Debian Linux vulnerabilities

CVE-2025-68315 CVE-2025-68315: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: fix t... In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to detect potential corrupted nid in free_nid_list As reported, on-disk footer.ino and footer.nid is the same and out-of-range, let's add sanity check on f2fs_alloc_nid() to detect any potential corruption in free_nid_list. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 6.17.8

CVE-2026-23428 CVE-2026-23428: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of share_conf in compound request smb2_get_ksmbd_tcon() reuses work->tcon in compound requests without validating tcon->t_state. ksmbd_tree_conn_lookup() checks t_state == TREE_CONNECTED on the initial lookup path, but the compound reuse path bypasses this check entirely. If a prior

CVE-2012-3375 [MEDIUM] CVE-2012-3375: linux - The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 do... The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency. NOTE: this vulnerability exists because of an

CVE-2025-40282 CVE-2025-40282: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: reset link-local header on ipv6 recv path Bluetooth 6lowpan.c netdev has header_ops, so it must set link-local header for RX skb, otherwise things crash, eg. with AF_PACKET SOCK_RAW Add missing skb_reset_mac_header() for uncompressed ipv6 RX path. For the compressed one, it is done in low

CVE-2025-40318 CVE-2025-40318: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and "UAF". Fix this by holding cmd_sync_work_lock across b

CVE-2019-12818 [HIGH] CVE-2019-12818: linux - An issue was discovered in the Linux kernel before 4.20.15. The nfc_llcp_build_t... An issue was discovered in the Linux kernel before 4.20.15. The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If the caller does not check for this, it will trigger a NULL pointer dereference. This will cause denial of service. This affects nfc_llcp_build_gb in net/nfc/llcp_core.c. Scope: local bookworm: resolved (fixed in 4.19.28-1) bullseye

CVE-2025-40269 CVE-2025-40269: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-a... In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and each packet size is determined dynamically. The packet sizes are limited by some factors such as wMaxPacketSize USB descriptor. OTOH, in the current code, the

CVE-2025-40058 [LOW] CVE-2025-40058: linux - In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d:... In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Disallow dirty tracking if incoherent page walk Dirty page tracking relies on the IOMMU atomically updating the dirty bit in the paging-structure entry. For this operation to succeed, the paging- structure memory must be coherent between the IOMMU and the CPU. In another word, if the iommu

CVE-2025-39970 CVE-2025-39970: linux - In the Linux kernel, the following vulnerability has been resolved: i40e: fix i... In the Linux kernel, the following vulnerability has been resolved: i40e: fix input validation logic for action_meta Fix condition to check 'greater or equal' to prevent OOB dereference. Scope: local bookworm: resolved (fixed in 6.1.158-1) bullseye: resolved (fixed in 5.10.247-1) forky: resolved (fixed in 6.16.10-1) sid: resolved (fixed in 6.16.10-1) trixie: resolved (fixed

CVE-2023-5972 [HIGH] CVE-2023-5972: linux - A null pointer dereference flaw was found in the nft_inner.c functionality of ne... A null pointer dereference flaw was found in the nft_inner.c functionality of netfilter in the Linux kernel. This issue could allow a local user to crash the system or escalate their privileges on the system. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.5.10-1) sid: resolved (fixed in 6.5.10-1) trixie: resolved (fixed in 6.5.10-1)

CVE-2017-6214 [HIGH] CVE-2017-6214: linux - The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before 4.9.11... The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before 4.9.11 allows remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag. Scope: local bookworm: resolved (fixed in 4.9.13-1) bullseye: resolved (fixed in 4.9.13-1) forky: resolved (fixed in 4.9.13-1) sid: resolved (fixed in 4

CVE-2019-19447 [HIGH] CVE-2019-19447: linux - In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing... In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list in fs/ext4/super.c. Scope: local bookworm: resolved (fixed in 5.4.6-1) bullseye: resolved (fixed in 5.4.6-1) forky: resolved (fixed in 5.4.6-1) sid: resolved (fix

CVE-2023-39197 [MEDIUM] CVE-2023-39197: linux - An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (... An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol. Scope: local bookworm: resolved (fixed in 6.1.52-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 6.4.4-1) sid: resolved (fixed in 6.4.4-1) trixie:

CVE-2019-19377 [HIGH] CVE-2019-19377: linux - In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performin... In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and unmounting can lead to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c. Scope: local bookworm: resolved (fixed in 5.6.7-1) bullseye: resolved (fixed in 5.6.7-1) forky: resolved (fixed in 5.6.7-1) sid: resolved (fixed in 5.6.7-1) trixie: resolved (fixe

CVE-2018-20784 [CRITICAL] CVE-2018-20784: linux - In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's,... In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a denial of service (infinite loop in update_blocked_averages) or possibly have unspecified other impact by inducing a high load. Scope: local bookworm: resolved (fixed in 4.19.16-1) bullseye: resolved (fixed in 4.19.16-1) forky: resolved (fixed in 4.19

CVE-2023-5633 [MEDIUM] CVE-2023-5633: linux - The reference count changes made as part of the CVE-2023-33951 and CVE-2023-3395... The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges. Scope: local

CVE-2019-15099 [HIGH] CVE-2019-15099: linux - drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NU... drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via an incomplete address in an endpoint descriptor. Scope: local bookworm: resolved (fixed in 5.3.15-1) bullseye: resolved (fixed in 5.3.15-1) forky: resolved (fixed in 5.3.15-1) sid: resolved (fixed in 5.3.15-1) trixie: resolved (fixed in 5.3.15-1)

CVE-2021-22543 [HIGH] CVE-2021-22543: linux - An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNM... An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation. Scope: local bookworm: resolved

CVE-2016-7912 [HIGH] CVE-2016-7912: linux - Use-after-free vulnerability in the ffs_user_copy_worker function in drivers/usb... Use-after-free vulnerability in the ffs_user_copy_worker function in drivers/usb/gadget/function/f_fs.c in the Linux kernel before 4.5.3 allows local users to gain privileges by accessing an I/O data structure after a certain callback call. Scope: local bookworm: resolved (fixed in 4.5.3-1) bullseye: resolved (fixed in 4.5.3-1) forky: resolved (fixed in 4.5.3-1) sid: re

CVE-2013-1959 [LOW] CVE-2013-1959: linux - kernel/user_namespace.c in the Linux kernel before 3.8.9 does not have appropria... kernel/user_namespace.c in the Linux kernel before 3.8.9 does not have appropriate capability requirements for the uid_map and gid_map files, which allows local users to gain privileges by opening a file within an unprivileged process and then modifying the file within a privileged process. Scope: local bookworm: resolved (fixed in 3.8.11-1) bullseye: resolved (fixed in