Debian Linux vulnerabilities

CVE-2024-35883 [MEDIUM] CVE-2024-35883: linux - In the Linux kernel, the following vulnerability has been resolved: spi: mchp-p... In the Linux kernel, the following vulnerability has been resolved: spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe In function pci1xxxx_spi_probe, there is a potential null pointer that may be caused by a failed memory allocation by the function devm_kzalloc. Hence, a null pointer check needs to be added to prevent null pointer deref

CVE-2024-42278 [MEDIUM] CVE-2024-42278: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: TAS27... In the Linux kernel, the following vulnerability has been resolved: ASoC: TAS2781: Fix tasdev_load_calibrated_data() This function has a reversed if statement so it's either a no-op or it leads to a NULL dereference. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.10.3-1) sid: resolved (fixed in 6.10.3-1) trixie: resolved (fixed in 6.1

CVE-2024-27060 [MEDIUM] CVE-2024-27060: linux - In the Linux kernel, the following vulnerability has been resolved: thunderbolt... In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL pointer dereference in tb_port_update_credits() Olliver reported that his system crashes when plugging in Thunderbolt 1 device: BUG: kernel NULL pointer dereference, address: 0000000000000020 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page

CVE-2024-38593 [MEDIUM] CVE-2024-38593: linux - In the Linux kernel, the following vulnerability has been resolved: net: micrel... In the Linux kernel, the following vulnerability has been resolved: net: micrel: Fix receiving the timestamp in the frame for lan8841 The blamed commit started to use the ptp workqueue to get the second part of the timestamp. And when the port was set down, then this workqueue is stopped. But if the config option NETWORK_PHY_TIMESTAMPING is not enabled, then the ptp

CVE-2023-52677 [MEDIUM] CVE-2023-52677: linux - In the Linux kernel, the following vulnerability has been resolved: riscv: Chec... In the Linux kernel, the following vulnerability has been resolved: riscv: Check if the code to patch lies in the exit section Otherwise we fall through to vmalloc_to_page() which panics since the address does not lie in the vmalloc region. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: open forky: resolved (fixed in 6.6.15-1) sid: resolved (fixed in

CVE-2023-52561 [MEDIUM] CVE-2023-52561: linux - In the Linux kernel, the following vulnerability has been resolved: arm64: dts:... In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved Adding a reserved memory region for the framebuffer memory (the splash memory region set up by the bootloader). It fixes a kernel panic (arm-smmu: Unhandled context fault at this particular memory region) reported on DB845c

CVE-2022-48776 [MEDIUM] CVE-2022-48776: linux - In the Linux kernel, the following vulnerability has been resolved: mtd: parser... In the Linux kernel, the following vulnerability has been resolved: mtd: parsers: qcom: Fix missing free for pparts in cleanup Mtdpart doesn't free pparts when a cleanup function is declared. Add missing free for pparts in cleanup function for smem to fix the leak. Scope: local bookworm: resolved (fixed in 5.16.11-1) bullseye: resolved forky: resolved (fixed in 5.16

CVE-2022-48727 [MEDIUM] CVE-2022-48727: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: arm64:... In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Avoid consuming a stale esr value when SError occur When any exception other than an IRQ occurs, the CPU updates the ESR_EL2 register with the exception syndrome. An SError may also become pending, and will be synchronised by KVM. KVM notes the exception type, and whether an SError was s

CVE-2021-4441 [MEDIUM] CVE-2021-4441: linux - In the Linux kernel, the following vulnerability has been resolved: spi: spi-zy... In the Linux kernel, the following vulnerability has been resolved: spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op() In zynq_qspi_exec_mem_op(), kzalloc() is directly used in memset(), which could lead to a NULL pointer dereference on failure of kzalloc(). Fix this bug by adding a check of tmpbuf. This bug was found by a static analyzer. T

CVE-2021-47077 [MEDIUM] CVE-2021-47077: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: qedf:... In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Add pointer checks in qedf_update_link_speed() The following trace was observed: [ 14.042059] Call Trace: [ 14.042061] [ 14.042068] qedf_link_update+0x144/0x1f0 [qedf] [ 14.042117] qed_link_update+0x5c/0x80 [qed] [ 14.042135] qed_mcp_handle_link_change+0x2d2/0x410 [qed] [ 14.042155] ? qe

CVE-2021-47444 [MEDIUM] CVE-2021-47444: linux - In the Linux kernel, the following vulnerability has been resolved: drm/edid: I... In the Linux kernel, the following vulnerability has been resolved: drm/edid: In connector_bad_edid() cap num_of_ext by num_blocks read In commit e11f5bd8228f ("drm: Add support for DP 1.4 Compliance edid corruption test") the function connector_bad_edid() started assuming that the memory for the EDID passed to it was big enough to hold `edid[0x7e] + 1` blocks of da

CVE-2021-47187 [MEDIUM] CVE-2021-47187: linux - In the Linux kernel, the following vulnerability has been resolved: arm64: dts:... In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency The entry/exit latency and minimum residency in state for the idle states of MSM8998 were ..bad: first of all, for all of them the timings were written for CPU sleep but the min-residency-us param was miscalculated (supposedly, w

CVE-2025-21711 [MEDIUM] CVE-2025-21711: linux - In the Linux kernel, the following vulnerability has been resolved: net/rose: p... In the Linux kernel, the following vulnerability has been resolved: net/rose: prevent integer overflows in rose_setsockopt() In case of possible unpredictably large arguments passed to rose_setsockopt() and multiplied by extra values on top of that, integer overflows may occur. Do the safest minimum and fix these issues by checking the contents of 'opt' and returnin

CVE-2024-56724 [MEDIUM] CVE-2024-56724: linux - In the Linux kernel, the following vulnerability has been resolved: mfd: intel_... In the Linux kernel, the following vulnerability has been resolved: mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (inherited) flaws. This was unveiled when platform_get_irq() had started WARN() on IRQ 0 that is supposed to be a Linu

CVE-2024-46750 [MEDIUM] CVE-2024-46750: linux - In the Linux kernel, the following vulnerability has been resolved: PCI: Add mi... In the Linux kernel, the following vulnerability has been resolved: PCI: Add missing bridge lock to pci_bus_lock() One of the true positives that the cfg_access_lock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70 RIP: 0010:pci_bridge_secondary_bus_reset+0x5d/0x70 Call Trace: ? __

CVE-2024-47809 [MEDIUM] CVE-2024-47809: linux - In the Linux kernel, the following vulnerability has been resolved: dlm: fix po... In the Linux kernel, the following vulnerability has been resolved: dlm: fix possible lkb_resource null dereference This patch fixes a possible null pointer dereference when this function is called from request_lock() as lkb->lkb_resource is not assigned yet, only after validate_lock_args() by calling attach_lkb(). Another issue is that a resource name could be a no

CVE-2024-44938 [MEDIUM] CVE-2024-44938: linux - In the Linux kernel, the following vulnerability has been resolved: jfs: Fix sh... In the Linux kernel, the following vulnerability has been resolved: jfs: Fix shift-out-of-bounds in dbDiscardAG When searching for the next smaller log2 block, BLKSTOL2() returned 0, causing shift exponent -1 to be negative. This patch fixes the issue by exiting the loop directly when negative shift is found. Scope: local bookworm: resolved (fixed in 6.1.112-1) bull

CVE-2024-39474 [MEDIUM] CVE-2024-39474: linux - In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc:... In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL commit a421ef303008 ("mm: allow !GFP_KERNEL allocations for kvmalloc") includes support for __GFP_NOFAIL, but it presents a conflict with commit dd544141b9eb ("vmalloc: back off when the current task is OOM-killed"). A possibl

CVE-2024-53125 [MEDIUM] CVE-2024-53125: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: sync_l... In the Linux kernel, the following vulnerability has been resolved: bpf: sync_linked_regs() must preserve subreg_def Range propagation must not affect subreg_def marks, otherwise the following example is rewritten by verifier incorrectly when BPF_F_TEST_RND_HI32 flag is set: 0: call bpf_ktime_get_ns call bpf_ktime_get_ns 1: r0 &= 0x7fffffff after verifier r0 &= 0x7f

CVE-2023-52559 [MEDIUM] CVE-2023-52559: linux - In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d:... In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid memory allocation in iommu_suspend() The iommu_suspend() syscore suspend callback is invoked with IRQ disabled. Allocating memory with the GFP_KERNEL flag may re-enable IRQs during the suspend callback, which can cause intermittent suspend/hibernation problems with the following ke