Debian Linux vulnerabilities

CVE-2020-27830 [MEDIUM] CVE-2020-27830: linux - A vulnerability was found in Linux Kernel where in the spk_ttyio_receive_buf2() ... A vulnerability was found in Linux Kernel where in the spk_ttyio_receive_buf2() function, it would dereference spk_ttyio_synth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash. Scope: local bookworm: resolved (fixed in 5.9.15-1) bullseye: resolved (fixed in 5.9.15-1) forky: resolved (fixed in 5.9.15-1) sid: resolved (fixed in 5.9.15

CVE-2025-37802 [MEDIUM] CVE-2025-37802: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" wait_event_timeout() will set the state of the current task to TASK_UNINTERRUPTIBLE, before doing the condition check. This means that ksmbd_durable_scavenger_alive() will try to acquire the mutex while already in a sleeping state. The

CVE-2025-37954 [MEDIUM] CVE-2025-37954: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: Avoid race in open_cached_dir with lease breaks A pre-existing valid cfid returned from find_or_create_cached_dir might race with a lease break, meaning open_cached_dir doesn't consider it valid, and thinks it's newly-constructed. This leaks a dentry reference if the allocation occurs b

CVE-2024-39507 [MEDIUM] CVE-2024-39507: linux - In the Linux kernel, the following vulnerability has been resolved: net: hns3: ... In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash problem in concurrent scenario When link status change, the nic driver need to notify the roce driver to handle this event, but at this time, the roce driver may uninit, then cause kernel crash. To fix the problem, when link status change, need to check whether the roce r

CVE-2024-27046 [MEDIUM] CVE-2024-27046: linux - In the Linux kernel, the following vulnerability has been resolved: nfp: flower... In the Linux kernel, the following vulnerability has been resolved: nfp: flower: handle acti_netdevs allocation failure The kmalloc_array() in nfp_fl_lag_do_work() will return null, if the physical memory has run out. As a result, if we dereference the acti_netdevs, the null pointer dereference bugs will happen. This patch adds a check to judge whether allocation fa

CVE-2024-40924 [MEDIUM] CVE-2024-40924: linux - In the Linux kernel, the following vulnerability has been resolved: drm/i915/dp... In the Linux kernel, the following vulnerability has been resolved: drm/i915/dpt: Make DPT object unshrinkable In some scenarios, the DPT object gets shrunk but the actual framebuffer did not and thus its still there on the DPT's vm->bound_list. Then it tries to rewrite the PTEs via a stale CPU mapping. This causes panic. [vsyrjala: Add TODO comment] (cherry picked

CVE-2024-27434 [MEDIUM] CVE-2024-27434: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwi... In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't set the MFP flag for the GTK The firmware doesn't need the MFP flag for the GTK, it can even make the firmware crash. in case the AP is configured with: group cipher TKIP and MFPC. We would send the GTK with cipher = TKIP and MFP which is of course not possible. Scope: loca

CVE-2024-26809 [MEDIUM] CVE-2024-26809: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: release elements in clone only from destroy path Clone already always provides a current view of the lookup table, use it to destroy the set, otherwise it is possible to destroy elements twice. This fix requires: 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into c

CVE-2024-41023 [MEDIUM] CVE-2024-41023: linux - In the Linux kernel, the following vulnerability has been resolved: sched/deadl... In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Fix task_struct reference leak During the execution of the following stress test with linux-rt: stress-ng --cyclic 30 --timeout 30 --minimize --quiet kmemleak frequently reported a memory leak concerning the task_struct: unreferenced object 0xffff8881305b8000 (size 16136): comm "stre

CVE-2022-49492 [MEDIUM] CVE-2022-49492: linux - In the Linux kernel, the following vulnerability has been resolved: nvme-pci: f... In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags In nvme_alloc_admin_tags, the admin_q can be set to an error (typically -ENOMEM) if the blk_mq_init_queue call fails to set up the queue, which is checked immediately after the call. However, when we return the error message up the st

CVE-2024-27025 [MEDIUM] CVE-2024-27025: linux - In the Linux kernel, the following vulnerability has been resolved: nbd: null c... In the Linux kernel, the following vulnerability has been resolved: nbd: null check for nla_nest_start nla_nest_start() may fail and return NULL. Insert a check and set errno based on other call sites within the same source code. Scope: local bookworm: resolved (fixed in 6.1.85-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.7.12-1) sid: reso

CVE-2024-26994 [MEDIUM] CVE-2024-26994: linux - In the Linux kernel, the following vulnerability has been resolved: speakup: Av... In the Linux kernel, the following vulnerability has been resolved: speakup: Avoid crash on very long word In case a console is set up really large and contains a really long word (> 256 characters), we have to stop before the length of the word buffer. Scope: local bookworm: resolved (fixed in 6.1.90-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixe

CVE-2024-27038 [MEDIUM] CVE-2024-27038: linux - In the Linux kernel, the following vulnerability has been resolved: clk: Fix cl... In the Linux kernel, the following vulnerability has been resolved: clk: Fix clk_core_get NULL dereference It is possible for clk_core_get to dereference a NULL in the following sequence: clk_core_get() of_clk_get_hw_from_clkspec() __of_clk_get_hw_from_provider() __clk_get_hw() __clk_get_hw() can return NULL which is dereferenced by clk_core_get() at hw->core. Prior

CVE-2021-47105 [MEDIUM] CVE-2021-47105: linux - In the Linux kernel, the following vulnerability has been resolved: ice: xsk: r... In the Linux kernel, the following vulnerability has been resolved: ice: xsk: return xsk buffers back to pool when cleaning the ring Currently we only NULL the xdp_buff pointer in the internal SW ring but we never give it back to the xsk buffer pool. This means that buffers can be leaked out of the buff pool and never be used again. Add missing xsk_buff_free() call

CVE-2022-49307 [MEDIUM] CVE-2022-49307: linux - In the Linux kernel, the following vulnerability has been resolved: tty: syncli... In the Linux kernel, the following vulnerability has been resolved: tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() When the driver fails at alloc_hdlcdev(), and then we remove the driver module, we will get the following splat: [ 25.065966] general protection fault, probably for non-canonical address 0xdffffc0000000182: 0000 [#1] PREEMPT SMP KASAN PT

CVE-2022-49450 [MEDIUM] CVE-2022-49450: linux - In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ... In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix listen() setting the bar too high for the prealloc rings AF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump up the sysctl), but whilst the preallocation circular buffers have 32 slots in them, one of them has to be a dead slot because we're using CIRC_CNT(). This m

CVE-2022-49442 [MEDIUM] CVE-2022-49442: linux - In the Linux kernel, the following vulnerability has been resolved: drivers/bas... In the Linux kernel, the following vulnerability has been resolved: drivers/base/node.c: fix compaction sysfs file leak Compaction sysfs file is created via compaction_register_node in register_node. But we forgot to remove it in unregister_node. Thus compaction sysfs file is leaked. Using compaction_unregister_node to fix this issue. Scope: local bookworm: resolved

CVE-2024-26601 [MEDIUM] CVE-2024-26601: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: regen... In the Linux kernel, the following vulnerability has been resolved: ext4: regenerate buddy after block freeing failed if under fc replay This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") and reintroduces mb_regenerate_buddy(). Based on code in mb_free_blocks(), fast commit replay can end up marking as free blocks that are alrea

CVE-2024-27074 [MEDIUM] CVE-2024-27074: linux - In the Linux kernel, the following vulnerability has been resolved: media: go70... In the Linux kernel, the following vulnerability has been resolved: media: go7007: fix a memleak in go7007_load_encoder In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without a deallocation thereafter. After the following call chain: saa7134_go7007_init |-> go7007_boot_encoder |-> go7007_load_encoder |-> kfree(go) go is freed and thus bounce is leake

CVE-2024-56590 [MEDIUM] CVE-2024-56590: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet This fixes not checking if skb really contains an ACL header otherwise the code may attempt to access some uninitilized/invalid memory past the valid skb->data. Scope: local bookworm: resolved (fixed in 6.1.123-1) bullseye: open