Debian Linux vulnerabilities

CVE-2019-15118 [MEDIUM] CVE-2019-15118: linux - check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandl... check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to kernel stack exhaustion. Scope: local bookworm: resolved (fixed in 5.2.17-1) bullseye: resolved (fixed in 5.2.17-1) forky: resolved (fixed in 5.2.17-1) sid: resolved (fixed in 5.2.17-1) trixie: resolved (fixed in 5.2.17-1)

CVE-2021-47162 [MEDIUM] CVE-2021-47162: linux - In the Linux kernel, the following vulnerability has been resolved: tipc: skb_l... In the Linux kernel, the following vulnerability has been resolved: tipc: skb_linearize the head skb when reassembling msgs It's not a good idea to append the frag skb to a skb's frag_list if the frag_list already has skbs from elsewhere, such as this skb was created by pskb_copy() where the frag_list was cloned (all the skbs in it were skb_get'ed) and shared by mul

CVE-2021-3679 [MEDIUM] CVE-2021-3679: linux - A lack of CPU resource in the Linux kernel tracing module functionality in versi... A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolve

CVE-2025-37871 [MEDIUM] CVE-2025-37871: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: decre... In the Linux kernel, the following vulnerability has been resolved: nfsd: decrease sc_count directly if fail to queue dl_recall A deadlock warning occurred when invoking nfs4_put_stid following a failed dl_recall queue operation: T1 T2 nfs4_laundromat nfs4_get_client_reaplist nfs4_anylock_blockers __break_lease spin_lock // ctx->flc_lock spin_lock // clp->cl_lock nf

CVE-2022-49670 [MEDIUM] CVE-2022-49670: linux - In the Linux kernel, the following vulnerability has been resolved: linux/dim: ... In the Linux kernel, the following vulnerability has been resolved: linux/dim: Fix divide by 0 in RDMA DIM Fix a divide 0 error in rdma_dim_stats_compare() when prev->cpe_ratio == 0. CallTrace: Hardware name: H3C R4900 G3/RS33M2C9S, BIOS 2.00.37P21 03/12/2020 task: ffff880194b78000 task.stack: ffffc90006714000 RIP: 0010:backport_rdma_dim+0x10e/0x240 [mlx_compat] RSP

CVE-2024-26880 [MEDIUM] CVE-2024-26880: linux - In the Linux kernel, the following vulnerability has been resolved: dm: call th... In the Linux kernel, the following vulnerability has been resolved: dm: call the resume method on internal suspend There is this reported crash when experimenting with the lvm2 testsuite. The list corruption is caused by the fact that the postsuspend and resume methods were not paired correctly; there were two consecutive calls to the origin_postsuspend function. Th

CVE-2021-47109 [MEDIUM] CVE-2021-47109: linux - In the Linux kernel, the following vulnerability has been resolved: neighbour: ... In the Linux kernel, the following vulnerability has been resolved: neighbour: allow NUD_NOARP entries to be forced GCed IFF_POINTOPOINT interfaces use NUD_NOARP entries for IPv6. It's possible to fill up the neighbour table with enough entries that it will overflow for valid connections after that. This behaviour is more prevalent after commit 58956317c8de ("neighb

CVE-2023-52454 [MEDIUM] CVE-2023-52454: linux - In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: ... In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length If the host sends an H2CData command with an invalid DATAL, the kernel may crash in nvmet_tcp_build_pdu_iovec(). Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 lr : nvmet_tcp_io_work+0x6ac/0

CVE-2023-52513 [MEDIUM] CVE-2023-52513: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: F... In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix connection failure handling In case immediate MPA request processing fails, the newly created endpoint unlinks the listening endpoint and is ready to be dropped. This special case was not handled correctly by the code handling the later TCP socket close, causing a NULL dereference cras

CVE-2024-35797 [MEDIUM] CVE-2024-35797: linux - In the Linux kernel, the following vulnerability has been resolved: mm: cachest... In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix two shmem bugs When cachestat on shmem races with swapping and invalidation, there are two possible bugs: 1) A swapin error can have resulted in a poisoned swap entry in the shmem inode's xarray. Calling get_shadow_from_swap_cache() on it will result in an out-of-bounds access to

CVE-2023-52834 [MEDIUM] CVE-2023-52834: linux - In the Linux kernel, the following vulnerability has been resolved: atl1c: Work... In the Linux kernel, the following vulnerability has been resolved: atl1c: Work around the DMA RX overflow issue This is based on alx driver commit 881d0327db37 ("net: alx: Work around the DMA RX overflow issue"). The alx and atl1c drivers had RX overflow error which was why a custom allocator was created to avoid certain addresses. The simpler workaround then creat

CVE-2023-52610 [MEDIUM] CVE-2023-52610: linux - In the Linux kernel, the following vulnerability has been resolved: net/sched: ... In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix skb leak and crash on ooo frags act_ct adds skb->users before defragmentation. If frags arrive in order, the last frag's reference is reset in: inet_frag_reasm_prepare skb_morph which is not straightforward. However when frags arrive out of order, nobody unref the last frag, a

CVE-2021-46983 [MEDIUM] CVE-2021-46983: linux - In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma:... In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: Fix NULL deref when SEND is completed with error When running some traffic and taking down the link on peer, a retry counter exceeded error is received. This leads to nvmet_rdma_error_comp which tried accessing the cq_context to obtain the queue. The cq_context is no longer valid after t

CVE-2022-49065 [MEDIUM] CVE-2022-49065: linux - In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix... In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix the svc_deferred_event trace class Fix a NULL deref crash that occurs when an svc_rqst is deferred while the sunrpc tracing subsystem is enabled. svc_revisit() sets dr->xprt to NULL, so it can't be relied upon in the tracepoint to provide the remote's address. Unfortunately we can't reve

CVE-2022-49325 [MEDIUM] CVE-2022-49325: linux - In the Linux kernel, the following vulnerability has been resolved: tcp: add ac... In the Linux kernel, the following vulnerability has been resolved: tcp: add accessors to read/set tp->snd_cwnd We had various bugs over the years with code breaking the assumption that tp->snd_cwnd is greater than zero. Lately, syzbot reported the WARN_ON_ONCE(!tp->prior_cwnd) added in commit 8b8a321ff72c ("tcp: fix zero cwnd in tcp_cwnd_reduction") can trigger, an

CVE-2022-48692 [MEDIUM] CVE-2022-48692: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: S... In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Set scmnd->result only when scmnd is not NULL This change fixes the following kernel NULL pointer dereference which is reproduced by blktests srp/007 occasionally. BUG: kernel NULL pointer dereference, address: 0000000000000170 PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 9 Co

CVE-2023-52991 [MEDIUM] CVE-2023-52991: linux - In the Linux kernel, the following vulnerability has been resolved: net: fix NU... In the Linux kernel, the following vulnerability has been resolved: net: fix NULL pointer in skb_segment_list Commit 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.") introduced UDP listifyed GRO. The segmentation relies on frag_list being untouched when passing through the network stack. This assumption can be broken sometimes, where frag_list itself gets pu

CVE-2025-21748 [MEDIUM] CVE-2025-21748: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix integer overflows on 32 bit systems On 32bit systems the addition operations in ipc_msg_alloc() can potentially overflow leading to memory corruption. Add bounds checking using KSMBD_IPC_MAX_PAYLOAD to avoid overflow. Scope: local bookworm: resolved (fixed in 6.1.129-1) bullseye: resolved

CVE-2021-47433 [MEDIUM] CVE-2021-47433: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix ... In the Linux kernel, the following vulnerability has been resolved: btrfs: fix abort logic in btrfs_replace_file_extents Error injection testing uncovered a case where we'd end up with a corrupt file system with a missing extent in the middle of a file. This occurs because the if statement to decide if we should abort is wrong. The only way we would abort in this ca

CVE-2024-35821 [MEDIUM] CVE-2024-35821: linux - In the Linux kernel, the following vulnerability has been resolved: ubifs: Set ... In the Linux kernel, the following vulnerability has been resolved: ubifs: Set page uptodate in the correct place Page cache reads are lockless, so setting the freshly allocated page uptodate before we've overwritten it with the data it's supposed to have in it will allow a simultaneous reader to see old data. Move the call to SetPageUptodate into ubifs_write_end(),