Debian Linux vulnerabilities

CVE-2024-56641 [MEDIUM] CVE-2024-56641: linux - In the Linux kernel, the following vulnerability has been resolved: net/smc: in... In the Linux kernel, the following vulnerability has been resolved: net/smc: initialize close_work early to avoid warning We encountered a warning that close_work was canceled before initialization. WARNING: CPU: 7 PID: 111103 at kernel/workqueue.c:3047 __flush_work+0x19e/0x1b0 Workqueue: events smc_lgr_terminate_work [smc] RIP: 0010:__flush_work+0x19e/0x1b0 Call Tr

CVE-2021-47215 [MEDIUM] CVE-2021-47215: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: ... In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: kTLS, Fix crash in RX resync flow For the TLS RX resync flow, we maintain a list of TLS contexts that require some attention, to communicate their resync information to the HW. Here we fix list corruptions, by protecting the entries against movements coming from resync_handle_seq_match(),

CVE-2020-10769 [MEDIUM] CVE-2020-10769: linux - A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_aut... A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat, leading to a system crash. This flaw allows a local attacker wi

CVE-2016-6197 [MEDIUM] CVE-2016-6197: linux - fs/overlayfs/dir.c in the OverlayFS filesystem implementation in the Linux kerne... fs/overlayfs/dir.c in the OverlayFS filesystem implementation in the Linux kernel before 4.6 does not properly verify the upper dentry before proceeding with unlink and rename system-call processing, which allows local users to cause a denial of service (system crash) via a rename system call that specifies a self-hardlink. Scope: local bookworm: resolved (fixed in 4.

CVE-2025-21788 [MEDIUM] CVE-2025-21788: linux - In the Linux kernel, the following vulnerability has been resolved: net: ethern... In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases If the XDP program doesn't result in XDP_PASS then we leak the memory allocated by am65_cpsw_build_skb(). It is pointless to allocate SKB memory before running the XDP program as we would be wasting CPU cycles for cases other than XDP_PA

CVE-2024-36947 [MEDIUM] CVE-2024-36947: linux - In the Linux kernel, the following vulnerability has been resolved: qibfs: fix ... In the Linux kernel, the following vulnerability has been resolved: qibfs: fix dentry leak simple_recursive_removal() drops the pinning references to all positives in subtree. For the cases when its argument has been kept alive by the pinning alone that's exactly the right thing to do, but here the argument comes from dcache lookup, that needs to be balanced by expl

CVE-2019-20054 [MEDIUM] CVE-2019-20054: linux - In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sy... In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved (fixed in 5.2.6-1) sid: resolved (fixed in 5.2.6-1) trixie: resolved (fixed in 5.2.6-1)

CVE-2024-50241 [MEDIUM] CVE-2024-50241: linux - In the Linux kernel, the following vulnerability has been resolved: NFSD: Initi... In the Linux kernel, the following vulnerability has been resolved: NFSD: Initialize struct nfsd4_copy earlier Ensure the refcount and async_copies fields are initialized early. cleanup_async_copy() will reference these fields if an error occurs in nfsd4_copy(). If they are not correctly initialized, at the very least, a refcount underflow occurs. Scope: local bookw

CVE-2024-47658 [MEDIUM] CVE-2024-47658: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: stm... In the Linux kernel, the following vulnerability has been resolved: crypto: stm32/cryp - call finalize with bh disabled The finalize operation in interrupt mode produce a produces a spinlock recursion warning. The reason is the fact that BH must be disabled during this process. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 6.10.9-1) sid: resol

CVE-2024-43864 [MEDIUM] CVE-2024-43864: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: ... In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix CT entry update leaks of modify header context The cited commit allocates a new modify header to replace the old one when updating CT entry. But if failed to allocate a new one, eg. exceed the max number firmware can support, modify header will be an error pointer that will trigger a

CVE-2025-21954 [MEDIUM] CVE-2025-21954: linux - In the Linux kernel, the following vulnerability has been resolved: netmem: pre... In the Linux kernel, the following vulnerability has been resolved: netmem: prevent TX of unreadable skbs Currently on stable trees we have support for netmem/devmem RX but not TX. It is not safe to forward/redirect an RX unreadable netmem packet into the device's TX path, as the device may call dma-mapping APIs on dma addrs that should not be passed to it. Fix this

CVE-2017-18221 [MEDIUM] CVE-2017-18221: linux - The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 a... The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users to cause a denial of service (NR_MLOCK accounting corruption) via crafted use of mlockall and munlockall system calls. Scope: local bookworm: resolved (fixed in 4.11.6-1) bullseye: resolved (fixed in 4.11.6-1) forky: resolved (fixed in 4.11.6-1) sid: resolved (fixed in

CVE-2015-8952 [MEDIUM] CVE-2015-8952: linux - The mbcache feature in the ext2 and ext4 filesystem implementations in the Linux... The mbcache feature in the ext2 and ext4 filesystem implementations in the Linux kernel before 4.6 mishandles xattr block caching, which allows local users to cause a denial of service (soft lockup) via filesystem operations in environments that use many attributes, as demonstrated by Ceph and Samba. Scope: local bookworm: resolved (fixed in 4.6.1-1) bullseye: resolve

CVE-2017-15274 [MEDIUM] CVE-2017-15274: linux - security/keys/keyctl.c in the Linux kernel before 4.11.5 does not consider the c... security/keys/keyctl.c in the Linux kernel before 4.11.5 does not consider the case of a NULL payload in conjunction with a nonzero length value, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted add_key or keyctl system call, a different vulnerability than CVE-2017-12192. Scope: local bookworm: resolved (fixed i

CVE-2016-10154 [MEDIUM] CVE-2016-10154: linux - The smbhash function in fs/cifs/smbencrypt.c in the Linux kernel 4.9.x before 4.... The smbhash function in fs/cifs/smbencrypt.c in the Linux kernel 4.9.x before 4.9.1 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a scatterlist. Scope: local bookworm: resol

CVE-2024-46799 [MEDIUM] CVE-2024-46799: linux - In the Linux kernel, the following vulnerability has been resolved: net: ethern... In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: Fix NULL dereference on XDP_TX If number of TX queues are set to 1 we get a NULL pointer dereference during XDP_TX. ~# ethtool -L eth0 tx 1 ~# ./xdp-trafficgen udp -A -a eth0 -t 2 Transmitting on eth0 (ifindex 2) [ 241.135257] Unable to handle kernel NULL pointer derefe

CVE-2024-58053 [MEDIUM] CVE-2024-58053: linux - In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ... In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix handling of received connection abort Fix the handling of a connection abort that we've received. Though the abort is at the connection level, it needs propagating to the calls on that connection. Whilst the propagation bit is performed, the calls aren't then woken up to go and process th

CVE-2024-44973 [MEDIUM] CVE-2024-44973: linux - In the Linux kernel, the following vulnerability has been resolved: mm, slub: d... In the Linux kernel, the following vulnerability has been resolved: mm, slub: do not call do_slab_free for kfence object In 782f8906f805 the freeing of kfence objects was moved from deep inside do_slab_free to the wrapper functions outside. This is a nice change, but unfortunately it missed one spot in __kmem_cache_free_bulk. This results in a crash like this: BUG s

CVE-2017-17862 [MEDIUM] CVE-2017-17862: linux - kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores unreachable cod... kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores unreachable code, even though it would still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic issue, could possibly be used by local users for denial of service. Scope: local bookworm: resolved (fixed in 4.14.7-1) bullseye: resolved (fixed in 4.14.7-1) fork

CVE-2025-21676 [MEDIUM] CVE-2025-21676: linux - In the Linux kernel, the following vulnerability has been resolved: net: fec: h... In the Linux kernel, the following vulnerability has been resolved: net: fec: handle page_pool_dev_alloc_pages error The fec_enet_update_cbd function calls page_pool_dev_alloc_pages but did not handle the case when it returned NULL. There was a WARN_ON(!new_page) but it would still proceed to use the NULL pointer and then crash. This case does seem somewhat rare but