Debian Linux vulnerabilities

CVE-2024-35869 [HIGH] CVE-2024-35869: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: guarantee refcounted children from parent session Avoid potential use-after-free bugs when walking DFS referrals, mounting and performing DFS failover by ensuring that all children from parent @tcon->ses are also refcounted. They're all needed across the entire DFS mount. Get rid of @tcon

CVE-2024-38384 [HIGH] CVE-2024-38384: linux - In the Linux kernel, the following vulnerability has been resolved: blk-cgroup:... In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix list corruption from reorder of WRITE ->lqueued __blkcg_rstat_flush() can be run anytime, especially when blk_cgroup_bio_start is being executed. If WRITE of `->lqueued` is re-ordered with READ of 'bisc->lnode.next' in the loop of __blkcg_rstat_flush(), `next_bisc` can be assigned with

CVE-2023-52629 [HIGH] CVE-2023-52629: linux - In the Linux kernel, the following vulnerability has been resolved: sh: push-sw... In the Linux kernel, the following vulnerability has been resolved: sh: push-switch: Reorder cleanup operations to avoid use-after-free bug The original code puts flush_work() before timer_shutdown_sync() in switch_drv_remove(). Although we use flush_work() to stop the worker, it could be rescheduled in switch_timer(). As a result, a use-after-free bug can occur. The

CVE-2025-38512 [LOW] CVE-2025-38512: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: preve... In the Linux kernel, the following vulnerability has been resolved: wifi: prevent A-MSDU attacks in mesh networks This patch is a mitigation to prevent the A-MSDU spoofing vulnerability for mesh networks. The initial update to the IEEE 802.11 standard, in response to the FragAttacks, missed this case (CVE-2025-27558). It can be considered a variant of CVE-2020-24588 bu

CVE-2022-32981 [HIGH] CVE-2022-32981: linux - An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit pla... An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers. Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved (fixed in 5.10.127-1) forky: resolved (fixed in 5.18.5-1) sid: resolved (fixed in 5.1

CVE-2017-1000365 [HIGH] CVE-2017-1000365: linux - The Linux Kernel imposes a size restriction on the arguments and environmental s... The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the size), but does not take the argument and environment pointers into account, which allows attackers to bypass this limitation. This affects Linux Kernel versions 4.11.5 and earlier. It appears that this feature was introduced

CVE-2022-36123 [HIGH] CVE-2022-36123: linux - The Linux kernel before 5.18.13 lacks a certain clear operation for the block st... The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to cause a denial of service or gain privileges. Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: resolved forky: resolved (fixed in 5.18.14-1) sid: resolved (fixed in 5.18.14-1) trixie: resolved (fixed in 5.18.14-1)

CVE-2019-5108 [MEDIUM] CVE-2019-5108: linux - An exploitable denial-of-service vulnerability exists in the Linux kernel prior ... An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading t

CVE-2024-26882 [HIGH] CVE-2024-26882: linux - In the Linux kernel, the following vulnerability has been resolved: net: ip_tun... In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() Apply the same fix than ones found in : 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") 1ca1ba465e55 ("geneve: make sure to pull inner header in geneve_rx()") We have to save skb->network_header in a tempo

CVE-2024-26592 [HIGH] CVE-2024-26592: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF issue in ksmbd_tcp_new_connection() The race is between the handling of a new TCP connection and its disconnection. It leads to UAF on `struct tcp_transport` in ksmbd_tcp_new_connection() function. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: resolved forky: resolved (f

CVE-2021-33034 [HIGH] CVE-2021-33034: linux - In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-fre... In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value. Scope: local bookworm: resolved (fixed in 5.10.38-1) bullseye: resolved (fixed in 5.10.38-1) forky: resolved (fixed in 5.10.38-1) sid: resolved (fixed in 5.10.38-1) trixie: resolved (fixed in 5.1

CVE-2022-48655 [HIGH] CVE-2022-48655: linux - In the Linux kernel, the following vulnerability has been resolved: firmware: a... In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Harden accesses to the reset domains Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations if the SCMI driver misbehave. Add an internal consistency check before an

CVE-2021-47477 [HIGH] CVE-2021-47477: linux - In the Linux kernel, the following vulnerability has been resolved: comedi: dt9... In the Linux kernel, the following vulnerability has been resolved: comedi: dt9812: fix DMA buffers on stack USB transfer buffers are typically mapped for DMA and must not be allocated on the stack or transfers will fail. Allocate proper transfer buffers in the various command helpers and return an error on short transfers instead of acting on random stack data. Note

CVE-2018-20856 [HIGH] CVE-2018-20856: linux - An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, ... An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an __blk_drain_queue() use-after-free because a certain error case is mishandled. Scope: local bookworm: resolved (fixed in 4.18.8-1) bullseye: resolved (fixed in 4.18.8-1) forky: resolved (fixed in 4.18.8-1) sid: resolved (fixed in 4.18.8-1) trixie: resolved (fixed in 4.18.8-1)

CVE-2020-25221 [HIGH] CVE-2020-25221: linux - get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allow... get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate page mishandling) of the struct page that backs the vsyscall page. The result is a refcount underflow. This can be triggered by any 64-bit process that can use ptrace() or process_vm_readv(), aka CID-9fa2dd94674

CVE-2020-25669 [HIGH] CVE-2020-25669: linux - A vulnerability was found in the Linux Kernel where the function sunkbd_reinit h... A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free. Scope: local bookworm: resolved (fixed in 5.9.11-1) bullseye: resolved (fixed in 5.9.11-1) f

CVE-2019-15117 [HIGH] CVE-2019-15117: linux - parse_audio_mixer_unit in sound/usb/mixer.c in the Linux kernel through 5.2.9 mi... parse_audio_mixer_unit in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles a short descriptor, leading to out-of-bounds memory access. Scope: local bookworm: resolved (fixed in 5.2.17-1) bullseye: resolved (fixed in 5.2.17-1) forky: resolved (fixed in 5.2.17-1) sid: resolved (fixed in 5.2.17-1) trixie: resolved (fixed in 5.2.17-1)

CVE-2018-20669 [HIGH] CVE-2018-20669: linux - An issue where a provided address with access_ok() is not checked was discovered... An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Linux kernel through 4.19.13. A local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation. Scope: local bookworm

CVE-2018-19824 [HIGH] CVE-2018-19824: linux - In the Linux kernel through 4.19.6, a local user could exploit a use-after-free ... In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c. Scope: local bookworm: resolved (fixed in 4.19.9-1) bullseye: resolved (fixed in 4.19.9-1) forky: resolved (fixed in 4.19.9-1) sid: resolved (fixed

CVE-2021-45469 [HIGH] CVE-2021-45469: linux - In __f2fs_setxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11, there... In __f2fs_setxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11, there is an out-of-bounds memory access when an inode has an invalid last xattr entry. Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved (fixed in 5.10.92-1) forky: resolved (fixed in 5.15.15-1) sid: resolved (fixed in 5.15.15-1) trixie: resolved (fixed in 5.15.15-1)