Debian Linux vulnerabilities

CVE-2025-71142 [MEDIUM] CVE-2025-71142: linux - In the Linux kernel, the following vulnerability has been resolved: cpuset: fix... In the Linux kernel, the following vulnerability has been resolved: cpuset: fix warning when disabling remote partition A warning was triggered as follows: WARNING: kernel/cgroup/cpuset.c:1651 at remote_partition_disable+0xf7/0x110 RIP: 0010:remote_partition_disable+0xf7/0x110 RSP: 0018:ffffc90001947d88 EFLAGS: 00000206 RAX: 0000000000007fff RBX: ffff888103b6e000 RC

CVE-2026-23114 [MEDIUM] CVE-2026-23114: linux - In the Linux kernel, the following vulnerability has been resolved: arm64/fpsim... In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: ptrace: Fix SVE writes on !SME systems When SVE is supported but SME is not supported, a ptrace write to the NT_ARM_SVE regset can place the tracee into an invalid state where (non-streaming) SVE register data is stored in FP_STATE_SVE format but TIF_SVE is clear. This can result in a

CVE-2026-23122 [MEDIUM] CVE-2026-23122: linux - In the Linux kernel, the following vulnerability has been resolved: igc: Reduce... In the Linux kernel, the following vulnerability has been resolved: igc: Reduce TSN TX packet buffer from 7KB to 5KB per queue The previous 7 KB per queue caused TX unit hangs under heavy timestamping load. Reducing to 5 KB avoids these hangs and matches the TSN recommendation in I225/I226 SW User Manual Section 7.5.4. The 8 KB "freed" by this change is currently un

CVE-2022-49264 [HIGH] CVE-2022-49264: linux - In the Linux kernel, the following vulnerability has been resolved: exec: Force... In the Linux kernel, the following vulnerability has been resolved: exec: Force single empty string when argv is empty Quoting[1] Ariadne Conill: "In several other operating systems, it is a hard requirement that the second argument to execve(2) be the name of a program, thus prohibiting a scenario where argc < 1. POSIX 2017 also recommends this behaviour, but it is n

CVE-2026-23103 [HIGH] CVE-2026-23103: linux - In the Linux kernel, the following vulnerability has been resolved: ipvlan: Mak... In the Linux kernel, the following vulnerability has been resolved: ipvlan: Make the addrs_lock be per port Make the addrs_lock be per port, not per ipvlan dev. Initial code seems to be written in the assumption, that any address change must occur under RTNL. But it is not so for the case of IPv6. So 1) Introduce per-port addrs_lock. 2) It was needed to fix places whe

CVE-2022-48638 [MEDIUM] CVE-2022-48638: linux - In the Linux kernel, the following vulnerability has been resolved: cgroup: cgr... In the Linux kernel, the following vulnerability has been resolved: cgroup: cgroup_get_from_id() must check the looked-up kn is a directory cgroup has to be one kernfs dir, otherwise kernel panic is caused, especially cgroup id is provide from userspace. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: resolved forky: resolved (fixed in 6.0.2-1) sid: res

CVE-2023-34324 [MEDIUM] CVE-2023-34324: linux - Closing of an event channel in the Linux kernel can result in a deadlock. This h... Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual device on the other side. As this action will cause

CVE-2019-18660 [MEDIUM] CVE-2019-18660: linux - The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the... The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c. Scope: local bookworm: resolved (fixed in 5.3.15-1) bullseye: resolved (fixed in 5.3.15-1) forky: resolved (fixed i

CVE-2020-27170 [MEDIUM] CVE-2020-27170: linux - An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c... An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This affects pointer types that do not define a ptr_limit. Scope: local bookwo

CVE-2022-50779 CVE-2022-50779: linux - In the Linux kernel, the following vulnerability has been resolved: orangefs: F... In the Linux kernel, the following vulnerability has been resolved: orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() When insert and remove the orangefs module, then debug_help_string will be leaked: unreferenced object 0xffff8881652ba000 (size 4096): comm "insmod", pid 1701, jiffies 4294893639 (age 13218.530s) hex dump (first 32 bytes): 43 6c 69 65 6e 74 20

CVE-2022-50749 CVE-2022-50749: linux - In the Linux kernel, the following vulnerability has been resolved: acct: fix p... In the Linux kernel, the following vulnerability has been resolved: acct: fix potential integer overflow in encode_comp_t() The integer overflow is descripted with following codes: > 317 static comp_t encode_comp_t(u64 value) > 318 { > 319 int exp, rnd; ...... > 341 exp 342 exp += value; > 343 return exp; > 344 } Currently comp_t is defined as type of '__u16', but the variab

CVE-2022-50715 CVE-2022-50715: linux - In the Linux kernel, the following vulnerability has been resolved: md/raid1: s... In the Linux kernel, the following vulnerability has been resolved: md/raid1: stop mdx_raid1 thread when raid1 array run failed fail run raid1 array when we assemble array with the inactive disk only, but the mdx_raid1 thread were not stop, Even if the associated resources have been released. it will caused a NULL dereference when we do poweroff. This causes the following Oo

CVE-2022-50716 CVE-2022-50716: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ar552... In the Linux kernel, the following vulnerability has been resolved: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out syzkaller reported use-after-free with the stack trace like below [1]: [ 38.960489][ C3] ================================================================== [ 38.963216][ C3] BUG: KASAN: use-after-free in ar5523_cmd_tx_cb+0x220/0x240 [ 38.964950][ C3]

CVE-2025-68299 [LOW] CVE-2025-68299: linux - In the Linux kernel, the following vulnerability has been resolved: afs: Fix de... In the Linux kernel, the following vulnerability has been resolved: afs: Fix delayed allocation of a cell's anonymous key The allocation of a cell's anonymous key is done in a background thread along with other cell setup such as doing a DNS upcall. In the reported bug, this is triggered by afs_parse_source() parsing the device name given to mount() and calling afs_loo

CVE-2025-40001 CVE-2025-40001: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: mvsas... In the Linux kernel, the following vulnerability has been resolved: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue During the detaching of Marvell's SAS/SATA controller, the original code calls cancel_delayed_work() in mvs_free() to cancel the delayed work item mwq->work_q. However, if mwq->work_q is already running, the cancel_delayed_work() may fail to cancel it. T

CVE-2022-50563 CVE-2022-50563: linux - In the Linux kernel, the following vulnerability has been resolved: dm thin: Fi... In the Linux kernel, the following vulnerability has been resolved: dm thin: Fix UAF in run_timer_softirq() When dm_resume() and dm_destroy() are concurrent, it will lead to UAF, as follows: BUG: KASAN: use-after-free in __run_timers+0x173/0x710 Write of size 8 at addr ffff88816d9490f0 by task swapper/0/0 Call Trace: dump_stack_lvl+0x73/0x9f print_report.cold+0x132/0xaa2 _ra

CVE-2023-53841 CVE-2023-53841: linux - In the Linux kernel, the following vulnerability has been resolved: devlink: re... In the Linux kernel, the following vulnerability has been resolved: devlink: report devlink_port_type_warn source device devlink_port_type_warn is scheduled for port devlink and warning when the port type is not set. But from this warning it is not easy found out which device (driver) has no devlink port set. [ 3709.975552] Type was not set for devlink port. [ 3709.975579] W

CVE-2022-50816 CVE-2022-50816: linux - In the Linux kernel, the following vulnerability has been resolved: ipv6: ensur... In the Linux kernel, the following vulnerability has been resolved: ipv6: ensure sane device mtu in tunnels Another syzbot report [1] with no reproducer hints at a bug in ip6_gre tunnel (dev:ip6gretap0) Since ipv6 mcast code makes sure to read dev->mtu once and applies a sanity check on it (see commit b9b312a7a451 "ipv6: mcast: better catch silly mtu values"), a remaining po

CVE-2022-50767 CVE-2022-50767: linux - In the Linux kernel, the following vulnerability has been resolved: fbdev: smsc... In the Linux kernel, the following vulnerability has been resolved: fbdev: smscufx: Fix several use-after-free bugs Several types of UAFs can occur when physically removing a USB device. Adds ufx_ops_destroy() function to .fb_destroy of fb_ops, and in this function, there is kref_put() that finally calls ufx_free(). This fix prevents multiple UAFs. Scope: local bookworm: res

CVE-2022-50638 CVE-2022-50638: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: fix b... In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on in __es_tree_search caused by bad boot loader inode We got a issue as fllows: ================================================================== kernel BUG at fs/ext4/extents_status.c:203! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 1 PID: 945 Comm: cat Not tainted 6.0.0-next-20221007-dirty #