Debian Linux vulnerabilities

CVE-2022-4696 [HIGH] CVE-2022-4696: linux - There exists a use-after-free vulnerability in the Linux kernel through io_uring... There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_u

CVE-2016-0758 [HIGH] CVE-2016-0758: linux - Integer overflow in lib/asn1_decoder.c in the Linux kernel before 4.6 allows loc... Integer overflow in lib/asn1_decoder.c in the Linux kernel before 4.6 allows local users to gain privileges via crafted ASN.1 data. Scope: local bookworm: resolved (fixed in 4.5.4-1) bullseye: resolved (fixed in 4.5.4-1) forky: resolved (fixed in 4.5.4-1) sid: resolved (fixed in 4.5.4-1) trixie: resolved (fixed in 4.5.4-1)

CVE-2025-38563 [HIGH] CVE-2025-38563: linux - In the Linux kernel, the following vulnerability has been resolved: perf/core: ... In the Linux kernel, the following vulnerability has been resolved: perf/core: Prevent VMA split of buffer mappings The perf mmap code is careful about mmap()'ing the user page with the ringbuffer and additionally the auxiliary buffer, when the event supports it. Once the first mapping is established, subsequent mapping have to use the same offset and the same size in

CVE-2022-0330 [HIGH] CVE-2022-0330: linux - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driv... A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.15.15-2) bullseye: resolved (fixed in 5.10.92-2) forky: resolved (fixed in 5.15.15-2

CVE-2021-33200 [HIGH] CVE-2021-33200: linux - kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limi... kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation to root. In particular, there is a corner case where the off reg causes a masking direction change, which then re

CVE-2025-21704 [HIGH] CVE-2025-21704: linux - In the Linux kernel, the following vulnerability has been resolved: usb: cdc-ac... In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check control transfer buffer size before access If the first fragment is shorter than struct usb_cdc_notification, we can't calculate an expected_size. Log an error and discard the notification instead of reading lengths from memory outside the received data, which can lead to memory co

CVE-2024-49996 [HIGH] CVE-2024-49996: linux - In the Linux kernel, the following vulnerability has been resolved: cifs: Fix b... In the Linux kernel, the following vulnerability has been resolved: cifs: Fix buffer overflow when parsing NFS reparse points ReparseDataLength is sum of the InodeType size and DataBuffer size. So to get DataBuffer size it is needed to subtract InodeType's size from ReparseDataLength. Function cifs_strndup_from_utf16() is currentlly accessing buf->DataBuffer at positi

CVE-2022-1998 [HIGH] CVE-2022-1998: linux - A use after free in the Linux kernel File System notify functionality was found ... A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.16.7-1) bullseye: resolved (fixed in 5.10.103-1)

CVE-2024-40902 [HIGH] CVE-2024-40902: linux - In the Linux kernel, the following vulnerability has been resolved: jfs: xattr:... In the Linux kernel, the following vulnerability has been resolved: jfs: xattr: fix buffer overflow for invalid xattr When an xattr size is not what is expected, it is printed out to the kernel log in hex format as a form of debugging. But when that xattr size is bigger than the expected size, printing it out can cause an access off the end of the buffer. Fix this all

CVE-2023-6111 [HIGH] CVE-2023-6111: linux - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables compon... A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_trans_gc_catchall did not remove the catchall set element from the catchall_list when the argument sync is true, making it possible to free a catchall set element many times. We recommend upgrading past commit 93995

CVE-2022-48805 [HIGH] CVE-2022-48805: linux - In the Linux kernel, the following vulnerability has been resolved: net: usb: a... In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup ax88179_rx_fixup() contains several out-of-bounds accesses that can be triggered by a malicious (or defective) USB device, in particular: - The metadata array (hdr_off..hdr_off+2*pkt_cnt) can be out of bounds, causing OOB reads and (on big

CVE-2023-6040 [HIGH] CVE-2023-6040: linux - An out-of-bounds access vulnerability involving netfilter was reported and fixed... An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an attacker to achieve out-of-bounds access. Scope: local bookwor

CVE-2023-4207 [HIGH] CVE-2023-4207: linux - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component... A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called

CVE-2024-41000 [HIGH] CVE-2024-41000: linux - In the Linux kernel, the following vulnerability has been resolved: block/ioctl... In the Linux kernel, the following vulnerability has been resolved: block/ioctl: prefer different overflow check Running syzkaller with the newly reintroduced signed integer overflow sanitizer shows this report: [ 62.982337] ------------[ cut here ]------------ [ 62.985692] cgroup: Invalid name [ 62.986211] UBSAN: signed-integer-overflow in ../block/ioctl.c:36:46 [ 62

CVE-2022-49581 [HIGH] CVE-2022-49581: linux - In the Linux kernel, the following vulnerability has been resolved: be2net: Fix... In the Linux kernel, the following vulnerability has been resolved: be2net: Fix buffer overflow in be_get_module_eeprom be_cmd_read_port_transceiver_data assumes that it is given a buffer that is at least PAGE_DATA_LEN long, or twice that if the module supports SFF 8472. However, this is not always the case. Fix this by passing the desired offset and length to be_cmd_

CVE-2023-4208 [HIGH] CVE-2023-4208: linux - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 componen... A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always calle

CVE-2023-4623 [HIGH] CVE-2023-4623: linux - A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC q... A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skippe

CVE-2024-46740 [HIGH] CVE-2024-46740: linux - In the Linux kernel, the following vulnerability has been resolved: binder: fix... In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF caused by offsets overwrite Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied as well. However, this raw data copy lacks an out-of-bounds check. If the raw data exceeds the data section size

CVE-2025-39866 [HIGH] CVE-2025-39866: linux - In the Linux kernel, the following vulnerability has been resolved: fs: writeba... In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1 ...... pstate: 60400005 (nZCv daif +PAN -UAO -TCO

CVE-2024-41039 [HIGH] CVE-2024-41039: linux - In the Linux kernel, the following vulnerability has been resolved: firmware: c... In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Fix overflow checking of wmfw header Fix the checking that firmware file buffer is large enough for the wmfw header, to prevent overrunning the buffer. The original code tested that the firmware data buffer contained enough bytes for the sums of the size of the structs wmfw_header +