Debian Linux vulnerabilities

CVE-2022-1998 [HIGH] CVE-2022-1998: linux - A use after free in the Linux kernel File System notify functionality was found ... A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.16.7-1) bullseye: resolved (fixed in 5.10.103-1)

CVE-2022-0516 [HIGH] CVE-2022-0516: linux - A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s39... A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4. Scope: local bookworm: resolved (fixed in 5.16.10-1) bullseye: resolved (fix

CVE-2024-39495 [HIGH] CVE-2024-39495: linux - In the Linux kernel, the following vulnerability has been resolved: greybus: Fi... In the Linux kernel, the following vulnerability has been resolved: greybus: Fix use-after-free bug in gb_interface_release due to race condition. In gb_interface_create, &intf->mode_switch_completion is bound with gb_interface_mode_switch_work. Then it will be started by gb_interface_request_mode_switch. Here is the relevant code. if (!queue_work(system_long_wq, &int

CVE-2024-53171 [HIGH] CVE-2024-53171: linux - In the Linux kernel, the following vulnerability has been resolved: ubifs: auth... In the Linux kernel, the following vulnerability has been resolved: ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit After an insertion in TNC, the tree might split and cause a node to change its `znode->parent`. A further deletion of other nodes in the tree (which also could free the nodes), the aforementioned node's `znode->cparent` could still poin

CVE-2022-47518 [HIGH] CVE-2022-47518: linux - An issue was discovered in the Linux kernel before 6.0.11. Missing validation of... An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames. Scope: local bookworm: resolved (fixed in 6.0.12-1) bullseye: res

CVE-2024-40901 [HIGH] CVE-2024-40901: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3s... In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory There is a potential out-of-bounds access when using test_bit() on a single word. The test_bit() and set_bit() functions operate on long values, and when testing or setting a single word, they can exceed the word boundary. KASAN det

CVE-2025-39866 [HIGH] CVE-2025-39866: linux - In the Linux kernel, the following vulnerability has been resolved: fs: writeba... In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1 ...... pstate: 60400005 (nZCv daif +PAN -UAO -TCO

CVE-2022-1419 [HIGH] CVE-2022-1419: linux - The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DU... The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of *drm_vgem_gem_object *(created in *vgem_gem_dumb_create*) concurrently, and *vgem_gem_dumb_create *will access the freed drm_vgem_gem_object. Scope: local bookworm: resolved (fixed in 5.5.13-1) bullseye: resolved (fixed in 5.5.13-1) forky: resolved (fixed in 5.5.1

CVE-2025-38533 [HIGH] CVE-2025-38533: linux - In the Linux kernel, the following vulnerability has been resolved: net: libwx:... In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix the using of Rx buffer DMA The wx_rx_buffer structure contained two DMA address fields: 'dma' and 'page_dma'. However, only 'page_dma' was actually initialized and used to program the Rx descriptor. But 'dma' was uninitialized and used in some paths. This could lead to undefined behavi

CVE-2022-49581 [HIGH] CVE-2022-49581: linux - In the Linux kernel, the following vulnerability has been resolved: be2net: Fix... In the Linux kernel, the following vulnerability has been resolved: be2net: Fix buffer overflow in be_get_module_eeprom be_cmd_read_port_transceiver_data assumes that it is given a buffer that is at least PAGE_DATA_LEN long, or twice that if the module supports SFF 8472. However, this is not always the case. Fix this by passing the desired offset and length to be_cmd_

CVE-2022-2964 [HIGH] CVE-2022-2964: linux - A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based US... A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes. Scope: local bookworm: resolved (fixed in 5.16.10-1) bullseye: resolved (fixed in 5.10.103-1) forky: resolved (fixed in 5.16.10-1) sid: resolved (fixed in 5.16.10-1)

CVE-2023-52975 [HIGH] CVE-2023-52975: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi... In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress Bug report and analysis from Ding Hui. During iSCSI session logout, if another task accesses the shost ipaddress attr, we can get a KASAN UAF report like this: [ 276.942144] BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x78/0

CVE-2024-40974 [HIGH] CVE-2024-40974: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/pse... In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Enforce hcall result buffer validity and size plpar_hcall(), plpar_hcall9(), and related functions expect callers to provide valid result buffers of certain minimum size. Currently this is communicated only through comments in the code and the compiler has no idea. For example, if I w

CVE-2025-22035 [HIGH] CVE-2025-22035: linux - In the Linux kernel, the following vulnerability has been resolved: tracing: Fi... In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in print_graph_function_flags during tracer switching Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can be reproduced if puting a 'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(), and executing the

CVE-2025-38248 [HIGH] CVE-2025-38248: linux - In the Linux kernel, the following vulnerability has been resolved: bridge: mca... In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix use-after-free during router port configuration The bridge maintains a global list of ports behind which a multicast router resides. The list is consulted during forwarding to ensure multicast packets are forwarded to these ports even if the ports are not member in the matching MDB

CVE-2022-49698 [HIGH] CVE-2022-49698: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: use get_random_u32 instead of prandom bh might occur while updating per-cpu rnd_state from user context, ie. local_out path. BUG: using smp_processor_id() in preemptible [00000000] code: nginx/2725 caller is nft_ng_random_eval+0x24/0x54 [nft_numgen] Call Trace: check_preemption_disabled+0xd

CVE-2023-45898 [HIGH] CVE-2023-45898: linux - The Linux kernel before 6.5.4 has an es1 use-after-free in fs/ext4/extents_statu... The Linux kernel before 6.5.4 has an es1 use-after-free in fs/ext4/extents_status.c, related to ext4_es_insert_extent. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.5.6-1) sid: resolved (fixed in 6.5.6-1) trixie: resolved (fixed in 6.5.6-1)

CVE-2021-47634 [HIGH] CVE-2021-47634: linux - In the Linux kernel, the following vulnerability has been resolved: ubi: Fix ra... In the Linux kernel, the following vulnerability has been resolved: ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl Hulk Robot reported a KASAN report about use-after-free: ================================================================== BUG: KASAN: use-after-free in __list_del_entry_valid+0x13d/0x160 Read of size 8 at addr ffff888035e37d98 by tas

CVE-2024-40927 [HIGH] CVE-2024-40927: linux - In the Linux kernel, the following vulnerability has been resolved: xhci: Handl... In the Linux kernel, the following vulnerability has been resolved: xhci: Handle TD clearing for multiple streams case When multiple streams are in use, multiple TDs might be in flight when an endpoint is stopped. We need to issue a Set TR Dequeue Pointer for each, to ensure everything is reset properly and the caches cleared. Change the logic so that any N>1 TDs foun

CVE-2022-49700 [HIGH] CVE-2022-49700: linux - In the Linux kernel, the following vulnerability has been resolved: mm/slub: ad... In the Linux kernel, the following vulnerability has been resolved: mm/slub: add missing TID updates on slab deactivation The fastpath in slab_alloc_node() assumes that c->slab is stable as long as the TID stays the same. However, two places in __slab_alloc() currently don't update the TID when deactivating the CPU slab. If multiple operations race the right way, this