Debian Linux vulnerabilities

CVE-2022-49610 [MEDIUM] CVE-2022-49610: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: P... In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Prevent RSB underflow before vmenter On VMX, there are some balanced returns between the time the guest's SPEC_CTRL value is written, and the vmenter. Balanced returns (matched by a preceding call) are usually ok, but it's at least theoretically possible an NMI with a deep call stack could

CVE-2022-49699 [MEDIUM] CVE-2022-49699: linux - In the Linux kernel, the following vulnerability has been resolved: filemap: Ha... In the Linux kernel, the following vulnerability has been resolved: filemap: Handle sibling entries in filemap_get_read_batch() If a read races with an invalidation followed by another read, it is possible for a folio to be replaced with a higher-order folio. If that happens, we'll see a sibling entry for the new folio in the next iteration of the loop. This manifes

CVE-2025-21814 [MEDIUM] CVE-2025-21814: linux - In the Linux kernel, the following vulnerability has been resolved: ptp: Ensure... In the Linux kernel, the following vulnerability has been resolved: ptp: Ensure info->enable callback is always set The ioctl and sysfs handlers unconditionally call the ->enable callback. Not all drivers implement that callback, leading to NULL dereferences. Example of affected drivers: ptp_s390.c, ptp_vclock.c and ptp_mock.c. Instead use a dummy callback if no bet

CVE-2024-35922 [MEDIUM] CVE-2024-35922: linux - In the Linux kernel, the following vulnerability has been resolved: fbmon: prev... In the Linux kernel, the following vulnerability has been resolved: fbmon: prevent division by zero in fb_videomode_from_videomode() The expression htotal * vtotal can have a zero value on overflow. It is necessary to prevent division by zero like in fb_var_to_videomode(). Found by Linux Verification Center (linuxtesting.org) with Svace. Scope: local bookworm: resol

CVE-2024-56769 [MEDIUM] CVE-2024-56769: linux - In the Linux kernel, the following vulnerability has been resolved: media: dvb-... In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg Syzbot reports [1] an uninitialized value issue found by KMSAN in dib3000_read_reg(). Local u8 rb[2] is used in i2c_transfer() as a read buffer; in case that call fails, the buffer may end up with some undefined values. Since no

CVE-2024-43913 [MEDIUM] CVE-2024-43913: linux - In the Linux kernel, the following vulnerability has been resolved: nvme: apple... In the Linux kernel, the following vulnerability has been resolved: nvme: apple: fix device reference counting Drivers must call nvme_uninit_ctrl after a successful nvme_init_ctrl. Split the allocation side out to make the error handling boundary easier to navigate. The apple driver had been doing this wrong, leaking the controller device memory on a tagset failure.

CVE-2024-26849 [MEDIUM] CVE-2024-26849: linux - In the Linux kernel, the following vulnerability has been resolved: netlink: ad... In the Linux kernel, the following vulnerability has been resolved: netlink: add nla be16/32 types to minlen array BUG: KMSAN: uninit-value in nla_validate_range_unsigned lib/nlattr.c:222 [inline] BUG: KMSAN: uninit-value in nla_validate_int_range lib/nlattr.c:336 [inline] BUG: KMSAN: uninit-value in validate_nla lib/nlattr.c:575 [inline] BUG: KMSAN: uninit-value in

CVE-2024-45007 [MEDIUM] CVE-2024-45007: linux - In the Linux kernel, the following vulnerability has been resolved: char: xilly... In the Linux kernel, the following vulnerability has been resolved: char: xillybus: Don't destroy workqueue from work item running on it Triggered by a kref decrement, destroy_workqueue() may be called from within a work item for destroying its own workqueue. This illegal situation is averted by adding a module-global workqueue for exclusive use of the offending wor

CVE-2024-35987 [MEDIUM] CVE-2024-35987: linux - In the Linux kernel, the following vulnerability has been resolved: riscv: Fix ... In the Linux kernel, the following vulnerability has been resolved: riscv: Fix loading 64-bit NOMMU kernels past the start of RAM commit 3335068f8721 ("riscv: Use PUD/P4D/PGD pages for the linear mapping") added logic to allow using RAM below the kernel load address. However, this does not work for NOMMU, where PAGE_OFFSET is fixed to the kernel load address. Since

CVE-2023-52453 [MEDIUM] CVE-2023-52453: linux - In the Linux kernel, the following vulnerability has been resolved: hisi_acc_vf... In the Linux kernel, the following vulnerability has been resolved: hisi_acc_vfio_pci: Update migration data pointer correctly on saving/resume When the optional PRE_COPY support was added to speed up the device compatibility check, it failed to update the saving/resuming data pointers based on the fd offset. This results in migration data corruption and when the de

CVE-2022-48845 [MEDIUM] CVE-2022-48845: linux - In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: ... In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: fill in sibling and core maps earlier After enabling CONFIG_SCHED_CORE (landed during 5.14 cycle), 2-core 2-thread-per-core interAptiv (CPS-driven) started emitting the following: [ 0.025698] CPU1 revision is: 0001a120 (MIPS interAptiv (multi)) [ 0.048183] ------------[ cut here ]--------

CVE-2025-21723 [MEDIUM] CVE-2025-21723: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3m... In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix possible crash when setting up bsg fails If bsg_setup_queue() fails, the bsg_queue is assigned a non-NULL value. Consequently, in mpi3mr_bsg_exit(), the condition "if(!mrioc->bsg_queue)" will not be satisfied, preventing execution from entering bsg_remove_queue(), which could lead

CVE-2024-47743 [MEDIUM] CVE-2024-47743: linux - In the Linux kernel, the following vulnerability has been resolved: KEYS: preve... In the Linux kernel, the following vulnerability has been resolved: KEYS: prevent NULL pointer dereference in find_asymmetric_key() In find_asymmetric_key(), if all NULLs are passed in the id_{0,1,2} arguments, the kernel will first emit WARN but then have an oops because id_2 gets dereferenced anyway. Add the missing id_2 check and move WARN_ON() to the final else

CVE-2024-53233 [MEDIUM] CVE-2024-53233: linux - In the Linux kernel, the following vulnerability has been resolved: unicode: Fi... In the Linux kernel, the following vulnerability has been resolved: unicode: Fix utf8_load() error path utf8_load() requests the symbol "utf8_data_table" and then checks if the requested UTF-8 version is supported. If it's unsupported, it tries to put the data table using symbol_put(). If an unsupported version is requested, symbol_put() fails like this: kernel BUG

CVE-2024-38390 [MEDIUM] CVE-2024-38390: linux - In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6x... In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails Calling a6xx_destroy() before adreno_gpu_init() leads to a null pointer dereference on: msm_gpu_cleanup() : platform_set_drvdata(gpu->pdev, NULL); as gpu->pdev is only assigned in: a6xx_gpu_init() |_ adreno_gpu_init |_ msm_gpu_ini

CVE-2024-49940 [MEDIUM] CVE-2024-49940: linux - In the Linux kernel, the following vulnerability has been resolved: l2tp: preve... In the Linux kernel, the following vulnerability has been resolved: l2tp: prevent possible tunnel refcount underflow When a session is created, it sets a backpointer to its tunnel. When the session refcount drops to 0, l2tp_session_free drops the tunnel refcount if session->tunnel is non-NULL. However, session->tunnel is set in l2tp_session_create, before the tunnel

CVE-2024-43868 [MEDIUM] CVE-2024-43868: linux - In the Linux kernel, the following vulnerability has been resolved: riscv/purga... In the Linux kernel, the following vulnerability has been resolved: riscv/purgatory: align riscv_kernel_entry When alignment handling is delegated to the kernel, everything must be word-aligned in purgatory, since the trap handler is then set to the kexec one. Without the alignment, hitting the exception would ultimately crash. On other occasions, the kernel's handl

CVE-2024-26963 [MEDIUM] CVE-2024-26963: linux - In the Linux kernel, the following vulnerability has been resolved: usb: dwc3-a... In the Linux kernel, the following vulnerability has been resolved: usb: dwc3-am62: fix module unload/reload behavior As runtime PM is enabled, the module can be runtime suspended when .remove() is called. Do a pm_runtime_get_sync() to make sure module is active before doing any register operations. Doing a pm_runtime_put_sync() should disable the refclk so no need

CVE-2024-38622 [MEDIUM] CVE-2024-38622: linux - In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu... In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add callback function pointer check before its call In dpu_core_irq_callback_handler() callback function pointer is compared to NULL, but then callback function is unconditionally called by this pointer. Fix this bug by adding conditional return. Found by Linux Verification Center (linu

CVE-2024-36021 [MEDIUM] CVE-2024-36021: linux - In the Linux kernel, the following vulnerability has been resolved: net: hns3: ... In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when devlink reload during pf initialization The devlink reload process will access the hardware resources, but the register operation is done before the hardware is initialized. So, processing the devlink reload during initialization may lead to kernel crash. This patch