Debian Linux vulnerabilities

CVE-2022-49608 [MEDIUM] CVE-2022-49608: linux - In the Linux kernel, the following vulnerability has been resolved: pinctrl: ra... In the Linux kernel, the following vulnerability has been resolved: pinctrl: ralink: Check for null return of devm_kcalloc Because of the possible failure of the allocation, data->domains might be NULL pointer and will cause the dereference of the NULL pointer later. Therefore, it might be better to check it and directly return -ENOMEM without releasing data manuall

CVE-2022-49555 [MEDIUM] CVE-2022-49555: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: Use del_timer_sync() before freeing While looking at a crash report on a timer list being corrupted, which usually happens when a timer is freed while still active. This is commonly triggered by code calling del_timer() instead of del_timer_sync() just before freeing. One possibl

CVE-2022-49525 [MEDIUM] CVE-2022-49525: linux - In the Linux kernel, the following vulnerability has been resolved: media: cx25... In the Linux kernel, the following vulnerability has been resolved: media: cx25821: Fix the warning when removing the module When removing the module, we will get the following warning: [ 14.746697] remove_proc_entry: removing non-empty directory 'irq/21', leaking at least 'cx25821[1]' [ 14.747449] WARNING: CPU: 4 PID: 368 at fs/proc/generic.c:717 remove_proc_entry+

CVE-2022-49643 [MEDIUM] CVE-2022-49643: linux - In the Linux kernel, the following vulnerability has been resolved: ima: Fix a ... In the Linux kernel, the following vulnerability has been resolved: ima: Fix a potential integer overflow in ima_appraise_measurement When the ima-modsig is enabled, the rc passed to evm_verifyxattr() may be negative, which may cause the integer overflow problem. Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: resolved (fixed in 5.10.136-1) forky: res

CVE-2022-49175 [MEDIUM] CVE-2022-49175: linux - In the Linux kernel, the following vulnerability has been resolved: PM: core: k... In the Linux kernel, the following vulnerability has been resolved: PM: core: keep irq flags in device_pm_check_callbacks() The function device_pm_check_callbacks() can be called under the spin lock (in the reported case it happens from genpd_add_device() -> dev_pm_domain_set(), when the genpd uses spinlocks rather than mutexes. However this function uncoditionally

CVE-2025-37862 [MEDIUM] CVE-2025-37862: linux - In the Linux kernel, the following vulnerability has been resolved: HID: pidff:... In the Linux kernel, the following vulnerability has been resolved: HID: pidff: Fix null pointer dereference in pidff_find_fields This function triggered a null pointer dereference if used to search for a report that isn't implemented on the device. This happened both for optional and required reports alike. The same logic was applied to pidff_find_special_field and

CVE-2024-56677 [MEDIUM] CVE-2024-56677: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/fad... In the Linux kernel, the following vulnerability has been resolved: powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init() During early init CMA_MIN_ALIGNMENT_BYTES can be PAGE_SIZE, since pageblock_order is still zero and it gets initialized later during initmem_init() e.g. setup_arch() -> initmem_init() -> sparse_init() -> set_pageblock_order()

CVE-2024-46737 [MEDIUM] CVE-2024-46737: linux - In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: ... In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix kernel crash if commands allocation fails If the commands allocation fails in nvmet_tcp_alloc_cmds() the kernel crashes in nvmet_tcp_release_queue_work() because of a NULL pointer dereference. nvmet: failed to install queue 0 cntlid 1 ret 6 Unable to handle kernel NULL pointer derefer

CVE-2022-48808 [MEDIUM] CVE-2022-48808: linux - In the Linux kernel, the following vulnerability has been resolved: net: dsa: f... In the Linux kernel, the following vulnerability has been resolved: net: dsa: fix panic when DSA master device unbinds on shutdown Rafael reports that on a system with LX2160A and Marvell DSA switches, if a reboot occurs while the DSA master (dpaa2-eth) is up, the following panic can be seen: systemd-shutdown[1]: Rebooting. Unable to handle kernel paging request at

CVE-2021-47343 [MEDIUM] CVE-2021-47343: linux - In the Linux kernel, the following vulnerability has been resolved: dm btree re... In the Linux kernel, the following vulnerability has been resolved: dm btree remove: assign new_root only when removal succeeds remove_raw() in dm_btree_remove() may fail due to IO read error (e.g. read the content of origin block fails during shadowing), and the value of shadow_spine::root is uninitialized, but the uninitialized value is still assign to new_root in

CVE-2024-41081 [MEDIUM] CVE-2024-41081: linux - In the Linux kernel, the following vulnerability has been resolved: ila: block ... In the Linux kernel, the following vulnerability has been resolved: ila: block BH in ila_output() As explained in commit 1378817486d6 ("tipc: block BH before using dst_cache"), net/core/dst_cache.c helpers need to be called with BH disabled. ila_output() is called from lwtunnel_output() possibly from process context, and under rcu_read_lock(). We might be interrupte

CVE-2024-40917 [MEDIUM] CVE-2024-40917: linux - In the Linux kernel, the following vulnerability has been resolved: memblock: m... In the Linux kernel, the following vulnerability has been resolved: memblock: make memblock_set_node() also warn about use of MAX_NUMNODES On an (old) x86 system with SRAT just covering space above 4Gb: ACPI: SRAT: Node 0 PXM 0 [mem 0x100000000-0xfffffffff] hotplug the commit referenced below leads to this NUMA configuration no longer being refused by a CONFIG_NUMA=

CVE-2024-27026 [MEDIUM] CVE-2024-27026: linux - In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fi... In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix missing reserved tailroom Use rbi->len instead of rcd->len for non-dataring packet. Found issue: XDP_WARN: xdp_update_frame_from_buff(line:278): Driver BUG: missing reserved tailroom WARNING: CPU: 0 PID: 0 at net/core/xdp.c:586 xdp_warn+0xf/0x20 CPU: 0 PID: 0 Comm: swapper/0 Tainted: G

CVE-2022-49701 [MEDIUM] CVE-2022-49701: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvf... In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Allocate/free queue resource only during probe/remove Currently, the sub-queues and event pool resources are allocated/freed for every CRQ connection event such as reset and LPM. This exposes the driver to a couple issues. First the inefficiency of freeing and reallocating memory that

CVE-2022-49562 [MEDIUM] CVE-2022-49562: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: x86: U... In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use __try_cmpxchg_user() to update guest PTE A/D bits Use the recently introduced __try_cmpxchg_user() to update guest PTE A/D bits instead of mapping the PTE into kernel address space. The VM_PFNMAP path is broken as it assumes that vm_pgoff is the base pfn of the mapped VMA range, which

CVE-2022-49511 [MEDIUM] CVE-2022-49511: linux - In the Linux kernel, the following vulnerability has been resolved: fbdev: defi... In the Linux kernel, the following vulnerability has been resolved: fbdev: defio: fix the pagelist corruption Easily hit the below list corruption: == list_add corruption. prev->next should be next (ffffffffc0ceb090), but was ffffec604507edc8. (prev=ffffec604507edc8). WARNING: CPU: 65 PID: 3959 at lib/list_debug.c:26 __list_add_valid+0x53/0x80 CPU: 65 PID: 3959 Comm

CVE-2022-49538 [MEDIUM] CVE-2022-49538: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: jack:... In the Linux kernel, the following vulnerability has been resolved: ALSA: jack: Access input_dev under mutex It is possible when using ASoC that input_dev is unregistered while calling snd_jack_report, which causes NULL pointer dereference. In order to prevent this serialize access to input_dev using mutex lock. Scope: local bookworm: resolved (fixed in 5.18.5-1) bu

CVE-2021-3659 [MEDIUM] CVE-2021-3659: linux - A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wi... A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the system. The highest threat from this vulnerability is to system availability. Scope: local bookworm: resolved (fixed in 5.10.38-1) bullseye: resolved (fixed in 5.10.38-

CVE-2024-40941 [MEDIUM] CVE-2024-40941: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwi... In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't read past the mfuart notifcation In case the firmware sends a notification that claims it has more data than it has, we will read past that was allocated for the notification. Remove the print of the buffer, we won't see it by default. If needed, we can see the content with

CVE-2024-53042 [MEDIUM] CVE-2024-53042: linux - In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_tu... In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow() There are code paths from which the function is called without holding the RCU read lock, resulting in a suspicious RCU usage warning [1]. Fix by using l3mdev_master_upper_ifindex_by_index() which will acquire the RCU read lo