Debian Linux vulnerabilities

CVE-2023-42753 [HIGH] CVE-2023-42753: linux - An array indexing vulnerability was found in the netfilter subsystem of the Linu... An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on

CVE-2023-6535 [MEDIUM] CVE-2023-6535: linux - A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unau... A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: resolved (fixed

CVE-2023-6536 [MEDIUM] CVE-2023-6536: linux - A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unau... A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: resolved (fixed

CVE-2023-6356 [MEDIUM] CVE-2023-6356: linux - A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unau... A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver and causing kernel panic and a denial of service. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: resolved (fix

CVE-2024-26828 [MEDIUM] CVE-2024-26828: linux - In the Linux kernel, the following vulnerability has been resolved: cifs: fix u... In the Linux kernel, the following vulnerability has been resolved: cifs: fix underflow in parse_server_interfaces() In this loop, we step through the buffer and after each item we check if the size_left is greater than the minimum size we need. However, the problem is that "bytes_left" is type ssize_t while sizeof() is type size_t. That means that because of type p

CVE-2019-9003 [HIGH] CVE-2019-9003: linux - In the Linux kernel before 4.20.5, attackers can trigger a drivers/char/ipmi/ipm... In the Linux kernel before 4.20.5, attackers can trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a "service ipmievd restart" loop. Scope: local bookworm: resolved (fixed in 4.19.20-1) bullseye: resolved (fixed in 4.19.20-1) forky: resolved (fixed in 4.19.20-1) sid: reso

CVE-2015-4004 [HIGH] CVE-2015-4004: linux - The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted lengt... The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted length field during packet parsing, which allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via a crafted packet. Scope: local bookworm: resolved (fixed in 4.3-1) bullseye: resolved (fixed in 4.3-1) forky:

CVE-2024-35843 [MEDIUM] CVE-2024-35843: linux - In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d:... In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Use device rbtree in iopf reporting path The existing I/O page fault handler currently locates the PCI device by calling pci_get_domain_bus_and_slot(). This function searches the list of all PCI devices until the desired device is found. To improve lookup efficiency, replace it with devi

CVE-2019-15538 [HIGH] CVE-2019-15538: linux - An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux... An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if

CVE-2016-7910 [HIGH] CVE-2016-7910: linux - Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in ... Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in the Linux kernel before 4.7.1 allows local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed. Scope: local bookworm: resolved (fixed in 4.7.2-1) bullseye: resolved (fixed in 4.7.2-1) forky: resolved (fixed in

CVE-2017-0786 [HIGH] CVE-2017-0786: linux - A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: An... A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37351060. References: B-V2017060101. Scope: local bookworm: resolved (fixed in 4.13.4-2) bullseye: resolved (fixed in 4.13.4-2) forky: resolved (fixed in 4.13.4-2) sid: resolved (fixed in 4.13.4-2) trixie: resolved (fixed in 4.13.4-2)

CVE-2026-23193 [HIGH] CVE-2026-23193: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: targe... In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() In iscsit_dec_session_usage_count(), the function calls complete() while holding the sess->session_usage_lock. Similar to the connection usage count logic, the waiter signaled by complete() (e.g., in the session release path)

CVE-2021-38207 [HIGH] CVE-2021-38207: linux - drivers/net/ethernet/xilinx/ll_temac_main.c in the Linux kernel before 5.12.13 a... drivers/net/ethernet/xilinx/ll_temac_main.c in the Linux kernel before 5.12.13 allows remote attackers to cause a denial of service (buffer overflow and lockup) by sending heavy network traffic for about ten minutes. Scope: local bookworm: resolved (fixed in 5.10.46-1) bullseye: resolved (fixed in 5.10.46-1) forky: resolved (fixed in 5.10.46-1) sid: resolved (fixed in

CVE-2018-9363 [HIGH] CVE-2018-9363: linux - In the hidp_process_report in bluetooth, there is an integer overflow. This coul... In the hidp_process_report in bluetooth, there is an integer overflow. This could lead to an out of bounds write with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-65853588 References: Upstream kernel. Scope: local bookworm: resolved (fixed in 4.17.15-1) bullseye: resol

CVE-2018-16884 [HIGH] CVE-2018-16884: linux - A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted i... A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation c

CVE-2021-47023 [HIGH] CVE-2021-47023: linux - In the Linux kernel, the following vulnerability has been resolved: net: marvel... In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: fix port event handling on init For some reason there might be a crash during ports creation if port events are handling at the same time because fw may send initial port event with down state. The crash points to cancel_delayed_work() which is called when port went is down. Cu

CVE-2017-7184 [HIGH] CVE-2017-7184: linux - The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel ... The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, which allows local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability, as demonstrated during a Pwn2Own competition at Can

CVE-2025-38501 [HIGH] CVE-2025-38501: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: limi... In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit repeated connections from clients with the same IP Repeated connections from clients with the same IP address may exhaust the max connections and prevent other normal client connections. This patch limit repeated connections from clients with the same IP. Scope: local bookworm: resolved (

CVE-2024-36913 [HIGH] CVE-2024-36913: linux - In the Linux kernel, the following vulnerability has been resolved: Drivers: hv... In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoi

CVE-2018-1087 [HIGH] CVE-2018-1087: linux - kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel... kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather