Debian Linux vulnerabilities

CVE-2020-0543 [MEDIUM] CVE-2020-0543: intel-microcode - Incomplete cleanup from specific special register read operations in some Intel(... Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Scope: local bookworm: resolved (fixed in 3.20200609.1) bullseye: resolved (fixed in 3.20200609.1) forky: resolved (fixed in 3.20200609.1) sid: resolved (fixed in 3.202006

CVE-2025-23145 [MEDIUM] CVE-2025-23145: linux - In the Linux kernel, the following vulnerability has been resolved: mptcp: fix ... In the Linux kernel, the following vulnerability has been resolved: mptcp: fix NULL pointer in can_accept_new_subflow When testing valkey benchmark tool with MPTCP, the kernel panics in 'mptcp_can_accept_new_subflow' because subflow_req->msk is NULL. Call trace: mptcp_can_accept_new_subflow (./net/mptcp/subflow.c:63 (discriminator 4)) (P) subflow_syn_recv_sock (./ne

CVE-2021-47036 [MEDIUM] CVE-2021-47036: linux - In the Linux kernel, the following vulnerability has been resolved: udp: skip L... In the Linux kernel, the following vulnerability has been resolved: udp: skip L4 aggregation for UDP tunnel packets If NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD are enabled, and there are UDP tunnels available in the system, udp_gro_receive() could end-up doing L4 aggregation (either SKB_GSO_UDP_L4 or SKB_GSO_FRAGLIST) at the outer UDP tunnel level for packets eff

CVE-2022-48629 [MEDIUM] CVE-2022-48629: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: qco... In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - ensure buffer for generate is completely filled The generate function in struct rng_alg expects that the destination buffer is completely filled if the function returns 0. qcom_rng_read() can run into a situation where the buffer is partially filled with randomness and the remaini

CVE-2022-50365 [MEDIUM] CVE-2022-50365: linux - In the Linux kernel, the following vulnerability has been resolved: skbuff: Acc... In the Linux kernel, the following vulnerability has been resolved: skbuff: Account for tail adjustment during pull operations Extending the tail can have some unexpected side effects if a program uses a helper like BPF_FUNC_skb_pull_data to read partial content beyond the head skb headlen when all the skbs in the gso frag_list are linear with no head_frag - kernel

CVE-2022-48673 [MEDIUM] CVE-2022-48673: linux - In the Linux kernel, the following vulnerability has been resolved: net/smc: Fi... In the Linux kernel, the following vulnerability has been resolved: net/smc: Fix possible access to freed memory in link clear After modifying the QP to the Error state, all RX WR would be completed with WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not wait for it is done, but destroy the QP and free the link group directly. So there is a risk that a

CVE-2016-5243 [MEDIUM] CVE-2016-5243: linux - The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux ... The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel through 4.6.3 does not properly copy a certain string, which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message. Scope: local bookworm: resolved (fixed in 4.6.2-1) bullseye: resolved (fixed in 4.6.2-1) forky: resolved (fixed in 4

CVE-2018-5750 [MEDIUM] CVE-2018-5750: linux - The acpi_smbus_hc_add function in drivers/acpi/sbshc.c in the Linux kernel throu... The acpi_smbus_hc_add function in drivers/acpi/sbshc.c in the Linux kernel through 4.14.15 allows local users to obtain sensitive address information by reading dmesg data from an SBS HC printk call. Scope: local bookworm: resolved (fixed in 4.15.4-1) bullseye: resolved (fixed in 4.15.4-1) forky: resolved (fixed in 4.15.4-1) sid: resolved (fixed in 4.15.4-1) trixie: r

CVE-2021-3564 [MEDIUM] CVE-2021-3564: linux - A flaw double-free memory corruption in the Linux kernel HCI device initializati... A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the system. This flaw affects all the Linux kernel versions starting from 3.13. Scope: local bookworm: resolved (fixed in 5.10.46-1) bullseye: resolved (fixed in 5.10

CVE-2025-38439 [MEDIUM] CVE-2025-38439: linux - In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Se... In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT When transmitting an XDP_REDIRECT packet, call dma_unmap_len_set() with the proper length instead of 0. This bug triggers this warning on a system with IOMMU enabled: WARNING: CPU: 36 PID: 0 at drivers/iommu/dma-iommu.c:842 __iommu_dma_unmap+0x15

CVE-2025-38067 [MEDIUM] CVE-2025-38067: linux - In the Linux kernel, the following vulnerability has been resolved: rseq: Fix s... In the Linux kernel, the following vulnerability has been resolved: rseq: Fix segfault on registration when rseq_cs is non-zero The rseq_cs field is documented as being set to 0 by user-space prior to registration, however this is not currently enforced by the kernel. This can result in a segfault on return to user-space if the value stored in the rseq_cs field does

CVE-2025-38089 [MEDIUM] CVE-2025-38089: linux - In the Linux kernel, the following vulnerability has been resolved: sunrpc: han... In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error tianshuo han reported a remotely-triggerable crash if the client sends a kernel RPC server a specially crafted packet. If decoding the RPC reply fails in such a way that SVC_GARBAGE is returned without setting the rq_accept_statp po

CVE-2021-47448 [MEDIUM] CVE-2021-47448: linux - In the Linux kernel, the following vulnerability has been resolved: mptcp: fix ... In the Linux kernel, the following vulnerability has been resolved: mptcp: fix possible stall on recvmsg() recvmsg() can enter an infinite loop if the caller provides the MSG_WAITALL, the data present in the receive queue is not sufficient to fulfill the request, and no more data is received by the peer. When the above happens, mptcp_wait_data() will always return w

CVE-2025-38181 [MEDIUM] CVE-2025-38181: linux - In the Linux kernel, the following vulnerability has been resolved: calipso: Fi... In the Linux kernel, the following vulnerability has been resolved: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). syzkaller reported a null-ptr-deref in sock_omalloc() while allocating a CALIPSO option. [0] The NULL is of struct sock, which was fetched by sk_to_full_sk() in calipso_req_setattr(). Since commit a1a5344ddbe8 ("tcp: avoid two atomic ops fo

CVE-2018-20511 [MEDIUM] CVE-2018-20511: linux - An issue was discovered in the Linux kernel before 4.18.11. The ipddp_ioctl func... An issue was discovered in the Linux kernel before 4.18.11. The ipddp_ioctl function in drivers/net/appletalk/ipddp.c allows local users to obtain sensitive kernel address information by leveraging CAP_NET_ADMIN to read the ipddp_route dev and next fields via an SIOCFINDIPDDPRT ioctl call. Scope: local bookworm: resolved (fixed in 4.18.20-1) bullseye: resolved (fixe

CVE-2022-2153 [MEDIUM] CVE-2022-2153: linux - A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. T... A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service. Scope: local

CVE-2020-8694 [MEDIUM] CVE-2020-8694: linux - Insufficient access control in the Linux kernel driver for some Intel(R) Process... Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Scope: local bookworm: resolved (fixed in 5.9.9-1) bullseye: resolved (fixed in 5.9.9-1) forky: resolved (fixed in 5.9.9-1) sid: resolved (fixed in 5.9.9-1) trixie: resolved (fixed in 5.9.9-1

CVE-2016-2085 [MEDIUM] CVE-2016-2085: linux - The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux k... The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack. Scope: local bookworm: resolved (fixed in 4.4.2-1) bullseye: resolved (fixed in 4.4.2-1) forky: resolved (fixed in 4.4.2-1) sid: resolved (fixed in 4.4.

CVE-2022-2318 [MEDIUM] CVE-2022-2318: linux - There are use-after-free vulnerabilities caused by timer handler in net/rose/ros... There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges. Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: resolved (fixed in 5.10.127-2) forky: resolved (fixed in 5.18.14-1) sid: resolved (fixed in 5.18.14-1) trixie: resolved (fixed in 5.18.14-1)

CVE-2016-9178 [MEDIUM] CVE-2016-9178: linux - The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kerne... The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel before 4.7.5 does not initialize a certain integer variable, which allows local users to obtain sensitive information from kernel stack memory by triggering failure of a get_user_ex call. Scope: local bookworm: resolved (fixed in 4.7.5-1) bullseye: resolved (fixed in 4.7.5-1) forky: reso