Debian Linux vulnerabilities

CVE-2016-3140 [MEDIUM] CVE-2016-3140: linux - The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux... The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor. Scope: local bookworm: resolved (fixed in 4.5.1-1) bullseye: resolved (fixed in 4.5.1-1) forky: reso

CVE-2025-68304 CVE-2025-68304: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: lookup hci_conn on RX path on protocol side The hdev lock/lookup/unlock/use pattern in the packet RX path doesn't ensure hci_conn* is not concurrently modified/deleted. This locking appears to be leftover from before conn_hash started using RCU commit bf4c63252490b ("Bluetooth: convert c

CVE-2016-2782 [MEDIUM] CVE-2016-2782: linux - The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel befor... The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1) bulk-in or (2) interrupt-in endpoint. Scope: local bookworm: resolved (fixed in 4.4.2-1)

CVE-2025-40205 CVE-2025-40205: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: avoi... In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() The function btrfs_encode_fh() does not properly account for the three cases it handles. Before writing to the file handle (fh), the function only returns to the user BTRFS_FID_SIZE_NON_CONNECTABLE (5 dwords, 20 bytes) or BTRFS_FID_SIZE_CONNECTABLE (8

CVE-2026-23359 CVE-2026-23359: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix st... In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack-out-of-bounds write in devmap get_upper_ifindexes() iterates over all upper devices and writes their indices into an array without checking bounds. Also the callers assume that the max number of upper devices is MAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack, but that

CVE-2021-47354 [CRITICAL] CVE-2021-47354: linux - In the Linux kernel, the following vulnerability has been resolved: drm/sched: ... In the Linux kernel, the following vulnerability has been resolved: drm/sched: Avoid data corruptions Wait for all dependencies of a job to complete before killing it to avoid data corruptions. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.70-1) forky: resolved (fixed in 5.14.6-1) sid: resolved (fixed in 5.14.6-1) trixie: re

CVE-2024-26898 [HIGH] CVE-2024-26898: linux - In the Linux kernel, the following vulnerability has been resolved: aoe: fix th... In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts This patch is against CVE-2023-6270. The description of cve is: A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-af

CVE-2022-1678 [MEDIUM] CVE-2022-1678: linux - An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper updat... An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns leak, which can be used by remote clients. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved (fixed in 5.2.6-1) sid: resolved (fixed in 5.2.6-1) trixie: resolved (fixed in 5.2.

CVE-2022-1012 [HIGH] CVE-2022-1012: linux - A memory leak problem was found in the TCP source port generation algorithm in n... A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem. Scope: local bookworm: resolved (fixed in 5.17.11-1) bullseye: resolved (fixed in 5.10.127-1) forky: resolved (fixed in 5.17.11-1) sid: resolved (

CVE-2019-19770 [HIGH] CVE-2019-19770: linux - In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_rem... In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (which is used to remove a file or directory in debugfs that was previously created with a call to another debugfs function such as debugfs_create_file). NOTE: Linux kernel developers dispute this issue as not being an issue with debugfs, instead this is

CVE-2019-19816 [HIGH] CVE-2019-19816: linux - In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and perfor... In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in __btrfs_map_block in fs/btrfs/volumes.c, because a value of 1 for the number of data stripes is mishandled. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved (fixed in 5

CVE-2017-12134 [HIGH] CVE-2017-12134: linux - The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might al... The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data streams and consequently obtain sensitive memory information, cause a denial of service, or gain host OS privileges by leveraging incorrect block IO merge-ability calculation. Scope: local bookworm: resolved (fixed in 4.12.12-1) bullsey

CVE-2026-23226 [HIGH] CVE-2026-23226: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: add ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: add chann_lock to protect ksmbd_chann_list xarray ksmbd_chann_list xarray lacks synchronization, allowing use-after-free in multi-channel sessions (between lookup_chann_list() and ksmbd_chann_del). Adds rw_semaphore chann_lock to struct ksmbd_session and protects all xa_load/xa_store/xa_erase a

CVE-2024-25744 [HIGH] CVE-2024-25744: linux - In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall han... In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point. This is related to arch/x86/coco/tdx/tdx.c and arch/x86/mm/mem_encrypt_amd.c. Scope: local bookworm: resolved (fixed in 6.1.69-1) bullseye: resolved forky: resolved (fixed in 6.6.8-1) sid: resolved (fixed in 6.6.8-1) trixie: resolved (fixed in 6.6.8-1)

CVE-2026-23193 [HIGH] CVE-2026-23193: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: targe... In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() In iscsit_dec_session_usage_count(), the function calls complete() while holding the sess->session_usage_lock. Similar to the connection usage count logic, the waiter signaled by complete() (e.g., in the session release path)

CVE-2022-1055 [HIGH] CVE-2022-1055: linux - A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a... A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 Scope: local bookworm: resolved (fixed in 5.16.7-1) bullseye: resolved (fixed in 5.10.103-1) forky: resolved (fixed in

CVE-2024-26581 [HIGH] CVE-2024-26581: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip end interval element from gc rbtree lazy gc on insert might collect an end interval element that has been just added in this transactions, skip end interval elements that are not yet active. Scope: local bookworm: resolved (fixed in 6.1.82-1) bullseye: resolved (fixed i

CVE-2018-16871 [HIGH] CVE-2018-16871: linux - A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and ... A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be los

CVE-2024-26927 [HIGH] CVE-2024-26927: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ... In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Add some bounds checking to firmware data Smatch complains about "head->full_size - head->header_size" can underflow. To some extent, we're always going to have to trust the firmware a bit. However, it's easy enough to add a check for negatives, and let's add a upper bounds check as well. S

CVE-2024-35948 [HIGH] CVE-2024-35948: linux - In the Linux kernel, the following vulnerability has been resolved: bcachefs: C... In the Linux kernel, the following vulnerability has been resolved: bcachefs: Check for journal entries overruning end of sb clean section Fix a missing bounds check in superblock validation. Note that we don't yet have repair code for this case - repair code for individual items is generally low priority, since the whole superblock is checksummed, validated prior to