Debian Linux vulnerabilities

CVE-2022-48744 [HIGH] CVE-2022-48744: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: ... In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid field-overflowing memcpy() In preparation for FORTIFY_SOURCE performing compile-time and run-time field bounds checking for memcpy(), memmove(), and memset(), avoid intentionally writing across neighboring fields. Use flexible arrays instead of zero-element arrays (which look like the

CVE-2019-15239 [HIGH] CVE-2019-15239: linux - In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly ... In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connect

CVE-2025-22088 [HIGH] CVE-2025-22088: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma:... In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() After the erdma_cep_put(new_cep) being called, new_cep will be freed, and the following dereference will cause a UAF problem. Fix this issue. Scope: local bookworm: resolved (fixed in 6.1.135-1) bullseye: resolved forky: resolved (fixed in 6

CVE-2024-26779 [MEDIUM] CVE-2024-26779: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80... In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix race condition on enabling fast-xmit fast-xmit must only be enabled after the sta has been uploaded to the driver, otherwise it could end up passing the not-yet-uploaded sta via drv_tx calls to the driver, leading to potential crashes because of uninitialized drv_priv data. Add a

CVE-2024-50047 [HIGH] CVE-2024-50047: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in async decryption Doing an async decryption (large read) crashes with a slab-use-after-free way down in the crypto API. Reproducer: # mount.cifs -o ...,seal,esize=1 //srv/share /mnt # dd if=/mnt/largefile of=/dev/null ... [ 194.196391] ===========================================

CVE-2023-3776 [HIGH] CVE-2023-3776: linux - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component... A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can c

CVE-2023-3609 [HIGH] CVE-2023-3609: linux - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 componen... A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can

CVE-2023-2124 [HIGH] CVE-2023-2124: linux - An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file sys... An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed

CVE-2025-38734 [HIGH] CVE-2025-38734: linux - In the Linux kernel, the following vulnerability has been resolved: net/smc: fi... In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on smcsk after smc_listen_out() BPF CI testing report a UAF issue: [ 16.446633] BUG: kernel NULL pointer dereference, address: 000000000000003 0 [ 16.447134] #PF: supervisor read access in kernel mod e [ 16.447516] #PF: error_code(0x0000) - not-present pag e [ 16.447878] PGD 0 P4D 0 [

CVE-2022-21546 [HIGH] CVE-2022-21546: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: targe... In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITE_SAME No Data Buffer crash In newer version of the SBC specs, we have a NDOB bit that indicates there is no data buffer that gets written out. If this bit is set using commands like "sg_write_same --ndob" we will crash in target_core_iblock/file's execute_write_same handlers whe

CVE-2022-4696 [HIGH] CVE-2022-4696: linux - There exists a use-after-free vulnerability in the Linux kernel through io_uring... There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_u

CVE-2022-50235 [HIGH] CVE-2022-50235: linux - In the Linux kernel, the following vulnerability has been resolved: NFSD: Prote... In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READDIR Restore the previous limit on the @count argument to prevent a buffer overflow attack. Scope: local bookworm: resolved (fixed in 6.0.3-1) bullseye: resolved (fixed in 5.10.221-1) forky: resolved (fixed in 6.0.3-1) sid: resolved (fixed in 6.0.

CVE-2023-46838 [HIGH] CVE-2023-46838: linux - Transmit requests in Xen's virtual network protocol can consist of multiple part... Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides a certain initial portion of the to be transferred data, these parts are directly translated into what Linux calls SKB fragments. Such converted request parts can,

CVE-2023-3777 [HIGH] CVE-2023-3777: linux - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables compon... A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances. We recommend upgrading past commit 6eaf41e87a223ae6f8e7

CVE-2016-0758 [HIGH] CVE-2016-0758: linux - Integer overflow in lib/asn1_decoder.c in the Linux kernel before 4.6 allows loc... Integer overflow in lib/asn1_decoder.c in the Linux kernel before 4.6 allows local users to gain privileges via crafted ASN.1 data. Scope: local bookworm: resolved (fixed in 4.5.4-1) bullseye: resolved (fixed in 4.5.4-1) forky: resolved (fixed in 4.5.4-1) sid: resolved (fixed in 4.5.4-1) trixie: resolved (fixed in 4.5.4-1)

CVE-2022-0330 [HIGH] CVE-2022-0330: linux - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driv... A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.15.15-2) bullseye: resolved (fixed in 5.10.92-2) forky: resolved (fixed in 5.15.15-2

CVE-2021-33200 [HIGH] CVE-2021-33200: linux - kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limi... kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation to root. In particular, there is a corner case where the off reg causes a masking direction change, which then re

CVE-2025-21704 [HIGH] CVE-2025-21704: linux - In the Linux kernel, the following vulnerability has been resolved: usb: cdc-ac... In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check control transfer buffer size before access If the first fragment is shorter than struct usb_cdc_notification, we can't calculate an expected_size. Log an error and discard the notification instead of reading lengths from memory outside the received data, which can lead to memory co

CVE-2022-0500 [HIGH] CVE-2022-0500: linux - A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a po... A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.16.10-1) bullseye: open forky: resolved (fixed in 5.16.10-1) s

CVE-2023-20938 [HIGH] CVE-2023-20938: linux - In binder_transaction_buffer_release of binder.c, there is a possible use after ... In binder_transaction_buffer_release of binder.c, there is a possible use after free due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-257685302References: Upstream kernel Scope: local bo