Debian Linux vulnerabilities

CVE-2022-50625 CVE-2022-50625: linux - In the Linux kernel, the following vulnerability has been resolved: serial: amb... In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: avoid SBSA UART accessing DMACR register Chapter "B Generic UART" in "ARM Server Base System Architecture" [1] documentation describes a generic UART interface. Such generic UART does not support DMA. In current code, sbsa_uart_pops and amba_pl011_pops share the same stop_rx operation, wh

CVE-2025-68362 CVE-2025-68362: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: rtl81... In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() The rtl8187_rx_cb() calculates the rx descriptor header address by subtracting its size from the skb tail pointer. However, it does not validate if the received packet (skb->len from urb->actual_length) is large enough to contain this

CVE-2023-54274 CVE-2023-54274: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: ... In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Add a check for valid 'mad_agent' pointer When unregistering MAD agent, srpt module has a non-null check for 'mad_agent' pointer before invoking ib_unregister_mad_agent(). This check can pass if 'mad_agent' variable holds an error value. The 'mad_agent' can have an error value for a short window w

CVE-2025-40287 [LOW] CVE-2025-40287: linux - In the Linux kernel, the following vulnerability has been resolved: exfat: fix ... In the Linux kernel, the following vulnerability has been resolved: exfat: fix improper check of dentry.stream.valid_size We found an infinite loop bug in the exFAT file system that can lead to a Denial-of-Service (DoS) condition. When a dentry in an exFAT filesystem is malformed, the following system calls — SYS_openat, SYS_ftruncate, and SYS_pwrite64 — can cause the

CVE-2025-40321 CVE-2025-40321: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: brcmf... In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode Currently, whenever there is a need to transmit an Action frame, the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to firmware. The P2P interfaces were available when wpa_supplicant is managing the wlan interfa

CVE-2022-50616 CVE-2022-50616: linux - In the Linux kernel, the following vulnerability has been resolved: regulator: ... In the Linux kernel, the following vulnerability has been resolved: regulator: core: Use different devices for resource allocation and DT lookup Following by the below discussion, there's the potential UAF issue between regulator and mfd. https://lore.kernel.org/all/[email protected]/ From the analysis of Yingliang CPU A |CPU B mt6370_probe()

CVE-2025-68239 CVE-2025-68239: linux - In the Linux kernel, the following vulnerability has been resolved: binfmt_misc... In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: restore write access before closing files opened by open_exec() bm_register_write() opens an executable file using open_exec(), which internally calls do_open_execat() and denies write access on the file to avoid modification while it is being executed. However, when an error occurs, bm_register

CVE-2025-40038 [LOW] CVE-2025-40038: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: S... In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid Skip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP isn't valid, e.g. because KVM is running with nrips=false. SVM must decode and emulate to skip the instruction if the CPU doesn't provide the next RIP, and gett

CVE-2025-68209 CVE-2025-68209: linux - In the Linux kernel, the following vulnerability has been resolved: mlx5: Fix d... In the Linux kernel, the following vulnerability has been resolved: mlx5: Fix default values in create CQ Currently, CQs without a completion function are assigned the mlx5_add_cq_to_tasklet function by default. This is problematic since only user CQs created through the mlx5_ib driver are intended to use this function. Additionally, all CQs that will use doorbells instead o

CVE-2025-68236 CVE-2025-68236: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: ... In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3) According to UFS specifications, the power-off sequence for a UFS device includes: - Sending an SSU command with Power_Condition=3 and await a response. - Asserting RST_N low. - Turning off REF_CLK. - Turning off VCC. - Turning off VCCQ/VCCQ

CVE-2018-1118 [LOW] CVE-2018-1118: linux - Linux kernel vhost since version 4.8 does not properly initialize memory in mess... Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file. Scope: local bookworm: resolved (fixed in 4.17.3-1) bulls

CVE-2013-6381 [MEDIUM] CVE-2013-6381: linux - Buffer overflow in the qeth_snmp_command function in drivers/s390/net/qeth_core_... Buffer overflow in the qeth_snmp_command function in drivers/s390/net/qeth_core_main.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service or possibly have unspecified other impact via an SNMP ioctl call with a length value that is incompatible with the command-buffer size. Scope: local bookworm: resolved (fixed in 3.11.10-1) bullseye: r

CVE-2020-26558 [MEDIUM] CVE-2020-26558: bluez - Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 throu... Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authentic

CVE-2018-12207 [MEDIUM] CVE-2018-12207: linux - Improper invalidation for page table updates by a virtual guest operating system... Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access. Scope: local bookworm: resolved (fixed in 5.3.9-2) bullseye: resolved (fixed in 5.3.9-2) forky: resolved (fixed in 5.3.9-2) sid: resolved (fixed

CVE-2017-16643 [MEDIUM] CVE-2017-16643: linux - The parse_hid_report_descriptor function in drivers/input/tablet/gtco.c in the L... The parse_hid_report_descriptor function in drivers/input/tablet/gtco.c in the Linux kernel before 4.13.11 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device. Scope: local bookworm: resolved (fixed in 4.13.13-1) bullseye: resolved (fixed in 4.13.13-1) forky: resolve

CVE-2017-16649 [MEDIUM] CVE-2017-16649: linux - The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux... The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device. Scope: local bookworm: resolved (fixed in 4.13.13-1) bullseye: resolved (fixed in 4.13.13-1) forky: resolved

CVE-2017-16650 [MEDIUM] CVE-2017-16650: linux - The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel thr... The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device. Scope: local bookworm: resolved (fixed in 4.13.13-1) bullseye: resolved (fixed in 4.13.13-1) forky: resolved (fixed in

CVE-2017-16645 [MEDIUM] CVE-2017-16645: linux - The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the L... The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device. Scope: local bookworm: resolved (fixed in 4.14.2-1) bullseye: resolved (fixed in 4.

CVE-2017-16644 [MEDIUM] CVE-2017-16644: linux - The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux ke... The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (improper error handling and system crash) or possibly have unspecified other impact via a crafted USB device. Scope: local bookworm: resolved (fixed in 4.14.7-1) bullseye: resolved (fixed in 4.14.7-1) forky: resolved (

CVE-2017-16531 [MEDIUM] CVE-2017-16531: linux - drivers/usb/core/config.c in the Linux kernel before 4.13.6 allows local users t... drivers/usb/core/config.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor. Scope: local bookworm: resolved (fixed in 4.13.10-1) bullseye: resolved (fixed in 4.13.10-1) forky