Debian Linux vulnerabilities

CVE-2021-47499 [MEDIUM] CVE-2021-47499: linux - In the Linux kernel, the following vulnerability has been resolved: iio: accel:... In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove When ACPI type is ACPI_SMO8500, the data->dready_trig will not be set, the memory allocated by iio_triggered_buffer_setup() will not be freed, and cause memory leak as follows: unreferenced object 0xffff888009551400 (size 512): com

CVE-2024-36881 [MEDIUM] CVE-2024-36881: linux - In the Linux kernel, the following vulnerability has been resolved: mm/userfaul... In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: reset ptes when close() for wr-protected ones Userfaultfd unregister includes a step to remove wr-protect bits from all the relevant pgtable entries, but that only covered an explicit UFFDIO_UNREGISTER ioctl, not a close() on the userfaultfd itself. Cover that too. This fixes a WARN

CVE-2024-39493 [MEDIUM] CVE-2024-39493: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: qat... In the Linux kernel, the following vulnerability has been resolved: crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak Using completion_done to determine whether the caller has gone away only works after a complete call. Furthermore it's still possible that the caller has not yet called wait_for_completion, resulting in another potential UAF. Fix this by making the ca

CVE-2024-36029 [MEDIUM] CVE-2024-36029: linux - In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-... In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-msm: pervent access to suspended controller Generic sdhci code registers LED device and uses host->runtime_suspended flag to protect access to it. The sdhci-msm driver doesn't set this flag, which causes a crash when LED is accessed while controller is runtime suspended. Fix this by setti

CVE-2024-46773 [MEDIUM] CVE-2024-46773: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check denominator pbn_div before used [WHAT & HOW] A denominator cannot be 0, and is checked before used. This fixes 1 DIVIDE_BY_ZERO issue reported by Coverity. Scope: local bookworm: resolved (fixed in 6.1.112-1) bullseye: open forky: resolved (fixed in 6.10.11-1) sid: resolved (f

CVE-2024-40944 [MEDIUM] CVE-2024-40944: linux - In the Linux kernel, the following vulnerability has been resolved: x86/kexec: ... In the Linux kernel, the following vulnerability has been resolved: x86/kexec: Fix bug with call depth tracking The call to cc_platform_has() triggers a fault and system crash if call depth tracking is active because the GS segment has been reset by load_segments() and GS_BASE is now 0 but call depth tracking uses per-CPU variables to operate. Call cc_platform_has()

CVE-2024-40951 [MEDIUM] CVE-2024-40951: linux - In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix ... In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger() bdev->bd_super has been removed and commit 8887b94d9322 change the usage from bdev->bd_super to b_assoc_map->host->i_sb. Since ocfs2 hasn't set bh->b_assoc_map, it will trigger NULL pointer dereference when calling into ocfs2_abort_trigger

CVE-2024-42113 [MEDIUM] CVE-2024-42113: linux - In the Linux kernel, the following vulnerability has been resolved: net: txgbe:... In the Linux kernel, the following vulnerability has been resolved: net: txgbe: initialize num_q_vectors for MSI/INTx interrupts When using MSI/INTx interrupts, wx->num_q_vectors is uninitialized. Thus there will be kernel panic in wx_alloc_q_vectors() to allocate queue vectors. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.9.9-1) si

CVE-2023-52808 [MEDIUM] CVE-2023-52808: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_... In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs If init debugfs failed during device registration due to memory allocation failure, debugfs_remove_recursive() is called, after which debugfs_dir is not set to NULL. debugfs_remove_recursive() will be called again during device r

CVE-2023-52520 [MEDIUM] CVE-2023-52520: linux - In the Linux kernel, the following vulnerability has been resolved: platform/x8... In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix reference leak If a duplicate attribute is found using kset_find_obj(), a reference to that attribute is returned which needs to be disposed accordingly using kobject_put(). Move the setting name validation into a separate function to allow for this change without having

CVE-2023-52569 [MEDIUM] CVE-2023-52569: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: remo... In the Linux kernel, the following vulnerability has been resolved: btrfs: remove BUG() after failure to insert delayed dir index item Instead of calling BUG() when we fail to insert a delayed dir index item into the delayed node's tree, we can just release all the resources we have allocated/acquired before and return the error to the caller. This is fine because a

CVE-2022-4128 [MEDIUM] CVE-2022-4128: linux - A NULL pointer dereference issue was discovered in the Linux kernel in the MPTCP... A NULL pointer dereference issue was discovered in the Linux kernel in the MPTCP protocol when traversing the subflow list at disconnect time. A local user could use this flaw to potentially crash the system causing a denial of service. Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: resolved forky: resolved (fixed in 5.18.14-1) sid: resolved (fixed in

CVE-2022-48868 [MEDIUM] CVE-2022-48868: linux - In the Linux kernel, the following vulnerability has been resolved: dmaengine: ... In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Let probe fail when workqueue cannot be enabled The workqueue is enabled when the appropriate driver is loaded and disabled when the driver is removed. When the driver is removed it assumes that the workqueue was enabled successfully and proceeds to free allocations made during work

CVE-2021-47037 [MEDIUM] CVE-2021-47037: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: q6afe... In the Linux kernel, the following vulnerability has been resolved: ASoC: q6afe-clocks: fix reprobing of the driver Q6afe-clocks driver can get reprobed. For example if the APR services are restarted after the firmware crash. However currently Q6afe-clocks driver will oops because hw.init will get cleared during first _probe call. Rewrite the driver to fill the cloc

CVE-2021-47396 [MEDIUM] CVE-2021-47396: linux - In the Linux kernel, the following vulnerability has been resolved: mac80211-hw... In the Linux kernel, the following vulnerability has been resolved: mac80211-hwsim: fix late beacon hrtimer handling Thomas explained in https://lore.kernel.org/r/87mtoeb4hb.ffs@tglx that our handling of the hrtimer here is wrong: If the timer fires late (e.g. due to vCPU scheduling, as reported by Dmitry/syzbot) then it tries to actually rearm the timer at the next

CVE-2021-47583 [MEDIUM] CVE-2021-47583: linux - In the Linux kernel, the following vulnerability has been resolved: media: mxl1... In the Linux kernel, the following vulnerability has been resolved: media: mxl111sf: change mutex_init() location Syzbot reported, that mxl111sf_ctrl_msg() uses uninitialized mutex. The problem was in wrong mutex_init() location. Previous mutex_init(&state->msg_lock) call was in ->init() function, but dvb_usbv2_init() has this order of calls: dvb_usbv2_init() dvb_us

CVE-2021-47362 [MEDIUM] CVE-2021-47362: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm:... In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Update intermediate power state for SI Update the current state as boot state during dpm initialization. During the subsequent initialization, set_power_state gets called to transition to the final power state. set_power_state refers to values from the current state and without current s

CVE-2021-47047 [MEDIUM] CVE-2021-47047: linux - In the Linux kernel, the following vulnerability has been resolved: spi: spi-zy... In the Linux kernel, the following vulnerability has been resolved: spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails The spi controller supports 44-bit address space on AXI in DMA mode, so set dma_addr_t width to 44-bit to avoid using a swiotlb mapping. In addition, if dma_map_single fails, it should return immediately instead of continuing doing the DM

CVE-2024-35839 [MEDIUM] CVE-2024-35839: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: replace physindev with physinif in nf_bridge_info An skb can be added to a neigh->arp_queue while waiting for an arp reply. Where original skb's skb->dev can be different to neigh's neigh->dev. For instance in case of bridging dnated skb from one veth to another, the skb would be

CVE-2024-49897 [MEDIUM] CVE-2024-49897: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check phantom_stream before it is used dcn32_enable_phantom_stream can return null, so returned value must be checked before used. This fixes 1 NULL_RETURNS issue reported by Coverity. Scope: local bookworm: resolved (fixed in 6.1.123-1) bullseye: open forky: resolved (fixed in 6.11