Debian Linux vulnerabilities

CVE-2025-37917 [MEDIUM] CVE-2025-37917: linux - In the Linux kernel, the following vulnerability has been resolved: net: ethern... In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll Use spin_lock_irqsave and spin_unlock_irqrestore instead of spin_lock and spin_unlock in mtk_star_emac driver to avoid spinlock recursion occurrence that can happen when enabling the DMA interrupts again in rx/tx poll. ``` BUG

CVE-2022-49743 [MEDIUM] CVE-2022-49743: linux - In the Linux kernel, the following vulnerability has been resolved: ovl: Use "b... In the Linux kernel, the following vulnerability has been resolved: ovl: Use "buf" flexible array for memcpy() destination The "buf" flexible array needs to be the memcpy() destination to avoid false positive run-time warning from the recent FORTIFY_SOURCE hardening: memcpy: detected field-spanning write (size 93) of single field "&fh->fb" at fs/overlayfs/export.c:7

CVE-2024-46697 [MEDIUM] CVE-2024-46697: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: ensur... In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure that nfsd4_fattr_args.context is zeroed out If nfsd4_encode_fattr4 ends up doing a "goto out" before we get to checking for the security label, then args.context will be set to uninitialized junk on the stack, which we'll then try to free. Initialize it early. Scope: local bookworm: res

CVE-2021-29650 [MEDIUM] CVE-2021-29650: linux - An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsys... An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf. Scope: local bookworm: resolved (fixed in 5.10.28-1) bullseye: reso

CVE-2024-56694 [MEDIUM] CVE-2024-56694: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: fix re... In the Linux kernel, the following vulnerability has been resolved: bpf: fix recursive lock when verdict program return SK_PASS When the stream_verdict program returns SK_PASS, it places the received skb into its own receive queue, but a recursive lock eventually occurs, leading to an operating system deadlock. This issue has been present since v6.9. ''' sk_psock_st

CVE-2015-7550 [MEDIUM] CVE-2015-7550: linux - The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel befor... The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not properly use a semaphore, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted application that leverages a race condition between keyctl_revoke and keyctl_read calls. Scop

CVE-2025-37935 [MEDIUM] CVE-2025-37935: linux - In the Linux kernel, the following vulnerability has been resolved: net: ethern... In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM If the mtk_poll_rx() function detects the MTK_RESETTING flag, it will jump to release_desc and refill the high word of the SDP on the 4GB RFB. Subsequently, mtk_rx_clean will process an incorrect SDP, leading to a panic. Add patch from MediaTek

CVE-2025-21885 [MEDIUM] CVE-2025-21885: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_r... In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers While using nvme target with use_srq on, below kernel panic is noticed. [ 549.698111] bnxt_en 0000:41:00.0 enp65s0np0: FEC autoneg off encoding: Clause 91 RS(544,514) [ 566.393619] Oops: divide error: 0000 [#1] PREEMPT SMP NO

CVE-2017-17975 [MEDIUM] CVE-2017-17975: linux - Use-after-free in the usbtv_probe function in drivers/media/usb/usbtv/usbtv-core... Use-after-free in the usbtv_probe function in drivers/media/usb/usbtv/usbtv-core.c in the Linux kernel through 4.14.10 allows attackers to cause a denial of service (system crash) or possibly have unspecified other impact by triggering failure of audio registration, because a kfree of the usbtv data structure occurs during a usbtv_video_free call, but the usbtv_vide

CVE-2025-37894 [MEDIUM] CVE-2025-37894: linux - In the Linux kernel, the following vulnerability has been resolved: net: use so... In the Linux kernel, the following vulnerability has been resolved: net: use sock_gen_put() when sk_state is TCP_TIME_WAIT It is possible for a pointer of type struct inet_timewait_sock to be returned from the functions __inet_lookup_established() and __inet6_lookup_established(). This can cause a crash when the returned pointer is of type struct inet_timewait_sock

CVE-2022-28388 [MEDIUM] CVE-2022-28388: linux - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel throug... usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed in 5.17.3-1) sid: resolved (fixed in 5.17.3-1) trixie: resolved (fixed in 5.17.3-1)

CVE-2025-21829 [MEDIUM] CVE-2025-21829: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: F... In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]" The Call Trace is as below: " ? show_regs.cold+0x1a/0x1f ? __rxe_cleanup+0x12c/0x170 [rdma_rxe] ? __warn+0x84/0xd0 ? __rxe_cleanup+0x12c/0x170 [rdma_rxe] ? report_bug+0x105/0x180 ? handle_bug+0x46/0x80 ? exc_invalid_op+0x19/0x70 ? asm_

CVE-2017-18257 [MEDIUM] CVE-2017-18257: linux - The __get_data_block function in fs/f2fs/data.c in the Linux kernel before 4.11 ... The __get_data_block function in fs/f2fs/data.c in the Linux kernel before 4.11 allows local users to cause a denial of service (integer overflow and loop) via crafted use of the open and fallocate system calls with an FS_IOC_FIEMAP ioctl. Scope: local bookworm: resolved (fixed in 4.11.6-1) bullseye: resolved (fixed in 4.11.6-1) forky: resolved (fixed in 4.11.6-1) s

CVE-2015-8845 [MEDIUM] CVE-2015-8845: linux - The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the Linux ker... The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM suspend mode exists before proceeding with a tm_reclaim call, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application. Scope: local bookworm: resolved (fixed in 4.4.2-1)

CVE-2025-38018 [MEDIUM] CVE-2025-38018: linux - In the Linux kernel, the following vulnerability has been resolved: net/tls: fi... In the Linux kernel, the following vulnerability has been resolved: net/tls: fix kernel panic when alloc_page failed We cannot set frag_list to NULL pointer when alloc_page failed. It will be used in tls_strp_check_queue_ok when the next time tls_strp_read_sock is called. This is because we don't reset full_len in tls_strp_flush_anchor_copy() so the recv path will t

CVE-2025-38325 [MEDIUM] CVE-2025-38325: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: add ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: add free_transport ops in ksmbd connection free_transport function for tcp connection can be called from smbdirect. It will cause kernel oops. This patch add free_transport ops in ksmbd connection, and add each free_transports for tcp and smbdirect. Scope: local bookworm: resolved bullseye: r

CVE-2021-28971 [MEDIUM] CVE-2021-28971: linux - In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel th... In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS status in a PEBS record is mishandled, aka CID-d88d05a9e0b6. Scope: local bookworm: resolved (fixed in 5.10.26-1) bullseye: resolved (fixed in 5.10.26-1) forky: resol

CVE-2016-6327 [MEDIUM] CVE-2016-6327: linux - drivers/infiniband/ulp/srpt/ib_srpt.c in the Linux kernel before 4.5.1 allows lo... drivers/infiniband/ulp/srpt/ib_srpt.c in the Linux kernel before 4.5.1 allows local users to cause a denial of service (NULL pointer dereference and system crash) by using an ABORT_TASK command to abort a device write operation. Scope: local bookworm: resolved (fixed in 4.6.1-1) bullseye: resolved (fixed in 4.6.1-1) forky: resolved (fixed in 4.6.1-1) sid: resolved (fi

CVE-2017-6348 [MEDIUM] CVE-2017-6348: linux - The hashbin_delete function in net/irda/irqueue.c in the Linux kernel before 4.9... The hashbin_delete function in net/irda/irqueue.c in the Linux kernel before 4.9.13 improperly manages lock dropping, which allows local users to cause a denial of service (deadlock) via crafted operations on IrDA devices. Scope: local bookworm: resolved (fixed in 4.9.13-1) bullseye: resolved (fixed in 4.9.13-1) forky: resolved (fixed in 4.9.13-1) sid: resolved (fixed

CVE-2025-38660 [MEDIUM] CVE-2025-38660: linux - In the Linux kernel, the following vulnerability has been resolved: [ceph] pars... In the Linux kernel, the following vulnerability has been resolved: [ceph] parse_longname(): strrchr() expects NUL-terminated string ... and parse_longname() is not guaranteed that. That's the reason why it uses kmemdup_nul() to build the argument for kstrtou64(); the problem is, kstrtou64() is not the only thing that need it. Just get a NUL-terminated copy of the e