Debian Linux vulnerabilities

CVE-2026-23292 CVE-2026-23292: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: targe... In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix recursive locking in __configfs_open_file() In flush_write_buffer, &p->frag_sem is acquired and then the loaded store function is called, which, here, is target_core_item_dbroot_store(). This function called filp_open(), following which these functions were called (in reverse order), accord

CVE-2026-23321 CVE-2026-23321: linux - In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ... In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: in-kernel: always mark signal+subflow endp as used Syzkaller managed to find a combination of actions that was generating this warning: msk->pm.local_addr_used == 0 WARNING: net/mptcp/pm_kernel.c:1071 at __mark_subflow_endp_available net/mptcp/pm_kernel.c:1071 [inline], CPU#1: syz.2.17/961 WARNING

CVE-2026-23277 CVE-2026-23277: linux - In the Linux kernel, the following vulnerability has been resolved: net/sched: ... In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit teql_master_xmit() calls netdev_start_xmit(skb, slave) to transmit through slave devices, but does not update skb->dev to the slave device beforehand. When a gretap tunnel is a TEQL slave, the transmit path reaches iptunnel_xmi

CVE-2026-23465 CVE-2026-23465: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: log ... In the Linux kernel, the following vulnerability has been resolved: btrfs: log new dentries when logging parent dir of a conflicting inode If we log the parent directory of a conflicting inode, we are not logging the new dentries of the directory, so when we finish we have the parent directory's inode marked as logged but we did not log its new dentries. As a consequence if

CVE-2026-23386 [LOW] CVE-2026-23386: linux - In the Linux kernel, the following vulnerability has been resolved: gve: fix in... In the Linux kernel, the following vulnerability has been resolved: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL In DQ-QPL mode, gve_tx_clean_pending_packets() incorrectly uses the RDA buffer cleanup path. It iterates num_bufs times and attempts to unmap entries in the dma array. This leads to two issues: 1. The dma array shares storage wit

CVE-2026-23375 [LOW] CVE-2026-23375: linux - In the Linux kernel, the following vulnerability has been resolved: mm: thp: de... In the Linux kernel, the following vulnerability has been resolved: mm: thp: deny THP for files on anonymous inodes file_thp_enabled() incorrectly allows THP for files on anonymous inodes (e.g. guest_memfd and secretmem). These files are created via alloc_file_pseudo(), which does not call get_write_access() and leaves inode->i_writecount at 0. Combined with S_ISREG(in

CVE-2017-15129 [MEDIUM] CVE-2017-15129: linux - A use-after-free vulnerability was found in network namespaces code affecting th... A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged loc

CVE-2025-40039 [MEDIUM] CVE-2025-40039: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix race condition in RPC handle list access The 'sess->rpc_handle_list' XArray manages RPC handles within a ksmbd session. Access to this list is intended to be protected by 'sess->rpc_lock' (an rw_semaphore). However, the locking implementation was flawed, leading to potential race conditio

CVE-2022-27672 [MEDIUM] CVE-2022-27672: linux - When SMT is enabled, certain AMD processors may speculatively execute instructio... When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially resulting in information disclosure. Scope: local bookworm: resolved (fixed in 6.1.12-1) bullseye: open forky: resolved (fixed in 6.1.12-1) sid: resolved (fixed in 6.1.12-1) trixie: resolved (fixed in 6.1.12-1

CVE-2022-49771 [MEDIUM] CVE-2022-49771: linux - In the Linux kernel, the following vulnerability has been resolved: dm ioctl: f... In the Linux kernel, the following vulnerability has been resolved: dm ioctl: fix misbehavior if list_versions races with module loading __list_versions will first estimate the required space using the "dm_target_iterate(list_version_get_needed, &needed)" call and then will fill the space using the "dm_target_iterate(list_version_get_info, &iter_info)" call. Each of

CVE-2024-24858 [MEDIUM] CVE-2024-24858: linux - A race condition was found in the Linux kernel's net/bluetooth in {conn,adv}_{mi... A race condition was found in the Linux kernel's net/bluetooth in {conn,adv}_{min,max}_interval_set() function. This can result in I2cap connection or broadcast abnormality issue, possibly leading to denial of service. Scope: local bookworm: resolved (fixed in 6.1.85-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.8.9-1) sid: resolved (fixed

CVE-2022-20423 [MEDIUM] CVE-2022-20423: linux - In rndis_set_response of rndis.c, there is a possible out of bounds write due to... In rndis_set_response of rndis.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious USB device is attached with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239842288References: Upstream

CVE-2018-19854 [LOW] CVE-2018-19854: linux - An issue was discovered in the Linux kernel before 4.19.3. crypto_report_one() a... An issue was discovered in the Linux kernel before 4.19.3. crypto_report_one() and related functions in crypto/crypto_user.c (the crypto user configuration API) do not fully initialize structures that are copied to userspace, potentially leaking sensitive memory to user programs. NOTE: this is a CVE-2013-2547 regression but with easier exploitability because the attack

CVE-2015-0239 [MEDIUM] CVE-2015-0239: linux - The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.... The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction. Scope: local bookworm: resolved (fixed in 3.16.7-ck

CVE-2024-46695 [MEDIUM] CVE-2024-46695: linux - In the Linux kernel, the following vulnerability has been resolved: selinux,sma... In the Linux kernel, the following vulnerability has been resolved: selinux,smack: don't bypass permissions check in inode_setsecctx hook Marek Gresko reports that the root user on an NFS client is able to change the security labels on files on an NFS filesystem that is exported with root squashing enabled. The end of the kerneldoc comment for __vfs_setxattr_noperm(

CVE-2016-7097 [MEDIUM] CVE-2016-7097: linux - The filesystem implementation in the Linux kernel through 4.8.2 preserves the se... The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions. Scope: local bookworm: resolved (fixed in 4.7.8-1) bullseye: resolved (fixed in 4.7.8-1) forky: resolved (fixed in 4.

CVE-2024-35811 [MEDIUM] CVE-2024-35811: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: brcmf... In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach This is the candidate patch of CVE-2023-47233 : https://nvd.nist.gov/vuln/detail/CVE-2023-47233 In brcm80211 driver,it starts with the following invoking chain to start init a timeout worker: ->brcmf_usb_probe ->brcmf_usb_probe_cb ->brc

CVE-2025-38343 [MEDIUM] CVE-2025-38343: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mt76:... In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: drop fragments with multicast or broadcast RA IEEE 802.11 fragmentation can only be applied to unicast frames. Therefore, drop fragments with multicast or broadcast RA. This patch addresses vulnerabilities such as CVE-2020-26145. Scope: local bookworm: resolved bullseye: resolved

CVE-2015-8785 [MEDIUM] CVE-2015-8785: linux - The fuse_fill_write_pages function in fs/fuse/file.c in the Linux kernel before ... The fuse_fill_write_pages function in fs/fuse/file.c in the Linux kernel before 4.4 allows local users to cause a denial of service (infinite loop) via a writev system call that triggers a zero length for the first segment of an iov. Scope: local bookworm: resolved (fixed in 4.3.5-1) bullseye: resolved (fixed in 4.3.5-1) forky: resolved (fixed in 4.3.5-1) sid: resolve

CVE-2013-1827 [MEDIUM] CVE-2013-1827: linux - net/dccp/ccid.h in the Linux kernel before 3.5.4 allows local users to gain priv... net/dccp/ccid.h in the Linux kernel before 3.5.4 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability for a certain (1) sender or (2) receiver getsockopt call. Scope: local bookworm: resolved (fixed in 3.2.29-1) bullseye: resolved (fixed in 3.2.29-1) forky: resolved (f