Debian Linux vulnerabilities

CVE-2022-49216 [MEDIUM] CVE-2022-49216: linux - In the Linux kernel, the following vulnerability has been resolved: drm/tegra: ... In the Linux kernel, the following vulnerability has been resolved: drm/tegra: Fix reference leak in tegra_dsi_ganged_probe The reference taken by 'of_find_device_by_node()' must be released when not needed anymore. Add put_device() call to fix this. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed i

CVE-2022-49495 [MEDIUM] CVE-2022-49495: linux - In the Linux kernel, the following vulnerability has been resolved: drm/msm/hdm... In the Linux kernel, the following vulnerability has been resolved: drm/msm/hdmi: check return value after calling platform_get_resource_byname() It will cause null-ptr-deref if platform_get_resource_byname() returns NULL, we need check the return value. Patchwork: https://patchwork.freedesktop.org/patch/482992/ Scope: local bookworm: resolved (fixed in 5.18.5-1) bu

CVE-2022-49432 [MEDIUM] CVE-2022-49432: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/xic... In the Linux kernel, the following vulnerability has been resolved: powerpc/xics: fix refcount leak in icp_opal_init() The of_find_compatible_node() function returns a node pointer with refcount incremented, use of_node_put() on it when done. Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved (fixed in 5.10.127-1) forky: resolved (fixed in 5.18.5

CVE-2022-49277 [MEDIUM] CVE-2022-49277: linux - In the Linux kernel, the following vulnerability has been resolved: jffs2: fix ... In the Linux kernel, the following vulnerability has been resolved: jffs2: fix memory leak in jffs2_do_mount_fs If jffs2_build_filesystem() in jffs2_do_mount_fs() returns an error, we can observe the following kmemleak report: -------------------------------------------- unreferenced object 0xffff88811b25a640 (size 64): comm "mount", pid 691, jiffies 4294957728 (age

CVE-2022-49191 [MEDIUM] CVE-2022-49191: linux - In the Linux kernel, the following vulnerability has been resolved: mxser: fix ... In the Linux kernel, the following vulnerability has been resolved: mxser: fix xmit_buf leak in activate when LSR == 0xff When LSR is 0xff in ->activate() (rather unlike), we return an error. Provided ->shutdown() is not called when ->activate() fails, nothing actually frees the buffer in this case. Fix this by properly freeing the buffer in a designated label. We j

CVE-2022-49438 [MEDIUM] CVE-2022-49438: linux - In the Linux kernel, the following vulnerability has been resolved: Input: spar... In the Linux kernel, the following vulnerability has been resolved: Input: sparcspkr - fix refcount leak in bbc_beep_probe of_find_node_by_path() calls of_find_node_opts_by_path(), which returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. Scope: local bookworm: resolved (fix

CVE-2022-49351 [MEDIUM] CVE-2022-49351: linux - In the Linux kernel, the following vulnerability has been resolved: net: altera... In the Linux kernel, the following vulnerability has been resolved: net: altera: Fix refcount leak in altera_tse_mdio_create Every iteration of for_each_child_of_node() decrements the reference count of the previous node. When break from a for_each_child_of_node() loop, we need to explicitly call of_node_put() on the child node when not need anymore. Add missing of_

CVE-2022-49491 [MEDIUM] CVE-2022-49491: linux - In the Linux kernel, the following vulnerability has been resolved: drm/rockchi... In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() It will cause null-ptr-deref in resource_size(), if platform_get_resource() returns NULL, move calling resource_size() after devm_ioremap_resource() that will check 'res' to avoid null-ptr-deref. Scope: local bookworm: resolved (fixed in 5

CVE-2022-49457 [MEDIUM] CVE-2022-49457: linux - In the Linux kernel, the following vulnerability has been resolved: ARM: versat... In the Linux kernel, the following vulnerability has been resolved: ARM: versatile: Add missing of_node_put in dcscb_init The device_node pointer is returned by of_find_compatible_node with refcount incremented. We should use of_node_put() to avoid the refcount leak. Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved (fixed in 5.10.127-1) forky:

CVE-2024-53205 [MEDIUM] CVE-2024-53205: linux - In the Linux kernel, the following vulnerability has been resolved: phy: realte... In the Linux kernel, the following vulnerability has been resolved: phy: realtek: usb: fix NULL deref in rtk_usb2phy_probe In rtk_usb2phy_probe() devm_kzalloc() may return NULL but this returned value is not checked. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.12.3-1) sid: resolved (fixed in 6.12.3-1) trixie: resolved (fixed in 6.1

CVE-2021-38206 [MEDIUM] CVE-2021-38206: linux - The mac80211 subsystem in the Linux kernel before 5.12.13, when a device support... The mac80211 subsystem in the Linux kernel before 5.12.13, when a device supporting only 5 GHz is used, allows attackers to cause a denial of service (NULL pointer dereference in the radiotap parser) by injecting a frame with 802.11a rates. Scope: local bookworm: resolved (fixed in 5.10.46-1) bullseye: resolved (fixed in 5.10.46-1) forky: resolved (fixed in 5.10.46-

CVE-2024-42079 [MEDIUM] CVE-2024-42079: linux - In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix N... In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix NULL pointer dereference in gfs2_log_flush In gfs2_jindex_free(), set sdp->sd_jdesc to NULL under the log flush lock to provide exclusion against gfs2_log_flush(). In gfs2_log_flush(), check if sdp->sd_jdesc is non-NULL before dereferencing it. Otherwise, we could run into a NULL pointer d

CVE-2024-35947 [MEDIUM] CVE-2024-35947: linux - In the Linux kernel, the following vulnerability has been resolved: dyndbg: fix... In the Linux kernel, the following vulnerability has been resolved: dyndbg: fix old BUG_ON in >control parser Fix a BUG_ON from 2009. Even if it looks "unreachable" (I didn't really look), lets make sure by removing it, doing pr_err and return -EINVAL instead. Scope: local bookworm: resolved (fixed in 6.1.94-1) bullseye: resolved (fixed in 5.10.218-1) forky: resolve

CVE-2021-3764 [MEDIUM] CVE-2021-3764: linux - A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() functio... A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is to system availability. Scope: local bookworm: resolved (fixed in 5.14.12-1) bullseye: resolved (fixed in 5.10.84-1) forky: resolv

CVE-2024-27039 [MEDIUM] CVE-2024-27039: linux - In the Linux kernel, the following vulnerability has been resolved: clk: hisili... In the Linux kernel, the following vulnerability has been resolved: clk: hisilicon: hi3559a: Fix an erroneous devm_kfree() 'p_clk' is an array allocated just before the for loop for all clk that need to be registered. It is incremented at each loop iteration. If a clk_register() call fails, 'p_clk' may point to something different from what should be freed. The best

CVE-2024-26993 [MEDIUM] CVE-2024-26993: linux - In the Linux kernel, the following vulnerability has been resolved: fs: sysfs: ... In the Linux kernel, the following vulnerability has been resolved: fs: sysfs: Fix reference leak in sysfs_break_active_protection() The sysfs_break_active_protection() routine has an obvious reference leak in its error path. If the call to kernfs_find_and_get() fails then kn will be NULL, so the companion sysfs_unbreak_active_protection() routine won't get called (

CVE-2024-46816 [MEDIUM] CVE-2024-46816: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links [Why] Coverity report OVERRUN warning. There are only max_links elements within dc->links. link count could up to AMDGPU_DM_MAX_DISPLAY_INDEX 31. [How] Make sure link count less than max_links. Scope: local bookworm: re

CVE-2022-49183 [MEDIUM] CVE-2022-49183: linux - In the Linux kernel, the following vulnerability has been resolved: net/sched: ... In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix ref leak when switching zones When switching zones or network namespaces without doing a ct clear in between, it is now leaking a reference to the old ct entry. That's because tcf_ct_skb_nfct_cached() returns false and tcf_ct_flow_table_lookup() may simply overwrite it. The fi

CVE-2022-49158 [MEDIUM] CVE-2022-49158: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: qla2x... In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix warning message due to adisc being flushed Fix warning message due to adisc being flushed. Linux kernel triggered a warning message where a different error code type is not matching up with the expected type. Add additional translation of one error code type to another. WARNING: C

CVE-2024-43884 [MEDIUM] CVE-2024-43884: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Add error handling to pair_device() hci_conn_params_add() never checks for a NULL value and could lead to a NULL pointer dereference causing a crash. Fixed by adding error handling in the function. Scope: local bookworm: resolved (fixed in 6.1.112-1) bullseye: resolved (fixed in 5.1