Debian Linux vulnerabilities

CVE-2024-35978 [MEDIUM] CVE-2024-35978: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix memory leak in hci_req_sync_complete() In 'hci_req_sync_complete()', always free the previous sync request state before assigning reference to a new one. Scope: local bookworm: resolved (fixed in 6.1.90-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.8.9-1) sid

CVE-2021-28951 [MEDIUM] CVE-2021-28951: linux - An issue was discovered in fs/io_uring.c in the Linux kernel through 5.11.8. It ... An issue was discovered in fs/io_uring.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (deadlock) because exit may be waiting to park a SQPOLL thread, but concurrently that SQPOLL thread is waiting for a signal to start, aka CID-3ebba796fa25. Scope: local bookworm: resolved (fixed in 5.10.26-1) bullseye: resolved (fixed in 5.10

CVE-2024-56591 [MEDIUM] CVE-2024-56591: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Use disable_delayed_work_sync This makes use of disable_delayed_work_sync instead cancel_delayed_work_sync as it not only cancel the ongoing work but also disables new submit which is disarable since the object holding the work is about to be freed. Scope: local bookworm: open b

CVE-2024-46739 [MEDIUM] CVE-2024-46739: linux - In the Linux kernel, the following vulnerability has been resolved: uio_hv_gene... In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind For primary VM Bus channels, primary_channel pointer is always NULL. This pointer is valid only for the secondary channels. Also, rescind callback is meant for primary channels only. Fix NULL pointer dereference by retrieving the

CVE-2024-27051 [MEDIUM] CVE-2024-27051: linux - In the Linux kernel, the following vulnerability has been resolved: cpufreq: br... In the Linux kernel, the following vulnerability has been resolved: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value cpufreq_cpu_get may return NULL. To avoid NULL-dereference check it and return 0 in case of error. Found by Linux Verification Center (linuxtesting.org) with SVACE. Scope: local bookworm: resolved (fixed in 6.1.85-1) bullseye

CVE-2023-52653 [MEDIUM] CVE-2023-52653: linux - In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix... In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix a memleak in gss_import_v2_context The ctx->mech_used.data allocated by kmemdup is not freed in neither gss_import_v2_context nor it only caller gss_krb5_import_sec_context, which frees ctx on error. Thus, this patch reform the last call of gss_import_v2_context to the gss_krb5_import_ct

CVE-2022-49274 [MEDIUM] CVE-2022-49274: linux - In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix ... In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix crash when mount with quota enabled There is a reported crash when mounting ocfs2 with quota enabled. RIP: 0010:ocfs2_qinfo_lock_res_init+0x44/0x50 [ocfs2] Call Trace: ocfs2_local_read_info+0xb9/0x6f0 [ocfs2] dquot_load_quota_sb+0x216/0x470 dquot_load_quota_inode+0x85/0x100 ocfs2_enable_q

CVE-2024-27048 [MEDIUM] CVE-2024-27048: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: brcm8... In the Linux kernel, the following vulnerability has been resolved: wifi: brcm80211: handle pmk_op allocation failure The kzalloc() in brcmf_pmksa_v3_op() will return null if the physical memory has run out. As a result, if we dereference the null value, the null pointer dereference bug will happen. Return -ENOMEM from brcmf_pmksa_v3_op() if kzalloc() fails for pmk_

CVE-2022-49644 [MEDIUM] CVE-2022-49644: linux - In the Linux kernel, the following vulnerability has been resolved: drm/i915: f... In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector() If drm_connector_init fails, intel_connector_free will be called to take care of proper free. So it is necessary to drop the refcount of port before intel_connector_free. (cherry picked from commit cea9ed611e85d36a05db52b6457bf58

CVE-2024-49925 [MEDIUM] CVE-2024-49925: linux - In the Linux kernel, the following vulnerability has been resolved: fbdev: efif... In the Linux kernel, the following vulnerability has been resolved: fbdev: efifb: Register sysfs groups through driver core The driver core can register and cleanup sysfs groups already. Make use of that functionality to simplify the error handling and cleanup. Also avoid a UAF race during unregistering where the sysctl attributes were usable after the info struct w

CVE-2025-37881 [MEDIUM] CVE-2025-37881: linux - In the Linux kernel, the following vulnerability has been resolved: usb: gadget... In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() The variable d->name, returned by devm_kasprintf(), could be NULL. A pointer check is added to prevent potential NULL pointer dereference. This is similar to the fix in commit 3027e7b15b02 ("ice: Fix some null pointer dereference iss

CVE-2025-37857 [MEDIUM] CVE-2025-37857: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: st: F... In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix array overflow in st_setup() Change the array size to follow parms size instead of a fixed value. Scope: local bookworm: resolved (fixed in 6.1.135-1) bullseye: resolved (fixed in 5.10.237-1) forky: resolved (fixed in 6.12.25-1) sid: resolved (fixed in 6.12.25-1) trixie: resolved (fixe

CVE-2024-27023 [MEDIUM] CVE-2024-27023: linux - In the Linux kernel, the following vulnerability has been resolved: md: Fix mis... In the Linux kernel, the following vulnerability has been resolved: md: Fix missing release of 'active_io' for flush submit_flushes atomic_set(&mddev->flush_pending, 1); rdev_for_each_rcu(rdev, mddev) atomic_inc(&mddev->flush_pending); bi->bi_end_io = md_end_flush submit_bio(bi); /* flush io is done first */ md_end_flush if (atomic_dec_and_test(&mddev->flush_pending

CVE-2024-50237 [MEDIUM] CVE-2024-50237: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80... In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower Avoid potentially crashing in the driver because of uninitialized private data Scope: local bookworm: resolved (fixed in 6.1.119-1) bullseye: resolved (fixed in 5.10.234-1) forky: resolved (fixed in 6.11.7-1) sid: resolved (fixe

CVE-2023-23455 [MEDIUM] CVE-2023-23455: linux - atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows a... atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results). Scope: local bookworm: resolved (fixed in 6.1.7-1) bullseye: resolved (fixed in 5.10.162-1) forky: resolved (fix

CVE-2022-48669 [MEDIUM] CVE-2022-48669: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/pse... In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix potential memleak in papr_get_attr() `buf` is allocated in papr_get_attr(), and krealloc() of `buf` could fail. We need to free the original `buf` in the case of failure. Scope: local bookworm: resolved (fixed in 6.1.85-1) bullseye: resolved forky: resolved (fixed in 6.7.12-1) s

CVE-2023-52675 [MEDIUM] CVE-2023-52675: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/imc... In the Linux kernel, the following vulnerability has been resolved: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: resolved (fixed in 5.10.209-1) forky: resolved (fixed in 6.6.15-1) sid: re

CVE-2024-53158 [MEDIUM] CVE-2024-53158: linux - In the Linux kernel, the following vulnerability has been resolved: soc: qcom: ... In the Linux kernel, the following vulnerability has been resolved: soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() This loop is supposed to break if the frequency returned from clk_round_rate() is the same as on the previous iteration. However, that check doesn't make sense on the first iteration through the loop. It leads to reading before the sta

CVE-2024-26651 [MEDIUM] CVE-2024-26651: linux - In the Linux kernel, the following vulnerability has been resolved: sr9800: Add... In the Linux kernel, the following vulnerability has been resolved: sr9800: Add check for usbnet_get_endpoints Add check for usbnet_get_endpoints() and return the error if it fails in order to transfer the error. Scope: local bookworm: resolved (fixed in 6.1.82-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.7.12-1) sid: resolved (fixed in 6.

CVE-2022-49447 [MEDIUM] CVE-2022-49447: linux - In the Linux kernel, the following vulnerability has been resolved: ARM: hisi: ... In the Linux kernel, the following vulnerability has been resolved: ARM: hisi: Add missing of_node_put after of_find_compatible_node of_find_compatible_node will increment the refcount of the returned device_node. Calling of_node_put() to avoid the refcount leak Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved (fixed in 5.10.127-1) forky: resol