Debian Linux vulnerabilities

CVE-2017-17806 [HIGH] CVE-2017-17806: linux - The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does n... The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequ

CVE-2025-38052 [HIGH] CVE-2025-38052: linux - In the Linux kernel, the following vulnerability has been resolved: net/tipc: f... In the Linux kernel, the following vulnerability has been resolved: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done Syzbot reported a slab-use-after-free with the following call trace: ================================================================== BUG: KASAN: slab-use-after-free in tipc_aead_encrypt_done+0x4bd/0x510 net/tipc/crypto.c:840 Read of s

CVE-2015-8966 [HIGH] CVE-2015-8966: linux - arch/arm/kernel/sys_oabi-compat.c in the Linux kernel before 4.4 allows local us... arch/arm/kernel/sys_oabi-compat.c in the Linux kernel before 4.4 allows local users to gain privileges via a crafted (1) F_OFD_GETLK, (2) F_OFD_SETLK, or (3) F_OFD_SETLKW command in an fcntl64 system call. Scope: local bookworm: resolved (fixed in 4.4.2-1) bullseye: resolved (fixed in 4.4.2-1) forky: resolved (fixed in 4.4.2-1) sid: resolved (fixed in 4.4.2-1) trixie: r

CVE-2023-53116 [HIGH] CVE-2023-53116: linux - In the Linux kernel, the following vulnerability has been resolved: nvmet: avoi... In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid potential UAF in nvmet_req_complete() An nvme target ->queue_response() operation implementation may free the request passed as argument. Such implementation potentially could result in a use after free of the request pointer when percpu_ref_put() is called in nvmet_req_complete(). Avoid

CVE-2019-18675 [HIGH] CVE-2019-18675: linux - The Linux kernel through 5.3.13 has a start_offset+size Integer Overflow in cpia... The Linux kernel through 5.3.13 has a start_offset+size Integer Overflow in cpia2_remap_buffer in drivers/media/usb/cpia2/cpia2_core.c because cpia2 has its own mmap implementation. This allows local users (with /dev/video0 access) to obtain read and write permissions on kernel physical pages, which can possibly result in a privilege escalation. Scope: local bookworm:

CVE-2018-8822 [HIGH] CVE-2018-8822: linux - Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncp... Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c in the Linux kernel through 4.15.11, and in drivers/staging/ncpfs/ncplib_kernel.c in the Linux kernel 4.16-rc through 4.16-rc6, could be exploited by malicious NCPFS servers to crash the kernel or execute code. Scope: local bookworm: resolved (fixed in 4.15.17-1) bullseye: resol

CVE-2023-35788 [HIGH] CVE-2023-35788: linux - An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Li... An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved (fixed in 5.10.191-1) for

CVE-2016-3157 [HIGH] CVE-2016-3157: linux - The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel doe... The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel does not properly context-switch IOPL on 64-bit PV Xen guests, which allows local guest OS users to gain privileges, cause a denial of service (guest OS crash), or obtain sensitive information by leveraging I/O port access. Scope: local bookworm: resolved (fixed in 4.5.1-1) bullseye: resolved (

CVE-2020-25671 [HIGH] CVE-2020-25671: linux - A vulnerability was found in Linux Kernel, where a refcount leak in llcp_sock_co... A vulnerability was found in Linux Kernel, where a refcount leak in llcp_sock_connect() causing use-after-free which might lead to privilege escalations. Scope: local bookworm: resolved (fixed in 5.10.38-1) bullseye: resolved (fixed in 5.10.38-1) forky: resolved (fixed in 5.10.38-1) sid: resolved (fixed in 5.10.38-1) trixie: resolved (fixed in 5.10.38-1)

CVE-2020-0423 [HIGH] CVE-2020-0423: linux - In binder_release_work of binder.c, there is a possible use-after-free due to im... In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-161151868References: N/A Scope: local bookworm: resolved (fixed

CVE-2024-56557 [MEDIUM] CVE-2024-56557: linux - In the Linux kernel, the following vulnerability has been resolved: iio: adc: a... In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer The AD7923 was updated to support devices with 8 channels, but the size of tx_buf and ring_xfer was not increased accordingly, leading to a potential buffer overflow in ad7923_update_scan_mode(). Scope: local bookworm: resolved (fixed in

CVE-2024-50043 [HIGH] CVE-2024-50043: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: fix p... In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible badness in FREE_STATEID When multiple FREE_STATEIDs are sent for the same delegation stateid, it can lead to a possible either use-after-free or counter refcount underflow errors. In nfsd4_free_stateid() under the client lock we find a delegation stateid, however the code drops the

CVE-2021-43057 [HIGH] CVE-2021-43057: linux - An issue was discovered in the Linux kernel before 5.14.8. A use-after-free in s... An issue was discovered in the Linux kernel before 5.14.8. A use-after-free in selinux_ptrace_traceme (aka the SELinux handler for PTRACE_TRACEME) could be used by local attackers to cause memory corruption and escalate privileges, aka CID-a3727a8bac0a. This occurs because of an attempt to access the subjective credentials of another task. Scope: local bookworm: resol

CVE-2015-1465 [HIGH] CVE-2015-1465: linux - The IPv4 implementation in the Linux kernel before 3.18.8 does not properly cons... The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allows remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets. Scope: local bookworm: resolved (fixed in 3.16.7-ckt7-1) bulls

CVE-2021-39685 [HIGH] CVE-2021-39685: linux - In various setup methods of the USB gadget subsystem, there is a possible out of... In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210292376References: Upstream kernel Scope: l

CVE-2025-68817 [HIGH] CVE-2025-68817: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency Under high concurrency, A tree-connection object (tcon) is freed on a disconnect path while another path still holds a reference and later executes *_put()/write on it. Scope: local bookworm: resolved (fixed in 6.1.162-1) bullseye:

CVE-2022-50401 [HIGH] CVE-2022-50401: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: under... In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure On error situation `clp->cl_cb_conn.cb_xprt` should not be given a reference to the xprt otherwise both client cleanup and the error handling path of the caller call to put it. Better to delay handing over the reference to a later bran

CVE-2017-12188 [HIGH] CVE-2017-12188: linux - arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisatio... arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a guest virtual address, which allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service (incorrect index during page walking, and host OS crash), aka an "MMU potential stack buffe

CVE-2022-4378 [HIGH] CVE-2022-4378: linux - A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a ... A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 6.0.12-1) bullseye: resolved (fixed in 5.10.158-1) forky: resolved (fixed in 6.0.12-1) sid: resolved

CVE-2025-21855 [HIGH] CVE-2025-21855: linux - In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Do... In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Don't reference skb after sending to VIOS Previously, after successfully flushing the xmit buffer to VIOS, the tx_bytes stat was incremented by the length of the skb. It is invalid to access the skb memory after sending the buffer to the VIOS because, at any point after sending, the VIOS can