Debian Linux vulnerabilities

CVE-2025-38523 [MEDIUM] CVE-2025-38523: linux - In the Linux kernel, the following vulnerability has been resolved: cifs: Fix t... In the Linux kernel, the following vulnerability has been resolved: cifs: Fix the smbd_response slab to allow usercopy The handling of received data in the smbdirect client code involves using copy_to_iter() to copy data from the smbd_reponse struct's packet trailer to a folioq buffer provided by netfslib that encapsulates a chunk of pagecache. If, however, CONFIG_H

CVE-2025-71161 [MEDIUM] CVE-2025-71161: linux - In the Linux kernel, the following vulnerability has been resolved: dm-verity: ... In the Linux kernel, the following vulnerability has been resolved: dm-verity: disable recursive forward error correction There are two problems with the recursive correction: 1. It may cause denial-of-service. In fec_read_bufs, there is a loop that has 253 iterations. For each iteration, we may call verity_hash_for_block recursively. There is a limit of 4 nested re

CVE-2021-33630 [MEDIUM] CVE-2021-33630: linux - NULL Pointer Dereference vulnerability in openEuler kernel on Linux (network mod... NULL Pointer Dereference vulnerability in openEuler kernel on Linux (network modules) allows Pointer Manipulation. This vulnerability is associated with program files net/sched/sch_cbs.C. This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3. Scope: local bookworm: resolved (fixed in 5.3.7-1) bullseye: resolved (fixed in 5.3.7-1) forky: resolved (f

CVE-2025-39703 [MEDIUM] CVE-2025-39703: linux - In the Linux kernel, the following vulnerability has been resolved: net, hsr: r... In the Linux kernel, the following vulnerability has been resolved: net, hsr: reject HSR frame if skb can't hold tag Receiving HSR frame with insufficient space to hold HSR tag in the skb can result in a crash (kernel BUG): [ 45.390915] skbuff: skb_under_panic: text:ffffffff86f32cac len:26 put:14 head:ffff888042418000 data:ffff888042417ff4 tail:0xe end:0x180 dev:bri

CVE-2022-50472 [MEDIUM] CVE-2022-50472: linux - In the Linux kernel, the following vulnerability has been resolved: IB/mad: Don... In the Linux kernel, the following vulnerability has been resolved: IB/mad: Don't call to function that might sleep while in atomic context Tracepoints are not allowed to sleep, as such the following splat is generated due to call to ib_query_pkey() in atomic context. WARNING: CPU: 0 PID: 1888000 at kernel/trace/ring_buffer.c:2492 rb_commit+0xc1/0x220 CPU: 0 PID: 18

CVE-2025-37799 [MEDIUM] CVE-2025-37799: linux - In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fi... In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp vmxnet3 driver's XDP handling is buggy for packet sizes using ring0 (that is, packet sizes between 128 - 3k bytes). We noticed MTU-related connectivity issues with Cilium's service load- balancing in case of vmxnet3 as NIC underneath. A sim

CVE-2024-36905 [MEDIUM] CVE-2024-36905: linux - In the Linux kernel, the following vulnerability has been resolved: tcp: defer ... In the Linux kernel, the following vulnerability has been resolved: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets TCP_SYN_RECV state is really special, it is only used by cross-syn connections, mostly used by fuzzers. In the following crash [1], syzbot managed to trigger a divide by zero in tcp_rcv_space_adjust() A socket makes the following state tran

CVE-2024-26798 [MEDIUM] CVE-2024-26798: linux - In the Linux kernel, the following vulnerability has been resolved: fbcon: alwa... In the Linux kernel, the following vulnerability has been resolved: fbcon: always restore the old font data in fbcon_do_set_font() Commit a5a923038d70 (fbdev: fbcon: Properly revert changes when vc_resize() failed) started restoring old font data upon failure (of vc_resize()). But it performs so only for user fonts. It means that the "system"/internal fonts are not

CVE-2023-1249 [MEDIUM] CVE-2023-1249: linux - A use-after-free flaw was found in the Linux kernel’s core dump subsystem. This ... A use-after-free flaw was found in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 ("coredump: Use the vma snapshot in fill_files_note") not applied yet, then kernel could be affected. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed

CVE-2021-47620 [MEDIUM] CVE-2021-47620: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: refactor malicious adv data check Check for out-of-bound read was being performed at the end of while num_reports loop, and would fill journal with false positives. Added check to beginning of loop processing so that it doesn't get checked after ptr has been advanced. Scope: local bookwor

CVE-2023-0469 [MEDIUM] CVE-2023-0469: linux - A use-after-free flaw was found in io_uring/filetable.c in io_install_fixed_file... A use-after-free flaw was found in io_uring/filetable.c in io_install_fixed_file in the io_uring subcomponent in the Linux Kernel during call cleanup. This flaw may lead to a denial of service. Scope: local bookworm: resolved (fixed in 6.0.12-1) bullseye: resolved forky: resolved (fixed in 6.0.12-1) sid: resolved (fixed in 6.0.12-1) trixie: resolved (fixed in 6.0.12-1

CVE-2022-2873 [MEDIUM] CVE-2022-2873: linux - An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT S... An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input data. This flaw allows a local user to crash the system. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixed in 5.10.162-1) forky: resolv

CVE-2025-37959 [MEDIUM] CVE-2025-37959: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub ... In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpf_redirect_peer When bpf_redirect_peer is used to redirect packets to a device in another network namespace, the skb isn't scrubbed. That can lead skb information from one namespace to be "misused" in another namespace. As one example, this is causing Cilium to drop traffic wh

CVE-2024-40971 [MEDIUM] CVE-2024-40971: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: remov... In the Linux kernel, the following vulnerability has been resolved: f2fs: remove clear SB_INLINECRYPT flag in default_options In f2fs_remount, SB_INLINECRYPT flag will be clear and re-set. If create new file or open file during this gap, these files will not use inlinecrypt. Worse case, it may lead to data corruption if wrappedkey_v0 is enable. Thread A: Thread B: -

CVE-2024-41034 [MEDIUM] CVE-2024-41034: linux - In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix... In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug on rename operation of broken directory Syzbot reported that in rename directory operation on broken directory on nilfs2, __block_write_begin_int() called to prepare block write may fail BUG_ON check for access exceeding the folio/page size. This is because nilfs_dotdot(), whi

CVE-2024-49878 [MEDIUM] CVE-2024-49878: linux - In the Linux kernel, the following vulnerability has been resolved: resource: f... In the Linux kernel, the following vulnerability has been resolved: resource: fix region_intersects() vs add_memory_driver_managed() On a system with CXL memory, the resource tree (/proc/iomem) related to CXL memory may look like something as follows. 490000000-50fffffff : CXL Window 0 490000000-50fffffff : region0 490000000-50fffffff : dax0.0 490000000-50fffffff :

CVE-2022-49372 [MEDIUM] CVE-2022-49372: linux - In the Linux kernel, the following vulnerability has been resolved: tcp: tcp_rt... In the Linux kernel, the following vulnerability has been resolved: tcp: tcp_rtx_synack() can be called from process context Laurent reported the enclosed report [1] This bug triggers with following coditions: 0) Kernel built with CONFIG_DEBUG_PREEMPT=y 1) A new passive FastOpen TCP socket is created. This FO socket waits for an ACK coming from client to be a comple

CVE-2022-0171 [MEDIUM] CVE-2022-0171: linux - A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerabili... A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization (SEV). Scope: local bookworm: resolved (fixed in 5.18.2-1) bullseye: resolved (fixed in 5.10.149-1) forky:

CVE-2024-40984 [MEDIUM] CVE-2024-40984: linux - In the Linux kernel, the following vulnerability has been resolved: ACPICA: Rev... In the Linux kernel, the following vulnerability has been resolved: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." Undo the modifications made in commit d410ee5109a1 ("ACPICA: avoid "Info: mapping multiple BARs. Your kernel is fine.""). The initial purpose of this commit was to stop memory mappings for operation regions from overlap

CVE-2024-36902 [MEDIUM] CVE-2024-36902: linux - In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6_... In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() syzbot is able to trigger the following crash [1], caused by unsafe ip6_dst_idev() use. Indeed ip6_dst_idev() can return NULL, and must always be checked. [1] Oops: general protection fault, probably for non-canonical address 0x