Debian Linux vulnerabilities

CVE-2022-49421 [MEDIUM] CVE-2022-49421: linux - In the Linux kernel, the following vulnerability has been resolved: video: fbde... In the Linux kernel, the following vulnerability has been resolved: video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye

CVE-2023-52470 [MEDIUM] CVE-2023-52470: linux - In the Linux kernel, the following vulnerability has been resolved: drm/radeon:... In the Linux kernel, the following vulnerability has been resolved: drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() check the alloc_workqueue return value in radeon_crtc_init() to avoid null-ptr-deref. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: resolved (fixed in 5.10.209-1) forky: resolved (fixed in 6.6.15-1) sid: resolve

CVE-2024-27077 [MEDIUM] CVE-2024-27077: linux - In the Linux kernel, the following vulnerability has been resolved: media: v4l2... In the Linux kernel, the following vulnerability has been resolved: media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity The entity->name (i.e. name) is allocated in v4l2_m2m_register_entity but isn't freed in its following error-handling paths. This patch adds such deallocation to prevent memleak of entity->name. Scope: local bookworm: resolved (fixed in

CVE-2024-27078 [MEDIUM] CVE-2024-27078: linux - In the Linux kernel, the following vulnerability has been resolved: media: v4l2... In the Linux kernel, the following vulnerability has been resolved: media: v4l2-tpg: fix some memleaks in tpg_alloc In tpg_alloc, resources should be deallocated in each and every error-handling paths, since they are allocated in for statements. Otherwise there would be memleaks because tpg_free is called only when tpg_alloc return 0. Scope: local bookworm: resolved

CVE-2024-40921 [MEDIUM] CVE-2024-40921: linux - In the Linux kernel, the following vulnerability has been resolved: net: bridge... In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state Pass the already obtained vlan group pointer to br_mst_vlan_set_state() instead of dereferencing it again. Each caller has already correctly dereferenced it for their context. This change is required for the following suspicious RCU

CVE-2025-39929 [MEDIUM] CVE-2025-39929: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path During tests of another unrelated patch I was able to trigger this error: Objects remaining on __kmem_cache_shutdown() Scope: local bookworm: resolved (fixed in 6.1.158-1) bullseye: open forky: resolved (fixed in 6.16.9-1) sid: r

CVE-2023-52813 [MEDIUM] CVE-2023-52813: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: pcr... In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix hungtask for PADATA_RESET We found a hungtask bug in test_aead_vec_cfg as follows: INFO: task cryptomgr_test:391009 blocked for more than 120 seconds. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. Call trace: __switch_to+0x98/0xe0 __schedule+0x6c4/0xf

CVE-2023-4569 [MEDIUM] CVE-2023-4569: linux - A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_table... A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which can result in a memory leak. Scope: local bookworm: resolved (fixed in 6.1.52-1) bullseye: open forky: resolved (fixed in 6.4.13-1) sid: resolved (fixed in 6.4.13-1)

CVE-2022-49611 [MEDIUM] CVE-2022-49611: linux - In the Linux kernel, the following vulnerability has been resolved: x86/specula... In the Linux kernel, the following vulnerability has been resolved: x86/speculation: Fill RSB on vmexit for IBRS Prevent RSB underflow/poisoning attacks with RSB. While at it, add a bunch of comments to attempt to document the current state of tribal knowledge about RSB attacks and what exactly is being mitigated. Scope: local bookworm: resolved (fixed in 5.18.14-1)

CVE-2024-39505 [MEDIUM] CVE-2024-39505: linux - In the Linux kernel, the following vulnerability has been resolved: drm/komeda:... In the Linux kernel, the following vulnerability has been resolved: drm/komeda: check for error-valued pointer komeda_pipeline_get_state() may return an error-valued pointer, thus check the pointer for negative or null value before dereferencing. Scope: local bookworm: resolved (fixed in 6.1.99-1) bullseye: resolved (fixed in 5.10.221-1) forky: resolved (fixed in 6.

CVE-2022-49475 [MEDIUM] CVE-2022-49475: linux - In the Linux kernel, the following vulnerability has been resolved: spi: spi-fs... In the Linux kernel, the following vulnerability has been resolved: spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname() It will cause null-ptr-deref if platform_get_resource_byname() returns NULL, we need check the return value. Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved (fixed in 5.10.127-1) forky: resolved

CVE-2023-52585 [MEDIUM] CVE-2023-52585: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper() Return invalid error code -EINVAL for invalid block id. Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c:1183 amdgpu_ras_query_error_status_helper() error: we previously assumed 'info' could be null (see line

CVE-2022-49358 [MEDIUM] CVE-2022-49358: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: memleak flow rule from commit path Abort path release flow rule object, however, commit path does not. Update code to destroy these objects before releasing the transaction. Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved (fixed in 5.10.127-1) forky: reso

CVE-2022-48809 [MEDIUM] CVE-2022-48809: linux - In the Linux kernel, the following vulnerability has been resolved: net: fix a ... In the Linux kernel, the following vulnerability has been resolved: net: fix a memleak when uncloning an skb dst and its metadata When uncloning an skb dst and its associated metadata, a new dst+metadata is allocated and later replaces the old one in the skb. This is helpful to have a non-shared dst+metadata attached to a specific skb. The issue is the uncloned dst+

CVE-2022-49673 [MEDIUM] CVE-2022-49673: linux - In the Linux kernel, the following vulnerability has been resolved: dm raid: fi... In the Linux kernel, the following vulnerability has been resolved: dm raid: fix KASAN warning in raid5_add_disks There's a KASAN warning in raid5_add_disk when running the LVM testsuite. The warning happens in the test lvconvert-raid-reshape-linear_to_raid6-single-type.sh. We fix the warning by verifying that rdev->saved_raid_disk is within limits. Scope: local boo

CVE-2019-14763 [MEDIUM] CVE-2019-14763: linux - In the Linux kernel before 4.16.4, a double-locking error in drivers/usb/dwc3/ga... In the Linux kernel before 4.16.4, a double-locking error in drivers/usb/dwc3/gadget.c may potentially cause a deadlock with f_hid. Scope: local bookworm: resolved (fixed in 4.16.5-1) bullseye: resolved (fixed in 4.16.5-1) forky: resolved (fixed in 4.16.5-1) sid: resolved (fixed in 4.16.5-1) trixie: resolved (fixed in 4.16.5-1)

CVE-2024-40988 [MEDIUM] CVE-2024-40988: linux - In the Linux kernel, the following vulnerability has been resolved: drm/radeon:... In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix UBSAN warning in kv_dpm.c Adds bounds check for sumo_vid_mapping_entry. Scope: local bookworm: resolved (fixed in 6.1.99-1) bullseye: resolved (fixed in 5.10.221-1) forky: resolved (fixed in 6.9.7-1) sid: resolved (fixed in 6.9.7-1) trixie: resolved (fixed in 6.9.7-1)

CVE-2025-39720 [MEDIUM] CVE-2025-39720: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix refcount leak causing resource not released When ksmbd_conn_releasing(opinfo->conn) returns true,the refcount was not decremented properly, causing a refcount leak that prevents the count from reaching zero and the memory from being released. Scope: local bookworm: open bullseye: resolved

CVE-2024-40987 [MEDIUM] CVE-2024-40987: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix UBSAN warning in kv_dpm.c Adds bounds check for sumo_vid_mapping_entry. Scope: local bookworm: resolved (fixed in 6.1.99-1) bullseye: resolved (fixed in 5.10.221-1) forky: resolved (fixed in 6.9.7-1) sid: resolved (fixed in 6.9.7-1) trixie: resolved (fixed in 6.9.7-1)

CVE-2024-26840 [MEDIUM] CVE-2024-26840: linux - In the Linux kernel, the following vulnerability has been resolved: cachefiles:... In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix memory leak in cachefiles_add_cache() The following memory leak was reported after unbinding /dev/cachefiles: ================================================================== unreferenced object 0xffff9b674176e3c0 (size 192): comm "cachefilesd2", pid 680, jiffies 4294881224 hex dum