Debian Linux vulnerabilities

CVE-2025-21842 [MEDIUM] CVE-2025-21842: linux - In the Linux kernel, the following vulnerability has been resolved: amdkfd: pro... In the Linux kernel, the following vulnerability has been resolved: amdkfd: properly free gang_ctx_bo when failed to init user queue The destructor of a gtt bo is declared as void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void **mem_obj); Which takes void** as the second parameter. GCC allows passing void* to the function because void* can be implicitly

CVE-2021-47170 [MEDIUM] CVE-2021-47170: linux - In the Linux kernel, the following vulnerability has been resolved: USB: usbfs:... In the Linux kernel, the following vulnerability has been resolved: USB: usbfs: Don't WARN about excessively large memory allocations Syzbot found that the kernel generates a WARNing if the user tries to submit a bulk transfer through usbfs with a buffer that is way too large. This isn't a bug in the kernel; it's merely an invalid request from the user and the usbfs

CVE-2021-47227 [MEDIUM] CVE-2021-47227: linux - In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Pr... In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Prevent state corruption in __fpu__restore_sig() The non-compacted slowpath uses __copy_from_user() and copies the entire user buffer into the kernel buffer, verbatim. This means that the kernel buffer may now contain entirely invalid state on which XRSTOR will #GP. validate_user_xstate_hea

CVE-2024-47712 [MEDIUM] CVE-2024-47712: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1... In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param In the `wilc_parse_join_bss_param` function, the TSF field of the `ies` structure is accessed after the RCU read-side critical section is unlocked. According to RCU usage rules, this is illegal. Reusing this pointer can

CVE-2024-42108 [MEDIUM] CVE-2024-42108: linux - In the Linux kernel, the following vulnerability has been resolved: net: rswitc... In the Linux kernel, the following vulnerability has been resolved: net: rswitch: Avoid use-after-free in rswitch_poll() The use-after-free is actually in rswitch_tx_free(), which is inlined in rswitch_poll(). Since `skb` and `gq->skbs[gq->dirty]` are in fact the same pointer, the skb is first freed using dev_kfree_skb_any(), then the value in skb->len is used to up

CVE-2024-26891 [MEDIUM] CVE-2024-26891: linux - In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d:... In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected For those endpoint devices connect to system via hotplug capable ports, users could request a hot reset to the device by flapping device's link through setting the slot's link control register, as pciehp_ist() DLLSC interru

CVE-2023-52477 [MEDIUM] CVE-2023-52477: linux - In the Linux kernel, the following vulnerability has been resolved: usb: hub: G... In the Linux kernel, the following vulnerability has been resolved: usb: hub: Guard against accesses to uninitialized BOS descriptors Many functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h access fields inside udev->bos without checking if it was allocated and initialized. If usb_get_bos_descriptor() fails for whatever reason, udev->bos will be NULL and

CVE-2024-35247 [MEDIUM] CVE-2024-35247: linux - In the Linux kernel, the following vulnerability has been resolved: fpga: regio... In the Linux kernel, the following vulnerability has been resolved: fpga: region: add owner module and take its refcount The current implementation of the fpga region assumes that the low-level module registers a driver for the parent device and uses its owner pointer to take the module's refcount. This approach is problematic since it can lead to a null pointer der

CVE-2024-42084 [MEDIUM] CVE-2024-42084: linux - In the Linux kernel, the following vulnerability has been resolved: ftruncate: ... In the Linux kernel, the following vulnerability has been resolved: ftruncate: pass a signed offset The old ftruncate() syscall, using the 32-bit off_t misses a sign extension when called in compat mode on 64-bit architectures. As a result, passing a negative length accidentally succeeds in truncating to file size between 2GiB and 4GiB. Changing the type of the comp

CVE-2022-48720 [MEDIUM] CVE-2022-48720: linux - In the Linux kernel, the following vulnerability has been resolved: net: macsec... In the Linux kernel, the following vulnerability has been resolved: net: macsec: Fix offload support for NETDEV_UNREGISTER event Current macsec netdev notify handler handles NETDEV_UNREGISTER event by releasing relevant SW resources only, this causes resources leak in case of macsec HW offload, as the underlay driver was not notified to clean it's macsec offload res

CVE-2024-44935 [MEDIUM] CVE-2024-44935: linux - In the Linux kernel, the following vulnerability has been resolved: sctp: Fix n... In the Linux kernel, the following vulnerability has been resolved: sctp: Fix null-ptr-deref in reuseport_add_sock(). syzbot reported a null-ptr-deref while accessing sk2->sk_reuseport_cb in reuseport_add_sock(). [0] The repro first creates a listener with SO_REUSEPORT. Then, it creates another listener on the same port and concurrently closes the first listener. Th

CVE-2023-52627 [MEDIUM] CVE-2023-52627: linux - In the Linux kernel, the following vulnerability has been resolved: iio: adc: a... In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7091r: Allow users to configure device events AD7091R-5 devices are supported by the ad7091r-5 driver together with the ad7091r-base driver. Those drivers declared iio events for notifying user space when ADC readings fall bellow the thresholds of low limit registers or above the values

CVE-2021-47381 [MEDIUM] CVE-2021-47381: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ... In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Fix DSP oops stack dump output contents Fix @buf arg given to hex_dump_to_buffer() and stack address used in dump error output. Scope: local bookworm: resolved (fixed in 5.14.12-1) bullseye: open forky: resolved (fixed in 5.14.12-1) sid: resolved (fixed in 5.14.12-1) trixie: resolved (fix

CVE-2024-41082 [MEDIUM] CVE-2024-41082: linux - In the Linux kernel, the following vulnerability has been resolved: nvme-fabric... In the Linux kernel, the following vulnerability has been resolved: nvme-fabrics: use reserved tag for reg read/write command In some scenarios, if too many commands are issued by nvme command in the same time by user tasks, this may exhaust all tags of admin_q. If a reset (nvme reset or IO timeout) occurs before these commands finish, reconnect routine may fail to

CVE-2023-52879 [MEDIUM] CVE-2023-52879: linux - In the Linux kernel, the following vulnerability has been resolved: tracing: Ha... In the Linux kernel, the following vulnerability has been resolved: tracing: Have trace_event_file have ref counters The following can crash the kernel: # cd /sys/kernel/tracing # echo 'p:sched schedule' > kprobe_events # exec 5>>events/kprobes/sched/enable # > kprobe_events # exec 5>&- The above commands: 1. Change directory to the tracefs directory 2. Create a kpr

CVE-2023-52462 [MEDIUM] CVE-2023-52462: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: fix ch... In the Linux kernel, the following vulnerability has been resolved: bpf: fix check for attempt to corrupt spilled pointer When register is spilled onto a stack as a 1/2/4-byte register, we set slot_type[BPF_REG_SIZE - 1] (plus potentially few more below it, depending on actual spill size). So to check if some stack slot has spilled register we need to consult slot_t

CVE-2024-26822 [MEDIUM] CVE-2024-26822: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: set correct id, uid and cruid for multiuser automounts When uid, gid and cruid are not specified, we need to dynamically set them into the filesystem context used for automounting otherwise they'll end up reusing the values from the parent mount. Scope: local bookworm: resolved (fixed i

CVE-2024-26807 [MEDIUM] CVE-2024-26807: linux - In the Linux kernel, the following vulnerability has been resolved: Both cadenc... In the Linux kernel, the following vulnerability has been resolved: Both cadence-quadspi ->runtime_suspend() and ->runtime_resume() implementations start with: struct cqspi_st *cqspi = dev_get_drvdata(dev); struct spi_controller *host = dev_get_drvdata(dev); This obviously cannot be correct, unless "struct cqspi_st" is the first member of " struct spi_controller", o

CVE-2023-52871 [MEDIUM] CVE-2023-52871: linux - In the Linux kernel, the following vulnerability has been resolved: soc: qcom: ... In the Linux kernel, the following vulnerability has been resolved: soc: qcom: llcc: Handle a second device without data corruption Usually there is only one llcc device. But if there were a second, even a failed probe call would modify the global drv_data pointer. So check if drv_data is valid before overwriting it. Scope: local bookworm: resolved (fixed in 6.1.64-

CVE-2024-26718 [MEDIUM] CVE-2024-26718: linux - In the Linux kernel, the following vulnerability has been resolved: dm-crypt, d... In the Linux kernel, the following vulnerability has been resolved: dm-crypt, dm-verity: disable tasklets Tasklets have an inherent problem with memory corruption. The function tasklet_action_common calls tasklet_trylock, then it calls the tasklet callback and then it calls tasklet_unlock. If the tasklet callback frees the structure that contains the tasklet or if i