Debian Linux vulnerabilities

CVE-2026-22976 [MEDIUM] CVE-2026-22976: linux - In the Linux kernel, the following vulnerability has been resolved: net/sched: ... In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset `qfq_class->leaf_qdisc->q.qlen > 0` does not imply that the class itself is active. Two qfq_class objects may point to the same leaf_qdisc. This happens when: 1. one QFQ qdisc is attached to the dev as the root qdis

CVE-2026-23094 [MEDIUM] CVE-2026-23094: linux - In the Linux kernel, the following vulnerability has been resolved: uacce: fix ... In the Linux kernel, the following vulnerability has been resolved: uacce: fix isolate sysfs check condition uacce supports the device isolation feature. If the driver implements the isolate_err_threshold_read and isolate_err_threshold_write callback functions, uacce will create sysfs files now. Users can read and configure the isolation policy through sysfs. Curren

CVE-2025-71104 [MEDIUM] CVE-2025-71104: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: x86: F... In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer When advancing the target expiration for the guest's APIC timer in periodic mode, set the expiration to "now" if the target expiration is in the past (similar to what is done in update_target_expiration()). Blindly adding

CVE-2021-47467 [MEDIUM] CVE-2021-47467: linux - In the Linux kernel, the following vulnerability has been resolved: kunit: fix ... In the Linux kernel, the following vulnerability has been resolved: kunit: fix reference count leak in kfree_at_end The reference counting issue happens in the normal path of kfree_at_end(). When kunit_alloc_and_get_resource() is invoked, the function forgets to handle the returned resource object, whose refcount increased inside, causing a refcount leak. Fix this i

CVE-2026-23198 [HIGH] CVE-2026-23198: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: Don't ... In the Linux kernel, the following vulnerability has been resolved: KVM: Don't clobber irqfd routing type when deassigning irqfd When deassigning a KVM_IRQFD, don't clobber the irqfd's copy of the IRQ's routing entry as doing so breaks kvm_arch_irq_bypass_del_producer() on x86 and arm64, which explicitly look for KVM_IRQ_ROUTING_MSI. Instead, to handle a concurrent ro

CVE-2019-20934 [MEDIUM] CVE-2019-20934: linux - An issue was discovered in the Linux kernel before 5.2.6. On NUMA systems, the L... An issue was discovered in the Linux kernel before 5.2.6. On NUMA systems, the Linux fair scheduler has a use-after-free in show_numa_stats() because NUMA fault statistics are inappropriately freed, aka CID-16d51a590a8c. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved (fixed in 5.2.6-1) sid: resolved (fixed in

CVE-2022-48761 [MEDIUM] CVE-2022-48761: linux - In the Linux kernel, the following vulnerability has been resolved: usb: xhci-p... In the Linux kernel, the following vulnerability has been resolved: usb: xhci-plat: fix crash when suspend if remote wake enable Crashed at i.mx8qm platform when suspend if enable remote wakeup Internal error: synchronous external abort: 96000210 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 244 Comm: kworker/u12:6 Not tainted 5.15.5-dirty #12 Hardware name: Frees

CVE-2022-48634 [MEDIUM] CVE-2022-48634: linux - In the Linux kernel, the following vulnerability has been resolved: drm/gma500:... In the Linux kernel, the following vulnerability has been resolved: drm/gma500: Fix BUG: sleeping function called from invalid context errors gma_crtc_page_flip() was holding the event_lock spinlock while calling crtc_funcs->mode_set_base() which takes ww_mutex. The only reason to hold event_lock is to clear gma_crtc->page_flip_event on mode_set_base() errors. Inste

CVE-2023-4155 [MEDIUM] CVE-2023-4155: linux - A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux k... A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the `VMGEXIT` handler recursively. If an attacker manages to call the handler multiple times, they can trigger a stack overflow and cause a denial of service or

CVE-2018-10876 [MEDIUM] CVE-2018-10876: linux - A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free i... A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image. Scope: local bookworm: resolved (fixed in 4.17.3-1) bullseye: resolved (fixed in 4.17.3-1) forky: resolved (fixed in 4.17.3-1) sid: resolved (fixed in 4.17.3-1) trixie: resolved (fixed in 4.1

CVE-2026-23139 [HIGH] CVE-2026-23139: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: update last_gc only when GC has been performed Currently last_gc is being updated everytime a new connection is tracked, that means that it is updated even if a GC wasn't performed. With a sufficiently high packet rate, it is possible to always bypass the GC, causing the list

CVE-2026-23136 [HIGH] CVE-2026-23136: linux - In the Linux kernel, the following vulnerability has been resolved: libceph: re... In the Linux kernel, the following vulnerability has been resolved: libceph: reset sparse-read state in osd_fault() When a fault occurs, the connection is abandoned, reestablished, and any pending operations are retried. The OSD client tracks the progress of a sparse-read reply using a separate state machine, largely independent of the messenger's state. If a connecti

CVE-2026-23148 [HIGH] CVE-2026-23148: linux - In the Linux kernel, the following vulnerability has been resolved: nvmet: fix ... In the Linux kernel, the following vulnerability has been resolved: nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference There is a race condition in nvmet_bio_done() that can cause a NULL pointer dereference in blk_cgroup_bio_start(): 1. nvmet_bio_done() is called when a bio completes 2. nvmet_req_complete() is called, which invokes req->ops->queue

CVE-2021-33624 [MEDIUM] CVE-2021-33624: linux - In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mis... In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db. Scope: local bookworm: resolved (fixed in 5.10.46-1) bullseye: resolved (fixed in 5.10.46-1) forky: resolved (fixe

CVE-2016-0821 [MEDIUM] CVE-2016-0821: linux - The LIST_POISON feature in include/linux/poison.h in the Linux kernel before 4.3... The LIST_POISON feature in include/linux/poison.h in the Linux kernel before 4.3, as used in Android 6.0.1 before 2016-03-01, does not properly consider the relationship to the mmap_min_addr value, which makes it easier for attackers to bypass a poison-pointer protection mechanism by triggering the use of an uninitialized list entry, aka Android internal bug 26186802,

CVE-2015-2925 [MEDIUM] CVE-2015-2925: linux - The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does n... The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack." Scope: local bookworm: resolved (fixed in 4.2.1-1) bullseye: resolved (fixed in 4.2.1-1) forky:

CVE-2026-23236 [HIGH] CVE-2026-23236: linux - In the Linux kernel, the following vulnerability has been resolved: fbdev: smsc... In the Linux kernel, the following vulnerability has been resolved: fbdev: smscufx: properly copy ioctl memory to kernelspace The UFX_IOCTL_REPORT_DAMAGE ioctl does not properly copy data from userspace to kernelspace, and instead directly references the memory, which can cause problems if invalid data is passed from userspace. Fix this all up by correctly copying the

CVE-2023-52481 [MEDIUM] CVE-2023-52481: linux - In the Linux kernel, the following vulnerability has been resolved: arm64: erra... In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Add Cortex-A520 speculative unprivileged load workaround Implement the workaround for ARM Cortex-A520 erratum 2966298. On an affected Cortex-A520 core, a speculatively executed unprivileged load might leak data from a privileged load via a cache side channel. The issue only exists for

CVE-2020-24588 [LOW] CVE-2020-24588: firmware-nonfree - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) ... The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary networ

CVE-2025-39996 CVE-2025-39996: linux - In the Linux kernel, the following vulnerability has been resolved: media: b2c2... In the Linux kernel, the following vulnerability has been resolved: media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove The original code uses cancel_delayed_work() in flexcop_pci_remove(), which does not guarantee that the delayed work item irq_check_work has fully completed if it was already running. This leads to use-after-free scenarios where