Debian Linux vulnerabilities

CVE-2024-26956 [HIGH] CVE-2024-26956: linux - In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix... In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix failure to detect DAT corruption in btree and direct mappings Patch series "nilfs2: fix kernel bug at submit_bh_wbc()". This resolves a kernel BUG reported by syzbot. Since there are two flaws involved, I've made each one a separate patch. The first patch alone resolves the syzbot-reported

CVE-2021-47598 [HIGH] CVE-2021-47598: linux - In the Linux kernel, the following vulnerability has been resolved: sch_cake: d... In the Linux kernel, the following vulnerability has been resolved: sch_cake: do not call cake_destroy() from cake_init() qdiscs are not supposed to call their own destroy() method from init(), because core stack already does that. syzbot was able to trigger use after free: DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: CPU: 0 PID: 21902 at kernel/locking/mutex.c:5

CVE-2024-0562 [HIGH] CVE-2024-0562: linux - A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi... A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to stop further write-back and waits for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation work after this has completed, which can result in the timer attempting to access the recently freed bdi_writeback. Scope: l

CVE-2024-38577 [HIGH] CVE-2024-38577: linux - In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: ... In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow There is a possibility of buffer overflow in show_rcu_tasks_trace_gp_kthread() if counters, passed to sprintf() are huge. Counter numbers, needed for this are unrealistically high, but buffer overflow is still possible. Use snprintf() with

CVE-2025-38236 [HIGH] CVE-2025-38236: linux - In the Linux kernel, the following vulnerability has been resolved: af_unix: Do... In the Linux kernel, the following vulnerability has been resolved: af_unix: Don't leave consecutive consumed OOB skbs. Jann Horn reported a use-after-free in unix_stream_read_generic(). The following sequences reproduce the issue: $ python3 from socket import * s1, s2 = socketpair(AF_UNIX, SOCK_STREAM) s1.send(b'x', MSG_OOB) s2.recv(1, MSG_OOB) # leave a consumed OOB

CVE-2023-52474 [HIGH] CVE-2023-52474: linux - In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fi... In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests hfi1 user SDMA request processing has two bugs that can cause data corruption for user SDMA requests that have multiple payload iovecs where an iovec other than the tail iovec does not run up to the page boundary for the buffer po

CVE-2024-49869 [HIGH] CVE-2024-49869: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: send... In the Linux kernel, the following vulnerability has been resolved: btrfs: send: fix buffer overflow detection when copying path to cache entry Starting with commit c0247d289e73 ("btrfs: send: annotate struct name_cache_entry with __counted_by()") we annotated the variable length array "name" from the name_cache_entry structure with __counted_by() to improve overflow

CVE-2022-49186 [HIGH] CVE-2022-49186: linux - In the Linux kernel, the following vulnerability has been resolved: clk: viscon... In the Linux kernel, the following vulnerability has been resolved: clk: visconti: prevent array overflow in visconti_clk_register_gates() This code was using -1 to represent that there was no reset function. Unfortunately, the -1 was stored in u8 so the if (clks[i].rs_id >= 0) condition was always true. This lead to an out of bounds access in visconti_clk_register_ga

CVE-2022-3239 [HIGH] CVE-2022-3239: linux - A flaw use after free in the Linux kernel video4linux driver was found in the wa... A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fix

CVE-2022-3577 [HIGH] CVE-2022-3577: linux - An out-of-bounds memory write flaw was found in the Linux kernel’s Kid-friendly ... An out-of-bounds memory write flaw was found in the Linux kernel’s Kid-friendly Wired Controller driver. This flaw allows a local user to crash or potentially escalate their privileges on the system. It is in bigben_probe of drivers/hid/hid-bigbenff.c. The reason is incorrect assumption - bigben devices all have inputs. However, malicious devices can break this assumpti

CVE-2025-37822 [HIGH] CVE-2025-37822: linux - In the Linux kernel, the following vulnerability has been resolved: riscv: upro... In the Linux kernel, the following vulnerability has been resolved: riscv: uprobes: Add missing fence.i after building the XOL buffer The XOL (execute out-of-line) buffer is used to single-step the replaced instruction(s) for uprobes. The RISC-V port was missing a proper fence.i (i$ flushing) after constructing the XOL buffer, which can result in incorrect execution o

CVE-2024-57998 [HIGH] CVE-2024-57998: linux - In the Linux kernel, the following vulnerability has been resolved: OPP: add in... In the Linux kernel, the following vulnerability has been resolved: OPP: add index check to assert to avoid buffer overflow in _read_freq() Pass the freq index to the assert function to make sure we do not read a freq out of the opp->rates[] table when called from the indexed variants: dev_pm_opp_find_freq_exact_indexed() or dev_pm_opp_find_freq_ceil/floor_indexed().

CVE-2022-3424 [HIGH] CVE-2022-3424: linux - A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way ... A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye:

CVE-2021-47458 [HIGH] CVE-2021-47458: linux - In the Linux kernel, the following vulnerability has been resolved: ocfs2: moun... In the Linux kernel, the following vulnerability has been resolved: ocfs2: mount fails with buffer overflow in strlen Starting with kernel 5.11 built with CONFIG_FORTIFY_SOURCE mouting an ocfs2 filesystem with either o2cb or pcmk cluster stack fails with the trace below. Problem seems to be that strings for cluster stack and cluster name are not guaranteed to be null

CVE-2022-2977 [HIGH] CVE-2022-2977: linux - A flaw was found in the Linux kernel implementation of proxied virtualized TPM d... A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-free and create a situation where it may be possible to escalate privileges on the system. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved

CVE-2025-37752 [HIGH] CVE-2025-37752: linux - In the Linux kernel, the following vulnerability has been resolved: net_sched: ... In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: move the limit validation It is not sufficient to directly validate the limit on the data that the user passes as it can be updated based on how the other parameters are changed. Move the check at the end of the configuration update process to also catch scenarios where the limit i

CVE-2022-1976 [HIGH] CVE-2022-1976: linux - A flaw was found in the Linux kernel’s implementation of IO-URING. This flaw all... A flaw was found in the Linux kernel’s implementation of IO-URING. This flaw allows an attacker with local executable permission to create a string of requests that can cause a use-after-free flaw within the kernel. This issue leads to memory corruption and possible privilege escalation. Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: resolved forky: reso

CVE-2021-47566 [HIGH] CVE-2021-47566: linux - In the Linux kernel, the following vulnerability has been resolved: proc/vmcore... In the Linux kernel, the following vulnerability has been resolved: proc/vmcore: fix clearing user buffer by properly using clear_user() To clear a user buffer we cannot simply use memset, we have to use clear_user(). With a virtio-mem device that registers a vmcore_cb and has some logically unplugged memory inside an added Linux memory block, I can easily trigger a B

CVE-2024-35905 [HIGH] CVE-2024-35905: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Protec... In the Linux kernel, the following vulnerability has been resolved: bpf: Protect against int overflow for stack access size This patch re-introduces protection against the size of access to stack memory being negative; the access size can appear negative as a result of overflowing its signed int representation. This should not actually happen, as there are other prote

CVE-2024-53095 [HIGH] CVE-2024-53095: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free of network namespace. Recently, we got a customer report that CIFS triggers oops while reconnecting to a server. [0] The workload runs on Kubernetes, and some pods mount CIFS servers in non-root network namespaces. The problem rarely happened, but it was always while th