Debian Linux vulnerabilities

CVE-2024-53093 [MEDIUM] CVE-2024-53093: linux - In the Linux kernel, the following vulnerability has been resolved: nvme-multip... In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: defer partition scanning We need to suppress the partition scan from occuring within the controller's scan_work context. If a path error occurs here, the IO will wait until a path becomes available or all paths are torn down, but that action also occurs within scan_work, so it would

CVE-2023-52687 [MEDIUM] CVE-2023-52687: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: saf... In the Linux kernel, the following vulnerability has been resolved: crypto: safexcel - Add error handling for dma_map_sg() calls Macro dma_map_sg() may return 0 on error. This patch enables checks in case of the macro failure and ensures unmapping of previously mapped buffers with dma_unmap_sg(). Found by Linux Verification Center (linuxtesting.org) with static anal

CVE-2024-35882 [MEDIUM] CVE-2024-35882: linux - In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix... In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP Jan Schunk reports that his small NFS servers suffer from memory exhaustion after just a few days. A bisect shows that commit e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single sock_sendmsg() call") is the first bad commit. That

CVE-2021-46911 [MEDIUM] CVE-2021-46911: linux - In the Linux kernel, the following vulnerability has been resolved: ch_ktls: Fi... In the Linux kernel, the following vulnerability has been resolved: ch_ktls: Fix kernel panic Taking page refcount is not ideal and causes kernel panic sometimes. It's better to take tx_ctx lock for the complete skb transmit, to avoid page cleanup if ACK received in middle. Scope: local bookworm: resolved (fixed in 5.10.38-1) bullseye: resolved (fixed in 5.10.38-1)

CVE-2018-7740 [MEDIUM] CVE-2018-7740: linux - The resv_map_release function in mm/hugetlb.c in the Linux kernel through 4.15.7... The resv_map_release function in mm/hugetlb.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (BUG) via a crafted application that makes mmap system calls and has a large pgoff argument to the remap_file_pages system call. Scope: local bookworm: resolved (fixed in 4.15.17-1) bullseye: resolved (fixed in 4.15.17-1) forky: resolved (fi

CVE-2024-27066 [MEDIUM] CVE-2024-27066: linux - In the Linux kernel, the following vulnerability has been resolved: virtio: pac... In the Linux kernel, the following vulnerability has been resolved: virtio: packed: fix unmap leak for indirect desc table When use_dma_api and premapped are true, then the do_unmap is false. Because the do_unmap is false, vring_unmap_extra_packed is not called by detach_buf_packed. if (unlikely(vq->do_unmap)) { curr = id; for (i = 0; i num; i++) { vring_unmap_extra

CVE-2021-46948 [MEDIUM] CVE-2021-46948: linux - In the Linux kernel, the following vulnerability has been resolved: sfc: farch:... In the Linux kernel, the following vulnerability has been resolved: sfc: farch: fix TX queue lookup in TX event handling We're starting from a TXQ label, not a TXQ type, so efx_channel_get_tx_queue() is inappropriate (and could return NULL, leading to panics). Scope: local bookworm: resolved (fixed in 5.10.38-1) bullseye: resolved (fixed in 5.10.38-1) forky: resolve

CVE-2014-3647 [MEDIUM] CVE-2014-3647: linux - arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 d... arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application. Scope: local bookworm: resolved (fixed in 3.16.7-1) bullseye: resolved (fixed in 3.16.7-1) forky: resolved (fixed in 3.16.7-1) sid: resolved (fixed in

CVE-2022-49110 [MEDIUM] CVE-2022-49110: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: revisit gc autotuning as of commit 4608fdfc07e1 ("netfilter: conntrack: collect all entries in one cycle") conntrack gc was changed to run every 2 minutes. On systems where conntrack hash table is set to large value, most evictions happen from gc worker rather than the packet p

CVE-2025-21844 [MEDIUM] CVE-2025-21844: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: Add check for next_buffer in receive_encrypted_standard() Add check for the return value of cifs_buf_get() and cifs_small_buf_get() in receive_encrypted_standard() to prevent null pointer dereference. Scope: local bookworm: resolved (fixed in 6.1.133-1) bullseye: resolved (fixed in 5.10

CVE-2018-10124 [MEDIUM] CVE-2018-10124: linux - The kill_something_info function in kernel/signal.c in the Linux kernel before 4... The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN argument. Scope: local bookworm: resolved (fixed in 4.13.4-1) bullseye: resolved (fixed in 4.13.4-1) forky: resolved (fixed in 4.13.4-1) sid: resolved (fixed in

CVE-2020-27152 [MEDIUM] CVE-2020-27152: linux - An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in th... An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering, aka CID-77377064c3a9. Scope: local bookworm: resolved (fixed in 5.9.6-1) bullseye: resolved (fixed in 5.9.6-1) forky: resolved (fixed in 5.9.6-1) sid: resolved (f

CVE-2025-39688 [MEDIUM] CVE-2025-39688: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: allow... In the Linux kernel, the following vulnerability has been resolved: nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() The pynfs DELEG8 test fails when run against nfsd. It acquires a delegation and then lets the lease time out. It then tries to use the deleg stateid and expects to see NFS4ERR_DELEG_REVOKED, but it gets bad NFS4ERR_BAD_STATEID i

CVE-2024-44970 [MEDIUM] CVE-2024-44970: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: ... In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink When all the strides in a WQE have been consumed, the WQE is unlinked from the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible to receive CQEs with 0 consumed strides for the same WQE even after the WQE is fully consumed and unlinked

CVE-2024-46855 [MEDIUM] CVE-2024-46855: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_socket: fix sk refcount leaks We must put 'sk' reference before returning. Scope: local bookworm: resolved (fixed in 6.1.112-1) bullseye: resolved (fixed in 5.10.244-1) forky: resolved (fixed in 6.10.11-1) sid: resolved (fixed in 6.10.11-1) trixie: resolved (fixed in 6.10.11-1)

CVE-2018-7757 [MEDIUM] CVE-2018-7757: linux - Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_ex... Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (memory consumption) via many read accesses to files in the /sys/class/sas_phy directory, as demonstrated by the /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file. Scope: local bookworm: resolv

CVE-2024-50284 [MEDIUM] CVE-2024-50284: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix the missing xa_store error check xa_store() can fail, it return xa_err(-EINVAL) if the entry cannot be stored in an XArray, or xa_err(-ENOMEM) if memory allocation failed, so check error for xa_store() to fix it. Scope: local bookworm: resolved (fixed in 6.1.119-1) bullseye: resolved fork

CVE-2021-3744 [MEDIUM] CVE-2021-3744: linux - A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() fu... A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808. Scope: local bookworm: resolved (fixed in 5.14.12-1) bullseye: resolved (fixed in 5.10.84-1) forky: resolved (fixed

CVE-2024-39468 [MEDIUM] CVE-2024-39468: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: fix deadlock in smb2_find_smb_tcon() Unlock cifs_tcp_ses_lock before calling cifs_put_smb_ses() to avoid such deadlock. Scope: local bookworm: resolved (fixed in 6.1.94-1) bullseye: resolved (fixed in 5.10.221-1) forky: resolved (fixed in 6.9.7-1) sid: resolved (fixed in 6.9.7-1) trixie

CVE-2025-21766 [MEDIUM] CVE-2025-21766: linux - In the Linux kernel, the following vulnerability has been resolved: ipv4: use R... In the Linux kernel, the following vulnerability has been resolved: ipv4: use RCU protection in __ip_rt_update_pmtu() __ip_rt_update_pmtu() must use RCU protection to make sure the net structure it reads does not disappear. Scope: local bookworm: resolved (fixed in 6.1.129-1) bullseye: open forky: resolved (fixed in 6.12.16-1) sid: resolved (fixed in 6.12.16-1) trix