Debian Linux vulnerabilities

CVE-2024-49962 [MEDIUM] CVE-2024-49962: linux - In the Linux kernel, the following vulnerability has been resolved: ACPICA: che... In the Linux kernel, the following vulnerability has been resolved: ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() ACPICA commit 4d4547cf13cca820ff7e0f859ba83e1a610b9fd0 ACPI_ALLOCATE_ZEROED() may fail, elements might be NULL and will cause NULL pointer dereference later. [ rjw: Subject and changelog edits ] Scope: local bookworm

CVE-2024-38548 [MEDIUM] CVE-2024-38548: linux - In the Linux kernel, the following vulnerability has been resolved: drm: bridge... In the Linux kernel, the following vulnerability has been resolved: drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference In cdns_mhdp_atomic_enable(), the return value of drm_mode_duplicate() is assigned to mhdp_state->current_mode, and there is a dereference of it in drm_mode_set_name(), which will lead to a NULL pointer dereference on failure of drm_m

CVE-2024-57922 [MEDIUM] CVE-2024-57922: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add check for granularity in dml ceil/floor helpers [Why] Wrapper functions for dcn_bw_ceil2() and dcn_bw_floor2() should check for granularity is non zero to avoid assert and divide-by-zero error in dcn_bw_ functions. [How] Add check for granularity 0. (cherry picked from commit f6

CVE-2023-52686 [MEDIUM] CVE-2023-52686: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/pow... In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv: Add a null pointer check in opal_event_init() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: resolved (fixed in 5.10.209-1) forky: resolved (fixed in 6.6.15-1) sid: resolved

CVE-2023-3773 [MEDIUM] CVE-2023-3773: linux - A flaw was found in the Linux kernel’s IP framework for transforming packets (XF... A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace. Scope: local bookworm: resolved (fixed in 6.1.52

CVE-2022-48773 [MEDIUM] CVE-2022-48773: linux - In the Linux kernel, the following vulnerability has been resolved: xprtrdma: f... In the Linux kernel, the following vulnerability has been resolved: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create If there are failures then we must not leave the non-NULL pointers with the error value, otherwise `rpcrdma_ep_destroy` gets confused and tries free them, resulting in an Oops. Scope: local bookworm: resolved (fixed in 5.16.11-1) bulls

CVE-2022-49974 [MEDIUM] CVE-2022-49974: linux - In the Linux kernel, the following vulnerability has been resolved: HID: ninten... In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix rumble worker null pointer deref We can dereference a null pointer trying to queue work to a destroyed workqueue. If the device is disconnected, nintendo_hid_remove is called, in which the rumble_queue is destroyed. Avoid using that queue to defer rumble work once the controller s

CVE-2023-52809 [MEDIUM] CVE-2023-52809: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: libfc... In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() fc_lport_ptp_setup() did not check the return value of fc_rport_create() which can return NULL and would cause a NULL pointer dereference. Address this issue by checking return value of fc_rport_create() and log error messag

CVE-2023-23006 [MEDIUM] CVE-2023-23006: linux - In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/stee... In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c misinterprets the mlx5_get_uars_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer). Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved (fixed in 5.10.92-1) forky: resolved (fixed in 5.15.15-1) sid: re

CVE-2021-47645 [MEDIUM] CVE-2021-47645: linux - In the Linux kernel, the following vulnerability has been resolved: media: stag... In the Linux kernel, the following vulnerability has been resolved: media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com On the case tmp_dcim=1, the index of buffer is miscalculated. This generate a NULL pointer dereference later. So let's fix the calcul and add a check to prevent this to reappear. Scope: local bookworm: resolved (

CVE-2024-41060 [MEDIUM] CVE-2024-41060: linux - In the Linux kernel, the following vulnerability has been resolved: drm/radeon:... In the Linux kernel, the following vulnerability has been resolved: drm/radeon: check bo_va->bo is non-NULL before using it The call to radeon_vm_clear_freed might clear bo_va->bo, so we have to check it before dereferencing it. Scope: local bookworm: resolved (fixed in 6.1.106-1) bullseye: resolved (fixed in 5.10.234-1) forky: resolved (fixed in 6.9.11-1) sid: reso

CVE-2024-36014 [MEDIUM] CVE-2024-36014: linux - In the Linux kernel, the following vulnerability has been resolved: drm/arm/mal... In the Linux kernel, the following vulnerability has been resolved: drm/arm/malidp: fix a possible null pointer dereference In malidp_mw_connector_reset, new memory is allocated with kzalloc, but no check is performed. In order to prevent null pointer dereferencing, ensure that mw_state is checked before calling __drm_atomic_helper_connector_reset. Scope: local book

CVE-2024-53113 [MEDIUM] CVE-2024-53113: linux - In the Linux kernel, the following vulnerability has been resolved: mm: fix NUL... In the Linux kernel, the following vulnerability has been resolved: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof We triggered a NULL pointer dereference for ac.preferred_zoneref->zone in alloc_pages_bulk_noprof() when the task is migrated between cpusets. When cpuset is enabled, in prepare_alloc_pages(), ac->nodemask may be ¤t->mems_allowed. when firs

CVE-2024-53101 [MEDIUM] CVE-2024-53101: linux - In the Linux kernel, the following vulnerability has been resolved: fs: Fix uni... In the Linux kernel, the following vulnerability has been resolved: fs: Fix uninitialized value issue in from_kuid and from_kgid ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set. Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_

CVE-2024-49913 [MEDIUM] CVE-2024-49913: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream This commit addresses a null pointer dereference issue in the `commit_planes_for_stream` function at line 4140. The issue could occur when `top_pipe_to_program` is null. The fix adds a check to ensure `top_pipe_to_pr

CVE-2023-52913 [MEDIUM] CVE-2023-52913: linux - In the Linux kernel, the following vulnerability has been resolved: drm/i915: F... In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential context UAFs gem_context_register() makes the context visible to userspace, and which point a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl. So we need to ensure that nothing uses the ctx ptr after this. And we need to ensure that adding the ctx to the xarray

CVE-2022-49077 [MEDIUM] CVE-2022-49077: linux - In the Linux kernel, the following vulnerability has been resolved: mmmremap.c:... In the Linux kernel, the following vulnerability has been resolved: mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) If an mremap() syscall with old_size=0 ends up in move_page_tables(), it will call invalidate_range_start()/invalidate_range_end() unnecessarily, i.e. with an empty range. This causes a WARN in KVM's mmu_notifier. In the pa

CVE-2021-47184 [MEDIUM] CVE-2021-47184: linux - In the Linux kernel, the following vulnerability has been resolved: i40e: Fix N... In the Linux kernel, the following vulnerability has been resolved: i40e: Fix NULL ptr dereference on VSI filter sync Remove the reason of null pointer dereference in sync VSI filters. Added new I40E_VSI_RELEASING flag to signalize deleting and releasing of VSI resources to sync this thread with sync filters subtask. Without this patch it is possible to start update

CVE-2025-21836 [MEDIUM] CVE-2025-21836: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/kb... In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: reallocate buf lists on upgrade IORING_REGISTER_PBUF_RING can reuse an old struct io_buffer_list if it was created for legacy selected buffer and has been emptied. It violates the requirement that most of the field should stay stable after publish. Always reallocate it instead. Scope:

CVE-2025-37860 [MEDIUM] CVE-2025-37860: linux - In the Linux kernel, the following vulnerability has been resolved: sfc: fix NU... In the Linux kernel, the following vulnerability has been resolved: sfc: fix NULL dereferences in ef100_process_design_param() Since cited commit, ef100_probe_main() and hence also ef100_check_design_params() run before efx->net_dev is created; consequently, we cannot netif_set_tso_max_size() or _segs() at this point. Move those netif calls to ef100_probe_netdev(),