Debian Linux vulnerabilities

CVE-2025-38075 [MEDIUM] CVE-2025-38075: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: targe... In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix timeout on deleted connection NOPIN response timer may expire on a deleted connection and crash with such logs: Did not receive response to NOPIN on CID: 0, failing connection for I_T Nexus (null),i,0x00023d000125,iqn.2017-01.com.iscsi.target,t,0x3d BUG: Kernel NULL pointer

CVE-2017-15127 [MEDIUM] CVE-2017-15127: linux - A flaw was found in the hugetlb_mcopy_atomic_pte function in mm/hugetlb.c in the... A flaw was found in the hugetlb_mcopy_atomic_pte function in mm/hugetlb.c in the Linux kernel before 4.13. A superfluous implicit page unlock for VM_SHARED hugetlbfs mapping could trigger a local denial of service (BUG). Scope: local bookworm: resolved (fixed in 3.13.4-1) bullseye: resolved (fixed in 3.13.4-1) forky: resolved (fixed in 3.13.4-1) sid: resolved (fixed

CVE-2020-36322 [MEDIUM] CVE-2020-36322: linux - An issue was discovered in the FUSE filesystem implementation in the Linux kerne... An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, aka CID-5d069dbe8aaf. fuse_do_getattr() calls make_bad_inode() in inappropriate situations, causing a system crash. NOTE: the original fix for this vulnerability was incomplete, and its incompleteness is tracked as CVE-2021-28950. Scope: local bookworm: resolved (fixed i

CVE-2017-7346 [MEDIUM] CVE-2017-7346: linux - The vmw_gb_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surfac... The vmw_gb_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.7 does not validate certain levels data, which allows local users to cause a denial of service (system hang) via a crafted ioctl call for a /dev/dri/renderD* device. Scope: local bookworm: resolved (fixed in 4.11.6-1) bullseye: resolved (fixed in 4.11.6

CVE-2024-50206 [MEDIUM] CVE-2024-50206: linux - In the Linux kernel, the following vulnerability has been resolved: net: ethern... In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: fix memory corruption during fq dma init The loop responsible for allocating up to MTK_FQ_DMA_LENGTH buffers must only touch as many descriptors, otherwise it ends up corrupting unrelated memory. Fix the loop iteration count accordingly. Scope: local bookworm: resolved bu

CVE-2017-7261 [MEDIUM] CVE-2017-7261: linux - The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c... The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.5 does not check for a zero value of certain levels data, which allows local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device. Scope: local bookworm: resolved

CVE-2025-38405 [MEDIUM] CVE-2025-38405: linux - In the Linux kernel, the following vulnerability has been resolved: nvmet: fix ... In the Linux kernel, the following vulnerability has been resolved: nvmet: fix memory leak of bio integrity If nvmet receives commands with metadata there is a continuous memory leak of kmalloc-128 slab or more precisely bio->bi_integrity. Since commit bf4c89fc8797 ("block: don't call bio_uninit from bio_endio") each user of bio_init has to use bio_uninit as well. O

CVE-2024-27416 [MEDIUM] CVE-2024-27416: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST If we received HCI_EV_IO_CAPA_REQUEST while HCI_OP_READ_REMOTE_EXT_FEATURES is yet to be responded assume the remote does support SSP since otherwise this event shouldn't be generated. Scope: local bookworm: resolved (fixed in 6.1.82-1) bu

CVE-2021-45480 [MEDIUM] CVE-2021-45480: linux - An issue was discovered in the Linux kernel before 5.15.11. There is a memory le... An issue was discovered in the Linux kernel before 5.15.11. There is a memory leak in the __rds_conn_create() function in net/rds/connection.c in a certain combination of circumstances. Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved (fixed in 5.10.92-1) forky: resolved (fixed in 5.15.15-1) sid: resolved (fixed in 5.15.15-1) trixie: resolved

CVE-2024-36922 [MEDIUM] CVE-2024-36922: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwi... In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: read txq->read_ptr under lock If we read txq->read_ptr without lock, we can read the same value twice, then obtain the lock, and reclaim from there to two different places, but crucially reclaim the same entry twice, resulting in the WARN_ONCE() a little later. Fix that by reading txq

CVE-2021-28950 [MEDIUM] CVE-2021-28950: linux - An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A... An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A "stall on CPU" can occur because a retry loop continually finds the same bad inode, aka CID-775c5033a0d1. Scope: local bookworm: resolved (fixed in 5.10.24-1) bullseye: resolved (fixed in 5.10.24-1) forky: resolved (fixed in 5.10.24-1) sid: resolved (fixed in 5.10.24-1) trixie: resolved

CVE-2024-47724 [MEDIUM] CVE-2024-47724: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ath11... In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: use work queue to process beacon tx event Commit 3a415daa3e8b ("wifi: ath11k: add P2P IE in beacon template") from Feb 28, 2024 (linux-next), leads to the following Smatch static checker warning: drivers/net/wireless/ath/ath11k/wmi.c:1742 ath11k_wmi_p2p_go_bcn_ie() warn: sleeping in at

CVE-2023-32249 [MEDIUM] CVE-2023-32249: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: not ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: not allow guest user on multichannel This patch return STATUS_NOT_SUPPORTED if binding session is guest. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved forky: resolved (fixed in 6.3.7-1) sid: resolved (fixed in 6.3.7-1) trixie: resolved (fixed in 6.3.7-1)

CVE-2022-49928 [MEDIUM] CVE-2022-49928: linux - In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix... In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix null-ptr-deref when xps sysfs alloc failed There is a null-ptr-deref when xps sysfs alloc failed: BUG: KASAN: null-ptr-deref in sysfs_do_create_link_sd+0x40/0xd0 Read of size 8 at addr 0000000000000030 by task gssproxy/457 CPU: 5 PID: 457 Comm: gssproxy Not tainted 6.0.0-09040-g02357b27e

CVE-2023-52522 [MEDIUM] CVE-2023-52522: linux - In the Linux kernel, the following vulnerability has been resolved: net: fix po... In the Linux kernel, the following vulnerability has been resolved: net: fix possible store tearing in neigh_periodic_work() While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an RCU protected item from a list. Readers use rcu_deference(*np), we need to use either rcu_assign_pointer() or

CVE-2022-49160 [MEDIUM] CVE-2022-49160: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: qla2x... In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash during module load unload test During purex packet handling the driver was incorrectly freeing a pre-allocated structure. Fix this by skipping that entry. System crashed with the following stack during a module unload test. Call Trace: sbitmap_init_node+0x7f/0x1e0 sbitmap_qu

CVE-2024-57997 [MEDIUM] CVE-2024-57997: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36... In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix channel survey memory allocation size KASAN reported a memory allocation issue in wcn->chan_survey due to incorrect size calculation. This commit uses kcalloc to allocate memory for wcn->chan_survey, ensuring proper initialization and preventing the use of uninitialized values whe

CVE-2022-28389 [MEDIUM] CVE-2022-28389: linux - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel throug... mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed in 5.17.3-1) sid: resolved (fixed in 5.17.3-1) trixie: resolved (fixed in 5.17.3-1)

CVE-2023-6622 [MEDIUM] CVE-2023-6622: linux - A null pointer dereference vulnerability was found in nft_dynset_init() in net/n... A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service. Scope: local bookworm: resolved (fixed in 6.1.69-1) bullseye: resolved forky: resolved (fixed in 6.6.8-1) sid: resolved (fixed in

CVE-2022-49468 [MEDIUM] CVE-2022-49468: linux - In the Linux kernel, the following vulnerability has been resolved: thermal/cor... In the Linux kernel, the following vulnerability has been resolved: thermal/core: Fix memory leak in __thermal_cooling_device_register() I got memory leak as follows when doing fault injection test: unreferenced object 0xffff888010080000 (size 264312): comm "182", pid 102533, jiffies 4296434960 (age 10.100s) hex dump (first 32 bytes): 00 00 00 00 ad 4e ad de ff ff f