Debian Linux vulnerabilities

CVE-2026-23105 [HIGH] CVE-2026-23105: linux - In the Linux kernel, the following vulnerability has been resolved: net/sched: ... In the Linux kernel, the following vulnerability has been resolved: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag This is more of a preventive patch to make the code more consistent and to prevent possible exploits that employ child qlen manipulations on qfq. use cl_is_active instead of relying on the child qdisc's qlen to det

CVE-2025-68288 [MEDIUM] CVE-2025-68288: linux - In the Linux kernel, the following vulnerability has been resolved: usb: storag... In the Linux kernel, the following vulnerability has been resolved: usb: storage: Fix memory leak in USB bulk transport A kernel memory leak was identified by the 'ioctl_sg01' test from Linux Test Project (LTP). The following bytes were mainly observed: 0x53425355. When USB storage devices incorrectly skip the data phase with status data, the code extracts/validates

CVE-2016-8405 [MEDIUM] CVE-2016-8405: linux - An information disclosure vulnerability in kernel components including the ION s... An information disclosure vulnerability in kernel components including the ION subsystem, Binder, USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.1

CVE-2020-36557 [MEDIUM] CVE-2020-36557: linux - A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioc... A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free. Scope: local bookworm: resolved (fixed in 5.5.17-1) bullseye: resolved (fixed in 5.5.17-1) forky: resolved (fixed in 5.5.17-1) sid: resolved (fixed in 5.5.17-1) trixie: resolved (fixed in 5.5.17-1)

CVE-2023-52633 [MEDIUM] CVE-2023-52633: linux - In the Linux kernel, the following vulnerability has been resolved: um: time-tr... In the Linux kernel, the following vulnerability has been resolved: um: time-travel: fix time corruption In 'basic' time-travel mode (without =inf-cpu or =ext), we still get timer interrupts. These can happen at arbitrary points in time, i.e. while in timer_read(), which pushes time forward just a little bit. Then, if we happen to get the interrupt after calculating

CVE-2018-10882 [MEDIUM] CVE-2018-10882: linux - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a... A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image. Scope: local bookworm: resolved (fixed in 4.17.3-1) bullseye: resolved (fixed in 4.17.3-1) forky: resolved (fixed in 4.17.3-1) sid: resolved (fixe

CVE-2018-19985 [MEDIUM] CVE-2018-19985: linux - The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel th... The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allows arbitrary read in the kernel address space. Scope: local bookworm: resolved (fixed in 4.19.13-1) bullseye: resolved (fixed i

CVE-2014-1438 [MEDIUM] CVE-2014-1438: linux - The restore_fpu_checking function in arch/x86/include/asm/fpu-internal.h in the ... The restore_fpu_checking function in arch/x86/include/asm/fpu-internal.h in the Linux kernel before 3.12.8 on the AMD K7 and K8 platforms does not clear pending exceptions before proceeding to an EMMS instruction, which allows local users to cause a denial of service (task kill) or possibly gain privileges via a crafted application. Scope: local bookworm: resolved (fi

CVE-2024-24860 [MEDIUM] CVE-2024-24860: linux - A race condition was found in the Linux kernel's bluetooth device driver in {min... A race condition was found in the Linux kernel's bluetooth device driver in {min,max}_key_size_set() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: resolved (fixed in 5.10.209-1) forky: resolved (fixed in 6.6.15-1) sid: resolve

CVE-2022-50733 CVE-2022-50733: linux - In the Linux kernel, the following vulnerability has been resolved: usb: idmous... In the Linux kernel, the following vulnerability has been resolved: usb: idmouse: fix an uninit-value in idmouse_open In idmouse_create_image, if any ftip_command fails, it will go to the reset label. However, this leads to the data in bulk_in_buffer[HEADER..IMGSIZE] uninitialized. And the check for valid image incurs an uninitialized dereference. Fix this by moving the chec

CVE-2022-50728 CVE-2022-50728: linux - In the Linux kernel, the following vulnerability has been resolved: s390/lcs: F... In the Linux kernel, the following vulnerability has been resolved: s390/lcs: Fix return type of lcs_start_xmit() With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a fail

CVE-2025-40150 [LOW] CVE-2025-40150: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: fix t... In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid migrating empty section It reports a bug from device w/ zufs: F2FS-fs (dm-64): Inconsistent segment (173822) type [1, 0] in SSA and SIT F2FS-fs (dm-64): Stopped filesystem due to reason: 4 Thread A Thread B - f2fs_expand_inode_data - f2fs_allocate_pinning_section - f2fs_gc_range - do

CVE-2025-40225 [LOW] CVE-2025-40225: linux - In the Linux kernel, the following vulnerability has been resolved: drm/panthor... In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix kernel panic on partial unmap of a GPU VA region This commit address a kernel panic issue that can happen if Userspace tries to partially unmap a GPU virtual region (aka drm_gpuva). The VM_BIND interface allows partial unmapping of a BO. Panthor driver pre-allocates memory for the new

CVE-2023-53863 CVE-2023-53863: linux - In the Linux kernel, the following vulnerability has been resolved: netlink: do... In the Linux kernel, the following vulnerability has been resolved: netlink: do not hard code device address lenth in fdb dumps syzbot reports that some netdev devices do not have a six bytes address [1] Replace ETH_ALEN by dev->addr_len. [1] (Case of a device where dev->addr_len = 4) BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [in

CVE-2019-11190 [MEDIUM] CVE-2019-11190: linux - The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs... The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat. Scope: local bookworm: resolved (fixed in 4.8.5-1) bullseye: resolved (fixed in 4.8.5-1) fo

CVE-2023-53845 CVE-2023-53845: linux - In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix... In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix infinite loop in nilfs_mdt_get_block() If the disk image that nilfs2 mounts is corrupted and a virtual block address obtained by block lookup for a metadata file is invalid, nilfs_bmap_lookup_at_level() may return the same internal return code as -ENOENT, meaning the block does not exist in the m

CVE-2025-40010 CVE-2025-40010: linux - In the Linux kernel, the following vulnerability has been resolved: afs: Fix po... In the Linux kernel, the following vulnerability has been resolved: afs: Fix potential null pointer dereference in afs_put_server afs_put_server() accessed server->debug_id before the NULL check, which could lead to a null pointer dereference. Move the debug_id assignment, ensuring we never dereference a NULL server pointer. Scope: local bookworm: resolved (fixed in 6.1.158-

CVE-2025-40009 [LOW] CVE-2025-40009: linux - In the Linux kernel, the following vulnerability has been resolved: fs/proc/tas... In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: check p->vec_buf for NULL When the PAGEMAP_SCAN ioctl is invoked with vec_len = 0 reaches pagemap_scan_backout_range(), kernel panics with null-ptr-deref: [ 44.936808] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP DEBUG_PAGEALLOC

CVE-2025-40003 CVE-2025-40003: linux - In the Linux kernel, the following vulnerability has been resolved: net: mscc: ... In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work The origin code calls cancel_delayed_work() in ocelot_stats_deinit() to cancel the cyclic delayed work item ocelot->stats_work. However, cancel_delayed_work() may fail to cancel the work item if it is already executing. While destroy_workque

CVE-2025-40078 CVE-2025-40078: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Explic... In the Linux kernel, the following vulnerability has been resolved: bpf: Explicitly check accesses to bpf_sock_addr Syzkaller found a kernel warning on the following sock_addr program: 0: r0 = 0 1: r2 = *(u32 *)(r1 +60) 2: exit which triggers: verifier bug: error during ctx access conversion (0) This is happening because offset 60 in bpf_sock_addr corresponds to an implicit