Debian Linux vulnerabilities

CVE-2022-1199 [HIGH] CVE-2022-1199: linux - A flaw was found in the Linux kernel. This flaw allows an attacker to crash the ... A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free vulnerability. Scope: local bookworm: resolved (fixed in 5.16.18-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed in 5.16.18-1) sid: resolved (fixe

CVE-2021-3347 [HIGH] CVE-2021-3347: linux - An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a k... An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458. Scope: local bookworm: resolved (fixed in 5.10.12-1) bullseye: resolved (fixed in 5.10.12-1) forky: resolved (fixed in 5.10.12-1) sid: resolved (fixed in 5.10.12-1) tri

CVE-2026-31788 [HIGH] CVE-2026-31788: linux - In the Linux kernel, the following vulnerability has been resolved: xen/privcmd... In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: restrict usage in unprivileged domU The Xen privcmd driver allows to issue arbitrary hypercalls from user space processes. This is normally no problem, as access is usually limited to root and the hypervisor will deny any hypercalls affecting other domains. In case the guest is booted usi

CVE-2014-0101 [HIGH] CVE-2014-0101: linux - The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel t... The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH c

CVE-2022-3910 [HIGH] CVE-2022-3910: linux - Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An imp... Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in io_uring leads to Use-After-Free and Local Privilege Escalation. When io_msg_ring was invoked with a fixed file, it called io_fput_file() which improperly decreased its reference count (leading to Use-After-Free and Local Privilege Escalation). Fixed files

CVE-2023-1829 [HIGH] CVE-2023-1829: linux - A use-after-free vulnerability in the Linux Kernel traffic control index filter ... A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure. A local attacker user can use thi

CVE-2020-10757 [HIGH] CVE-2020-10757: linux - A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap... A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.6.14-2) bullseye: resolved (fixed in 5.6.14-2) forky: resolved (fixed in 5.6.14-2) sid: resolved (fixed in

CVE-2021-47478 [MEDIUM] CVE-2021-47478: linux - In the Linux kernel, the following vulnerability has been resolved: isofs: Fix ... In the Linux kernel, the following vulnerability has been resolved: isofs: Fix out of bound access for corrupted isofs image When isofs image is suitably corrupted isofs_read_inode() can read data beyond the end of buffer. Sanity-check the directory entry length before using it. Scope: local bookworm: resolved (fixed in 5.15.3-1) bullseye: resolved (fixed in 5.10.84

CVE-2016-7039 [HIGH] CVE-2016-7039: linux - The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause ... The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers, a related issue to CVE-2016-8666. Scope: local bookworm: resolved (fixed in 4.7.

CVE-2024-49996 [HIGH] CVE-2024-49996: linux - In the Linux kernel, the following vulnerability has been resolved: cifs: Fix b... In the Linux kernel, the following vulnerability has been resolved: cifs: Fix buffer overflow when parsing NFS reparse points ReparseDataLength is sum of the InodeType size and DataBuffer size. So to get DataBuffer size it is needed to subtract InodeType's size from ReparseDataLength. Function cifs_strndup_from_utf16() is currentlly accessing buf->DataBuffer at positi

CVE-2014-0100 [CRITICAL] CVE-2014-0100: linux - Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in t... Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in the Linux kernel through 3.13.6 allows remote attackers to cause a denial of service (use-after-free error) or possibly have unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with a heavy CPU load. Scope: local bookworm: resolved (fixed in 3.1

CVE-2025-38488 [HIGH] CVE-2025-38488: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in crypt_message when using async crypto The CVE-2024-50047 fix removed asynchronous crypto handling from crypt_message(), assuming all crypto operations are synchronous. However, when hardware crypto accelerators are used, this can cause use-after-free crashes: crypt_m

CVE-2024-56626 [HIGH] CVE-2024-56626: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write An offset from client could be a negative value, It could allows to write data outside the bounds of the allocated buffer. Note that this issue is coming when setting 'vfs objects = streams_xattr parameter' in ksmbd.conf. Scope: local bookworm:

CVE-2022-49362 [HIGH] CVE-2022-49362: linux - In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix p... In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix potential use-after-free in nfsd_file_put() nfsd_file_put_noref() can free @nf, so don't dereference @nf immediately upon return from nfsd_file_put_noref(). Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved (fixed in 5.10.221-1) forky: resolved (fixed in 5.18.5-1) sid: r

CVE-2023-0461 [HIGH] CVE-2023-0461: linux - There is a use-after-free vulnerability in the Linux Kernel which can be exploit... There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONF

CVE-2024-35969 [MEDIUM] CVE-2024-35969: linux - In the Linux kernel, the following vulnerability has been resolved: ipv6: fix r... In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item that got removed from the list. The memory itself of such item is not freed thanks to RCU but nothing guaran

CVE-2022-20421 [HIGH] CVE-2022-20421: linux - In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memor... In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239630375References: Upstream kernel Scope: local bookworm: reso

CVE-2019-14835 [HIGH] CVE-2019-14835: linux - A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way L... A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the

CVE-2023-31436 [HIGH] CVE-2023-31436: linux - qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows... qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX. Scope: local bookworm: resolved (fixed in 6.1.27-1) bullseye: resolved (fixed in 5.10.179-1) forky: resolved (fixed in 6.1.27-1) sid: resolved (fixed in 6.1.27-1) trixie: resolved (fixed in 6.1.27-1)

CVE-2023-4206 [HIGH] CVE-2023-4206: linux - A use-after-free vulnerability in the Linux kernel's net/sched: cls_route compon... A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always