Debian Linux vulnerabilities

CVE-2022-30594 [HIGH] CVE-2022-30594: linux - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE ... The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed in 5.17.3-1) sid: resolved (fixed in 5.17.3-1) trixie: resolved (fixed in 5

CVE-2024-27398 [HIGH] CVE-2024-27398: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout When the sco connection is established and then, the sco socket is releasing, timeout_work will be scheduled to judge whether the sco disconnection is timeout. The sock will be deallocated later, but it is dereferenced again in sco_sock_tim

CVE-2014-0100 [CRITICAL] CVE-2014-0100: linux - Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in t... Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in the Linux kernel through 3.13.6 allows remote attackers to cause a denial of service (use-after-free error) or possibly have unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with a heavy CPU load. Scope: local bookworm: resolved (fixed in 3.1

CVE-2014-3673 [HIGH] CVE-2014-3673: linux - The SCTP implementation in the Linux kernel through 3.17.2 allows remote attacke... The SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c. Scope: local bookworm: resolved (fixed in 3.16.7-1) bullseye: resolved (fixed in 3.16.7-1) forky: resolved (fixed in 3.16.7-1) sid: resolved (fixed in

CVE-2024-36904 [HIGH] CVE-2024-36904: linux - In the Linux kernel, the following vulnerability has been resolved: tcp: Use re... In the Linux kernel, the following vulnerability has been resolved: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). Anderson Nascimento reported a use-after-free splat in tcp_twsk_unique() with nice analysis. Since commit ec94c2696f0b ("tcp/dccp: avoid one atomic operation for timewait hashdance"), inet_twsk_hashdance() sets TIME-WAIT socket's sk_refcnt after p

CVE-2021-3444 [HIGH] CVE-2021-3444: linux - The bpf verifier in the Linux kernel did not properly handle mod32 destination r... The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and possibly out-of-bounds writes that could potentially lead to c

CVE-2025-21692 [HIGH] CVE-2025-21692: linux - In the Linux kernel, the following vulnerability has been resolved: net: sched:... In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ets qdisc OOB Indexing Haowei Yan found that ets_class_from_arg() can index an Out-Of-Bound class in ets_class_from_arg() when passed clid of 0. The overflow may cause local privilege escalation. [ 18.852298] ------------[ cut here ]------------ [ 18.853271] UBSAN: array-index-out-of-b

CVE-2019-15239 [HIGH] CVE-2019-15239: linux - In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly ... In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connect

CVE-2023-31436 [HIGH] CVE-2023-31436: linux - qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows... qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX. Scope: local bookworm: resolved (fixed in 6.1.27-1) bullseye: resolved (fixed in 5.10.179-1) forky: resolved (fixed in 6.1.27-1) sid: resolved (fixed in 6.1.27-1) trixie: resolved (fixed in 6.1.27-1)

CVE-2022-20421 [HIGH] CVE-2022-20421: linux - In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memor... In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239630375References: Upstream kernel Scope: local bookworm: reso

CVE-2017-17806 [HIGH] CVE-2017-17806: linux - The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does n... The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequ

CVE-2023-35788 [HIGH] CVE-2023-35788: linux - An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Li... An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved (fixed in 5.10.191-1) for

CVE-2020-0423 [HIGH] CVE-2020-0423: linux - In binder_release_work of binder.c, there is a possible use-after-free due to im... In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-161151868References: N/A Scope: local bookworm: resolved (fixed

CVE-2025-22088 [HIGH] CVE-2025-22088: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma:... In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() After the erdma_cep_put(new_cep) being called, new_cep will be freed, and the following dereference will cause a UAF problem. Fix this issue. Scope: local bookworm: resolved (fixed in 6.1.135-1) bullseye: resolved forky: resolved (fixed in 6

CVE-2023-2124 [HIGH] CVE-2023-2124: linux - An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file sys... An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed

CVE-2025-37947 [HIGH] CVE-2025-37947: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: prev... In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds stream writes by validating *pos ksmbd_vfs_stream_write() did not validate whether the write offset (*pos) was within the bounds of the existing stream data length (v_len). If *pos was greater than or equal to v_len, this could lead to an out-of-bounds memory write. This p

CVE-2021-39685 [HIGH] CVE-2021-39685: linux - In various setup methods of the USB gadget subsystem, there is a possible out of... In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210292376References: Upstream kernel Scope: l

CVE-2023-3609 [HIGH] CVE-2023-3609: linux - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 componen... A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can

CVE-2023-46838 [HIGH] CVE-2023-46838: linux - Transmit requests in Xen's virtual network protocol can consist of multiple part... Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides a certain initial portion of the to be transferred data, these parts are directly translated into what Linux calls SKB fragments. Such converted request parts can,

CVE-2023-3777 [HIGH] CVE-2023-3777: linux - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables compon... A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances. We recommend upgrading past commit 6eaf41e87a223ae6f8e7