Debian Linux vulnerabilities

CVE-2021-47181 [MEDIUM] CVE-2021-47181: linux - In the Linux kernel, the following vulnerability has been resolved: usb: musb: ... In the Linux kernel, the following vulnerability has been resolved: usb: musb: tusb6010: check return value after calling platform_get_resource() It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value. Scope: local bookworm: resolved (fixed in 5.15.5-1) bullseye: resolved (fixed in 5.10.84-1) forky: resolved (fixed in 5.

CVE-2024-26943 [MEDIUM] CVE-2024-26943: linux - In the Linux kernel, the following vulnerability has been resolved: nouveau/dme... In the Linux kernel, the following vulnerability has been resolved: nouveau/dmem: handle kcalloc() allocation failure The kcalloc() in nouveau_dmem_evict_chunk() will return null if the physical memory has run out. As a result, if we dereference src_pfns, dst_pfns or dma_addrs, the null pointer dereference bugs will happen. Moreover, the GPU is going away. If the kc

CVE-2024-35800 [MEDIUM] CVE-2024-35800: linux - In the Linux kernel, the following vulnerability has been resolved: efi: fix pa... In the Linux kernel, the following vulnerability has been resolved: efi: fix panic in kdump kernel Check if get_next_variable() is actually valid pointer before calling it. In kdump kernel this method is set to NULL that causes panic during the kexec-ed kernel boot. Tested with QEMU and OVMF firmware. Scope: local bookworm: resolved (fixed in 6.1.85-1) bullseye: res

CVE-2024-26978 [MEDIUM] CVE-2024-26978: linux - In the Linux kernel, the following vulnerability has been resolved: serial: max... In the Linux kernel, the following vulnerability has been resolved: serial: max310x: fix NULL pointer dereference in I2C instantiation When trying to instantiate a max14830 device from userspace: echo max14830 0x60 > /sys/bus/i2c/devices/i2c-2/new_device we get the following error: Unable to handle kernel NULL pointer dereference at virtual address... ... Call trace

CVE-2024-26964 [MEDIUM] CVE-2024-26964: linux - In the Linux kernel, the following vulnerability has been resolved: usb: xhci: ... In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Add error handling in xhci_map_urb_for_dma Currently xhci_map_urb_for_dma() creates a temporary buffer and copies the SG list to the new linear buffer. But if the kzalloc_node() fails, then the following sg_pcopy_to_buffer() can lead to crash since it tries to memcpy to NULL pointer. So r

CVE-2024-43831 [MEDIUM] CVE-2024-43831: linux - In the Linux kernel, the following vulnerability has been resolved: media: medi... In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Handle invalid decoder vsi Handle an invalid decoder vsi in vpu_dec_init to ensure the decoder vsi is valid for future use. Scope: local bookworm: resolved (fixed in 6.1.133-1) bullseye: open forky: resolved (fixed in 6.10.3-1) sid: resolved (fixed in 6.10.3-1) trixie: resol

CVE-2024-43823 [MEDIUM] CVE-2024-43823: linux - In the Linux kernel, the following vulnerability has been resolved: PCI: keysto... In the Linux kernel, the following vulnerability has been resolved: PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs() If IORESOURCE_MEM is not provided in Device Tree due to any error, resource_list_first_type() will return NULL and pci_parse_request_of_pci_ranges() will just emit a warning. This will cause a NULL pointer

CVE-2024-35943 [MEDIUM] CVE-2024-35943: linux - In the Linux kernel, the following vulnerability has been resolved: pmdomain: t... In the Linux kernel, the following vulnerability has been resolved: pmdomain: ti: Add a null pointer check to the omap_prm_domain_init devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. Scope: local bookworm: resolved (fixed in 6.1.112-1) bullseye:

CVE-2024-26896 [MEDIUM] CVE-2024-26896: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: ... In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: fix memory leak when starting AP Kmemleak reported this error: unreferenced object 0xd73d1180 (size 184): comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.245s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 1e

CVE-2024-26667 [MEDIUM] CVE-2024-26667: linux - In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu... In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: check for valid hw_pp in dpu_encoder_helper_phys_cleanup The commit 8b45a26f2ba9 ("drm/msm/dpu: reserve cdm blocks for writeback in case of YUV output") introduced a smatch warning about another conditional block in dpu_encoder_helper_phys_cleanup() which had assumed hw_pp will always b

CVE-2024-38607 [MEDIUM] CVE-2024-38607: linux - In the Linux kernel, the following vulnerability has been resolved: macintosh/v... In the Linux kernel, the following vulnerability has been resolved: macintosh/via-macii: Fix "BUG: sleeping function called from invalid context" The via-macii ADB driver calls request_irq() after disabling hard interrupts. But disabling interrupts isn't necessary here because the VIA shift register interrupt was masked during VIA1 initialization. Scope: local bookw

CVE-2024-41093 [MEDIUM] CVE-2024-41093: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid using null object of framebuffer Instead of using state->fb->obj[0] directly, get object from framebuffer by calling drm_gem_fb_get_obj() and return error code when object is null to avoid using null object of framebuffer. Scope: local bookworm: resolved (fixed in 6.1.98-1) bullsey

CVE-2024-42141 [MEDIUM] CVE-2024-42141: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Check socket flag instead of hcon This fixes the following Smatch static checker warning: net/bluetooth/iso.c:1364 iso_sock_recvmsg() error: we previously assumed 'pi->conn->hcon' could be null (line 1359) net/bluetooth/iso.c 1347 static int iso_sock_recvmsg(struct socket *sock, stru

CVE-2024-38563 [MEDIUM] CVE-2024-38563: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mt76:... In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix potential memory leakage when reading chip temperature Without this commit, reading chip temperature will cause memory leakage. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.8.12-1) sid: resolved (fixed in 6.8.12-1) trixie: resolved (fixed in

CVE-2024-38584 [MEDIUM] CVE-2024-38584: linux - In the Linux kernel, the following vulnerability has been resolved: net: ti: ic... In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg_prueth: Fix NULL pointer dereference in prueth_probe() In the prueth_probe() function, if one of the calls to emac_phy_connect() fails due to of_phy_connect() returning NULL, then the subsequent call to phy_attached_info() will dereference a NULL pointer. Check the return code of emac

CVE-2024-43821 [MEDIUM] CVE-2024-43821: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc:... In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix a possible null pointer dereference In function lpfc_xcvr_data_show, the memory allocation with kmalloc might fail, thereby making rdp_context a null pointer. In the following context and functions that use this pointer, there are dereferencing operations, leading to null pointer der

CVE-2023-52680 [MEDIUM] CVE-2023-52680: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: scarl... In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Add missing error checks to *_ctl_get() The *_ctl_get() functions which call scarlett2_update_*() were not checking the return value. Fix to check the return value and pass to the caller. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: open forky: resolved (fixed in 6.

CVE-2023-52593 [MEDIUM] CVE-2023-52593: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: ... In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap() Since 'ieee80211_beacon_get()' can return NULL, 'wfx_set_mfp_ap()' should check the return value before examining skb data. So convert the latter to return an appropriate error code and propagate it to return from 'wfx_start_ap()'

CVE-2022-48777 [MEDIUM] CVE-2022-48777: linux - In the Linux kernel, the following vulnerability has been resolved: mtd: parser... In the Linux kernel, the following vulnerability has been resolved: mtd: parsers: qcom: Fix kernel panic on skipped partition In the event of a skipped partition (case when the entry name is empty) the kernel panics in the cleanup function as the name entry is NULL. Rework the parser logic by first checking the real partition number and then allocate the space and s

CVE-2021-47095 [MEDIUM] CVE-2021-47095: linux - In the Linux kernel, the following vulnerability has been resolved: ipmi: ssif:... In the Linux kernel, the following vulnerability has been resolved: ipmi: ssif: initialize ssif_info->client early During probe ssif_info->client is dereferenced in error path. However, it is set when some of the error checking has already been done. This causes following kernel crash if an error path is taken: [ 30.645593][ T674] ipmi_ssif 0-000e: ipmi_ssif: Not pr