Debian Linux vulnerabilities

CVE-2022-49682 [MEDIUM] CVE-2022-49682: linux - In the Linux kernel, the following vulnerability has been resolved: xtensa: Fix... In the Linux kernel, the following vulnerability has been resolved: xtensa: Fix refcount leak bug in time.c In calibrate_ccount(), of_find_compatible_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: resolved (fixed in 5.10.127-1) forky:

CVE-2022-49704 [MEDIUM] CVE-2022-49704: linux - In the Linux kernel, the following vulnerability has been resolved: 9p: fix fid... In the Linux kernel, the following vulnerability has been resolved: 9p: fix fid refcount leak in v9fs_vfs_get_link we check for protocol version later than required, after a fid has been obtained. Just move the version check earlier. Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: resolved forky: resolved (fixed in 5.18.14-1) sid: resolved (fixed in 5

CVE-2022-49408 [MEDIUM] CVE-2022-49408: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: fix m... In the Linux kernel, the following vulnerability has been resolved: ext4: fix memory leak in parse_apply_sb_mount_options() If processing the on-disk mount options fails after any memory was allocated in the ext4_fs_context, e.g. s_qf_names, then this memory is leaked. Fix this by calling ext4_fc_free() instead of kfree() directly. Reproducer: mkfs.ext4 -F /dev/vdc

CVE-2022-49712 [MEDIUM] CVE-2022-49712: linux - In the Linux kernel, the following vulnerability has been resolved: usb: gadget... In the Linux kernel, the following vulnerability has been resolved: usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. of_node_put() will check NULL pointer. Scope: local bookwor

CVE-2022-49483 [MEDIUM] CVE-2022-49483: linux - In the Linux kernel, the following vulnerability has been resolved: drm/msm/dis... In the Linux kernel, the following vulnerability has been resolved: drm/msm/disp/dpu1: avoid clearing hw interrupts if hw_intr is null during drm uninit If edp modeset init is failed due to panel being not ready and probe defers during drm bind, avoid clearing irqs and dereference hw_intr when hw_intr is null. BUG: Unable to handle kernel NULL pointer dereference at

CVE-2022-49146 [MEDIUM] CVE-2022-49146: linux - In the Linux kernel, the following vulnerability has been resolved: virtio: use... In the Linux kernel, the following vulnerability has been resolved: virtio: use virtio_device_ready() in virtio_device_restore() After waking up a suspended VM, the kernel prints the following trace for virtio drivers which do not directly call virtio_device_ready() in the .restore: PM: suspend exit irq 22: nobody cared (try booting with the "irqpoll" option) Call T

CVE-2022-49681 [MEDIUM] CVE-2022-49681: linux - In the Linux kernel, the following vulnerability has been resolved: xtensa: xtf... In the Linux kernel, the following vulnerability has been resolved: xtensa: xtfpga: Fix refcount leak bug in setup In machine_setup(), of_find_compatible_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: resolved (fixed in 5.10.127-1) fo

CVE-2022-49570 [MEDIUM] CVE-2022-49570: linux - In the Linux kernel, the following vulnerability has been resolved: gpio: gpio-... In the Linux kernel, the following vulnerability has been resolved: gpio: gpio-xilinx: Fix integer overflow Current implementation is not able to configure more than 32 pins due to incorrect data type. So type casting with unsigned long to avoid it. Scope: local bookworm: resolved (fixed in 5.18.16-1) bullseye: resolved forky: resolved (fixed in 5.18.16-1) sid: reso

CVE-2022-49334 [MEDIUM] CVE-2022-49334: linux - In the Linux kernel, the following vulnerability has been resolved: mm/huge_mem... In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: Fix xarray node memory leak If xas_split_alloc() fails to allocate the necessary nodes to complete the xarray entry split, it sets the xa_state to -ENOMEM, which xas_nomem() then interprets as "Please allocate more memory", not as "Please free any unnecessary memory" (which was the i

CVE-2024-38546 [MEDIUM] CVE-2024-38546: linux - In the Linux kernel, the following vulnerability has been resolved: drm: vc4: F... In the Linux kernel, the following vulnerability has been resolved: drm: vc4: Fix possible null pointer dereference In vc4_hdmi_audio_init() of_get_address() may return NULL which is later dereferenced. Fix this bug by adding NULL check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Scope: local bookworm: resolved (fixed in 6.1.94-1) bullseye: re

CVE-2023-52996 [MEDIUM] CVE-2023-52996: linux - In the Linux kernel, the following vulnerability has been resolved: ipv4: preve... In the Linux kernel, the following vulnerability has been resolved: ipv4: prevent potential spectre v1 gadget in fib_metrics_match() if (!type) continue; if (type > RTAX_MAX) return false; ... fi_val = fi->fib_metrics->metrics[type - 1]; @type being used as an array index, we need to prevent cpu speculation or risk leaking kernel memory content. Scope: local bookwor

CVE-2022-49618 [MEDIUM] CVE-2022-49618: linux - In the Linux kernel, the following vulnerability has been resolved: pinctrl: as... In the Linux kernel, the following vulnerability has been resolved: pinctrl: aspeed: Fix potential NULL dereference in aspeed_pinmux_set_mux() pdesc could be null but still dereference pdesc->name and it will lead to a null pointer access. So we move a null check before dereference. Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: resolved (fixed in 5.

CVE-2022-49116 [MEDIUM] CVE-2022-49116: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: use memset avoid memory leaks Use memset to initialize structs to prevent memory leaks in l2cap_ecred_connect Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed in 5.17.3-1) sid: resolved (fixed in 5.17.3-1) trixie: resolved

CVE-2022-49126 [MEDIUM] CVE-2022-49126: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3m... In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix memory leaks Fix memory leaks related to operational reply queue's memory segments which are not getting freed while unloading the driver. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved forky: resolved (fixed in 5.17.3-1) sid: resolved (fixed in 5.17.3-1) tr

CVE-2024-53119 [MEDIUM] CVE-2024-53119: linux - In the Linux kernel, the following vulnerability has been resolved: virtio/vsoc... In the Linux kernel, the following vulnerability has been resolved: virtio/vsock: Fix accept_queue memory leak As the final stages of socket destruction may be delayed, it is possible that virtio_transport_recv_listen() will be called after the accept_queue has been flushed, but before the SOCK_DONE flag has been set. As a result, sockets enqueued after the flush wo

CVE-2022-49033 [MEDIUM] CVE-2022-49033: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: qgro... In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() Syzkaller reported BUG as follows: BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274 Call Trace: dump_stack_lvl+0xcd/0x134 __might_resched.cold+0x222/0x26b kmem_cache_alloc+0x2e7/0x3c0 update

CVE-2021-47405 [MEDIUM] CVE-2021-47405: linux - In the Linux kernel, the following vulnerability has been resolved: HID: usbhid... In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: free raw_report buffers in usbhid_stop Free the unsent raw_report buffers when the device is removed. Fixes a memory leak reported by syzbot at: https://syzkaller.appspot.com/bug?id=7b4fa7cb1a7c2d3342a2a8a6c53371c8c418ab47 Scope: local bookworm: resolved (fixed in 5.14.12-1) bullseye: r

CVE-2024-49877 [MEDIUM] CVE-2024-49877: linux - In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix ... In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate When doing cleanup, if flags without OCFS2_BH_READAHEAD, it may trigger NULL pointer dereference in the following ocfs2_set_buffer_uptodate() if bh is NULL. Scope: local bookworm: resolved (fixed in 6.1.115-1) bullseye: resolved (fixed

CVE-2024-26855 [MEDIUM] CVE-2024-26855: linux - In the Linux kernel, the following vulnerability has been resolved: net: ice: F... In the Linux kernel, the following vulnerability has been resolved: net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() The function ice_bridge_setlink() may encounter a NULL pointer dereference if nlmsg_find_attr() returns NULL and br_spec is dereferenced subsequently in nla_for_each_nested(). To address this issue, add a check to ensure that b

CVE-2024-49975 [MEDIUM] CVE-2024-49975: linux - In the Linux kernel, the following vulnerability has been resolved: uprobes: fi... In the Linux kernel, the following vulnerability has been resolved: uprobes: fix kernel info leak via "[uprobes]" vma xol_add_vma() maps the uninitialized page allocated by __create_xol_area() into userspace. On some architectures (x86) this memory is readable even without VM_READ, VM_EXEC results in the same pgprot_t as VM_EXEC|VM_READ, although this doesn't really