Debian Linux vulnerabilities

CVE-2022-49539 [MEDIUM] CVE-2022-49539: linux - In the Linux kernel, the following vulnerability has been resolved: rtw89: ser:... In the Linux kernel, the following vulnerability has been resolved: rtw89: ser: fix CAM leaks occurring in L2 reset The CAM, meaning address CAM and bssid CAM here, will get leaks during SER (system error recover) L2 reset process and ieee80211_restart_hw() which is called by L2 reset process eventually. The normal flow would be like -> add interface (acquire 1) ->

CVE-2022-49150 [MEDIUM] CVE-2022-49150: linux - In the Linux kernel, the following vulnerability has been resolved: rtc: gamecu... In the Linux kernel, the following vulnerability has been resolved: rtc: gamecube: Fix refcount leak in gamecube_rtc_read_offset_from_sram The of_find_compatible_node() function returns a node pointer with refcount incremented, We should use of_node_put() on it when done Add the missing of_node_put() to release the refcount. Scope: local bookworm: resolved (fixed in

CVE-2022-49423 [MEDIUM] CVE-2022-49423: linux - In the Linux kernel, the following vulnerability has been resolved: rtla: Avoid... In the Linux kernel, the following vulnerability has been resolved: rtla: Avoid record NULL pointer dereference Fix the following null/deref_null.cocci errors: ./tools/tracing/rtla/src/osnoise_hist.c:870:31-36: ERROR: record is NULL but dereferenced. ./tools/tracing/rtla/src/osnoise_top.c:650:31-36: ERROR: record is NULL but dereferenced. ./tools/tracing/rtla/src/ti

CVE-2022-49436 [MEDIUM] CVE-2022-49436: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/pap... In the Linux kernel, the following vulnerability has been resolved: powerpc/papr_scm: Fix leaking nvdimm_events_map elements Right now 'char *' elements allocated for individual 'stat_id' in 'papr_scm_priv.nvdimm_events_map[]' during papr_scm_pmu_check_events(), get leaked in papr_scm_remove() and papr_scm_pmu_register(), papr_scm_pmu_check_events() error paths. Als

CVE-2024-56767 [MEDIUM] CVE-2024-56767: linux - In the Linux kernel, the following vulnerability has been resolved: dmaengine: ... In the Linux kernel, the following vulnerability has been resolved: dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset The at_xdmac_memset_create_desc may return NULL, which will lead to a null pointer dereference. For example, the len input is error, or the atchan->free_descs_list is empty and memory is exhausted. Therefore, add check to avoid th

CVE-2024-47705 [MEDIUM] CVE-2024-47705: linux - In the Linux kernel, the following vulnerability has been resolved: block: fix ... In the Linux kernel, the following vulnerability has been resolved: block: fix potential invalid pointer dereference in blk_add_partition The blk_add_partition() function initially used a single if-condition (IS_ERR(part)) to check for errors when adding a partition. This was modified to handle the specific case of -ENXIO separately, allowing the function to proceed

CVE-2022-48767 [MEDIUM] CVE-2022-48767: linux - In the Linux kernel, the following vulnerability has been resolved: ceph: prope... In the Linux kernel, the following vulnerability has been resolved: ceph: properly put ceph_string reference after async create attempt The reference acquired by try_prep_async_create is currently leaked. Ensure we put it. Scope: local bookworm: resolved (fixed in 5.16.7-1) bullseye: resolved (fixed in 5.10.103-1) forky: resolved (fixed in 5.16.7-1) sid: resolved (f

CVE-2022-3115 [MEDIUM] CVE-2022-3115: linux - An issue was discovered in the Linux kernel through 5.16-rc6. malidp_crtc_reset ... An issue was discovered in the Linux kernel through 5.16-rc6. malidp_crtc_reset in drivers/gpu/drm/arm/malidp_crtc.c lacks check of the return value of kzalloc() and will cause the null pointer dereference. Scope: local bookworm: resolved (fixed in 5.18.5-1) bullseye: resolved (fixed in 5.10.127-1) forky: resolved (fixed in 5.18.5-1) sid: resolved (fixed in 5.18.5-1)

CVE-2024-42312 [MEDIUM] CVE-2024-42312: linux - In the Linux kernel, the following vulnerability has been resolved: sysctl: alw... In the Linux kernel, the following vulnerability has been resolved: sysctl: always initialize i_uid/i_gid Always initialize i_uid/i_gid inside the sysfs core so set_ownership() can safely skip setting them. Commit 5ec27ec735ba ("fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.") added defaults for i_uid/i_gid when set_ownership() was

CVE-2024-53201 [MEDIUM] CVE-2024-53201: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe This commit addresses a null pointer dereference issue in dcn20_program_pipe(). Previously, commit 8e4ed3cf1642 ("drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe") partially fixed the null

CVE-2023-52704 [MEDIUM] CVE-2023-52704: linux - In the Linux kernel, the following vulnerability has been resolved: freezer,umh... In the Linux kernel, the following vulnerability has been resolved: freezer,umh: Fix call_usermode_helper_exec() vs SIGKILL Tetsuo-San noted that commit f5d39b020809 ("freezer,sched: Rewrite core freezer logic") broke call_usermodehelper_exec() for the KILLABLE case. Specifically it was missed that the second, unconditional, wait_for_completion() was not optional an

CVE-2025-21793 [MEDIUM] CVE-2025-21793: linux - In the Linux kernel, the following vulnerability has been resolved: spi: sn-f-o... In the Linux kernel, the following vulnerability has been resolved: spi: sn-f-ospi: Fix division by zero When there is no dummy cycle in the spi-nor commands, both dummy bus cycle bytes and width are zero. Because of the cpu's warning when divided by zero, the warning should be avoided. Return just zero to avoid such calculations. Scope: local bookworm: resolved bul

CVE-2024-46754 [MEDIUM] CVE-2024-46754: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Remove... In the Linux kernel, the following vulnerability has been resolved: bpf: Remove tst_run from lwt_seg6local_prog_ops. The syzbot reported that the lwt_seg6 related BPF ops can be invoked via bpf_test_run() without without entering input_action_end_bpf() first. Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL probably didn't work since it was intro

CVE-2024-43867 [MEDIUM] CVE-2024-43867: linux - In the Linux kernel, the following vulnerability has been resolved: drm/nouveau... In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: prime: fix refcount underflow Calling nouveau_bo_ref() on a nouveau_bo without initializing it (and hence the backing ttm_bo) leads to a refcount underflow. Instead of calling nouveau_bo_ref() in the unwind path of drm_gem_object_init(), clean things up manually. (cherry picked from com

CVE-2024-50166 [MEDIUM] CVE-2024-50166: linux - In the Linux kernel, the following vulnerability has been resolved: fsl/fman: F... In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix refcount handling of fman-related devices In mac_probe() there are multiple calls to of_find_device_by_node(), fman_bind() and fman_port_bind() which takes references to of_dev->dev. Not all references taken by these calls are released later on error path in mac_probe() and in mac_remo

CVE-2024-50263 [MEDIUM] CVE-2024-50263: linux - In the Linux kernel, the following vulnerability has been resolved: fork: only ... In the Linux kernel, the following vulnerability has been resolved: fork: only invoke khugepaged, ksm hooks if no error There is no reason to invoke these hooks early against an mm that is in an incomplete state. The change in commit d24062914837 ("fork: use __mt_dup() to duplicate maple tree in dup_mmap()") makes this more pertinent as we may be in a state where en

CVE-2024-50157 [MEDIUM] CVE-2024-50157: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_r... In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop Driver waits indefinitely for the fifo occupancy to go below a threshold as soon as the pacing interrupt is received. This can cause soft lockup on one of the processors, if the rate of DB is very high. Add a loop count for FPGA and exit

CVE-2024-48873 [MEDIUM] CVE-2024-48873: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89... In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: check return value of ieee80211_probereq_get() for RNR The return value of ieee80211_probereq_get() might be NULL, so check it before using to avoid NULL pointer access. Addresses-Coverity-ID: 1529805 ("Dereference null return value") Scope: local bookworm: resolved bullseye: resolved f

CVE-2024-46706 [MEDIUM] CVE-2024-46706: linux - In the Linux kernel, the following vulnerability has been resolved: tty: serial... In the Linux kernel, the following vulnerability has been resolved: tty: serial: fsl_lpuart: mark last busy before uart_add_one_port With "earlycon initcall_debug=1 loglevel=8" in bootargs, kernel sometimes boot hang. It is because normal console still is not ready, but runtime suspend is called, so early console putchar will hang in waiting TRDE set in UARTSTAT. Th

CVE-2024-35993 [MEDIUM] CVE-2024-35993: linux - In the Linux kernel, the following vulnerability has been resolved: mm: turn fo... In the Linux kernel, the following vulnerability has been resolved: mm: turn folio_test_hugetlb into a PageType The current folio_test_hugetlb() can be fooled by a concurrent folio split into returning true for a folio which has never belonged to hugetlbfs. This can't happen if the caller holds a refcount on it, but we have a few places (memory-failure, compaction,