Debian Linux vulnerabilities

CVE-2023-52657 [MEDIUM] CVE-2023-52657: linux - In the Linux kernel, the following vulnerability has been resolved: Revert "drm... In the Linux kernel, the following vulnerability has been resolved: Revert "drm/amd/pm: resolve reboot exception for si oland" This reverts commit e490d60a2f76bff636c68ce4fe34c1b6c34bbd86. This causes hangs on SI when DC is enabled and errors on driver reboot and power off cycles. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.7.9-1)

CVE-2021-47431 [MEDIUM] CVE-2021-47431: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix gart.bo pin_count leak gmc_v{9,10}_0_gart_disable() isn't called matched with correspoding gart_enbale function in SRIOV case. This will lead to gart.bo pin_count leak on driver unload. Scope: local bookworm: resolved (fixed in 5.14.16-1) bullseye: resolved (fixed in 5.10.84-1) forky

CVE-2021-47151 [MEDIUM] CVE-2021-47151: linux - In the Linux kernel, the following vulnerability has been resolved: interconnec... In the Linux kernel, the following vulnerability has been resolved: interconnect: qcom: bcm-voter: add a missing of_node_put() Add a missing of_node_put() in of_bcm_voter_get() to avoid the reference leak. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.46-1) forky: resolved (fixed in 5.14.6-1) sid: resolved (fixed in 5.14.6-1)

CVE-2021-47186 [MEDIUM] CVE-2021-47186: linux - In the Linux kernel, the following vulnerability has been resolved: tipc: check... In the Linux kernel, the following vulnerability has been resolved: tipc: check for null after calling kmemdup kmemdup can return a null pointer so need to check for it, otherwise the null key will be dereferenced later in tipc_crypto_key_xmit as can be seen in the trace [1]. [1] https://syzkaller.appspot.com/bug?id=bca180abb29567b189efdbdb34cbf7ba851c2a58 Scope: lo

CVE-2021-47539 [MEDIUM] CVE-2021-47539: linux - In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ... In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() Need to call rxrpc_put_peer() for bundle candidate before kfree() as it holds a ref to rxrpc_peer. [DH: v2: Changed to abstract out the bundle freeing code into a function] Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved (f

CVE-2021-46968 [MEDIUM] CVE-2021-46968: linux - In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt... In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: fix zcard and zqueue hot-unplug memleak Tests with kvm and a kmemdebug kernel showed, that on hot unplug the zcard and zqueue structs for the unplugged card or queue are not properly freed because of a mismatch with get/put for the embedded kref counter. This fix now adjusts the handlin

CVE-2024-38625 [MEDIUM] CVE-2024-38625: linux - In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: C... In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Check 'folio' pointer for NULL It can be NULL if bmap is called. Scope: local bookworm: open bullseye: resolved forky: resolved (fixed in 6.9.7-1) sid: resolved (fixed in 6.9.7-1) trixie: resolved (fixed in 6.9.7-1)

CVE-2024-53202 [MEDIUM] CVE-2024-53202: linux - In the Linux kernel, the following vulnerability has been resolved: firmware_lo... In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Fix possible resource leak in fw_log_firmware_info() The alg instance should be released under the exception path, otherwise there may be resource leak here. To mitigate this, free the alg instance with crypto_free_shash when kmalloc fails. Scope: local bookworm: resolved bullseye:

CVE-2024-47700 [MEDIUM] CVE-2024-47700: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: check... In the Linux kernel, the following vulnerability has been resolved: ext4: check stripe size compatibility on remount as well We disable stripe size in __ext4_fill_super if it is not a multiple of the cluster ratio however this check is missed when trying to remount. This can leave us with cases where stripe s_stripe) become 0 that can cause some unforeseen bugs like

CVE-2022-49957 [MEDIUM] CVE-2022-49957: linux - In the Linux kernel, the following vulnerability has been resolved: kcm: fix st... In the Linux kernel, the following vulnerability has been resolved: kcm: fix strp_init() order and cleanup strp_init() is called just a few lines above this csk->sk_user_data check, it also initializes strp->work etc., therefore, it is unnecessary to call strp_done() to cancel the freshly initialized work. And if sk_user_data is already used by KCM, psock->strp shou

CVE-2025-21828 [MEDIUM] CVE-2025-21828: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80... In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't flush non-uploaded STAs If STA state is pre-moved to AUTHORIZED (such as in IBSS scenarios) and insertion fails, the station is freed. In this case, the driver never knew about the station, so trying to flush it is unexpected and may crash. Check if the sta was uploaded to the

CVE-2024-50138 [MEDIUM] CVE-2024-50138: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Use ra... In the Linux kernel, the following vulnerability has been resolved: bpf: Use raw_spinlock_t in ringbuf The function __bpf_ringbuf_reserve is invoked from a tracepoint, which disables preemption. Using spinlock_t in this context can lead to a "sleep in atomic" warning in the RT variant. This issue is illustrated in the example below: BUG: sleeping function called fro

CVE-2024-56683 [MEDIUM] CVE-2024-56683: linux - In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hd... In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hdmi: Avoid hang with debug registers when suspended Trying to read /sys/kernel/debug/dri/1/hdmi1_regs when the hdmi is disconnected results in a fatal system hang. This is due to the pm suspend code disabling the dvp clock. That is just a gate of the 108MHz clock in DVP_HT_RPI_MISC_CONFIG,

CVE-2024-40969 [MEDIUM] CVE-2024-40969: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: don't... In the Linux kernel, the following vulnerability has been resolved: f2fs: don't set RO when shutting down f2fs Shutdown does not check the error of thaw_super due to readonly, which causes a deadlock like below. f2fs_ioc_shutdown(F2FS_GOING_DOWN_FULLSYNC) issue_discard_thread - bdev_freeze - freeze_super - f2fs_stop_checkpoint() - f2fs_handle_critical_error - sb_sta

CVE-2024-46728 [MEDIUM] CVE-2024-46728: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check index for aux_rd_interval before using aux_rd_interval has size of 7 and should be checked. This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 6.10.9-1) sid: resolved (fixed in 6.10.9-1)

CVE-2024-42258 [MEDIUM] CVE-2024-42258: linux - In the Linux kernel, the following vulnerability has been resolved: mm: huge_me... In the Linux kernel, the following vulnerability has been resolved: mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines Yves-Alexis Perez reported commit 4ef9ad19e176 ("mm: huge_memory: don't force huge page alignment on 32 bit") didn't work for x86_32 [1]. It is because x86_32 uses CONFIG_X86_32 instead of CONFIG_32BIT. !CONFIG_64BIT

CVE-2024-56660 [MEDIUM] CVE-2024-56660: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: D... In the Linux kernel, the following vulnerability has been resolved: net/mlx5: DR, prevent potential error pointer dereference The dr_domain_add_vport_cap() function generally returns NULL on error but sometimes we want it to return ERR_PTR(-EBUSY) so the caller can retry. The problem here is that "ret" can be either -EBUSY or -ENOMEM and if it's and -ENOMEM then the

CVE-2024-47720 [MEDIUM] CVE-2024-47720: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func This commit adds a null check for the set_output_gamma function pointer in the dcn30_set_output_transfer_func function. Previously, set_output_gamma was being checked for nullity at line 386, but then it was being

CVE-2024-50003 [MEDIUM] CVE-2024-50003: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix system hang while resume with TBT monitor [Why] Connected with a Thunderbolt monitor and do the suspend and the system may hang while resume. The TBT monitor HPD will be triggered during the resume procedure and call the drm_client_modeset_probe() while struct drm_connector conn

CVE-2024-50004 [MEDIUM] CVE-2024-50004: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: update DML2 policy EnhancedPrefetchScheduleAccelerationFinal DCN35 [WHY & HOW] Mismatch in DCN35 DML2 cause bw validation failed to acquire unexpected DPP pipe to cause grey screen and system hang. Remove EnhancedPrefetchScheduleAccelerationFinal value override to match HW spec. (ch