Debian Linux vulnerabilities

CVE-2025-39713 [MEDIUM] CVE-2025-39713: linux - In the Linux kernel, the following vulnerability has been resolved: media: rain... In the Linux kernel, the following vulnerability has been resolved: media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() In the interrupt handler rain_interrupt(), the buffer full check on rain->buf_len is performed before acquiring rain->buf_lock. This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as rain->buf_len is concurrently a

CVE-2025-39961 [MEDIUM] CVE-2025-39961: linux - In the Linux kernel, the following vulnerability has been resolved: iommu/amd/p... In the Linux kernel, the following vulnerability has been resolved: iommu/amd/pgtbl: Fix possible race while increase page table level The AMD IOMMU host page table implementation supports dynamic page table levels (up to 6 levels), starting with a 3-level configuration that expands based on IOVA address. The kernel maintains a root pointer and current page table le

CVE-2023-53188 [MEDIUM] CVE-2023-53188: linux - In the Linux kernel, the following vulnerability has been resolved: net: openvs... In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix race on port output assume the following setup on a single machine: 1. An openvswitch instance with one bridge and default flows 2. two network namespaces "server" and "client" 3. two ovs interfaces "server" and "client" on the bridge 4. for each ovs interface a veth pair with

CVE-2020-11494 [MEDIUM] CVE-2020-11494: linux - An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kern... An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL, aka CID-b9258a2cece4. Scope: local bookworm: resolved (fixed in 5.5.17-1) bullseye: re

CVE-2023-2860 [MEDIUM] CVE-2023-2860: linux - An out-of-bounds read vulnerability was found in the SR-IPv6 implementation in t... An out-of-bounds read vulnerability was found in the SR-IPv6 implementation in the Linux kernel. The flaw exists within the processing of seg6 attributes. The issue results from the improper validation of user-supplied data, which can result in a read past the end of an allocated buffer. This flaw allows a privileged local user to disclose sensitive information on aff

CVE-2023-7042 [MEDIUM] CVE-2023-7042: linux - A null pointer dereference vulnerability was found in ath10k_wmi_tlv_op_pull_mgm... A null pointer dereference vulnerability was found in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() in drivers/net/wireless/ath/ath10k/wmi-tlv.c in the Linux kernel. This issue could be exploited to trigger a denial of service. Scope: local bookworm: resolved (fixed in 6.1.82-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.7.12-1) sid: resolved (fi

CVE-2018-10881 [MEDIUM] CVE-2018-10881: linux - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a... A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. Scope: local bookworm: resolved (fixed in 4.17.3-1) bullseye: resolved (fixed in 4.17.3-1) forky: resolved (fixed in 4.17.3-1) sid:

CVE-2020-25656 [MEDIUM] CVE-2020-25656: linux - A flaw was found in the Linux kernel. A use-after-free was found in the way the ... A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality. Scope: local bookworm: resolved (fixed in 5.9.6-1) bullseye: resolved (fixed in 5.9

CVE-2023-42755 [MEDIUM] CVE-2023-42755: linux - A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in ... A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service. Scope: local bookworm: resolved (fixed in 6.1.55-1) bullseye

CVE-2012-3511 [MEDIUM] CVE-2012-3511: linux - Multiple race conditions in the madvise_remove function in mm/madvise.c in the L... Multiple race conditions in the madvise_remove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service (use-after-free and system crash) via vectors involving a (1) munmap or (2) close system call. Scope: local bookworm: resolved (fixed in 3.2.23-1) bullseye: resolved (fixed in 3.2.23-1) forky: resolved (fixed in 3.2.23

CVE-2023-52838 [MEDIUM] CVE-2023-52838: linux - In the Linux kernel, the following vulnerability has been resolved: fbdev: imst... In the Linux kernel, the following vulnerability has been resolved: fbdev: imsttfb: fix a resource leak in probe I've re-written the error handling but the bug is that if init_imstt() fails we need to call iounmap(par->cmap_regs). Scope: local bookworm: resolved (fixed in 6.1.64-1) bullseye: resolved (fixed in 5.10.205-1) forky: resolved (fixed in 6.6.8-1) sid: reso

CVE-2022-48646 [MEDIUM] CVE-2022-48646: linux - In the Linux kernel, the following vulnerability has been resolved: sfc/siena: ... In the Linux kernel, the following vulnerability has been resolved: sfc/siena: fix null pointer dereference in efx_hard_start_xmit Like in previous patch for sfc, prevent potential (but unlikely) NULL pointer dereference. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: open forky: resolved (fixed in 6.0.2-1) sid: resolved (fixed in 6.0.2-1) trixie: reso

CVE-2023-3108 [MEDIUM] CVE-2023-3108: linux - A flaw was found in the subsequent get_user_pages_fast in the Linux kernel’s int... A flaw was found in the subsequent get_user_pages_fast in the Linux kernel’s interface for symmetric key cipher algorithms in the skcipher_recvmsg of crypto/algif_skcipher.c function. This flaw allows a local user to crash the system. Scope: local bookworm: resolved (fixed in 4.0.2-1) bullseye: resolved (fixed in 4.0.2-1) forky: resolved (fixed in 4.0.2-1) sid: resolv

CVE-2022-3544 [LOW] CVE-2022-3544: linux - A vulnerability, which was classified as problematic, was found in Linux Kernel.... A vulnerability, which was classified as problematic, was found in Linux Kernel. Affected is the function damon_sysfs_add_target of the file mm/damon/sysfs.c of the component Netfilter. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211044. Scope: local bookworm: resolved (fixed in

CVE-2022-3543 [LOW] CVE-2022-3543: linux - A vulnerability, which was classified as problematic, has been found in Linux Ke... A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function unix_sock_destructor/unix_release_sock of the file net/unix/af_unix.c of the component BPF. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211043. Scope:

CVE-2017-5986 [MEDIUM] CVE-2017-5986: linux - Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the ... Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel before 4.9.11 allows local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state. Scope: local bookworm: resolved (fixed in 4.9.10-1) bullseye: resolved (fixed in 4.9.10-1)

CVE-2020-28915 [MEDIUM] CVE-2020-28915: linux - A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux ker... A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read kernel memory, aka CID-6735b4632def. Scope: local bookworm: resolved (fixed in 5.9.1-1) bullseye: resolved (fixed in 5.9.1-1) forky: resolved (fixed in 5.9.1-1) sid: resolved (fixed in 5.9.1-1) trixie: resolved (fixed in 5.9.1-1)

CVE-2020-10732 [LOW] CVE-2020-10732: linux - A flaw was found in the Linux kernel's implementation of Userspace core dumps. T... A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and exfiltrate private kernel data. Scope: local bookworm: resolved (fixed in 5.6.14-2) bullseye: resolved (fixed in 5.6.14-2) forky: resolved (fixed in 5.6.14-2) sid: resolved (fixed in 5.6.14-2) trixie: resolved (

CVE-2019-20096 [MEDIUM] CVE-2019-20096: linux - In the Linux kernel before 5.1, there is a memory leak in __feat_register_sp() i... In the Linux kernel before 5.1, there is a memory leak in __feat_register_sp() in net/dccp/feat.c, which may cause denial of service, aka CID-1d3ff0950e2b. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved (fixed in 5.2.6-1) sid: resolved (fixed in 5.2.6-1) trixie: resolved (fixed in 5.2.6-1)

CVE-2025-21947 [HIGH] CVE-2025-21947: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix type confusion via race condition when using ipc_msg_send_request req->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on ida_alloc. req->handle from ksmbd_ipc_login_request and FSCTL_PIPE_TRANSCEIVE ioctl can be same and it could lead to type confusion between messages, resulti