Debian Linux vulnerabilities

CVE-2025-40318 CVE-2025-40318: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and "UAF". Fix this by holding cmd_sync_work_lock across b

CVE-2012-3375 [MEDIUM] CVE-2012-3375: linux - The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 do... The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency. NOTE: this vulnerability exists because of an

CVE-2025-39983 [LOW] CVE-2025-39983: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue This fixes the following UAF caused by not properly locking hdev when processing HCI_EV_NUM_COMP_PKTS: BUG: KASAN: slab-use-after-free in hci_conn_tx_dequeue+0x1be/0x220 net/bluetooth/hci_conn.c:3036 Read of size 4 at addr ffff8880740f0940 by task kw

CVE-2023-53762 CVE-2023-53762: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync Use-after-free can occur in hci_disconnect_all_sync if a connection is deleted by concurrent processing of a controller event. To prevent this the code now tries to iterate over the list backwards to ensure the links are cleanup before its parents, also

CVE-2023-54092 CVE-2023-54092: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: s390: ... In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pv: fix index value of replaced ASCE The index field of the struct page corresponding to a guest ASCE should be 0. When replacing the ASCE in s390_replace_asce(), the index of the new ASCE should also be set to 0. Having the wrong index might lead to the wrong addresses being passed around when no

CVE-2025-40205 CVE-2025-40205: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: avoi... In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() The function btrfs_encode_fh() does not properly account for the three cases it handles. Before writing to the file handle (fh), the function only returns to the user BTRFS_FID_SIZE_NON_CONNECTABLE (5 dwords, 20 bytes) or BTRFS_FID_SIZE_CONNECTABLE (8

CVE-2024-26789 [HIGH] CVE-2024-26789: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: arm... In the Linux kernel, the following vulnerability has been resolved: crypto: arm64/neonbs - fix out-of-bounds access on short input The bit-sliced implementation of AES-CTR operates on blocks of 128 bytes, and will fall back to the plain NEON version for tail blocks or inputs that are shorter than 128 bytes to begin with. It will call straight into the plain NEON asm h

CVE-2017-6214 [HIGH] CVE-2017-6214: linux - The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before 4.9.11... The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before 4.9.11 allows remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag. Scope: local bookworm: resolved (fixed in 4.9.13-1) bullseye: resolved (fixed in 4.9.13-1) forky: resolved (fixed in 4.9.13-1) sid: resolved (fixed in 4

CVE-2019-19447 [HIGH] CVE-2019-19447: linux - In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing... In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list in fs/ext4/super.c. Scope: local bookworm: resolved (fixed in 5.4.6-1) bullseye: resolved (fixed in 5.4.6-1) forky: resolved (fixed in 5.4.6-1) sid: resolved (fix

CVE-2023-39197 [MEDIUM] CVE-2023-39197: linux - An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (... An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol. Scope: local bookworm: resolved (fixed in 6.1.52-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 6.4.4-1) sid: resolved (fixed in 6.4.4-1) trixie:

CVE-2018-20784 [CRITICAL] CVE-2018-20784: linux - In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's,... In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a denial of service (infinite loop in update_blocked_averages) or possibly have unspecified other impact by inducing a high load. Scope: local bookworm: resolved (fixed in 4.19.16-1) bullseye: resolved (fixed in 4.19.16-1) forky: resolved (fixed in 4.19

CVE-2023-5633 [MEDIUM] CVE-2023-5633: linux - The reference count changes made as part of the CVE-2023-33951 and CVE-2023-3395... The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges. Scope: local

CVE-2019-15099 [HIGH] CVE-2019-15099: linux - drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NU... drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via an incomplete address in an endpoint descriptor. Scope: local bookworm: resolved (fixed in 5.3.15-1) bullseye: resolved (fixed in 5.3.15-1) forky: resolved (fixed in 5.3.15-1) sid: resolved (fixed in 5.3.15-1) trixie: resolved (fixed in 5.3.15-1)

CVE-2021-22543 [HIGH] CVE-2021-22543: linux - An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNM... An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation. Scope: local bookworm: resolved

CVE-2021-47244 [MEDIUM] CVE-2021-47244: linux - In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix ... In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix out of bounds when parsing TCP options The TCP option parser in mptcp (mptcp_get_options) could read one byte out of bounds. When the length is 1, the execution flow gets into the loop, reads one byte of the opcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more

CVE-2016-7912 [HIGH] CVE-2016-7912: linux - Use-after-free vulnerability in the ffs_user_copy_worker function in drivers/usb... Use-after-free vulnerability in the ffs_user_copy_worker function in drivers/usb/gadget/function/f_fs.c in the Linux kernel before 4.5.3 allows local users to gain privileges by accessing an I/O data structure after a certain callback call. Scope: local bookworm: resolved (fixed in 4.5.3-1) bullseye: resolved (fixed in 4.5.3-1) forky: resolved (fixed in 4.5.3-1) sid: re

CVE-2013-1959 [LOW] CVE-2013-1959: linux - kernel/user_namespace.c in the Linux kernel before 3.8.9 does not have appropria... kernel/user_namespace.c in the Linux kernel before 3.8.9 does not have appropriate capability requirements for the uid_map and gid_map files, which allows local users to gain privileges by opening a file within an unprivileged process and then modifying the file within a privileged process. Scope: local bookworm: resolved (fixed in 3.8.11-1) bullseye: resolved (fixed in

CVE-2024-26864 [MEDIUM] CVE-2024-26864: linux - In the Linux kernel, the following vulnerability has been resolved: tcp: Fix re... In the Linux kernel, the following vulnerability has been resolved: tcp: Fix refcnt handling in __inet_hash_connect(). syzbot reported a warning in sk_nulls_del_node_init_rcu(). The commit 66b60b0c8c4a ("dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished().") tried to fix an issue that an unconnected socket occupies an ehash entry when bha

CVE-2023-52629 [HIGH] CVE-2023-52629: linux - In the Linux kernel, the following vulnerability has been resolved: sh: push-sw... In the Linux kernel, the following vulnerability has been resolved: sh: push-switch: Reorder cleanup operations to avoid use-after-free bug The original code puts flush_work() before timer_shutdown_sync() in switch_drv_remove(). Although we use flush_work() to stop the worker, it could be rescheduled in switch_timer(). As a result, a use-after-free bug can occur. The

CVE-2020-36385 [HIGH] CVE-2020-36385: linux - An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core... An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c. Scope: local bookworm: resolved (fixed in 5.10.4-1) bullseye: resolved (fixed in 5.10.4-1) forky: resolved (fixed in 5.10.4-1) sid: