Debian Linux vulnerabilities

CVE-2016-3156 [MEDIUM] CVE-2016-3156: linux - The IPv4 implementation in the Linux kernel before 4.5.2 mishandles destruction ... The IPv4 implementation in the Linux kernel before 4.5.2 mishandles destruction of device objects, which allows guest OS users to cause a denial of service (host OS networking outage) by arranging for a large number of IP addresses. Scope: local bookworm: resolved (fixed in 4.5.1-1) bullseye: resolved (fixed in 4.5.1-1) forky: resolved (fixed in 4.5.1-1) sid: resolved

CVE-2021-47136 [MEDIUM] CVE-2021-47136: linux - In the Linux kernel, the following vulnerability has been resolved: net: zero-i... In the Linux kernel, the following vulnerability has been resolved: net: zero-initialize tc skb extension on allocation Function skb_ext_add() doesn't initialize created skb extension with any value and leaves it up to the user. However, since extension of type TC_SKB_EXT originally contained only single value tc_skb_ext->chain its users used to just assign the chai

CVE-2018-10940 [MEDIUM] CVE-2018-10940: linux - The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux ker... The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory. Scope: local bookworm: resolved (fixed in 4.16.12-1) bullseye: resolved (fixed in 4.16.12-1) forky: resolved (fixed in 4.16.12-1) sid: resolve

CVE-2019-3882 [MEDIUM] CVE-2019-3882: linux - A flaw was found in the Linux kernel's vfio interface implementation that permit... A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). Versions 3.10, 4.14 and 4.18 are v

CVE-2022-49418 [MEDIUM] CVE-2022-49418: linux - In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix ... In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix free of uninitialized nfs4_label on referral lookup. Send along the already-allocated fattr along with nfs4_fs_locations, and drop the memcpy of fattr. We end up growing two more allocations, but this fixes up a crash as: PID: 790 TASK: ffff88811b43c000 CPU: 0 COMMAND: "ls" #0 [ffffc90000

CVE-2018-1000200 [MEDIUM] CVE-2018-1000200: linux - The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference wh... The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out of memory (OOM) killing of large mlocked processes. The issue arises from an oom killed process's final thread calling exit_mmap(), which calls munlock_vma_pages_all() for mlocked vmas.This can happen synchronously with the oom reaper's unmap_page_range() sin

CVE-2025-38430 [MEDIUM] CVE-2025-38430: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4... In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request If the request being processed is not a v4 compound request, then examining the cstate can have undefined results. This patch adds a check that the rpc procedure being executed (rq_procinfo) is the NFSPROC4_COMPOUND procedure. Sco

CVE-2021-47041 [MEDIUM] CVE-2021-47041: linux - In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: ... In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix incorrect locking in state_change sk callback We are not changing anything in the TCP connection state so we should not take a write_lock but rather a read lock. This caused a deadlock when running nvmet-tcp and nvme-tcp on the same system, where state_change callbacks on the host and

CVE-2025-38035 [MEDIUM] CVE-2025-38035: linux - In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: ... In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: don't restore null sk_state_change queue->state_change is set as part of nvmet_tcp_set_queue_sock(), but if the TCP connection isn't established when nvmet_tcp_set_queue_sock() is called then queue->state_change isn't set and sock->sk->sk_state_change isn't replaced. As such we don't need

CVE-2022-49872 [MEDIUM] CVE-2022-49872: linux - In the Linux kernel, the following vulnerability has been resolved: net: gso: f... In the Linux kernel, the following vulnerability has been resolved: net: gso: fix panic on frag_list with mixed head alloc types Since commit 3dcbdb134f32 ("net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list"), it is allowed to change gso_size of a GRO packet. However, that commit assumes that "checking the first list_

CVE-2025-21960 [MEDIUM] CVE-2025-21960: linux - In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: ... In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: do not update checksum in bnxt_xdp_build_skb() The bnxt_rx_pkt() updates ip_summed value at the end if checksum offload is enabled. When the XDP-MB program is attached and it returns XDP_PASS, the bnxt_xdp_build_skb() is called to update skb_shared_info. The main purpose of bnxt_xdp_build

CVE-2023-53083 [MEDIUM] CVE-2023-53083: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: don't... In the Linux kernel, the following vulnerability has been resolved: nfsd: don't replace page in rq_pages if it's a continuation of last page The splice read calls nfsd_splice_actor to put the pages containing file data into the svc_rqst->rq_pages array. It's possible however to get a splice result that only has a partial page at the end, if (e.g.) the filesystem han

CVE-2022-3586 [MEDIUM] CVE-2022-3586: linux - A flaw was found in the Linux kernel’s networking code. A use-after-free was fou... A flaw was found in the Linux kernel’s networking code. A use-after-free was found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed) into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a denial of service. Scope: local bookworm: resolved (fixed in 5.19

CVE-2014-7975 [MEDIUM] CVE-2014-7975: linux - The do_umount function in fs/namespace.c in the Linux kernel through 3.17 does n... The do_umount function in fs/namespace.c in the Linux kernel through 3.17 does not require the CAP_SYS_ADMIN capability for do_remount_sb calls that change the root filesystem to read-only, which allows local users to cause a denial of service (loss of writability) by making certain unshare system calls, clearing the / MNT_LOCKED flag, and making an MNT_FORCE umount s

CVE-2017-2618 [MEDIUM] CVE-2017-2618: linux - A flaw was found in the Linux kernel's handling of clearing SELinux attributes o... A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An empty (null) write to this file can crash the system by causing the system to attempt to access unmapped kernel memory. Scope: local bookworm: resolved (fixed in 4.9.10-1) bullseye: resolved (fixed in 4.9.10-1) forky: resolved (fixed in 4.9.10-1) si

CVE-2020-12655 [MEDIUM] CVE-2020-12655: linux - An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Li... An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through 5.6.10. Attackers may trigger a sync of excessive duration via an XFS v5 image with crafted metadata, aka CID-d0c7feaf8767. Scope: local bookworm: resolved (fixed in 5.6.14-1) bullseye: resolved (fixed in 5.6.14-1) forky: resolved (fixed in 5.6.14-1) sid: resolved (fix

CVE-2023-53110 [MEDIUM] CVE-2023-53110: linux - In the Linux kernel, the following vulnerability has been resolved: net/smc: fi... In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler() When performing a stress test on SMC-R by rmmod mlx5_ib driver during the wrk/nginx test, we found that there is a probability of triggering a panic while terminating all link groups. This issue dues to the race between smc_smcr_terminate_all() a

CVE-2016-9756 [MEDIUM] CVE-2016-9756: linux - arch/x86/kvm/emulate.c in the Linux kernel before 4.8.12 does not properly initi... arch/x86/kvm/emulate.c in the Linux kernel before 4.8.12 does not properly initialize Code Segment (CS) in certain error cases, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. Scope: local bookworm: resolved (fixed in 4.8.15-1) bullseye: resolved (fixed in 4.8.15-1) forky: resolved (fixed in 4.8.15-1) sid: r

CVE-2017-5549 [MEDIUM] CVE-2017-5549: linux - The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the L... The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5 places uninitialized heap-memory contents into a log entry upon a failure to read the line status, which allows local users to obtain sensitive information by reading the log. Scope: local bookworm: resolved (fixed in 4.9.6-1) bullseye: resolved (fixed in 4.9.6-1)

CVE-2025-22021 [MEDIUM] CVE-2025-22021: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6 SNAT nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to restore the original 5-tuple in case of SNAT, to be able to find the right socket (if any). Then socket_match() can correctly check whether the socket was transparent. However, the I