Debian Linux vulnerabilities

CVE-2025-39843 [MEDIUM] CVE-2025-39843: linux - In the Linux kernel, the following vulnerability has been resolved: mm: slub: a... In the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion. The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)[n].lock, but when enabled CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare, and try to h

CVE-2025-39832 [MEDIUM] CVE-2025-39832: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: F... In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix lockdep assertion on sync reset unload event Fix lockdep assertion triggered during sync reset unload event. When the sync reset flow is initiated using the devlink reload fw_activate option, the PF already holds the devlink lock while handling unload event. In this case, delegate sync

CVE-2025-68223 [MEDIUM] CVE-2025-68223: linux - In the Linux kernel, the following vulnerability has been resolved: drm/radeon:... In the Linux kernel, the following vulnerability has been resolved: drm/radeon: delete radeon_fence_process in is_signaled, no deadlock Delete the attempt to progress the queue when checking if fence is signaled. This avoids deadlock. dma-fence_ops::signaled can be called with the fence lock in unknown state. For radeon, the fence lock is also the wait queue lock. T

CVE-2026-23106 [MEDIUM] CVE-2026-23106: linux - In the Linux kernel, the following vulnerability has been resolved: timekeeping... In the Linux kernel, the following vulnerability has been resolved: timekeeping: Adjust the leap state for the correct auxiliary timekeeper When __do_ajdtimex() was introduced to handle adjtimex for any timekeeper, this reference to tk_core was not updated. When called on an auxiliary timekeeper, the core timekeeper would be updated incorrectly. This gets caught by

CVE-2026-23211 [MEDIUM] CVE-2026-23211: linux - In the Linux kernel, the following vulnerability has been resolved: mm, swap: r... In the Linux kernel, the following vulnerability has been resolved: mm, swap: restore swap_space attr aviod kernel panic commit 8b47299a411a ("mm, swap: mark swap address space ro and add context debug check") made the swap address space read-only. It may lead to kernel panic if arch_prepare_to_swap returns a failure under heavy memory pressure as follows, el1_abort

CVE-2026-23018 [MEDIUM] CVE-2026-23018: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: rele... In the Linux kernel, the following vulnerability has been resolved: btrfs: release path before initializing extent tree in btrfs_read_locked_inode() In btrfs_read_locked_inode() we are calling btrfs_init_file_extent_tree() while holding a path with a read locked leaf from a subvolume tree, and btrfs_init_file_extent_tree() may do a GFP_KERNEL allocation, which can t

CVE-2022-50436 [MEDIUM] CVE-2022-50436: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: don't... In the Linux kernel, the following vulnerability has been resolved: ext4: don't set up encryption key during jbd2 transaction Commit a80f7fcf1867 ("ext4: fixup ext4_fc_track_* functions' signature") extended the scope of the transaction in ext4_unlink() too far, making it include the call to ext4_find_entry(). However, ext4_find_entry() can deadlock when called from

CVE-2025-39910 [MEDIUM] CVE-2025-39910: linux - In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc,... In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() kasan_populate_vmalloc() and its helpers ignore the caller's gfp_mask and always allocate memory using the hardcoded GFP_KERNEL flag. This makes them inconsistent with vmalloc(), which was recently extended to support GFP_NOFS and GF

CVE-2026-23199 [MEDIUM] CVE-2026-23199: linux - In the Linux kernel, the following vulnerability has been resolved: procfs: avo... In the Linux kernel, the following vulnerability has been resolved: procfs: avoid fetching build ID while holding VMA lock Fix PROCMAP_QUERY to fetch optional build ID only after dropping mmap_lock or per-VMA lock, whichever was used to lock VMA under question, to avoid deadlock reported by syzbot: -> #1 (&mm->mmap_lock){++++}-{4:4}: __might_fault+0xed/0x170 _copy_t

CVE-2025-71117 [MEDIUM] CVE-2025-71117: linux - In the Linux kernel, the following vulnerability has been resolved: block: Remo... In the Linux kernel, the following vulnerability has been resolved: block: Remove queue freezing from several sysfs store callbacks Freezing the request queue from inside sysfs store callbacks may cause a deadlock in combination with the dm-multipath driver and the queue_if_no_path option. Additionally, freezing the request queue slows down system boot on systems wh

CVE-2026-23217 [MEDIUM] CVE-2026-23217: linux - In the Linux kernel, the following vulnerability has been resolved: riscv: trac... In the Linux kernel, the following vulnerability has been resolved: riscv: trace: fix snapshot deadlock with sbi ecall If sbi_ecall.c's functions are traceable, echo "__sbi_ecall:snapshot" > /sys/kernel/tracing/set_ftrace_filter may get the kernel into a deadlock. (Functions in sbi_ecall.c are excluded from tracing if CONFIG_RISCV_ALTERNATIVE_EARLY is set.) __sbi_ec

CVE-2026-23165 [MEDIUM] CVE-2026-23165: linux - In the Linux kernel, the following vulnerability has been resolved: sfc: fix de... In the Linux kernel, the following vulnerability has been resolved: sfc: fix deadlock in RSS config read Since cited commit, core locks the net_device's rss_lock when handling ethtool -x command, so driver's implementation should not lock it again. Remove the latter. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.18.9-1) sid: resolved

CVE-2023-53033 [HIGH] CVE-2023-53033: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits If the offset + length goes over the ethernet + vlan header, then the length is adjusted to copy the bytes that are within the boundaries of the vlan_ethhdr scratchpad area. The remaining bytes beyond ethernet + vlan header a

CVE-2020-12888 [MEDIUM] CVE-2020-12888: linux - The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to ac... The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory space. Scope: local bookworm: resolved (fixed in 5.8.7-1) bullseye: resolved (fixed in 5.8.7-1) forky: resolved (fixed in 5.8.7-1) sid: resolved (fixed in 5.8.7-1) trixie: resolved (fixed in 5.8.7-1)

CVE-2026-23066 [HIGH] CVE-2026-23066: linux - In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ... In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix recvmsg() unconditional requeue If rxrpc_recvmsg() fails because MSG_DONTWAIT was specified but the call at the front of the recvmsg queue already has its mutex locked, it requeues the call - whether or not the call is already queued. The call may be on the queue because MSG_PEEK was also p

CVE-2014-0102 [MEDIUM] CVE-2014-0102: linux - The keyring_detect_cycle_iterator function in security/keys/keyring.c in the Lin... The keyring_detect_cycle_iterator function in security/keys/keyring.c in the Linux kernel through 3.13.6 does not properly determine whether keyrings are identical, which allows local users to cause a denial of service (OOPS) via crafted keyctl commands. Scope: local bookworm: resolved (fixed in 3.13.6-1) bullseye: resolved (fixed in 3.13.6-1) forky: resolved (fixed i

CVE-2022-48698 [MEDIUM] CVE-2022-48698: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix memory leak when using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. Fix this up by properly calling dput(). Scope: local bookworm: resolved (fixed in 5.19.11-1) bullseye: resolved forky: resolv

CVE-2016-2547 [MEDIUM] CVE-2016-2547: linux - sound/core/timer.c in the Linux kernel before 4.4.1 employs a locking approach t... sound/core/timer.c in the Linux kernel before 4.4.1 employs a locking approach that does not consider slave timer instances, which allows local users to cause a denial of service (race condition, use-after-free, and system crash) via a crafted ioctl call. Scope: local bookworm: resolved (fixed in 4.4.2-1) bullseye: resolved (fixed in 4.4.2-1) forky: resolved (fixed in

CVE-2021-47389 [MEDIUM] CVE-2021-47389: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: f... In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: fix missing sev_decommission in sev_receive_start DECOMMISSION the current SEV context if binding an ASID fails after RECEIVE_START. Per AMD's SEV API, RECEIVE_START generates a new guest context and thus needs to be paired with DECOMMISSION: The RECEIVE_START command is the only command o

CVE-2015-2150 [MEDIUM] CVE-2015-2150: linux - Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly rest... Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (U