Debian Linux vulnerabilities

CVE-2024-26758 [MEDIUM] CVE-2024-26758: linux - In the Linux kernel, the following vulnerability has been resolved: md: Don't i... In the Linux kernel, the following vulnerability has been resolved: md: Don't ignore suspended array in md_check_recovery() mddev_suspend() never stop sync_thread, hence it doesn't make sense to ignore suspended array in md_check_recovery(), which might cause sync_thread can't be unregistered. After commit f52f5c71f3d4 ("md: fix stopping sync thread"), following han

CVE-2024-43909 [MEDIUM] CVE-2024-43909: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm: Fix the null pointer dereference for smu7 optimize the code to avoid pass a null pointer (hwmgr->backend) to function smu7_update_edc_leakage_table. Scope: local bookworm: resolved (fixed in 6.1.106-1) bullseye: open forky: resolved (fixed in 6.10.6-1) sid: resolved (fixed in 6.10.6-1

CVE-2024-57931 [MEDIUM] CVE-2024-57931: linux - In the Linux kernel, the following vulnerability has been resolved: selinux: ig... In the Linux kernel, the following vulnerability has been resolved: selinux: ignore unknown extended permissions When evaluating extended permissions, ignore unknown permissions instead of calling BUG(). This commit ensures that future permissions can be added without interfering with older kernels. Scope: local bookworm: resolved (fixed in 6.1.124-1) bullseye: reso

CVE-2024-44971 [MEDIUM] CVE-2024-44971: linux - In the Linux kernel, the following vulnerability has been resolved: net: dsa: b... In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() bcm_sf2_mdio_register() calls of_phy_find_device() and then phy_device_remove() in a loop to remove existing PHY devices. of_phy_find_device() eventually calls bus_find_device(), which calls get_device() on the returned struct

CVE-2024-56698 [MEDIUM] CVE-2024-56698: linux - In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: ... In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix looping of queued SG entries The dwc3_request->num_queued_sgs is decremented on completion. If a partially completed request is handled, then the dwc3_request->num_queued_sgs no longer reflects the total number of num_queued_sgs (it would be cleared). Correctly check the numbe

CVE-2024-38602 [MEDIUM] CVE-2024-38602: linux - In the Linux kernel, the following vulnerability has been resolved: ax25: Fix r... In the Linux kernel, the following vulnerability has been resolved: ax25: Fix reference count leak issues of ax25_dev The ax25_addr_ax25dev() and ax25_dev_device_down() exist a reference count leak issue of the object "ax25_dev". Memory leak issue in ax25_addr_ax25dev(): The reference count of the object "ax25_dev" can be increased multiple times in ax25_addr_ax25de

CVE-2025-21690 [MEDIUM] CVE-2025-21690: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: storv... In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service If there's a persistent error in the hypervisor, the SCSI warning for failed I/O can flood the kernel log and max out CPU utilization, preventing troubleshooting from the VM side. Ratelimit the warning so it doesn't DoS the VM. Sc

CVE-2025-21665 [MEDIUM] CVE-2025-21665: linux - In the Linux kernel, the following vulnerability has been resolved: filemap: av... In the Linux kernel, the following vulnerability has been resolved: filemap: avoid truncating 64-bit offset to 32 bits On 32-bit kernels, folio_seek_hole_data() was inadvertently truncating a 64-bit value to 32 bits, leading to a possible infinite loop when writing to an xfs filesystem. Scope: local bookworm: resolved (fixed in 6.1.128-1) bullseye: resolved forky: r

CVE-2024-38603 [MEDIUM] CVE-2024-38603: linux - In the Linux kernel, the following vulnerability has been resolved: drivers/per... In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset() pci_alloc_irq_vectors() allocates an irq vector. When devm_add_action() fails, the irq vector is not freed, which leads to a memory leak. Replace the devm_add_action with devm_add_action_or_reset to ensure the irq vector can be destro

CVE-2024-35945 [MEDIUM] CVE-2024-35945: linux - In the Linux kernel, the following vulnerability has been resolved: net: phy: p... In the Linux kernel, the following vulnerability has been resolved: net: phy: phy_device: Prevent nullptr exceptions on ISR If phydev->irq is set unconditionally, check for valid interrupt handler or fall back to polling mode to prevent nullptr exceptions in interrupt service routine. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 6.8.9-1) sid:

CVE-2024-39461 [MEDIUM] CVE-2024-39461: linux - In the Linux kernel, the following vulnerability has been resolved: clk: bcm: r... In the Linux kernel, the following vulnerability has been resolved: clk: bcm: rpi: Assign ->num before accessing ->hws Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") annotated the hws member of 'struct clk_hw_onecell_data' with __counted_by, which informs the bounds sanitizer about the number of elements in hws, so that it can war

CVE-2024-39464 [MEDIUM] CVE-2024-39464: linux - In the Linux kernel, the following vulnerability has been resolved: media: v4l:... In the Linux kernel, the following vulnerability has been resolved: media: v4l: async: Fix notifier list entry init struct v4l2_async_notifier has several list_head members, but only waiting_list and done_list are initialized. notifier_entry was kept 'zeroed' leading to an uninitialized list_head. This results in a NULL-pointer dereference if csi2_async_register() f

CVE-2024-39491 [MEDIUM] CVE-2024-39491: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: ... In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance The cs_dsp instance is initialized in the driver probe() so it should be freed in the driver remove(). Also fix a missing call to cs_dsp_remove() in the error path of cs35l56_hda_common_probe(). The call to cs_dsp_remove() was being done in the com

CVE-2024-49972 [MEDIUM] CVE-2024-49972: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Deallocate DML memory if allocation fails [Why] When DC state create DML memory allocation fails, memory is not deallocated subsequently, resulting in uninitialized structure that is not NULL. [How] Deallocate memory if DML memory allocation fails. Scope: local bookworm: resolved bu

CVE-2022-48856 [MEDIUM] CVE-2022-48856: linux - In the Linux kernel, the following vulnerability has been resolved: gianfar: et... In the Linux kernel, the following vulnerability has been resolved: gianfar: ethtool: Fix refcount leak in gfar_get_ts_info The of_find_compatible_node() function returns a node pointer with refcount incremented, We should use of_node_put() on it when done Add the missing of_node_put() to release the refcount. Scope: local bookworm: resolved (fixed in 5.16.18-1) bul

CVE-2024-35940 [MEDIUM] CVE-2024-35940: linux - In the Linux kernel, the following vulnerability has been resolved: pstore/zone... In the Linux kernel, the following vulnerability has been resolved: pstore/zone: Add a null pointer check to the psz_kmsg_read kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. Scope: local bookworm: resolved (fixed in 6.1.90-1) bullseye: resolved (fixe

CVE-2024-58012 [MEDIUM] CVE-2024-58012: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ... In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params Each cpu DAI should associate with a widget. However, the topology might not create the right number of DAI widgets for aggregated amps. And it will cause NULL pointer deference. Check that the DAI widget associated with the CPU DAI

CVE-2024-42307 [MEDIUM] CVE-2024-42307: linux - In the Linux kernel, the following vulnerability has been resolved: cifs: fix p... In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path Dan Carpenter reported a Smack static checker warning: fs/smb/client/cifsfs.c:1981 init_cifs() error: we previously assumed 'serverclose_wq' could be null (see line 1895) The patch which introduced the serverclose work

CVE-2024-43912 [MEDIUM] CVE-2024-43912: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: nl802... In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: disallow setting special AP channel widths Setting the AP channel width is meant for use with the normal 20/40/... MHz channel width progression, and switching around in S1G or narrow channels isn't supported. Disallow that. Scope: local bookworm: resolved (fixed in 6.1.106-1) bullsey

CVE-2024-43875 [MEDIUM] CVE-2024-43875: linux - In the Linux kernel, the following vulnerability has been resolved: PCI: endpoi... In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Clean up error handling in vpci_scan_bus() Smatch complains about inconsistent NULL checking in vpci_scan_bus(): drivers/pci/endpoint/functions/pci-epf-vntb.c:1024 vpci_scan_bus() error: we previously assumed 'vpci_bus' could be null (see line 1021) Instead of printing an error messag