Debian Linux vulnerabilities

CVE-2022-49888 [HIGH] CVE-2022-49888: linux - In the Linux kernel, the following vulnerability has been resolved: arm64: entr... In the Linux kernel, the following vulnerability has been resolved: arm64: entry: avoid kprobe recursion The cortex_a76_erratum_1463225_debug_handler() function is called when handling debug exceptions (and synchronous exceptions from BRK instructions), and so is called when a probed function executes. If the compiler does not inline cortex_a76_erratum_1463225_debug_h

CVE-2025-37891 [HIGH] CVE-2025-37891: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: ... In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: Fix buffer overflow at UMP SysEx message conversion The conversion function from MIDI 1.0 to UMP packet contains an internal buffer to keep the incoming MIDI bytes, and its size is 4, as it was supposed to be the max size for a MIDI1 UMP packet data. However, the implementation overlooked t

CVE-2022-2977 [HIGH] CVE-2022-2977: linux - A flaw was found in the Linux kernel implementation of proxied virtualized TPM d... A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-free and create a situation where it may be possible to escalate privileges on the system. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved

CVE-2024-49869 [HIGH] CVE-2024-49869: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: send... In the Linux kernel, the following vulnerability has been resolved: btrfs: send: fix buffer overflow detection when copying path to cache entry Starting with commit c0247d289e73 ("btrfs: send: annotate struct name_cache_entry with __counted_by()") we annotated the variable length array "name" from the name_cache_entry structure with __counted_by() to improve overflow

CVE-2024-57998 [HIGH] CVE-2024-57998: linux - In the Linux kernel, the following vulnerability has been resolved: OPP: add in... In the Linux kernel, the following vulnerability has been resolved: OPP: add index check to assert to avoid buffer overflow in _read_freq() Pass the freq index to the assert function to make sure we do not read a freq out of the opp->rates[] table when called from the indexed variants: dev_pm_opp_find_freq_exact_indexed() or dev_pm_opp_find_freq_ceil/floor_indexed().

CVE-2022-3424 [HIGH] CVE-2022-3424: linux - A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way ... A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye:

CVE-2022-1976 [HIGH] CVE-2022-1976: linux - A flaw was found in the Linux kernel’s implementation of IO-URING. This flaw all... A flaw was found in the Linux kernel’s implementation of IO-URING. This flaw allows an attacker with local executable permission to create a string of requests that can cause a use-after-free flaw within the kernel. This issue leads to memory corruption and possible privilege escalation. Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: resolved forky: reso

CVE-2021-47668 [HIGH] CVE-2021-47668: linux - In the Linux kernel, the following vulnerability has been resolved: can: dev: c... In the Linux kernel, the following vulnerability has been resolved: can: dev: can_restart: fix use after free bug After calling netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the netif_rx_ni() in: stats->rx_bytes += cf->len; Reordering the lines solves the issue. Scope: local bookworm: resolved (f

CVE-2024-58069 [HIGH] CVE-2024-58069: linux - In the Linux kernel, the following vulnerability has been resolved: rtc: pcf850... In the Linux kernel, the following vulnerability has been resolved: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read The nvmem interface supports variable buffer sizes, while the regmap interface operates with fixed-size storage. If an nvmem client uses a buffer size less than 4 bytes, regmap_read will write out of bounds as it expects the buffer to point

CVE-2025-39952 [HIGH] CVE-2025-39952: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1... In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: avoid buffer overflow in WID string configuration Fix the following copy overflow warning identified by Smatch checker. drivers/net/wireless/microchip/wilc1000/wlan_cfg.c:184 wilc_wlan_parse_response_frame() error: '__memcpy()' 'cfg->s[i]->str' copy overflow (512 vs 65537) This patch i

CVE-2025-37810 [HIGH] CVE-2025-37810: linux - In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: ... In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: check that event count does not exceed event buffer length The event count is read from register DWC3_GEVNTCOUNT. There is a check for the count being zero, but not for exceeding the event buffer length. Check that event count does not exceed event buffer length, avoiding an out-of-

CVE-2021-47566 [HIGH] CVE-2021-47566: linux - In the Linux kernel, the following vulnerability has been resolved: proc/vmcore... In the Linux kernel, the following vulnerability has been resolved: proc/vmcore: fix clearing user buffer by properly using clear_user() To clear a user buffer we cannot simply use memset, we have to use clear_user(). With a virtio-mem device that registers a vmcore_cb and has some logically unplugged memory inside an added Linux memory block, I can easily trigger a B

CVE-2022-50156 [HIGH] CVE-2022-50156: linux - In the Linux kernel, the following vulnerability has been resolved: HID: cp2112... In the Linux kernel, the following vulnerability has been resolved: HID: cp2112: prevent a buffer overflow in cp2112_xfer() Smatch warnings: drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy() 'data->block[1]' too small (33 vs 255) drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy() 'buf' too small (64 vs 255) The 'read_length' variable is provided b

CVE-2022-50030 [HIGH] CVE-2022-50030: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc:... In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input Malformed user input to debugfs results in buffer overflow crashes. Adapt input string lengths to fit within internal buffers, leaving space for NULL terminators. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullsey

CVE-2021-47670 [HIGH] CVE-2021-47670: linux - In the Linux kernel, the following vulnerability has been resolved: can: peak_u... In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix use after free bugs After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the peak_usb_netif_rx_ni(). Reordering the lines solves the issue. Scope: local bookworm: resolved (fixed in 5.10.12-1) b

CVE-2023-1252 [HIGH] CVE-2023-1252: linux - A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a ... A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations simultaneously with the overlay FS usage. This flaw allows a local user to crash or potentially escalate their privileges on the system. Only if patch 9a2544037600 ("ovl: fix use after free in struct ovl_aio_req") not applied yet, the kernel could be aff

CVE-2022-20566 [HIGH] CVE-2022-20566: linux - In l2cap_chan_put of l2cap_core, there is a possible use after free due to impro... In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-165329981References: Upstream kernel Scope: local bookworm: resolved (fixed in

CVE-2024-46852 [HIGH] CVE-2024-46852: linux - In the Linux kernel, the following vulnerability has been resolved: dma-buf: he... In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix off-by-one in CMA heap fault handler Until VM_DONTEXPAND was added in commit 1c1914d6e8c6 ("dma-buf: heaps: Don't track CMA dma-buf pages under RssFile") it was possible to obtain a mapping larger than the buffer size via mremap and bypass the overflow check in dma_buf_mmap_interna

CVE-2025-38019 [HIGH] CVE-2025-38019: linux - In the Linux kernel, the following vulnerability has been resolved: mlxsw: spec... In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices The driver only offloads neighbors that are constructed on top of net devices registered by it or their uppers (which are all Ethernet). The device supports GRE encapsulation and decapsulation of forwarded traffic, but the driver

CVE-2025-38267 [HIGH] CVE-2025-38267: linux - In the Linux kernel, the following vulnerability has been resolved: ring-buffer... In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun When reading a memory mapped buffer the reader page is just swapped out with the last page written in the write buffer. If the reader page is the same as the commit buffer (the buffer that is currently being written to) it was assumed that