Debian Linux vulnerabilities

CVE-2021-38300 [HIGH] CVE-2021-38300: linux - arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirab... arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when transforming unprivileged cBPF programs, allowing execution of arbitrary code within the kernel context. This occurs because conditional branches can exceed the 128 KB limit of the MIPS architecture. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolve

CVE-2023-40283 [HIGH] CVE-2023-40283: linux - An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in t... An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled. Scope: local bookworm: resolved (fixed in 6.1.52-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 6.4.11-1) sid: resolved (fixed in 6.4.11-1) trixie: resolved (fixed

CVE-2021-4197 [HIGH] CVE-2021-4197: linux - An unprivileged write to the file handler flaw in the Linux kernel's control gro... An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of control groups. A local user could use this flaw to crash the

CVE-2023-5345 [HIGH] CVE-2023-5345: linux - A use-after-free vulnerability in the Linux kernel's fs/smb/client component can... A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation. In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead to double free. We recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705. Scope: local bookwo

CVE-2022-4744 [HIGH] CVE-2022-4744: linux - A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functio... A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw allows a local user to crash or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved (fixed in 5.

CVE-2023-4921 [HIGH] CVE-2023-4921: linux - A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq componen... A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue(). We recommend upgradi

CVE-2025-38708 [HIGH] CVE-2025-38708: linux - In the Linux kernel, the following vulnerability has been resolved: drbd: add m... In the Linux kernel, the following vulnerability has been resolved: drbd: add missing kref_get in handle_write_conflicts With `two-primaries` enabled, DRBD tries to detect "concurrent" writes and handle write conflicts, so that even if you write to the same sector simultaneously on both nodes, they end up with the identical data once the writes are completed. In handl

CVE-2022-1882 [HIGH] CVE-2022-1882: linux - A use-after-free flaw was found in the Linux kernel’s pipes functionality in how... A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This flaw allows a local user to crash or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.18.16-1) bullseye: resolved (fixed in

CVE-2022-49535 [HIGH] CVE-2022-49535: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc:... In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI If lpfc_issue_els_flogi() fails and returns non-zero status, the node reference count is decremented to trigger the release of the nodelist structure. However, if there is a prior registration or dev-loss-evt work pending,

CVE-2021-3715 [HIGH] CVE-2021-3715: linux - A flaw was found in the "Routing decision" classifier in the Linux kernel's Traf... A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled changing of classification filters, leading to a use-after-free condition. This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity,

CVE-2023-6817 [HIGH] CVE-2023-6817: linux - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables compon... A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free. We recommend upgrading past commit 317eb96850956

CVE-2024-27075 [HIGH] CVE-2024-27075: linux - In the Linux kernel, the following vulnerability has been resolved: media: dvb-... In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: avoid stack overflow warnings with clang A previous patch worked around a KASAN issue in stv0367, now a similar problem showed up with clang: drivers/media/dvb-frontends/stv0367.c:1222:12: error: stack frame size (3624) exceeds limit (2048) in 'stv0367ter_set_frontend' [-Werror,-

CVE-2023-53676 [HIGH] CVE-2023-53676: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: targe... In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() The function lio_target_nacl_info_show() uses sprintf() in a loop to print details for every iSCSI connection in a session without checking for the buffer length. With enough iSCSI connections it's possible to overflow the buffer

CVE-2021-4028 [HIGH] CVE-2021-4028: linux - A flaw in the Linux kernel's implementation of RDMA communications manager liste... A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local access to setup a socket to listen on a high port allowing for a list element to be used after free. Given the ability to execute code, a local attacker could leverage this use-after-free to crash the system or possibly escalate privileges on the syste

CVE-2023-1281 [HIGH] CVE-2023-1281: linux - Use After Free vulnerability in Linux kernel traffic control index filter (tcind... Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this vulnerability to elevate its privileges to root. This issue

CVE-2025-38236 [HIGH] CVE-2025-38236: linux - In the Linux kernel, the following vulnerability has been resolved: af_unix: Do... In the Linux kernel, the following vulnerability has been resolved: af_unix: Don't leave consecutive consumed OOB skbs. Jann Horn reported a use-after-free in unix_stream_read_generic(). The following sequences reproduce the issue: $ python3 from socket import * s1, s2 = socketpair(AF_UNIX, SOCK_STREAM) s1.send(b'x', MSG_OOB) s2.recv(1, MSG_OOB) # leave a consumed OOB

CVE-2024-47742 [HIGH] CVE-2024-47742: linux - In the Linux kernel, the following vulnerability has been resolved: firmware_lo... In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Block path traversal Most firmware names are hardcoded strings, or are constructed from fairly constrained format strings where the dynamic parts are just some hex numbers or such. However, there are a couple codepaths in the kernel where firmware file names contain string components

CVE-2024-1085 [HIGH] CVE-2024-1085: linux - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables compon... A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_setelem_catchall_deactivate() function checks whether the catch-all set element is active in the current generation instead of the next generation before freeing it, but only flags it inactive in the next generation, making

CVE-2023-1118 [HIGH] CVE-2023-1118: linux - A flaw use after free in the Linux kernel integrated infrared receiver/transceiv... A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 6.1.20-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.20-

CVE-2023-1670 [HIGH] CVE-2023-1670: linux - A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Etherne... A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 6.1.20-2) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.20-2) sid: resolved (fixed in 6.1.20-2) t