolved: NFS: fix an incorrect limit in filelayout_decode_layout() The "sizeof(struct nfs_fh)" is two bytes too large and could lead to memory corruption. It should be NFS_MAXFHSIZE because that's the size of the ->data[] buffer. I reversed the size of the arguments to put the variable on the left. Scope: lo

CVE-2019-19039 [MEDIUM] CVE-2019-19039: linux - __btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12... __btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program. NOTE: The BTRFS development team disputes this issues as not being a vulnerability because “1) The kernel provide facilities

CVE-2019-7222 [MEDIUM] CVE-2019-7222: linux - The KVM implementation in the Linux kernel through 4.20.5 has an Information Lea... The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak. Scope: local bookworm: resolved (fixed in 4.19.20-1) bullseye: resolved (fixed in 4.19.20-1) forky: resolved (fixed in 4.19.20-1) sid: resolved (fixed in 4.19.20-1) trixie: resolved (fixed in 4.19.20-1)

CVE-2022-49075 [MEDIUM] CVE-2022-49075: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix ... In the Linux kernel, the following vulnerability has been resolved: btrfs: fix qgroup reserve overflow the qgroup limit We use extent_changeset->bytes_changed in qgroup_reserve_data() to record how many bytes we set for EXTENT_QGROUP_RESERVED state. Currently the bytes_changed is set as "unsigned int", and it will overflow if we try to fallocate a range larger than

CVE-2019-11833 [MEDIUM] CVE-2019-11833: linux - fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused... fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem. Scope: local bookworm: resolved (fixed in 4.19.37-4) bullseye: resolved (fixed in 4.19.37-4) forky: resolved (fixed in 4.19.37-4) sid: r

CVE-2019-3887 [MEDIUM] CVE-2019-3887: linux - A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregi... A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Kernel versions from 4.16 and

CVE-2020-14390 [MEDIUM] CVE-2020-14390: linux - A flaw was found in the Linux kernel in versions before 5.9-rc6. When changing s... A flaw was found in the Linux kernel in versions before 5.9-rc6. When changing screen size, an out-of-bounds memory write can occur leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Scope: local bookworm: resolved (fixed in 5.8.10-1) bullseye: resolved (fixed in 5.8.10-1) forky: resolv

CVE-2021-47587 [MEDIUM] CVE-2021-47587: linux - In the Linux kernel, the following vulnerability has been resolved: net: system... In the Linux kernel, the following vulnerability has been resolved: net: systemport: Add global locking for descriptor lifecycle The descriptor list is a shared resource across all of the transmit queues, and the locking mechanism used today only protects concurrency across a given transmit queue between the transmit and reclaiming. This creates an opportunity for t

CVE-2021-34693 [MEDIUM] CVE-2021-34693: linux - net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain s... net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. Scope: local bookworm: resolved (fixed in 5.10.46-1) bullseye: resolved (fixed in 5.10.46-1) forky: resolved (fixed in 5.10.46-1) sid: resolved (fixed in 5.10.46-1) trixie: resolved (fixed

CVE-2020-0427 [MEDIUM] CVE-2020-0427: linux - In create_pinctrl of core.c, there is a possible out of bounds read due to a use... In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-140550171 Scope: local bookworm: resolved (fixed in 5.4.8-1) bullseye: resolved

CVE-2026-23003 [MEDIUM] CVE-2026-23003: linux - In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel:... In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1]. Use skb_vlan_inet_prepare() instead of pskb_inet_may_pull(). [1] BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMS

CVE-2020-8832 [MEDIUM] CVE-2020-8832: linux - The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux ... The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux kernel did not properly clear data structures on context switches for certain Intel graphics processors.") was discovered to be incomplete, meaning that in versions of the kernel before 4.15.0-91.92, an attacker could use this vulnerability to expose sensitive information. Scope: local boo

CVE-2025-22059 [MEDIUM] CVE-2025-22059: linux - In the Linux kernel, the following vulnerability has been resolved: udp: Fix mu... In the Linux kernel, the following vulnerability has been resolved: udp: Fix multiple wraparounds of sk->sk_rmem_alloc. __udp_enqueue_schedule_skb() has the following condition: if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) goto drop; sk->sk_rcvbuf is initialised by net.core.rmem_default and later can be configured by SO_RCVBUF, which is limited by net.core.r

CVE-2022-1198 [MEDIUM] CVE-2022-1198: linux - A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c ... A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space. Scope: local bookworm: resolved (fixed in 5.16.18-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed in 5.16.18-1) sid: resolved (fixed in 5.16.18-1) trixie:

CVE-2021-34556 [MEDIUM] CVE-2021-34556: linux - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensi... In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack. Scope: local bookworm: resolved (fixed in 5.10.46-4) bullseye: resolved (fixed in 5.10.46-4