Debian Linux vulnerabilities

CVE-2025-37756 [MEDIUM] CVE-2025-37756: linux - In the Linux kernel, the following vulnerability has been resolved: net: tls: e... In the Linux kernel, the following vulnerability has been resolved: net: tls: explicitly disallow disconnect syzbot discovered that it can disconnect a TLS socket and then run into all sort of unexpected corner cases. I have a vague recollection of Eric pointing this out to us a long time ago. Supporting disconnect is really hard, for one thing if offload is enabled

CVE-2025-37956 [MEDIUM] CVE-2025-37956: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: prev... In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent rename with empty string Client can send empty newname string to ksmbd server. It will cause a kernel oops from d_alloc. This patch return the error when attempting to rename a file or directory with an empty new name string. Scope: local bookworm: open bullseye: resolved forky: resol

CVE-2023-52587 [MEDIUM] CVE-2023-52587: linux - In the Linux kernel, the following vulnerability has been resolved: IB/ipoib: F... In the Linux kernel, the following vulnerability has been resolved: IB/ipoib: Fix mcast list locking Releasing the `priv->lock` while iterating the `priv->multicast_list` in `ipoib_mcast_join_task()` opens a window for `ipoib_mcast_dev_flush()` to remove the items while in the middle of iteration. If the mcast is removed while the lock was dropped, the for loop spin

CVE-2021-47353 [MEDIUM] CVE-2021-47353: linux - In the Linux kernel, the following vulnerability has been resolved: udf: Fix NU... In the Linux kernel, the following vulnerability has been resolved: udf: Fix NULL pointer dereference in udf_symlink function In function udf_symlink, epos.bh is assigned with the value returned by udf_tgetblk. The function udf_tgetblk is defined in udf/misc.c and returns the value of sb_getblk function that could be NULL. Then, epos.bh is used without any check, ca

CVE-2024-40910 [MEDIUM] CVE-2024-40910: linux - In the Linux kernel, the following vulnerability has been resolved: ax25: Fix r... In the Linux kernel, the following vulnerability has been resolved: ax25: Fix refcount imbalance on inbound connections When releasing a socket in ax25_release(), we call netdev_put() to decrease the refcount on the associated ax.25 device. However, the execution path for accepting an incoming connection never calls netdev_hold(). This imbalance leads to refcount er

CVE-2024-23850 [MEDIUM] CVE-2024-23850: linux - In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, t... In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and crash because a subvolume can be read out too soon after its root item is inserted upon subvolume creation. Scope: local bookworm: resolved (fixed in 6.1.82-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.6.7-1) sid: resolved (

CVE-2024-26816 [MEDIUM] CVE-2024-26816: linux - In the Linux kernel, the following vulnerability has been resolved: x86, relocs... In the Linux kernel, the following vulnerability has been resolved: x86, relocs: Ignore relocations in .notes section When building with CONFIG_XEN_PV=y, .text symbols are emitted into the .notes section so that Xen can find the "startup_xen" entry point. This information is used prior to booting the kernel, so relocations are not useful. In fact, performing relocat

CVE-2022-49217 [MEDIUM] CVE-2022-49217: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: pm800... In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix abort all task initialization In pm80xx_send_abort_all(), the n_elem field of the ccb used is not initialized to 0. This missing initialization sometimes lead to the task completion path seeing the ccb with a non-zero n_elem resulting in the execution of invalid dma_unmap_sg() call

CVE-2024-49953 [MEDIUM] CVE-2024-49953: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: ... In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix crash caused by calling __xfrm_state_delete() twice The km.state is not checked in driver's delayed work. When xfrm_state_check_expire() is called, the state can be reset to XFRM_STATE_EXPIRED, even if it is XFRM_STATE_DEAD already. This happens when xfrm state is deleted, but not fre

CVE-2022-49568 [MEDIUM] CVE-2022-49568: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: Don't ... In the Linux kernel, the following vulnerability has been resolved: KVM: Don't null dereference ops->destroy A KVM device cleanup happens in either of two callbacks: 1) destroy() which is called when the VM is being destroyed; 2) release() which is called when a device fd is closed. Most KVM devices use 1) but Book3s's interrupt controller KVM devices (XICS, XIVE, X

CVE-2022-49725 [MEDIUM] CVE-2022-49725: linux - In the Linux kernel, the following vulnerability has been resolved: i40e: Fix c... In the Linux kernel, the following vulnerability has been resolved: i40e: Fix call trace in setup_tx_descriptors After PF reset and ethtool -t there was call trace in dmesg sometimes leading to panic. When there was some time, around 5 seconds, between reset and test there were no errors. Problem was that pf reset calls i40e_vsi_close in prep_for_reset and ethtool -

CVE-2025-21809 [MEDIUM] CVE-2025-21809: linux - In the Linux kernel, the following vulnerability has been resolved: rxrpc, afs:... In the Linux kernel, the following vulnerability has been resolved: rxrpc, afs: Fix peer hash locking vs RCU callback In its address list, afs now retains pointers to and refs on one or more rxrpc_peer objects. The address list is freed under RCU and at this time, it puts the refs on those peers. Now, when an rxrpc_peer object runs out of refs, it gets removed from

CVE-2022-48803 [MEDIUM] CVE-2022-48803: linux - In the Linux kernel, the following vulnerability has been resolved: phy: ti: Fi... In the Linux kernel, the following vulnerability has been resolved: phy: ti: Fix missing sentinel for clk_div_table _get_table_maxdiv() tries to access "clk_div_table" array out of bound defined in phy-j721e-wiz.c. Add a sentinel entry to prevent the following global-out-of-bounds error reported by enabling KASAN. [ 9.552392] BUG: KASAN: global-out-of-bounds in _get

CVE-2022-49520 [MEDIUM] CVE-2022-49520: linux - In the Linux kernel, the following vulnerability has been resolved: arm64: comp... In the Linux kernel, the following vulnerability has been resolved: arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall If a compat process tries to execute an unknown system call above the __ARM_NR_COMPAT_END number, the kernel sends a SIGILL signal to the offending process. Information about the error is printed to dmesg in compat_arm_syscall()

CVE-2024-23851 [MEDIUM] CVE-2024-23851: linux - copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attem... copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes, and crash, because of a missing param_kernel->data_size check. This is related to ctl_ioctl. Scope: local bookworm: resolved (fixed in 6.1.82-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.6.7-1) sid: resolved (fixed in 6.6

CVE-2024-26600 [MEDIUM] CVE-2024-26600: linux - In the Linux kernel, the following vulnerability has been resolved: phy: ti: ph... In the Linux kernel, the following vulnerability has been resolved: phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP If the external phy working together with phy-omap-usb2 does not implement send_srp(), we may still attempt to call it. This can happen on an idle Ethernet gadget triggering a wakeup for example: configfs-gadget.g1 gadget.0: ECM Suspend co

CVE-2024-40916 [MEDIUM] CVE-2024-40916: linux - In the Linux kernel, the following vulnerability has been resolved: drm/exynos:... In the Linux kernel, the following vulnerability has been resolved: drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found When reading EDID fails and driver reports no modes available, the DRM core adds an artificial 1024x786 mode to the connector. Unfortunately some variants of the Exynos HDMI (like the one in Exynos4 SoCs) are not able to dri

CVE-2022-49054 [MEDIUM] CVE-2022-49054: linux - In the Linux kernel, the following vulnerability has been resolved: Drivers: hv... In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Deactivate sysctl_record_panic_msg by default in isolated guests hv_panic_page might contain guest-sensitive information, do not dump it over to Hyper-V by default in isolated guests. While at it, update some comments in hyperv_{panic,die}_event(). Scope: local bookworm: resolved

CVE-2022-49343 [MEDIUM] CVE-2022-49343: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: avoid... In the Linux kernel, the following vulnerability has been resolved: ext4: avoid cycles in directory h-tree A maliciously corrupted filesystem can contain cycles in the h-tree stored inside a directory. That can easily lead to the kernel corrupting tree nodes that were already verified under its hands while doing a node split and consequently accessing unallocated me

CVE-2022-49451 [MEDIUM] CVE-2022-49451: linux - In the Linux kernel, the following vulnerability has been resolved: firmware: a... In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix list protocols enumeration in the base protocol While enumerating protocols implemented by the SCMI platform using BASE_DISCOVER_LIST_PROTOCOLS, the number of returned protocols is currently validated in an improper way since the check employs a sum between unsigned integers