Debian Linux vulnerabilities

CVE-2025-71075 [HIGH] CVE-2025-71075: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: aic94... In the Linux kernel, the following vulnerability has been resolved: scsi: aic94xx: fix use-after-free in device removal path The asd_pci_remove() function fails to synchronize with pending tasklets before freeing the asd_ha structure, leading to a potential use-after-free vulnerability. When a device removal is triggered (via hot-unplug or module unload), race conditi

CVE-2026-23351 [HIGH] CVE-2026-23351: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Yiming Qian reports Use-after-free in the pipapo set type: Under a large number of expired elements, commit-time GC can run for a very long time in a non-preemptible context, triggering soft lockup warnings and RCU stall reports (local

CVE-2026-23273 [HIGH] CVE-2026-23273: linux - In the Linux kernel, the following vulnerability has been resolved: macvlan: ob... In the Linux kernel, the following vulnerability has been resolved: macvlan: observe an RCU grace period in macvlan_common_newlink() error path valis reported that a race condition still happens after my prior patch. macvlan_common_newlink() might have made @dev visible before detecting an error, and its caller will directly call free_netdev(dev). We must respect an R

CVE-2026-23221 [HIGH] CVE-2026-23221: linux - In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc... In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: fix use-after-free in driver_override_show() The driver_override_show() function reads the driver_override string without holding the device_lock. However, driver_override_store() uses driver_set_override(), which modifies and frees the string while holding the device_lock. This can resul

CVE-2025-71082 [HIGH] CVE-2025-71082: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of devm_kzalloc in btusb This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in btusb.c file"). In btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This ties the lifetime of all the btusb data to the binding of a driver to one interface, INTF. I

CVE-2025-71091 [HIGH] CVE-2025-71091: linux - In the Linux kernel, the following vulnerability has been resolved: team: fix c... In the Linux kernel, the following vulnerability has been resolved: team: fix check for port enabled in team_queue_override_port_prio_changed() There has been a syzkaller bug reported recently with the following trace: list_del corruption, ffff888058bea080->prev is LIST_POISON2 (dead000000000122) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:59!

CVE-2026-23234 [HIGH] CVE-2026-23234: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: fix t... In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid UAF in f2fs_write_end_io() As syzbot reported an use-after-free issue in f2fs_write_end_io(). It is caused by below race condition: loop device umount - worker_thread - loop_process_work - do_req_filebacked - lo_rw_aio - lo_rw_aio_complete - blk_mq_end_request - blk_update_request -

CVE-2026-23171 [HIGH] CVE-2026-23171: linux - In the Linux kernel, the following vulnerability has been resolved: bonding: fi... In the Linux kernel, the following vulnerability has been resolved: bonding: fix use-after-free due to enslave fail after slave array update Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the new slave can be used for Tx immediately, we can use it after it has been freed by the enslave error cleanup pat

CVE-2026-23194 [HIGH] CVE-2026-23194: linux - In the Linux kernel, the following vulnerability has been resolved: rust_binder... In the Linux kernel, the following vulnerability has been resolved: rust_binder: correctly handle FDA objects of length zero Fix a bug where an empty FDA (fd array) object with 0 fds would cause an out-of-bounds error. The previous implementation used `skip == 0` to mean "this is a pointer fixup", but 0 is also the correct skip length for an empty FDA. If the FDA is a

CVE-2024-38623 [CRITICAL] CVE-2024-38623: linux - In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: U... In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Use variable length array instead of fixed size Should fix smatch warning: ntfs_set_label() error: __builtin_memcpy() 'uni->name' too small (20 vs 256) Scope: local bookworm: resolved (fixed in 6.1.94-1) bullseye: resolved forky: resolved (fixed in 6.9.7-1) sid: resolved (fixed in 6.9.7-

CVE-2023-32256 [HIGH] CVE-2023-32256: linux - A flaw was found in the Linux kernel's ksmbd component. A race condition between... A flaw was found in the Linux kernel's ksmbd component. A race condition between smb2 close operation and logoff in multichannel connections could result in a use-after-free issue. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: open forky: resolved (fixed in 6.3.7-1) sid: resolved (fixed in 6.3.7-1) trixie: resolved (fixed in 6.3.7-1)

CVE-2021-31440 [HIGH] CVE-2021-31440: linux - This vulnerability allows local attackers to escalate privileges on affected ins... This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of u

CVE-2020-27068 [CRITICAL] CVE-2020-27068: linux - Product: AndroidVersions: Android kernelAndroid ID: A-127973231References: Upstr... Product: AndroidVersions: Android kernelAndroid ID: A-127973231References: Upstream kernel Scope: local bookworm: resolved (fixed in 5.5.13-1) bullseye: resolved (fixed in 5.5.13-1) forky: resolved (fixed in 5.5.13-1) sid: resolved (fixed in 5.5.13-1) trixie: resolved (fixed in 5.5.13-1)

CVE-2024-0565 [MEDIUM] CVE-2024-0565: linux - An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/... An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service. Scope: local bookworm: resolved (fixed in 6.1.69-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in

CVE-2026-23364 [HIGH] CVE-2026-23364: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: Comp... In the Linux kernel, the following vulnerability has been resolved: ksmbd: Compare MACs in constant time To prevent timing attacks, MAC comparisons need to be constant-time. Replace the memcmp() with the correct function, crypto_memneq(). Scope: local bookworm: open bullseye: resolved forky: resolved (fixed in 6.19.8-1) sid: resolved (fixed in 6.19.8-1) trixie: open

CVE-2021-4203 [MEDIUM] CVE-2021-4203: linux - A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due... A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information. Scope: local bookworm: resolved (fixed in 5.14.12-1) bullseye: resolved (fixed in 5.10.84-1)

CVE-2017-7645 [HIGH] CVE-2017-7645: linux - The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11... The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. Scope: local bookworm: resolved (fixed in 4.9.25-1) bullseye: resolved (fixed in 4.9.25-1) forky: resolved (fixed in 4.9.25-1) sid:

CVE-2025-40133 [LOW] CVE-2025-40133: linux - In the Linux kernel, the following vulnerability has been resolved: mptcp: Use ... In the Linux kernel, the following vulnerability has been resolved: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). mptcp_active_enable() is called from subflow_finish_connect(), which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always under RCU. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu(). Scope:

CVE-2016-9919 [HIGH] CVE-2016-9919: linux - The icmp6_send function in net/ipv6/icmp.c in the Linux kernel through 4.8.12 om... The icmp6_send function in net/ipv6/icmp.c in the Linux kernel through 4.8.12 omits a certain check of the dst data structure, which allows remote attackers to cause a denial of service (panic) via a fragmented IPv6 packet. Scope: local bookworm: resolved (fixed in 4.8.15-1) bullseye: resolved (fixed in 4.8.15-1) forky: resolved (fixed in 4.8.15-1) sid: resolved (fixed

CVE-2025-68360 [LOW] CVE-2025-68360: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mt76:... In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks MT7996 driver can use both wed and wed_hif2 devices to offload traffic from/to the wireless NIC. In the current codebase we assume to always use the primary wed device in wed callbacks resulting in the following crash if the hw run