Debian Linux vulnerabilities

CVE-2024-50098 [MEDIUM] CVE-2024-50098: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: ... In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down There is a history of deadlock if reboot is performed at the beginning of booting. SDEV_QUIESCE was set for all LU's scsi_devices by UFS shutdown, and at that time the audio driver was waiting on blk_mq_submit_bio() holding a mutex_lock while r

CVE-2024-36908 [MEDIUM] CVE-2024-36908: linux - In the Linux kernel, the following vulnerability has been resolved: blk-iocost:... In the Linux kernel, the following vulnerability has been resolved: blk-iocost: do not WARN if iocg was already offlined In iocg_pay_debt(), warn is triggered if 'active_list' is empty, which is intended to confirm iocg is active when it has debt. However, warn can be triggered during a blkcg or disk removal, if iocg_waitq_timer_fn() is run at that time: WARNING: CP

CVE-2024-56567 [MEDIUM] CVE-2024-56567: linux - In the Linux kernel, the following vulnerability has been resolved: ad7780: fix... In the Linux kernel, the following vulnerability has been resolved: ad7780: fix division by zero in ad7780_write_raw() In the ad7780_write_raw() , val2 can be zero, which might lead to a division by zero error in DIV_ROUND_CLOSEST(). The ad7780_write_raw() is based on iio_info's write_raw. While val is explicitly declared that can be zero (in read mode), val2 is not

CVE-2024-56579 [MEDIUM] CVE-2024-56579: linux - In the Linux kernel, the following vulnerability has been resolved: media: amph... In the Linux kernel, the following vulnerability has been resolved: media: amphion: Set video drvdata before register video device The video drvdata should be set before the video device is registered, otherwise video_drvdata() may return NULL in the open() file ops, and led to oops. Scope: local bookworm: resolved (fixed in 6.1.123-1) bullseye: resolved forky: reso

CVE-2024-35872 [MEDIUM] CVE-2024-35872: linux - In the Linux kernel, the following vulnerability has been resolved: mm/secretme... In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix GUP-fast succeeding on secretmem folios folio_is_secretmem() currently relies on secretmem folios being LRU folios, to save some cycles. However, folios might reside in a folio batch without the LRU flag set, or temporarily have their LRU flag cleared. Consequently, the LRU flag is

CVE-2024-35850 [MEDIUM] CVE-2024-35850: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NULL-deref on non-serdev setup Qualcomm ROME controllers can be registered from the Bluetooth line discipline and in this case the HCI UART serdev pointer is NULL. Add the missing sanity check to prevent a NULL-pointer dereference when setup() is called for a non-serdev controlle

CVE-2023-52607 [MEDIUM] CVE-2023-52607: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/mm:... In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: Fix null-pointer dereference in pgtable_cache_add kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. Scope: local bookworm: resolved (fixed in 6.1.82-1) bullseye: resolved (f

CVE-2021-47425 [MEDIUM] CVE-2021-47425: linux - In the Linux kernel, the following vulnerability has been resolved: i2c: acpi: ... In the Linux kernel, the following vulnerability has been resolved: i2c: acpi: fix resource leak in reconfiguration device addition acpi_i2c_find_adapter_by_handle() calls bus_find_device() which takes a reference on the adapter which is never released which will result in a reference count leak and render the adapter unremovable. Make sure to put the adapter after

CVE-2024-50179 [MEDIUM] CVE-2024-50179: linux - In the Linux kernel, the following vulnerability has been resolved: ceph: remov... In the Linux kernel, the following vulnerability has been resolved: ceph: remove the incorrect Fw reference check when dirtying pages When doing the direct-io reads it will also try to mark pages dirty, but for the read path it won't hold the Fw caps and there is case will it get the Fw reference. Scope: local bookworm: resolved (fixed in 6.1.115-1) bullseye: resolv

CVE-2021-47438 [MEDIUM] CVE-2021-47438: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: ... In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path Prior to this patch in case mlx5_core_destroy_cq() failed it returns without completing all destroy operations and that leads to memory leak. Instead, complete the destroy flow before return error. Also move mlx5_debug_cq_remove() to th

CVE-2025-21848 [MEDIUM] CVE-2025-21848: linux - In the Linux kernel, the following vulnerability has been resolved: nfp: bpf: A... In the Linux kernel, the following vulnerability has been resolved: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() Add check for the return value of nfp_app_ctrl_msg_alloc() in nfp_bpf_cmsg_alloc() to prevent null pointer dereference. Scope: local bookworm: resolved (fixed in 6.1.133-1) bullseye: resolved (fixed in 5.10.237-1) forky: resolved (fixed in 6.12.17-1)

CVE-2021-47134 [MEDIUM] CVE-2021-47134: linux - In the Linux kernel, the following vulnerability has been resolved: efi/fdt: fi... In the Linux kernel, the following vulnerability has been resolved: efi/fdt: fix panic when no valid fdt found setup_arch() would invoke efi_init()->efi_get_fdt_params(). If no valid fdt found then initial_boot_params will be null. So we should stop further fdt processing here. I encountered this issue on risc-v. Scope: local bookworm: resolved (fixed in 5.10.46-1)

CVE-2021-47164 [MEDIUM] CVE-2021-47164: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: ... In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix null deref accessing lag dev It could be the lag dev is null so stop processing the event. In bond_enslave() the active/backup slave being set before setting the upper dev so first event is without an upper dev. After setting the upper dev with bond_master_upper_dev_link() there is a

CVE-2021-46914 [MEDIUM] CVE-2021-46914: linux - In the Linux kernel, the following vulnerability has been resolved: ixgbe: fix ... In the Linux kernel, the following vulnerability has been resolved: ixgbe: fix unbalanced device enable/disable in suspend/resume pci_disable_device() called in __ixgbe_shutdown() decreases dev->enable_cnt by 1. pci_enable_device_mem() which increases dev->enable_cnt by 1, was removed from ixgbe_resume() in commit 6f82b2558735 ("ixgbe: use generic power management")

CVE-2021-46956 [MEDIUM] CVE-2021-46956: linux - In the Linux kernel, the following vulnerability has been resolved: virtiofs: f... In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix memory leak in virtio_fs_probe() When accidentally passing twice the same tag to qemu, kmemleak ended up reporting a memory leak in virtiofs. Also, looking at the log I saw the following error (that's when I realised the duplicated tag): virtiofs: probe of virtio5 failed with error -17

CVE-2024-42273 [MEDIUM] CVE-2024-42273: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: assig... In the Linux kernel, the following vulnerability has been resolved: f2fs: assign CURSEG_ALL_DATA_ATGC if blkaddr is valid mkdir /mnt/test/comp f2fs_io setflags compression /mnt/test/comp dd if=/dev/zero of=/mnt/test/comp/testfile bs=16k count=1 truncate --size 13 /mnt/test/comp/testfile In the above scenario, we can get a BUG_ON. kernel BUG at fs/f2fs/segment.c:3589

CVE-2024-49990 [MEDIUM] CVE-2024-49990: linux - In the Linux kernel, the following vulnerability has been resolved: drm/xe/hdcp... In the Linux kernel, the following vulnerability has been resolved: drm/xe/hdcp: Check GSC structure validity Sometimes xe_gsc is not initialized when checked at HDCP capability check. Add gsc structure check to avoid null pointer error. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.11.4-1) sid: resolved (fixed in 6.11.4-1) trixie: r

CVE-2022-49125 [MEDIUM] CVE-2022-49125: linux - In the Linux kernel, the following vulnerability has been resolved: drm/sprd: f... In the Linux kernel, the following vulnerability has been resolved: drm/sprd: fix potential NULL dereference 'drm' could be null in sprd_drm_shutdown, and drm_warn maybe dereference it, remove this warning log. v1 -> v2: - Split checking platform_get_resource() return value to a separate patch - Use dev_warn() instead of removing the warning log Scope: local bookwor

CVE-2021-46967 [MEDIUM] CVE-2021-46967: linux - In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa:... In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: fix vm_flags for virtqueue doorbell mapping The virtqueue doorbell is usually implemented via registeres but we don't provide the necessary vma->flags like VM_PFNMAP. This may cause several issues e.g when userspace tries to map the doorbell via vhost IOTLB, kernel may panic due to the p

CVE-2025-21697 [MEDIUM] CVE-2025-21697: linux - In the Linux kernel, the following vulnerability has been resolved: drm/v3d: En... In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Ensure job pointer is set to NULL after job completion After a job completes, the corresponding pointer in the device must be set to NULL. Failing to do so triggers a warning when unloading the driver, as it appears the job is still active. To prevent this, assign the job pointer to NULL af