Debian Linux vulnerabilities

CVE-2022-1652 [HIGH] CVE-2022-1652: linux - Linux Kernel could allow a local attacker to execute arbitrary code on the syste... Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system. Scope: local bookworm: resolved (fixed in 5.17.1

CVE-2024-27405 [HIGH] CVE-2024-27405: linux - In the Linux kernel, the following vulnerability has been resolved: usb: gadget... In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs It is observed sometimes when tethering is used over NCM with Windows 11 as host, at some instances, the gadget_giveback has one byte appended at the end of a proper NTB. When the NTB is parsed, unwrap call looks for any leftover bytes

CVE-2018-10902 [HIGH] CVE-2018-10902: linux - It was found that the raw midi kernel driver does not protect against concurrent... It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation. Scope: local bookworm: resolved

CVE-2019-25045 [HIGH] CVE-2019-25045: linux - An issue was discovered in the Linux kernel before 5.0.19. The XFRM subsystem ha... An issue was discovered in the Linux kernel before 5.0.19. The XFRM subsystem has a use-after-free, related to an xfrm_state_fini panic, aka CID-dbb2483b2a46. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved (fixed in 5.2.6-1) sid: resolved (fixed in 5.2.6-1) trixie: resolved (fixed in 5.2.6-1)

CVE-2018-8781 [HIGH] CVE-2018-8781: linux - The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c at the Linux kernel ver... The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c at the Linux kernel version 3.4 and up to and including 4.15 has an integer-overflow vulnerability allowing local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space. Scope: local bookworm: resolved (fixed in 4.1

CVE-2020-1749 [HIGH] CVE-2020-1749: linux - A flaw was found in the Linux kernel's implementation of some networking protoco... A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending the data unencrypted. This would allow anyone in between the two endpoints to read the traf

CVE-2021-43057 [HIGH] CVE-2021-43057: linux - An issue was discovered in the Linux kernel before 5.14.8. A use-after-free in s... An issue was discovered in the Linux kernel before 5.14.8. A use-after-free in selinux_ptrace_traceme (aka the SELinux handler for PTRACE_TRACEME) could be used by local attackers to cause memory corruption and escalate privileges, aka CID-a3727a8bac0a. This occurs because of an attempt to access the subjective credentials of another task. Scope: local bookworm: resol

CVE-2021-47103 [HIGH] CVE-2021-47103: linux - In the Linux kernel, the following vulnerability has been resolved: inet: fully... In the Linux kernel, the following vulnerability has been resolved: inet: fully convert sk->sk_rx_dst to RCU rules syzbot reported various issues around early demux, one being included in this changelog [1] sk->sk_rx_dst is using RCU protection without clearly documenting it. And following sequences in tcp_v4_do_rcv()/tcp_v6_do_rcv() are not following standard RCU rul

CVE-2023-3111 [HIGH] CVE-2023-3111: linux - A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relo... A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag(). Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 5.19.6-1) sid: resolved (fix

CVE-2021-20226 [HIGH] CVE-2021-20226: linux - A use-after-free flaw was found in the io_uring in Linux kernel, where a local a... A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem on the system The issue results from the lack of validating the existence of an object prior to performing operations on the object by not incrementing the file reference counter while in use. The highest threat from thi

CVE-2017-15868 [HIGH] CVE-2017-15868: linux - The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kerne... The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel before 3.19 does not ensure that an l2cap socket is available, which allows local users to gain privileges via a crafted application. Scope: local bookworm: resolved (fixed in 4.0.2-1) bullseye: resolved (fixed in 4.0.2-1) forky: resolved (fixed in 4.0.2-1) sid: resolved (fixed in 4.0.2-

CVE-2019-19252 [HIGH] CVE-2019-19252: linux - vcs_write in drivers/tty/vt/vc_screen.c in the Linux kernel through 5.3.13 does ... vcs_write in drivers/tty/vt/vc_screen.c in the Linux kernel through 5.3.13 does not prevent write access to vcsu devices, aka CID-0c9acb1af77a. Scope: local bookworm: resolved (fixed in 5.4.6-1) bullseye: resolved (fixed in 5.4.6-1) forky: resolved (fixed in 5.4.6-1) sid: resolved (fixed in 5.4.6-1) trixie: resolved (fixed in 5.4.6-1)

CVE-2019-15927 [HIGH] CVE-2019-15927: linux - An issue was discovered in the Linux kernel before 4.20.2. An out-of-bounds acce... An issue was discovered in the Linux kernel before 4.20.2. An out-of-bounds access exists in the function build_audio_procunit in the file sound/usb/mixer.c. Scope: local bookworm: resolved (fixed in 4.19.16-1) bullseye: resolved (fixed in 4.19.16-1) forky: resolved (fixed in 4.19.16-1) sid: resolved (fixed in 4.19.16-1) trixie: resolved (fixed in 4.19.16-1)

CVE-2017-11473 [HIGH] CVE-2017-11473: linux - Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi... Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux kernel through 3.2 allows local users to gain privileges via a crafted ACPI table. Scope: local bookworm: resolved (fixed in 4.13.4-1) bullseye: resolved (fixed in 4.13.4-1) forky: resolved (fixed in 4.13.4-1) sid: resolved (fixed in 4.13.4-1) trixie: resolved (fixed i

CVE-2025-38146 [HIGH] CVE-2025-38146: linux - In the Linux kernel, the following vulnerability has been resolved: net: openvs... In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix the dead loop of MPLS parse The unexpected MPLS packet may not end with the bottom label stack. When there are many stacks, The label count value has wrapped around. A dead loop occurs, soft lockup/CPU stuck finally. stack backtrace: UBSAN: array-index-out-of-bounds in /build/lin

CVE-2024-53141 [HIGH] CVE-2024-53141: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add missing range check in bitmap_ip_uadt When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists, the values of ip and ip_to are slightly swapped. Therefore, the range check for ip should be done later, but this part is missing and it seems that the vulnerability occ

CVE-2021-38160 [HIGH] CVE-2021-38160: linux - In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corrupt... In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE: the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anom

CVE-2023-26606 [HIGH] CVE-2023-26606: linux - In the Linux kernel 6.0.8, there is a use-after-free in ntfs_trim_fs in fs/ntfs3... In the Linux kernel 6.0.8, there is a use-after-free in ntfs_trim_fs in fs/ntfs3/bitmap.c. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved forky: resolved (fixed in 6.1.4-1) sid: resolved (fixed in 6.1.4-1) trixie: resolved (fixed in 6.1.4-1)

CVE-2025-38471 [HIGH] CVE-2025-38471: linux - In the Linux kernel, the following vulnerability has been resolved: tls: always... In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old skb when checking if all skbs in the queue have matching decrypt state and geometry. BUG: KASAN: slab-use-after-f

CVE-2023-52441 [HIGH] CVE-2023-52441: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds in init_smb2_rsp_hdr() If client send smb2 negotiate request and then send smb1 negotiate request, init_smb2_rsp_hdr is called for smb1 negotiate request since need_neg is set to false. This patch ignore smb1 packets after ->need_neg is set to false. Scope: local bookworm: res