Debian Linux vulnerabilities

CVE-2024-53081 [MEDIUM] CVE-2024-53081: linux - In the Linux kernel, the following vulnerability has been resolved: media: ar05... In the Linux kernel, the following vulnerability has been resolved: media: ar0521: don't overflow when checking PLL values The PLL checks are comparing 64 bit integers with 32 bit ones, as reported by Coverity. Depending on the values of the variables, this may underflow. Fix it ensuring that both sides of the expression are u64. Scope: local bookworm: resolved (fix

CVE-2024-36930 [MEDIUM] CVE-2024-36930: linux - In the Linux kernel, the following vulnerability has been resolved: spi: fix nu... In the Linux kernel, the following vulnerability has been resolved: spi: fix null pointer dereference within spi_sync If spi_sync() is called with the non-empty queue and the same spi_message is then reused, the complete callback for the message remains set while the context is cleared, leading to a null pointer dereference when the callback is invoked from spi_fina

CVE-2024-35799 [MEDIUM] CVE-2024-35799: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Prevent crash when disable stream [Why] Disabling stream encoder invokes a function that no longer exists. [How] Check if the function declaration is NULL in disable stream encoder. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 6.7.12-1) sid: resolved (fixed i

CVE-2024-42322 [MEDIUM] CVE-2024-42322: linux - In the Linux kernel, the following vulnerability has been resolved: ipvs: prope... In the Linux kernel, the following vulnerability has been resolved: ipvs: properly dereference pe in ip_vs_add_service Use pe directly to resolve sparse warning: net/netfilter/ipvs/ip_vs_ctl.c:1471:27: warning: dereference of noderef expression Scope: local bookworm: resolved (fixed in 6.1.119-1) bullseye: resolved (fixed in 5.10.237-1) forky: resolved (fixed in 6.1

CVE-2024-26649 [MEDIUM] CVE-2024-26649: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix the null pointer when load rlc firmware If the RLC firmware is invalid because of wrong header size, the pointer to the rlc firmware is released in function amdgpu_ucode_request. There will be a null pointer error in subsequent use. So skip validation to fix it. Scope: local bookworm

CVE-2024-26785 [MEDIUM] CVE-2024-26785: linux - In the Linux kernel, the following vulnerability has been resolved: iommufd: Fi... In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix protection fault in iommufd_test_syz_conv_iova Syzkaller reported the following bug: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7] Call Trace: lock_acquire lock_

CVE-2024-26975 [MEDIUM] CVE-2024-26975: linux - In the Linux kernel, the following vulnerability has been resolved: powercap: i... In the Linux kernel, the following vulnerability has been resolved: powercap: intel_rapl: Fix a NULL pointer dereference A NULL pointer dereference is triggered when probing the MMIO RAPL driver on platforms with CPU ID not listed in intel_rapl_common CPU model list. This is because the intel_rapl_common module still probes on such platforms even if 'defaults_msr' i

CVE-2024-26711 [MEDIUM] CVE-2024-26711: linux - In the Linux kernel, the following vulnerability has been resolved: iio: adc: a... In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4130: zero-initialize clock init data The clk_init_data struct does not have all its members initialized, causing issues when trying to expose the internal clock on the CLK pin. Fix this by zero-initializing the clk_init_data struct. Scope: local bookworm: resolved bullseye: resolved for

CVE-2024-26716 [MEDIUM] CVE-2024-26716: linux - In the Linux kernel, the following vulnerability has been resolved: usb: core: ... In the Linux kernel, the following vulnerability has been resolved: usb: core: Prevent null pointer dereference in update_port_device_state Currently, the function update_port_device_state gets the usb_hub from udev->parent by calling usb_hub_to_struct_hub. However, in case the actconfig or the maxchild is 0, the usb_hub would be NULL and upon further accessing to g

CVE-2022-3104 [MEDIUM] CVE-2022-3104: linux - An issue was discovered in the Linux kernel through 5.16-rc6. lkdtm_ARRAY_BOUNDS... An issue was discovered in the Linux kernel through 5.16-rc6. lkdtm_ARRAY_BOUNDS in drivers/misc/lkdtm/bugs.c lacks check of the return value of kmalloc() and will cause the null pointer dereference. Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved (fixed in 5.10.127-1) forky: resolved (fixed in 5.18.5-1) sid: resolved (fixed in 5.18.5-1) trixie:

CVE-2021-47206 [MEDIUM] CVE-2021-47206: linux - In the Linux kernel, the following vulnerability has been resolved: usb: host: ... In the Linux kernel, the following vulnerability has been resolved: usb: host: ohci-tmio: check return value after calling platform_get_resource() It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value. Scope: local bookworm: resolved (fixed in 5.15.5-1) bullseye: resolved (fixed in 5.10.84-1) forky: resolved (fixed in 5

CVE-2020-36783 [MEDIUM] CVE-2020-36783: linux - In the Linux kernel, the following vulnerability has been resolved: i2c: img-sc... In the Linux kernel, the following vulnerability has been resolved: i2c: img-scb: fix reference leak when pm_runtime_get_sync fails The PM reference count is not expected to be incremented on return in functions img_i2c_xfer and img_i2c_init. However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result i

CVE-2024-26787 [MEDIUM] CVE-2024-26787: linux - In the Linux kernel, the following vulnerability has been resolved: mmc: mmci: ... In the Linux kernel, the following vulnerability has been resolved: mmc: mmci: stm32: fix DMA API overlapping mappings warning Turning on CONFIG_DMA_API_DEBUG_SG results in the following warning: DMA-API: mmci-pl18x 48220000.mmc: cacheline tracking EEXIST, overlapping mappings aren't supported WARNING: CPU: 1 PID: 51 at kernel/dma/debug.c:568 add_dma_entry+0x234/0x2

CVE-2024-43861 [MEDIUM] CVE-2024-43861: linux - In the Linux kernel, the following vulnerability has been resolved: net: usb: q... In the Linux kernel, the following vulnerability has been resolved: net: usb: qmi_wwan: fix memory leak for not ip packets Free the unused skb when not ip packets arrive. Scope: local bookworm: resolved (fixed in 6.1.106-1) bullseye: resolved (fixed in 5.10.226-1) forky: resolved (fixed in 6.10.6-1) sid: resolved (fixed in 6.10.6-1) trixie: resolved (fixed in 6.10.6

CVE-2024-35925 [MEDIUM] CVE-2024-35925: linux - In the Linux kernel, the following vulnerability has been resolved: block: prev... In the Linux kernel, the following vulnerability has been resolved: block: prevent division by zero in blk_rq_stat_sum() The expression dst->nr_samples + src->nr_samples may have zero value on overflow. It is necessary to add a check to avoid division by zero. Found by Linux Verification Center (linuxtesting.org) with Svace. Scope: local bookworm: resolved (fixed in

CVE-2024-42267 [MEDIUM] CVE-2024-42267: linux - In the Linux kernel, the following vulnerability has been resolved: riscv/mm: A... In the Linux kernel, the following vulnerability has been resolved: riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error() Handle VM_FAULT_SIGSEGV in the page fault path so that we correctly kill the process and we don't BUG() the kernel. Scope: local bookworm: resolved (fixed in 6.1.106-1) bullseye: open forky: resolved (fixed in 6.10.4-1) sid: resolved (f

CVE-2022-49516 [MEDIUM] CVE-2022-49516: linux - In the Linux kernel, the following vulnerability has been resolved: ice: always... In the Linux kernel, the following vulnerability has been resolved: ice: always check VF VSI pointer values The ice_get_vf_vsi function can return NULL in some cases, such as if handling messages during a reset where the VSI is being removed and recreated. Several places throughout the driver do not bother to check whether this VSI pointer is valid. Static analysis

CVE-2022-3078 [MEDIUM] CVE-2022-3078: linux - An issue was discovered in the Linux kernel through 5.16-rc6. There is a lack of... An issue was discovered in the Linux kernel through 5.16-rc6. There is a lack of check after calling vzalloc() and lack of free after allocation in drivers/media/test-drivers/vidtv/vidtv_s302m.c. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed in 5.17.3-1) sid: resolved (fixed in 5.17.3-1) trixie: res

CVE-2022-48648 [MEDIUM] CVE-2022-48648: linux - In the Linux kernel, the following vulnerability has been resolved: sfc: fix nu... In the Linux kernel, the following vulnerability has been resolved: sfc: fix null pointer dereference in efx_hard_start_xmit Trying to get the channel from the tx_queue variable here is wrong because we can only be here if tx_queue is NULL, so we shouldn't dereference it. As the above comment in the code says, this is very unlikely to happen, but it's wrong anyway s

CVE-2021-47231 [MEDIUM] CVE-2021-47231: linux - In the Linux kernel, the following vulnerability has been resolved: can: mcba_u... In the Linux kernel, the following vulnerability has been resolved: can: mcba_usb: fix memory leak in mcba_usb Syzbot reported memory leak in SocketCAN driver for Microchip CAN BUS Analyzer Tool. The problem was in unfreed usb_coherent. In mcba_usb_start() 20 coherent buffers are allocated and there is nothing, that frees them: 1) In callback function the urb is res