Debian Linux vulnerabilities

CVE-2024-41032 [MEDIUM] CVE-2024-41032: linux - In the Linux kernel, the following vulnerability has been resolved: mm: vmalloc... In the Linux kernel, the following vulnerability has been resolved: mm: vmalloc: check if a hash-index is in cpu_possible_mask The problem is that there are systems where cpu_possible_mask has gaps between set CPUs, for example SPARC. In this scenario addr_to_vb_xa() hash function can return an index which accesses to not-possible and not setup CPU area using per_cp

CVE-2024-40923 [MEDIUM] CVE-2024-40923: linux - In the Linux kernel, the following vulnerability has been resolved: vmxnet3: di... In the Linux kernel, the following vulnerability has been resolved: vmxnet3: disable rx data ring on dma allocation failure When vmxnet3_rq_create() fails to allocate memory for rq->data_ring.base, the subsequent call to vmxnet3_rq_destroy_all_rxdataring does not reset rq->data_ring.desc_size for the data ring that failed, which presumably causes the hypervisor to r

CVE-2021-47092 [MEDIUM] CVE-2021-47092: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: A... In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Always clear vmx->fail on emulation_required Revert a relatively recent change that set vmx->fail if the vCPU is in L2 and emulation_required is true, as that behavior is completely bogus. Setting vmx->fail and synthesizing a VM-Exit is contradictory and wrong: (a) it's impossible to have

CVE-2024-42318 [MEDIUM] CVE-2024-42318: linux - In the Linux kernel, the following vulnerability has been resolved: landlock: D... In the Linux kernel, the following vulnerability has been resolved: landlock: Don't lose track of restrictions on cred_transfer When a process' cred struct is replaced, this _almost_ always invokes the cred_prepare LSM hook; but in one special case (when KEYCTL_SESSION_TO_PARENT updates the parent's credentials), the cred_transfer LSM hook is used instead. Landlock

CVE-2022-48652 [MEDIUM] CVE-2022-48652: linux - In the Linux kernel, the following vulnerability has been resolved: ice: Fix cr... In the Linux kernel, the following vulnerability has been resolved: ice: Fix crash by keep old cfg when update TCs more than queues There are problems if allocated queues less than Traffic Classes. Commit a632b2a4c920 ("ice: ethtool: Prohibit improper channel config for DCB") already disallow setting less queues than TCs. Another case is if we first set less queues,

CVE-2025-39857 [MEDIUM] CVE-2025-39857: linux - In the Linux kernel, the following vulnerability has been resolved: net/smc: fi... In the Linux kernel, the following vulnerability has been resolved: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() BUG: kernel NULL pointer dereference, address: 00000000000002ec PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 28 UID: 0 PID: 343 Comm: kworker/28:1 Kdump: loaded Tainted: G OE 6.17.0-rc2+ #9 NONE Tainted: [O]=OOT_MODULE, [E]=UNSI

CVE-2024-49863 [MEDIUM] CVE-2024-49863: linux - In the Linux kernel, the following vulnerability has been resolved: vhost/scsi:... In the Linux kernel, the following vulnerability has been resolved: vhost/scsi: null-ptr-dereference in vhost_scsi_get_req() Since commit 3f8ca2e115e5 ("vhost/scsi: Extract common handling code from control queue handler") a null pointer dereference bug can be triggered when guest sends an SCSI AN request. In vhost_scsi_ctl_handle_vq(), `vc.target` is assigned with

CVE-2022-1184 [MEDIUM] CVE-2022-1184: linux - A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linu... A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service. Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved (fixed in 5.10.149-1) forky: resolved (fixed in 5.19.6-1) sid: resolved (fixed in 5.19.6-1) trix

CVE-2024-36933 [MEDIUM] CVE-2024-36933: linux - In the Linux kernel, the following vulnerability has been resolved: nsh: Restor... In the Linux kernel, the following vulnerability has been resolved: nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). syzbot triggered various splats (see [0] and links) by a crafted GSO packet of VIRTIO_NET_HDR_GSO_UDP layering the following protocols: ETH_P_8021AD + ETH_P_NSH + ETH_P_IPV6 + IPPROTO_UDP NSH can encapsulate IPv4, IP

CVE-2022-49297 [MEDIUM] CVE-2022-49297: linux - In the Linux kernel, the following vulnerability has been resolved: nbd: fix io... In the Linux kernel, the following vulnerability has been resolved: nbd: fix io hung while disconnecting device In our tests, "qemu-nbd" triggers a io hung: INFO: task qemu-nbd:11445 blocked for more than 368 seconds. Not tainted 5.18.0-rc3-next-20220422-00003-g2176915513ca #884 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:qemu-nbd

CVE-2024-46745 [MEDIUM] CVE-2024-46745: linux - In the Linux kernel, the following vulnerability has been resolved: Input: uinp... In the Linux kernel, the following vulnerability has been resolved: Input: uinput - reject requests with unreasonable number of slots When exercising uinput interface syzkaller may try setting up device with a really large number of slots, which causes memory allocation failure in input_mt_init_slots(). While this allocation failure is handled properly and request i

CVE-2022-0480 [MEDIUM] CVE-2022-0480: linux - A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel... A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX) file locks. Scope: local bookworm: resolved (fixed in 5.15.3-1) bullseye: open forky: resolved (fixed in 5.15.3-1) sid: resolved (fixed in 5.15.3-1) trixie: r

CVE-2023-6560 [MEDIUM] CVE-2023-6560: linux - An out-of-bounds memory access flaw was found in the io_uring SQ/CQ rings functi... An out-of-bounds memory access flaw was found in the io_uring SQ/CQ rings functionality in the Linux kernel. This issue could allow a local user to crash the system. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.6.8-1) sid: resolved (fixed in 6.6.8-1) trixie: resolved (fixed in 6.6.8-1)

CVE-2022-49691 [MEDIUM] CVE-2022-49691: linux - In the Linux kernel, the following vulnerability has been resolved: erspan: do ... In the Linux kernel, the following vulnerability has been resolved: erspan: do not assume transport header is always set Rewrite tests in ip6erspan_tunnel_xmit() and erspan_fb_xmit() to not assume transport header is set. syzbot reported: WARNING: CPU: 0 PID: 1350 at include/linux/skbuff.h:2911 skb_transport_header include/linux/skbuff.h:2911 [inline] WARNING: CPU:

CVE-2025-38264 [MEDIUM] CVE-2025-38264: linux - In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: s... In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: sanitize request list handling Validate the request in nvme_tcp_handle_r2t() to ensure it's not part of any list, otherwise a malicious R2T PDU might inject a loop in request list processing. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 6.12.37-1) sid: resolved (fix

CVE-2024-38549 [MEDIUM] CVE-2024-38549: linux - In the Linux kernel, the following vulnerability has been resolved: drm/mediate... In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add 0 size check to mtk_drm_gem_obj Add a check to mtk_drm_gem_init if we attempt to allocate a GEM object of 0 bytes. Currently, no such check exists and the kernel will panic if a userspace application attempts to allocate a 0x0 GBM buffer. Tested by attempting to allocate a 0x0 GBM

CVE-2022-48823 [MEDIUM] CVE-2022-48823: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: qedf:... In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Fix refcount issue when LOGO is received during TMF Hung task call trace was seen during LOGO processing. [ 974.309060] [0000:00:00.0]:[qedf_eh_device_reset:868]: 1:0:2:0: LUN RESET Issued... [ 974.309065] [0000:00:00.0]:[qedf_initiate_tmf:2422]: tm_flags 0x10 sc_cmd 00000000c16b930f op

CVE-2022-48806 [MEDIUM] CVE-2022-48806: linux - In the Linux kernel, the following vulnerability has been resolved: eeprom: ee1... In the Linux kernel, the following vulnerability has been resolved: eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX Commit effa453168a7 ("i2c: i801: Don't silently correct invalid transfer size") revealed that ee1004_eeprom_read() did not properly limit how many bytes to read at once. In particular, i2c_smbus_read_i2c_block_data_or_emulated() takes the length

CVE-2022-48972 [MEDIUM] CVE-2022-48972: linux - In the Linux kernel, the following vulnerability has been resolved: mac802154: ... In the Linux kernel, the following vulnerability has been resolved: mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() Kernel fault injection test reports null-ptr-deref as follows: BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:cfg802154_netdev_notifier_call+0x120/0x310 include/linux/list.h:114 Call Trace: raw_notifier_call_chai

CVE-2022-49400 [MEDIUM] CVE-2022-49400: linux - In the Linux kernel, the following vulnerability has been resolved: md: Don't s... In the Linux kernel, the following vulnerability has been resolved: md: Don't set mddev private to NULL in raid0 pers->free In normal stop process, it does like this: do_md_stop | __md_stop (pers->free(); mddev->private=NULL) | md_free (free mddev) __md_stop sets mddev->private to NULL after pers->free. The raid device will be stopped and mddev memory is free. But i