Debian Linux vulnerabilities

CVE-2017-12134 [HIGH] CVE-2017-12134: linux - The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might al... The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data streams and consequently obtain sensitive memory information, cause a denial of service, or gain host OS privileges by leveraging incorrect block IO merge-ability calculation. Scope: local bookworm: resolved (fixed in 4.12.12-1) bullsey

CVE-2026-23226 [HIGH] CVE-2026-23226: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: add ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: add chann_lock to protect ksmbd_chann_list xarray ksmbd_chann_list xarray lacks synchronization, allowing use-after-free in multi-channel sessions (between lookup_chann_list() and ksmbd_chann_del). Adds rw_semaphore chann_lock to struct ksmbd_session and protects all xa_load/xa_store/xa_erase a

CVE-2024-25744 [HIGH] CVE-2024-25744: linux - In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall han... In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point. This is related to arch/x86/coco/tdx/tdx.c and arch/x86/mm/mem_encrypt_amd.c. Scope: local bookworm: resolved (fixed in 6.1.69-1) bullseye: resolved forky: resolved (fixed in 6.6.8-1) sid: resolved (fixed in 6.6.8-1) trixie: resolved (fixed in 6.6.8-1)

CVE-2020-16119 [MEDIUM] CVE-2020-16119: linux - Use-after-free vulnerability in the Linux kernel exploitable by a local attacker... Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye

CVE-2022-1055 [HIGH] CVE-2022-1055: linux - A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a... A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 Scope: local bookworm: resolved (fixed in 5.16.7-1) bullseye: resolved (fixed in 5.10.103-1) forky: resolved (fixed in

CVE-2023-52502 [MEDIUM] CVE-2023-52502: linux - In the Linux kernel, the following vulnerability has been resolved: net: nfc: f... In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF. Getting a reference on the socket found in a lookup while holding a lock should happen before releasing the lock. nfc_llcp_sock_get_sn() has a similar problem. Final

CVE-2024-26581 [HIGH] CVE-2024-26581: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip end interval element from gc rbtree lazy gc on insert might collect an end interval element that has been just added in this transactions, skip end interval elements that are not yet active. Scope: local bookworm: resolved (fixed in 6.1.82-1) bullseye: resolved (fixed i

CVE-2018-16871 [HIGH] CVE-2018-16871: linux - A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and ... A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be los

CVE-2024-26927 [HIGH] CVE-2024-26927: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ... In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Add some bounds checking to firmware data Smatch complains about "head->full_size - head->header_size" can underflow. To some extent, we're always going to have to trust the firmware a bit. However, it's easy enough to add a check for negatives, and let's add a upper bounds check as well. S

CVE-2016-20022 [HIGH] CVE-2016-20022: linux - In the Linux kernel before 4.8, usb_parse_endpoint in drivers/usb/core/config.c ... In the Linux kernel before 4.8, usb_parse_endpoint in drivers/usb/core/config.c does not validate the wMaxPacketSize field of an endpoint descriptor. NOTE: This vulnerability only affects products that are no longer supported by the supplier. Scope: local bookworm: resolved (fixed in 4.7.4-1) bullseye: resolved (fixed in 4.7.4-1) forky: resolved (fixed in 4.7.4-1) sid

CVE-2024-38616 [HIGH] CVE-2024-38616: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: carl9... In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: re-fix fortified-memset warning The carl9170_tx_release() function sometimes triggers a fortified-memset warning in my randconfig builds: In file included from include/linux/string.h:254, from drivers/net/wireless/ath/carl9170/tx.c:40: In function 'fortify_memset_chk', inlined from 'ca

CVE-2024-36886 [HIGH] CVE-2024-36886: linux - In the Linux kernel, the following vulnerability has been resolved: tipc: fix U... In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in error path Sam Page (sam4k) working with Trend Micro Zero Day Initiative reported a UAF in the tipc_buf_append() error path: BUG: KASAN: slab-use-after-free in kfree_skb_list_reason+0x47e/0x4c0 linux/net/core/skbuff.c:1183 Read of size 8 at addr ffff88804d2a7c80 by task poc/8034 CPU:

CVE-2020-29661 [HIGH] CVE-2020-29661: linux - A locking issue was discovered in the tty subsystem of the Linux kernel through ... A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b. Scope: local bookworm: resolved (fixed in 5.9.15-1) bullseye: resolved (fixed in 5.9.15-1) forky: resolved (fixed in 5.9.15-1) sid: resolved (fixed in 5.9.15-1) trixie: resolved (fixed

CVE-2021-47103 [HIGH] CVE-2021-47103: linux - In the Linux kernel, the following vulnerability has been resolved: inet: fully... In the Linux kernel, the following vulnerability has been resolved: inet: fully convert sk->sk_rx_dst to RCU rules syzbot reported various issues around early demux, one being included in this changelog [1] sk->sk_rx_dst is using RCU protection without clearly documenting it. And following sequences in tcp_v4_do_rcv()/tcp_v6_do_rcv() are not following standard RCU rul

CVE-2022-2639 [HIGH] CVE-2022-2639: linux - An integer coercion error was found in the openvswitch kernel module. Given a su... An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate t

CVE-2022-29581 [HIGH] CVE-2022-29581: linux - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel al... Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions. Scope: local bookworm: resolved (fixed in 5.17.6-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed in 5.17.6-1) sid: resolve

CVE-2024-42284 [HIGH] CVE-2024-42284: linux - In the Linux kernel, the following vulnerability has been resolved: tipc: Retur... In the Linux kernel, the following vulnerability has been resolved: tipc: Return non-zero value from tipc_udp_addr2str() on error tipc_udp_addr2str() should return non-zero value if the UDP media address is invalid. Otherwise, a buffer overflow access can occur in tipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP media address. Scope: local bookworm:

CVE-2024-35865 [MEDIUM] CVE-2024-35865: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_valid_oplock_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. Scope: local bookworm: resolved (fixed in 6.1.85-1) bullseye: open forky: resolved (fixed in 6.8.9-1) sid: resolved (fixed in 6.8.9-1) trixie: resolved (fixed

CVE-2024-26980 [MEDIUM] CVE-2024-26980: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf If ->ProtocolId is SMB2_TRANSFORM_PROTO_NUM, smb2 request size validation could be skipped. if request size is smaller than sizeof(struct smb2_query_info_req), slab-out-of-bounds read can happen in smb2_allocate_rsp_buf(). This patch allocate re

CVE-2022-50386 [HIGH] CVE-2022-50386: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref *kref) Bluetooth: chan 0000000023c4974d Bluetooth: parent 00000000ae861c08 ============