Debian Linux vulnerabilities

CVE-2024-35794 [MEDIUM] CVE-2024-35794: linux - In the Linux kernel, the following vulnerability has been resolved: dm-raid: re... In the Linux kernel, the following vulnerability has been resolved: dm-raid: really frozen sync_thread during suspend 1) commit f52f5c71f3d4 ("md: fix stopping sync thread") remove MD_RECOVERY_FROZEN from __md_stop_writes() and doesn't realize that dm-raid relies on __md_stop_writes() to frozen sync_thread indirectly. Fix this problem by adding MD_RECOVERY_FROZEN in

CVE-2024-40965 [MEDIUM] CVE-2024-40965: linux - In the Linux kernel, the following vulnerability has been resolved: i2c: lpi2c:... In the Linux kernel, the following vulnerability has been resolved: i2c: lpi2c: Avoid calling clk_get_rate during transfer Instead of repeatedly calling clk_get_rate for each transfer, lock the clock rate and cache the value. A deadlock has been observed while adding tlv320aic32x4 audio codec to the system. When this clock provider adds its clock, the clk mutex is l

CVE-2023-52869 [MEDIUM] CVE-2023-52869: linux - In the Linux kernel, the following vulnerability has been resolved: pstore/plat... In the Linux kernel, the following vulnerability has been resolved: pstore/platform: Add check for kstrdup Add check for the return value of kstrdup() and return the error if it fails in order to avoid NULL pointer dereference. Scope: local bookworm: resolved (fixed in 6.1.64-1) bullseye: resolved (fixed in 5.10.205-1) forky: resolved (fixed in 6.6.8-1) sid: resolve

CVE-2022-49317 [MEDIUM] CVE-2022-49317: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid... In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid infinite loop to flush node pages xfstests/generic/475 can give EIO all the time which give an infinite loop to flush node page like below. Let's avoid it. [16418.518551] Call Trace: [16418.518553] ? dm_submit_bio+0x48/0x400 [16418.518574] ? submit_bio_checks+0x1ac/0x5a0 [16418.525207] _

CVE-2024-38624 [MEDIUM] CVE-2024-38624: linux - In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: U... In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow For example, in the expression: vbo = 2 * vbo + skip Scope: local bookworm: resolved (fixed in 6.1.94-1) bullseye: resolved forky: resolved (fixed in 6.9.7-1) sid: resolved (fixed in 6.9.7-1) trixie: resolved (fixed in 6.9.7-1)

CVE-2024-26860 [MEDIUM] CVE-2024-26860: linux - In the Linux kernel, the following vulnerability has been resolved: dm-integrit... In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix a memory leak when rechecking the data Memory for the "checksums" pointer will leak if the data is rechecked after checksum failure (because the associated kfree won't happen due to 'goto skip_io'). Fix this by freeing the checksums memory before recheck, and just use the "checksum

CVE-2024-36026 [MEDIUM] CVE-2024-36026: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm:... In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11 While doing multiple S4 stress tests, GC/RLC/PMFW get into an invalid state resulting into hard hangs. Adding a GFX reset as workaround just before sending the MP1_UNLOAD message avoids this failure. Scope: local bookworm: resolved (fixed in 6

CVE-2024-50049 [MEDIUM] CVE-2024-50049: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null pointer before dereferencing se [WHAT & HOW] se is null checked previously in the same function, indicating it might be null; therefore, it must be checked when used again. This fixes 1 FORWARD_NULL issue reported by Coverity. Scope: local bookworm: resolved (fixed in 6.1

CVE-2024-40967 [MEDIUM] CVE-2024-40967: linux - In the Linux kernel, the following vulnerability has been resolved: serial: imx... In the Linux kernel, the following vulnerability has been resolved: serial: imx: Introduce timeout when waiting on transmitter empty By waiting at most 1 second for USR2_TXDC to be set, we avoid a potential deadlock. In case of the timeout, there is not much we can do, so we simply ignore the transmitter state and optimistically try to continue. Scope: local bookwor

CVE-2024-56599 [MEDIUM] CVE-2024-56599: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ath10... In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: avoid NULL pointer error during sdio remove When running 'rmmod ath10k', ath10k_sdio_remove() will free sdio workqueue by destroy_workqueue(). But if CONFIG_INIT_ON_FREE_DEFAULT_ON is set to yes, kernel panic will happen: Call trace: destroy_workqueue+0x1c/0x258 ath10k_sdio_remove+0x84

CVE-2024-53210 [MEDIUM] CVE-2024-53210: linux - In the Linux kernel, the following vulnerability has been resolved: s390/iucv: ... In the Linux kernel, the following vulnerability has been resolved: s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() Passing MSG_PEEK flag to skb_recv_datagram() increments skb refcount (skb->users) and iucv_sock_recvmsg() does not decrement skb refcount at exit. This results in skb memory leak in skb_queue_purge() and WARN_ON in iucv_sock_destruct() d

CVE-2024-41021 [MEDIUM] CVE-2024-41021: linux - In the Linux kernel, the following vulnerability has been resolved: s390/mm: Fi... In the Linux kernel, the following vulnerability has been resolved: s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception() There is no support for HWPOISON, MEMORY_FAILURE, or ARCH_HAS_COPY_MC on s390. Therefore we do not expect to see VM_FAULT_HWPOISON in do_exception(). However, since commit af19487f00f3 ("mm: make PTE_MARKER_SWAPIN_ERROR more general"), it is

CVE-2024-27067 [MEDIUM] CVE-2024-27067: linux - In the Linux kernel, the following vulnerability has been resolved: xen/evtchn:... In the Linux kernel, the following vulnerability has been resolved: xen/evtchn: avoid WARN() when unbinding an event channel When unbinding a user event channel, the related handler might be called a last time in case the kernel was built with CONFIG_DEBUG_SHIRQ. This might cause a WARN() in the handler. Avoid that by adding an "unbinding" flag to struct user_event

CVE-2024-42144 [MEDIUM] CVE-2024-42144: linux - In the Linux kernel, the following vulnerability has been resolved: thermal/dri... In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_data Verify that lvts_data is not NULL before using it. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.9.9-1) sid: resolved (fixed in 6.9.9-1) trixie: resolved (fixed in 6.9.9-1)

CVE-2024-35975 [MEDIUM] CVE-2024-35975: linux - In the Linux kernel, the following vulnerability has been resolved: octeontx2-p... In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix transmit scheduler resource leak Inorder to support shaping and scheduling, Upon class creation Netdev driver allocates trasmit schedulers. The previous patch which added support for Round robin scheduling has a bug due to which driver is not freeing transmit schedulers post class

CVE-2024-26871 [MEDIUM] CVE-2024-26871: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: fix N... In the Linux kernel, the following vulnerability has been resolved: f2fs: fix NULL pointer dereference in f2fs_submit_page_write() BUG: kernel NULL pointer dereference, address: 0000000000000014 RIP: 0010:f2fs_submit_page_write+0x6cf/0x780 [f2fs] Call Trace: ? show_regs+0x6e/0x80 ? __die+0x29/0x70 ? page_fault_oops+0x154/0x4a0 ? prb_read_valid+0x20/0x30 ? __irq_work

CVE-2023-52877 [MEDIUM] CVE-2023-52877: linux - In the Linux kernel, the following vulnerability has been resolved: usb: typec:... In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() It is possible that typec_register_partner() returns ERR_PTR on failure. When port->partner is an error, a NULL pointer dereference may occur as shown below. [91222.095236][ T319] typec port0: failed to register partner (-17) ... [9122

CVE-2023-52508 [MEDIUM] CVE-2023-52508: linux - In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Pr... In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() The nvme_fc_fcp_op structure describing an AEN operation is initialized with a null request structure pointer. An FC LLDD may make a call to nvme_fc_io_getuuid passing a pointer to an nvmefc_fcp_req for an AEN operation. Add validatio

CVE-2023-52692 [MEDIUM] CVE-2023-52692: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: scarl... In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Add missing error check to scarlett2_usb_set_config() scarlett2_usb_set_config() calls scarlett2_usb_get() but was not checking the result. Return the error if it fails rather than continuing with an invalid value. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: resolv

CVE-2023-52671 [MEDIUM] CVE-2023-52671: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix hang/underflow when transitioning to ODM4:1 [Why] Under some circumstances, disabling an OPTC and attempting to reclaim its OPP(s) for a different OPTC could cause a hang/underflow due to OPPs not being properly disconnected from the disabled OPTC. [How] Ensure that all OPPs are