Debian Linux vulnerabilities

CVE-2021-0512 [HIGH] CVE-2021-0512: linux - In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible ... In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-173843328References: Upstream kernel Scope

CVE-2024-36978 [HIGH] CVE-2024-36978: linux - In the Linux kernel, the following vulnerability has been resolved: net: sched:... In the Linux kernel, the following vulnerability has been resolved: net: sched: sch_multiq: fix possible OOB write in multiq_tune() q->bands will be assigned to qopt->bands to execute subsequent code logic after kmalloc. So the old q->bands should not be used in kmalloc. Otherwise, an out-of-bounds write will occur. Scope: local bookworm: resolved (fixed in 6.1.99-1)

CVE-2022-49196 [HIGH] CVE-2022-49196: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/pse... In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix use after free in remove_phb_dynamic() In remove_phb_dynamic() we use &phb->io_resource, after we've called device_unregister(&host_bridge->dev). But the unregister may have freed phb, because pcibios_free_controller_deferred() is the release function for the host_bridge. If there

CVE-2025-37822 [HIGH] CVE-2025-37822: linux - In the Linux kernel, the following vulnerability has been resolved: riscv: upro... In the Linux kernel, the following vulnerability has been resolved: riscv: uprobes: Add missing fence.i after building the XOL buffer The XOL (execute out-of-line) buffer is used to single-step the replaced instruction(s) for uprobes. The RISC-V port was missing a proper fence.i (i$ flushing) after constructing the XOL buffer, which can result in incorrect execution o

CVE-2024-39480 [HIGH] CVE-2024-39480: linux - In the Linux kernel, the following vulnerability has been resolved: kdb: Fix bu... In the Linux kernel, the following vulnerability has been resolved: kdb: Fix buffer overflow during tab-complete Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer rather than the destination to strncpy() with predicta

CVE-2023-0240 [HIGH] CVE-2023-0240: linux - There is a logic error in io_uring's implementation which can be used to trigger... There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not true, and in this case the function will use the init_cred or the previous linked requests identity to do operatio

CVE-2023-52464 [HIGH] CVE-2023-52464: linux - In the Linux kernel, the following vulnerability has been resolved: EDAC/thunde... In the Linux kernel, the following vulnerability has been resolved: EDAC/thunderx: Fix possible out-of-bounds string access Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound

CVE-2025-21780 [HIGH] CVE-2025-21780: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() It malicious user provides a small pptable through sysfs and then a bigger pptable, it may cause buffer overflow attack in function smu_sys_set_pp_table(). Scope: local bookworm: resolved (fixed in 6.1.129-1) bullseye: open forky: reso

CVE-2024-38578 [HIGH] CVE-2024-38578: linux - In the Linux kernel, the following vulnerability has been resolved: ecryptfs: F... In the Linux kernel, the following vulnerability has been resolved: ecryptfs: Fix buffer size for tag 66 packet The 'TAG 66 Packet Format' description is missing the cipher code and checksum fields that are packed into the message packet. As a result, the buffer allocated for the packet is 3 bytes too small and write_tag_66_packet() will write up to 3 bytes past the e

CVE-2022-3577 [HIGH] CVE-2022-3577: linux - An out-of-bounds memory write flaw was found in the Linux kernel’s Kid-friendly ... An out-of-bounds memory write flaw was found in the Linux kernel’s Kid-friendly Wired Controller driver. This flaw allows a local user to crash or potentially escalate their privileges on the system. It is in bigben_probe of drivers/hid/hid-bigbenff.c. The reason is incorrect assumption - bigben devices all have inputs. However, malicious devices can break this assumpti

CVE-2021-47609 [HIGH] CVE-2021-47609: linux - In the Linux kernel, the following vulnerability has been resolved: firmware: a... In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Fix string overflow in SCPI genpd driver Without the bound checks for scpi_pd->name, it could result in the buffer overflow when copying the SCPI device name from the corresponding device tree node as the name string is set at maximum size of 30. Let us fix it by using devm_kasprin

CVE-2021-47553 [HIGH] CVE-2021-47553: linux - In the Linux kernel, the following vulnerability has been resolved: sched/scs: ... In the Linux kernel, the following vulnerability has been resolved: sched/scs: Reset task stack state in bringup_cpu() To hot unplug a CPU, the idle task on that CPU calls a few layers of C code before finally leaving the kernel. When KASAN is in use, poisoned shadow is left around for each of the active stack frames, and when shadow call stacks are in use. When shado

CVE-2021-47474 [HIGH] CVE-2021-47474: linux - In the Linux kernel, the following vulnerability has been resolved: comedi: vmk... In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix bulk-buffer overflow The driver is using endpoint-sized buffers but must not assume that the tx and rx buffers are of equal size or a malicious device could overflow the slab-allocated receive buffer when doing bulk transfers. Scope: local bookworm: resolved (fixed in 5.15.3-1) bu

CVE-2023-52867 [HIGH] CVE-2023-52867: linux - In the Linux kernel, the following vulnerability has been resolved: drm/radeon:... In the Linux kernel, the following vulnerability has been resolved: drm/radeon: possible buffer overflow Buffer 'afmt_status' of size 6 could overflow, since index 'afmt_idx' is checked after access. Scope: local bookworm: resolved (fixed in 6.1.64-1) bullseye: resolved (fixed in 5.10.205-1) forky: resolved (fixed in 6.6.8-1) sid: resolved (fixed in 6.6.8-1) trixie: r

CVE-2024-38577 [HIGH] CVE-2024-38577: linux - In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: ... In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow There is a possibility of buffer overflow in show_rcu_tasks_trace_gp_kthread() if counters, passed to sprintf() are huge. Counter numbers, needed for this are unrealistically high, but buffer overflow is still possible. Use snprintf() with

CVE-2024-26956 [HIGH] CVE-2024-26956: linux - In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix... In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix failure to detect DAT corruption in btree and direct mappings Patch series "nilfs2: fix kernel bug at submit_bh_wbc()". This resolves a kernel BUG reported by syzbot. Since there are two flaws involved, I've made each one a separate patch. The first patch alone resolves the syzbot-reported

CVE-2024-0562 [HIGH] CVE-2024-0562: linux - A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi... A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to stop further write-back and waits for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation work after this has completed, which can result in the timer attempting to access the recently freed bdi_writeback. Scope: l

CVE-2023-52474 [HIGH] CVE-2023-52474: linux - In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fi... In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests hfi1 user SDMA request processing has two bugs that can cause data corruption for user SDMA requests that have multiple payload iovecs where an iovec other than the tail iovec does not run up to the page boundary for the buffer po

CVE-2022-3239 [HIGH] CVE-2022-3239: linux - A flaw use after free in the Linux kernel video4linux driver was found in the wa... A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fix

CVE-2021-47458 [HIGH] CVE-2021-47458: linux - In the Linux kernel, the following vulnerability has been resolved: ocfs2: moun... In the Linux kernel, the following vulnerability has been resolved: ocfs2: mount fails with buffer overflow in strlen Starting with kernel 5.11 built with CONFIG_FORTIFY_SOURCE mouting an ocfs2 filesystem with either o2cb or pcmk cluster stack fails with the trace below. Problem seems to be that strings for cluster stack and cluster name are not guaranteed to be null