Debian Linux vulnerabilities

CVE-2024-42235 [MEDIUM] CVE-2024-42235: linux - In the Linux kernel, the following vulnerability has been resolved: s390/mm: Ad... In the Linux kernel, the following vulnerability has been resolved: s390/mm: Add NULL pointer check to crst_table_free() base_crst_free() crst_table_free() used to work with NULL pointers before the conversion to ptdescs. Since crst_table_free() can be called with a NULL pointer (error handling in crst_table_upgrade() add an explicit check. Also add the same check t

CVE-2023-52878 [MEDIUM] CVE-2023-52878: linux - In the Linux kernel, the following vulnerability has been resolved: can: dev: c... In the Linux kernel, the following vulnerability has been resolved: can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds If the "struct can_priv::echoo_skb" is accessed out of bounds, this would cause a kernel crash. Instead, issue a meaningful warning message and return with an error. Scope: local bookworm: resolved (fixe

CVE-2022-49484 [MEDIUM] CVE-2022-49484: linux - In the Linux kernel, the following vulnerability has been resolved: mt76: mt791... In the Linux kernel, the following vulnerability has been resolved: mt76: mt7915: fix possible NULL pointer dereference in mt7915_mac_fill_rx_vector Fix possible NULL pointer dereference in mt7915_mac_fill_rx_vector routine if the chip does not support dbdc and the hw reports band_idx set to 1. Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved f

CVE-2024-43908 [MEDIUM] CVE-2024-43908: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix the null pointer dereference to ras_manager Check ras_manager before using it Scope: local bookworm: resolved (fixed in 6.1.106-1) bullseye: resolved (fixed in 5.10.226-1) forky: resolved (fixed in 6.10.6-1) sid: resolved (fixed in 6.10.6-1) trixie: resolved (fixed in 6.10.6-1)

CVE-2024-27418 [MEDIUM] CVE-2024-27418: linux - In the Linux kernel, the following vulnerability has been resolved: net: mctp: ... In the Linux kernel, the following vulnerability has been resolved: net: mctp: take ownership of skb in mctp_local_output Currently, mctp_local_output only takes ownership of skb on success, and we may leak an skb if mctp_local_output fails in specific states; the skb ownership isn't transferred until the actual output routing occurs. Instead, make mctp_local_output

CVE-2024-42299 [MEDIUM] CVE-2024-42299: linux - In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: U... In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed If an NTFS file system is mounted to another system with different PAGE_SIZE from the original system, log->page_size will change in log_replay(), but log->page_{mask,bits} don't change correspondingly. This will cause a panic because

CVE-2024-47756 [MEDIUM] CVE-2024-47756: linux - In the Linux kernel, the following vulnerability has been resolved: PCI: keysto... In the Linux kernel, the following vulnerability has been resolved: PCI: keystone: Fix if-statement expression in ks_pcie_quirk() This code accidentally uses && where || was intended. It potentially results in a NULL dereference. Thus, fix the if-statement expression to use the correct condition. [kwilczynski: commit log] Scope: local bookworm: resolved (fixed in 6.

CVE-2024-57978 [MEDIUM] CVE-2024-57978: linux - In the Linux kernel, the following vulnerability has been resolved: media: imx-... In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Fix potential error pointer dereference in detach_pm() The proble is on the first line: if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i])) If jpeg->pd_dev[i] is an error pointer, then passing it to pm_runtime_suspended() will lead to an Oops. The other conditions check f

CVE-2024-50245 [MEDIUM] CVE-2024-50245: linux - In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: F... In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix possible deadlock in mi_read Mutex lock with another subclass used in ni_lock_dir(). Scope: local bookworm: resolved (fixed in 6.1.119-1) bullseye: resolved forky: resolved (fixed in 6.11.7-1) sid: resolved (fixed in 6.11.7-1) trixie: resolved (fixed in 6.11.7-1)

CVE-2024-50056 [MEDIUM] CVE-2024-50056: linux - In the Linux kernel, the following vulnerability has been resolved: usb: gadget... In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c Fix potential dereferencing of ERR_PTR() in find_format_by_pix() and uvc_v4l2_enum_format(). Fix the following smatch errors: drivers/usb/gadget/function/uvc_v4l2.c:124 find_format_by_pix() error: 'fmtdesc' dereferencing possible ERR_PTR() driv

CVE-2024-50259 [MEDIUM] CVE-2024-50259: linux - In the Linux kernel, the following vulnerability has been resolved: netdevsim: ... In the Linux kernel, the following vulnerability has been resolved: netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write() This was found by a static analyzer. We should not forget the trailing zero after copy_from_user() if we will further do some string operations, sscanf() in this case. Adding a trailing zero will ensure that

CVE-2024-46846 [MEDIUM] CVE-2024-46846: linux - In the Linux kernel, the following vulnerability has been resolved: spi: rockch... In the Linux kernel, the following vulnerability has been resolved: spi: rockchip: Resolve unbalanced runtime PM / system PM handling Commit e882575efc77 ("spi: rockchip: Suspend and resume the bus during NOIRQ_SYSTEM_SLEEP_PM ops") stopped respecting runtime PM status and simply disabled clocks unconditionally when suspending the system. This causes problems when t

CVE-2024-50065 [MEDIUM] CVE-2024-50065: linux - In the Linux kernel, the following vulnerability has been resolved: ntfs3: Chan... In the Linux kernel, the following vulnerability has been resolved: ntfs3: Change to non-blocking allocation in ntfs_d_hash d_hash is done while under "rcu-walk" and should not sleep. __get_name() allocates using GFP_KERNEL, having the possibility to sleep when under memory pressure. Change the allocation to GFP_NOWAIT. Scope: local bookworm: resolved bullseye: reso

CVE-2024-49956 [MEDIUM] CVE-2024-49956: linux - In the Linux kernel, the following vulnerability has been resolved: gfs2: fix d... In the Linux kernel, the following vulnerability has been resolved: gfs2: fix double destroy_workqueue error When gfs2_fill_super() fails, destroy_workqueue() is called within gfs2_gl_hash_clear(), and the subsequent code path calls destroy_workqueue() on the same work queue again. This issue can be fixed by setting the work queue pointer to NULL after the first des

CVE-2024-53200 [MEDIUM] CVE-2024-53200: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix null check for pipe_ctx->plane_state in hwss_setup_dpp This commit addresses a null pointer dereference issue in hwss_setup_dpp(). The issue could occur when pipe_ctx->plane_state is null. The fix adds a check to ensure `pipe_ctx->plane_state` is not null before accessing. This

CVE-2022-3114 [MEDIUM] CVE-2022-3114: linux - An issue was discovered in the Linux kernel through 5.16-rc6. imx_register_uart_... An issue was discovered in the Linux kernel through 5.16-rc6. imx_register_uart_clocks in drivers/clk/imx/clk.c lacks check of the return value of kcalloc() and will cause the null pointer dereference. Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: open forky: resolved (fixed in 5.19.6-1) sid: resolved (fixed in 5.19.6-1) trixie: resolved (fixed in 5.19

CVE-2025-21775 [MEDIUM] CVE-2025-21775: linux - In the Linux kernel, the following vulnerability has been resolved: can: ctucan... In the Linux kernel, the following vulnerability has been resolved: can: ctucanfd: handle skb allocation failure If skb allocation fails, the pointer to struct can_frame is NULL. This is actually handled everywhere inside ctucan_err_interrupt() except for the only place. Add the missed NULL check. Found by Linux Verification Center (linuxtesting.org) with SVACE stat

CVE-2024-56546 [MEDIUM] CVE-2024-56546: linux - In the Linux kernel, the following vulnerability has been resolved: drivers: so... In the Linux kernel, the following vulnerability has been resolved: drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend() If we fail to allocate memory for cb_data by kmalloc, the memory allocation for eve_data is never freed, add the missing kfree() in the error handling path. Scope: local bookworm: resolved (fixed in 6.1.123-1) bullseye: resolve

CVE-2024-43879 [MEDIUM] CVE-2024-43879: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80... In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() Currently NL80211_RATE_INFO_HE_RU_ALLOC_2x996 is not handled in cfg80211_calculate_bitrate_he(), leading to below warning: kernel: invalid HE MCS: bw:6, ru:6 kernel: WARNING: CPU: 0 PID: 2312 at net/wireless/util.c:1501 cf

CVE-2024-53145 [MEDIUM] CVE-2024-53145: linux - In the Linux kernel, the following vulnerability has been resolved: um: Fix pot... In the Linux kernel, the following vulnerability has been resolved: um: Fix potential integer overflow during physmem setup This issue happens when the real map size is greater than LONG_MAX, which can be easily triggered on UML/i386. Scope: local bookworm: resolved (fixed in 6.1.123-1) bullseye: resolved (fixed in 5.10.234-1) forky: resolved (fixed in 6.12.3-1) sid