Debian Linux vulnerabilities

CVE-2021-45402 [MEDIUM] CVE-2021-45402: linux - The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through... The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the mov32 instruction, which allows local users to obtain potentially sensitive address information, aka a "pointer leak." Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved (fixed in 5.10.92-1) forky: resolved

CVE-2025-21629 [MEDIUM] CVE-2025-21629: linux - In the Linux kernel, the following vulnerability has been resolved: net: reenab... In the Linux kernel, the following vulnerability has been resolved: net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets The blamed commit disabled hardware offoad of IPv6 packets with extension headers on devices that advertise NETIF_F_IPV6_CSUM, based on the definition of that feature in skbuff.h: * * - %NETIF_F_IPV6_CSUM * - Driver (device) is only able to

CVE-2017-14991 [MEDIUM] CVE-2017-14991: linux - The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 all... The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain sensitive information from uninitialized kernel heap-memory locations via an SG_GET_REQUEST_TABLE ioctl call for /dev/sg0. Scope: local bookworm: resolved (fixed in 4.13.4-1) bullseye: resolved (fixed in 4.13.4-1) forky: resolved (fixed in 4.13.4-1) sid: resolve

CVE-2018-1091 [MEDIUM] CVE-2018-1091: linux - In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Li... In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path, leading to a denial of service. Scop

CVE-2021-47075 [MEDIUM] CVE-2021-47075: linux - In the Linux kernel, the following vulnerability has been resolved: nvmet: fix ... In the Linux kernel, the following vulnerability has been resolved: nvmet: fix memory leak in nvmet_alloc_ctrl() When creating ctrl in nvmet_alloc_ctrl(), if the cntlid_min is larger than cntlid_max of the subsystem, and jumps to the "out_free_changed_ns_list" label, but the ctrl->sqs lack of be freed. Fix this by jumping to the "out_free_sqs" label. Scope: local bo

CVE-2020-26088 [MEDIUM] CVE-2020-26088: linux - A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the L... A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a. Scope: local bookworm: resolved (fixed in 5.7.17-1) bullseye: resolved (fixed in 5.7.17-1) forky: resolved (fixed in 5.7.17-1) sid: resolved (fixed in 5.7

CVE-2022-1204 [MEDIUM] CVE-2022-1204: linux - A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protoc... A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed in 5.17.3-1) sid: resolved (fixed in 5.17.3-1) trixie: resol

CVE-2025-38608 [MEDIUM] CVE-2025-38608: linux - In the Linux kernel, the following vulnerability has been resolved: bpf, ktls: ... In the Linux kernel, the following vulnerability has been resolved: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls When sending plaintext data, we initially calculated the corresponding ciphertext length. However, if we later reduced the plaintext data length via socket policy, we failed to recalculate the ciphertext length. This results in tra

CVE-2025-38001 [MEDIUM] CVE-2025-38001: linux - In the Linux kernel, the following vulnerability has been resolved: net_sched: ... In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice Savino says: "We are writing to report that this recent patch (141d34391abbb315d68556b7c67ad97885407547) [1] can be bypassed, and a UAF can still occur when HFSC is utilized with NETEM. The patch only checks the cl->cl_nactive f

CVE-2020-25641 [MEDIUM] CVE-2020-25641: linux - A flaw was found in the Linux kernel's implementation of biovecs in versions bef... A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highes

CVE-2025-38429 [MEDIUM] CVE-2025-38429: linux - In the Linux kernel, the following vulnerability has been resolved: bus: mhi: e... In the Linux kernel, the following vulnerability has been resolved: bus: mhi: ep: Update read pointer only after buffer is written Inside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated before the buffer is written, potentially causing race conditions where the host sees an updated read pointer before the buffer is actually written. Updating rd_offs

CVE-2022-50363 [MEDIUM] CVE-2022-50363: linux - In the Linux kernel, the following vulnerability has been resolved: skmsg: pass... In the Linux kernel, the following vulnerability has been resolved: skmsg: pass gfp argument to alloc_sk_msg() syzbot found that alloc_sk_msg() could be called from a non sleepable context. sk_psock_verdict_recv() uses rcu_read_lock() protection. We need the callers to pass a gfp_t argument to avoid issues. syzbot report was: BUG: sleeping function called from inval

CVE-2021-29647 [MEDIUM] CVE-2021-29647: linux - An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/... An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure, aka CID-50535249f624. Scope: local bookworm: resolved (fixed in 5.10.28-1) bullseye: resolved (fixed in 5.10.28-1) forky: resolved (fixed in 5.10.28-1) sid

CVE-2025-38590 [MEDIUM] CVE-2025-38590: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: ... In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Remove skb secpath if xfrm state is not found Hardware returns a unique identifier for a decrypted packet's xfrm state, this state is looked up in an xarray. However, the state might have been freed by the time of this lookup. Currently, if the state is not found, only a counter is increm

CVE-2022-26373 [MEDIUM] CVE-2022-26373: linux - Non-transparent sharing of return predictor targets between contexts in some Int... Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. Scope: local bookworm: resolved (fixed in 5.18.16-1) bullseye: resolved (fixed in 5.10.136-1) forky: resolved (fixed in 5.18.16-1) sid: resolved (fixed in 5.18.16-1) trixie: resol

CVE-2024-41010 [MEDIUM] CVE-2024-41010: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix to... In the Linux kernel, the following vulnerability has been resolved: bpf: Fix too early release of tcx_entry Pedro Pinto and later independently also Hyunwoo Kim and Wongi Lee reported an issue that the tcx_entry can be released too early leading to a use after free (UAF) when an active old-style ingress or clsact qdisc with a shared tc block is later replaced by ano

CVE-2025-40040 [MEDIUM] CVE-2025-40040: linux - In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix... In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix flag-dropping behavior in ksm_madvise syzkaller discovered the following crash: (kernel BUG) [ 44.607039] ------------[ cut here ]------------ [ 44.607422] kernel BUG at mm/userfaultfd.c:2067! [ 44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 44.608814] CPU:

CVE-2022-50335 [MEDIUM] CVE-2022-50335: linux - In the Linux kernel, the following vulnerability has been resolved: 9p: set req... In the Linux kernel, the following vulnerability has been resolved: 9p: set req refcount to zero to avoid uninitialized usage When a new request is allocated, the refcount will be zero if it is reused, but if the request is newly allocated from slab, it is not fully initialized before being added to idr. If the p9_read_work got a response before the refcount initiat

CVE-2019-18786 [MEDIUM] CVE-2019-18786: linux - In the Linux kernel through 5.3.8, f->fmt.sdr.reserved is uninitialized in rcar_... In the Linux kernel through 5.3.8, f->fmt.sdr.reserved is uninitialized in rcar_drif_g_fmt_sdr_cap in drivers/media/platform/rcar_drif.c, which could cause a memory disclosure problem. Scope: local bookworm: resolved (fixed in 5.4.8-1) bullseye: resolved (fixed in 5.4.8-1) forky: resolved (fixed in 5.4.8-1) sid: resolved (fixed in 5.4.8-1) trixie: resolved (fixed in

CVE-2025-22077 [MEDIUM] CVE-2025-22077: linux - In the Linux kernel, the following vulnerability has been resolved: Revert "smb... In the Linux kernel, the following vulnerability has been resolved: Revert "smb: client: fix TCP timers deadlock after rmmod" This reverts commit e9f2517a3e18a54a3943c098d2226b245d488801. Commit e9f2517a3e18 ("smb: client: fix TCP timers deadlock after rmmod") is intended to fix a null-ptr-deref in LOCKDEP, which is mentioned as CVE-2024-54680, but is actually did n