Debian Linux vulnerabilities

CVE-2023-53002 [MEDIUM] CVE-2023-53002: linux - In the Linux kernel, the following vulnerability has been resolved: drm/i915: F... In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix a memory leak with reused mmap_offset drm_vma_node_allow() and drm_vma_node_revoke() should be called in balanced pairs. We call drm_vma_node_allow() once per-file everytime a user calls mmap_offset, but only call drm_vma_node_revoke once per-file on each mmap_offset. As the mmap_offse

CVE-2025-21774 [MEDIUM] CVE-2025-21774: linux - In the Linux kernel, the following vulnerability has been resolved: can: rockch... In the Linux kernel, the following vulnerability has been resolved: can: rockchip: rkcanfd_handle_rx_fifo_overflow_int(): bail out if skb cannot be allocated Fix NULL pointer check in rkcanfd_handle_rx_fifo_overflow_int() to bail out if skb cannot be allocated. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.12.16-1) sid: resolved (fix

CVE-2024-47703 [MEDIUM] CVE-2024-47703: linux - In the Linux kernel, the following vulnerability has been resolved: bpf, lsm: A... In the Linux kernel, the following vulnerability has been resolved: bpf, lsm: Add check for BPF LSM return value A bpf prog returning a positive number attached to file_alloc_security hook makes kernel panic. This happens because file system can not filter out the positive number returned by the LSM prog using IS_ERR, and misinterprets this positive number as a file

CVE-2024-50137 [MEDIUM] CVE-2024-50137: linux - In the Linux kernel, the following vulnerability has been resolved: reset: star... In the Linux kernel, the following vulnerability has been resolved: reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC data->asserted will be NULL on JH7110 SoC since commit 82327b127d41 ("reset: starfive: Add StarFive JH7110 reset driver") was added. Add the judgment condition to avoid errors when calling reset_control_status on JH7110 SoC. Scope

CVE-2024-57991 [MEDIUM] CVE-2024-57991: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89... In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: chan: fix soft lockup in rtw89_entity_recalc_mgnt_roles() During rtw89_entity_recalc_mgnt_roles(), there is a normalizing process which will re-order the list if an entry with target pattern is found. And once one is found, should have aborted the list_for_each_entry. But, `break` just

CVE-2024-57952 [MEDIUM] CVE-2024-57952: linux - In the Linux kernel, the following vulnerability has been resolved: Revert "lib... In the Linux kernel, the following vulnerability has been resolved: Revert "libfs: fix infinite directory reads for offset dir" The current directory offset allocator (based on mtree_alloc_cyclic) stores the next offset value to return in octx->next_offset. This mechanism typically returns values that increase monotonically over time. Eventually, though, the newly a

CVE-2024-57987 [MEDIUM] CVE-2024-57987: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() If insert an USB dongle which chip is not maintained in ic_id_table, it will hit the NULL point accessed. Add a null point check to avoid the Kernel Oops. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.12.13-1)

CVE-2022-48942 [MEDIUM] CVE-2022-48942: linux - In the Linux kernel, the following vulnerability has been resolved: hwmon: Hand... In the Linux kernel, the following vulnerability has been resolved: hwmon: Handle failure to register sensor with thermal zone correctly If an attempt is made to a sensor with a thermal zone and it fails, the call to devm_thermal_zone_of_sensor_register() may return -ENODEV. This may result in crashes similar to the following. Unable to handle kernel NULL pointer de

CVE-2022-3107 [MEDIUM] CVE-2022-3107: linux - An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool... An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the null pointer dereference. Scope: local bookworm: resolved (fixed in 5.16.18-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed in 5.16.18-1) sid: resolved (fixed

CVE-2022-3106 [MEDIUM] CVE-2022-3106: linux - An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats... An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats in drivers/net/ethernet/sfc/ef100_nic.c lacks check of the return value of kmalloc(). Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved (fixed in 5.10.92-1) forky: resolved (fixed in 5.15.15-1) sid: resolved (fixed in 5.15.15-1) trixie: resolved (fixed in 5.15.15-1)

CVE-2022-3105 [MEDIUM] CVE-2022-3105: linux - An issue was discovered in the Linux kernel through 5.16-rc6. uapi_finalize in d... An issue was discovered in the Linux kernel through 5.16-rc6. uapi_finalize in drivers/infiniband/core/uverbs_uapi.c lacks check of kmalloc_array(). Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved (fixed in 5.10.92-1) forky: resolved (fixed in 5.15.15-1) sid: resolved (fixed in 5.15.15-1) trixie: resolved (fixed in 5.15.15-1)

CVE-2022-3112 [MEDIUM] CVE-2022-3112: linux - An issue was discovered in the Linux kernel through 5.16-rc6. amvdec_set_canvase... An issue was discovered in the Linux kernel through 5.16-rc6. amvdec_set_canvases in drivers/staging/media/meson/vdec/vdec_helpers.c lacks check of the return value of kzalloc() and will cause the null pointer dereference. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed in 5.17.3-1) sid: resolved (fix

CVE-2025-21667 [MEDIUM] CVE-2025-21667: linux - In the Linux kernel, the following vulnerability has been resolved: iomap: avoi... In the Linux kernel, the following vulnerability has been resolved: iomap: avoid avoid truncating 64-bit offset to 32 bits on 32-bit kernels, iomap_write_delalloc_scan() was inadvertently using a 32-bit position due to folio_next_index() returning an unsigned long. This could lead to an infinite loop when writing to an xfs filesystem. Scope: local bookworm: resolved

CVE-2025-21847 [MEDIUM] CVE-2025-21847: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ... In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() The nullity of sps->cstream should be checked similarly as it is done in sof_set_stream_data_offset() function. Assuming that it is not NULL if sps->stream is NULL is incorrect and can lead to NULL pointer dereference. Scope: loc

CVE-2025-21857 [MEDIUM] CVE-2025-21857: linux - In the Linux kernel, the following vulnerability has been resolved: net/sched: ... In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: fix error handling causing NULL dereference tcf_exts_miss_cookie_base_alloc() calls xa_alloc_cyclic() which can return 1 if the allocation succeeded after wrapping. This was treated as an error, with value 1 returned to caller tcf_exts_init_ex() which sets exts->actions to NULL a

CVE-2024-44958 [MEDIUM] CVE-2024-44958: linux - In the Linux kernel, the following vulnerability has been resolved: sched/smt: ... In the Linux kernel, the following vulnerability has been resolved: sched/smt: Fix unbalance sched_smt_present dec/inc I got the following warn report while doing stress test: jump label: negative count! WARNING: CPU: 3 PID: 38 at kernel/jump_label.c:263 static_key_slow_try_dec+0x9d/0xb0 Call Trace: __static_key_slow_dec_cpuslocked+0x16/0x70 sched_cpu_deactivate+0x2

CVE-2024-50248 [MEDIUM] CVE-2024-50248: linux - In the Linux kernel, the following vulnerability has been resolved: ntfs3: Add ... In the Linux kernel, the following vulnerability has been resolved: ntfs3: Add bounds checking to mi_enum_attr() Added bounds checking to make sure that every attr don't stray beyond valid memory region. Scope: local bookworm: resolved (fixed in 6.1.123-1) bullseye: resolved forky: resolved (fixed in 6.11.7-1) sid: resolved (fixed in 6.11.7-1) trixie: resolved (fixe

CVE-2024-39470 [MEDIUM] CVE-2024-39470: linux - In the Linux kernel, the following vulnerability has been resolved: eventfs: Fi... In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix a possible null pointer dereference in eventfs_find_events() In function eventfs_find_events,there is a potential null pointer that may be caused by calling update_events_attr which will perform some operations on the members of the ei struct when ei is NULL. Hence,When ei->is_freed is

CVE-2022-48619 [MEDIUM] CVE-2022-48619: linux - An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17... An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause a denial of service (panic) because input_set_capability mishandles the situation in which an event code falls outside of a bitmap. Scope: local bookworm: resolved (fixed in 5.17.11-1) bullseye: resolved (fixed in 5.10.120-1) forky: resolved (fixed in 5.17.11-1

CVE-2021-47495 [MEDIUM] CVE-2021-47495: linux - In the Linux kernel, the following vulnerability has been resolved: usbnet: san... In the Linux kernel, the following vulnerability has been resolved: usbnet: sanity check for maxpacket maxpacket of 0 makes no sense and oopses as we need to divide by it. Give up. V2: fixed typo in log and stylistic issues Scope: local bookworm: resolved (fixed in 5.14.16-1) bullseye: resolved (fixed in 5.10.84-1) forky: resolved (fixed in 5.14.16-1) sid: resolved