Debian Linux vulnerabilities

CVE-2025-21720 [MEDIUM] CVE-2025-21720: linux - In the Linux kernel, the following vulnerability has been resolved: xfrm: delet... In the Linux kernel, the following vulnerability has been resolved: xfrm: delete intermediate secpath entry in packet offload mode Packets handled by hardware have added secpath as a way to inform XFRM core code that this path was already handled. That secpath is not needed at all after policy is checked and it is removed later in the stack. However, in the case of

CVE-2025-38737 [MEDIUM] CVE-2025-38737: linux - In the Linux kernel, the following vulnerability has been resolved: cifs: Fix o... In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uninitialised variable Fix smb3_init_transform_rq() to initialise buffer to NULL before calling netfs_alloc_folioq_buffer() as netfs assumes it can append to the buffer it is given. Setting it to NULL means it should start a fresh buffer, but the value is currently undefined. S

CVE-2021-26932 [MEDIUM] CVE-2021-26932: linux - An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen.... An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the succ

CVE-2021-43056 [MEDIUM] CVE-2021-43056: linux - An issue was discovered in the Linux kernel for powerpc before 5.14.15. It allow... An issue was discovered in the Linux kernel for powerpc before 5.14.15. It allows a malicious KVM guest to crash the host, when the host is running on Power8, due to an arch/powerpc/kvm/book3s_hv_rmhandlers.S implementation bug in the handling of the SRR1 register values. Scope: local bookworm: resolved (fixed in 5.14.16-1) bullseye: resolved (fixed in 5.10.84-1) fo

CVE-2025-38379 [MEDIUM] CVE-2025-38379: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: fix warning when reconnecting channel When reconnecting a channel in smb2_reconnect_server(), a dummy tcon is passed down to smb2_reconnect() with ->query_interface uninitialized, so we can't call queue_delayed_work() on it. Fix the following warning by ensuring that we're queueing the

CVE-2021-45095 [MEDIUM] CVE-2021-45095: linux - pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a ref... pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak. Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved (fixed in 5.10.92-1) forky: resolved (fixed in 5.15.15-1) sid: resolved (fixed in 5.15.15-1) trixie: resolved (fixed in 5.15.15-1)

CVE-2020-12656 [MEDIUM] CVE-2020-12656: linux - gss_mech_free in net/sunrpc/auth_gss/gss_mech_switch.c in the rpcsec_gss_krb5 im... gss_mech_free in net/sunrpc/auth_gss/gss_mech_switch.c in the rpcsec_gss_krb5 implementation in the Linux kernel through 5.6.10 lacks certain domain_release calls, leading to a memory leak. Note: This was disputed with the assertion that the issue does not grant any access not already available. It is a problem that on unloading a specific kernel module some memory

CVE-2021-47183 [MEDIUM] CVE-2021-47183: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc:... In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix link down processing to address NULL pointer dereference If an FC link down transition while PLOGIs are outstanding to fabric well known addresses, outstanding ABTS requests may result in a NULL pointer dereference. Driver unload requests may hang with repeated "2878" log messages. T

CVE-2024-26633 [MEDIUM] CVE-2024-26633: linux - In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel:... In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken. Reading frag_off can only be done if we pulled enough bytes to skb->head. Currently we might access garbage. [1] BUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc

CVE-2022-1516 [MEDIUM] CVE-2022-1516: linux - A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of stan... A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network protocols functionality in the way a user terminates their session using a simulated Ethernet card and continued usage of this connection. This flaw allows a local user to crash the system. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.

CVE-2025-38571 [MEDIUM] CVE-2025-38571: linux - In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix... In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix client side handling of tls alerts A security exploit was discovered in NFS over TLS in tls_alert_recv due to its assumption that there is valid data in the msghdr's iterator's kvec. Instead, this patch proposes the rework how control messages are setup and used by sock_recvmsg(). If no

CVE-2022-49532 [MEDIUM] CVE-2022-49532: linux - In the Linux kernel, the following vulnerability has been resolved: drm/virtio:... In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes drm_cvt_mode may return NULL and we should check it. This bug is found by syzkaller: FAULT_INJECTION stacktrace: [ 168.567394] FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 [ 168.56

CVE-2025-21900 [MEDIUM] CVE-2025-21900: linux - In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix ... In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix a deadlock when recovering state on a sillyrenamed file If the file is sillyrenamed, and slated for delete on close, it is possible for a server reboot to triggeer an open reclaim, with can again race with the application call to close(). When that happens, the call to put_nfs_open_contex

CVE-2022-4662 [MEDIUM] CVE-2022-4662: linux - A flaw incorrect access control in the Linux kernel USB core subsystem was found... A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A local user could use this flaw to crash the system. Scope: local bookworm: resolved (fixed in 5.19.11-1) bullseye: resolved (fixed in 5.10.148-1) forky: resolved (fixed in 5.19.11-1) sid: resolved (fixed in 5.19.11-1) trixie: resolved (fixed in 5.19.

CVE-2020-10781 [MEDIUM] CVE-2020-10781: linux - A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, w... A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device. With this vulnerability

CVE-2021-29646 [MEDIUM] CVE-2021-29646: linux - An issue was discovered in the Linux kernel before 5.11.11. tipc_nl_retrieve_key... An issue was discovered in the Linux kernel before 5.11.11. tipc_nl_retrieve_key in net/tipc/node.c does not properly validate certain data sizes, aka CID-0217ed2848e8. Scope: local bookworm: resolved (fixed in 5.10.28-1) bullseye: resolved (fixed in 5.10.28-1) forky: resolved (fixed in 5.10.28-1) sid: resolved (fixed in 5.10.28-1) trixie: resolved (fixed in 5.10.28

CVE-2024-23849 [MEDIUM] CVE-2024-23849: linux - In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1,... In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resulting in out-of-bounds access. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.6.15-1) sid: resolved (fixed in 6.6.15-1) trixie: resolv

CVE-2022-49122 [MEDIUM] CVE-2022-49122: linux - In the Linux kernel, the following vulnerability has been resolved: dm ioctl: p... In the Linux kernel, the following vulnerability has been resolved: dm ioctl: prevent potential spectre v1 gadget It appears like cmd could be a Spectre v1 gadget as it's supplied by a user and used as an array index. Prevent the contents of kernel memory from being leaked to userspace via speculative execution by using array_index_nospec. Scope: local bookworm: res

CVE-2025-39894 [MEDIUM] CVE-2025-39894: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm When send a broadcast packet to a tap device, which was added to a bridge, br_nf_local_in() is called to confirm the conntrack. If another conntrack with the same hash value is added to the hash table, which can be

CVE-2024-39509 [MEDIUM] CVE-2024-39509: linux - In the Linux kernel, the following vulnerability has been resolved: HID: core: ... In the Linux kernel, the following vulnerability has been resolved: HID: core: remove unnecessary WARN_ON() in implement() Syzkaller hit a warning [1] in a call to implement() when trying to write a value into a field of smaller size in an output report. Since implement() already has a warn message printed out with the help of hid_warn() and value in question gets t