Debian Linux vulnerabilities

CVE-2024-43865 [MEDIUM] CVE-2024-43865: linux - In the Linux kernel, the following vulnerability has been resolved: s390/fpu: R... In the Linux kernel, the following vulnerability has been resolved: s390/fpu: Re-add exception handling in load_fpu_state() With the recent rewrite of the fpu code exception handling for the lfpc instruction within load_fpu_state() was erroneously removed. Add it again to prevent that loading invalid floating point register values cause an unhandled specification ex

CVE-2022-49746 [MEDIUM] CVE-2022-49746: linux - In the Linux kernel, the following vulnerability has been resolved: dmaengine: ... In the Linux kernel, the following vulnerability has been resolved: dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init If the function sdma_load_context() fails, the sdma_desc will be freed, but the allocated desc->bd is forgot to be freed. We already met the sdma_load_context() failure case and the log as below: [ 450.699064] imx-sdma 30bd0000.dm

CVE-2022-49751 [MEDIUM] CVE-2022-49751: linux - In the Linux kernel, the following vulnerability has been resolved: w1: fix WAR... In the Linux kernel, the following vulnerability has been resolved: w1: fix WARNING after calling w1_process() I got the following WARNING message while removing driver(ds2482): ------------[ cut here ]------------ do not call blocking ops when !TASK_RUNNING; state=1 set at [] w1_process+0x9e/0x1d0 [wire] WARNING: CPU: 0 PID: 262 at kernel/sched/core.c:9817 __might_

CVE-2021-47484 [MEDIUM] CVE-2021-47484: linux - In the Linux kernel, the following vulnerability has been resolved: octeontx2-a... In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Fix possible null pointer dereference. This patch fixes possible null pointer dereference in files "rvu_debugfs.c" and "rvu_nix.c" Scope: local bookworm: resolved (fixed in 5.14.16-1) bullseye: open forky: resolved (fixed in 5.14.16-1) sid: resolved (fixed in 5.14.16-1) trixie: resolve

CVE-2025-38326 [MEDIUM] CVE-2025-38326: linux - In the Linux kernel, the following vulnerability has been resolved: aoe: clean ... In the Linux kernel, the following vulnerability has been resolved: aoe: clean device rq_list in aoedev_downdev() An aoe device's rq_list contains accepted block requests that are waiting to be transmitted to the aoe target. This queue was added as part of the conversion to blk_mq. However, the queue was not cleaned out when an aoe device is downed which caused blk_

CVE-2024-26722 [MEDIUM] CVE-2024-26722: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: rt564... In the Linux kernel, the following vulnerability has been resolved: ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work() There is a path in rt5645_jack_detect_work(), where rt5645->jd_mutex is left locked forever. That may lead to deadlock when rt5645_jack_detect_work() is called for the second time. Found by Linux Verification Center (linuxtesting.org) with SVAC

CVE-2024-41063 [MEDIUM] CVE-2024-41063: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: cancel all works upon hci_unregister_dev() syzbot is reporting that calling hci_release_dev() from hci_error_reset() due to hci_dev_put() from hci_error_reset() can cause deadlock at destroy_workqueue(), for hci_error_reset() is called from hdev->req_workqueue which destroy_work

CVE-2023-52583 [MEDIUM] CVE-2023-52583: linux - In the Linux kernel, the following vulnerability has been resolved: ceph: fix d... In the Linux kernel, the following vulnerability has been resolved: ceph: fix deadlock or deadcode of misusing dget() The lock order is incorrect between denty and its parent, we should always make sure that the parent get the lock first. But since this deadcode is never used and the parent dir will always be set from the callers, let's just remove it. Scope: local

CVE-2022-49741 [MEDIUM] CVE-2022-49741: linux - In the Linux kernel, the following vulnerability has been resolved: fbdev: smsc... In the Linux kernel, the following vulnerability has been resolved: fbdev: smscufx: fix error handling code in ufx_usb_probe The current error handling code in ufx_usb_probe have many unmatching issues, e.g., missing ufx_free_usb_list, destroy_modedb label should only include framebuffer_release, fb_dealloc_cmap only matches fb_alloc_cmap. My local syzkaller reports

CVE-2025-21749 [MEDIUM] CVE-2025-21749: linux - In the Linux kernel, the following vulnerability has been resolved: net: rose: ... In the Linux kernel, the following vulnerability has been resolved: net: rose: lock the socket in rose_bind() syzbot reported a soft lockup in rose_loopback_timer(), with a repro calling bind() from multiple threads. rose_bind() must lock the socket to avoid this issue. Scope: local bookworm: resolved (fixed in 6.1.129-1) bullseye: resolved (fixed in 5.10.237-1) for

CVE-2025-22016 [MEDIUM] CVE-2025-22016: linux - In the Linux kernel, the following vulnerability has been resolved: dpll: fix x... In the Linux kernel, the following vulnerability has been resolved: dpll: fix xa_alloc_cyclic() error handling In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will be returned, which will cause IS_ERR() to be false. Which can lead to dereference not allocated pointer (pin). Fix it by checking if err is lower than zero. This wasn't found in real u

CVE-2024-52560 [MEDIUM] CVE-2024-52560: linux - In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: M... In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr() Extended the `mi_enum_attr()` function interface with an additional parameter, `struct ntfs_inode *ni`, to allow marking the inode as bad as soon as an error is detected. Scope: local bookworm: open bullseye: resolved forky: res

CVE-2025-22117 [MEDIUM] CVE-2025-22117: linux - In the Linux kernel, the following vulnerability has been resolved: ice: fix us... In the Linux kernel, the following vulnerability has been resolved: ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() Fix using the untrusted value of proto->raw.pkt_len in function ice_vc_fdir_parse_raw() by verifying if it does not exceed the VIRTCHNL_MAX_SIZE_RAW_PACKET value. Scope: local bookworm: resolved bullseye: resolved forky: resolved (

CVE-2024-47662 [MEDIUM] CVE-2024-47662: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove register from DCN35 DMCUB diagnostic collection [Why] These registers should not be read from driver and triggering the security violation when DMCUB work times out and diagnostics are collected blocks Z8 entry. [How] Remove the register read from DCN35. Scope: local bookworm

CVE-2024-45019 [MEDIUM] CVE-2024-45019: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: ... In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Take state lock during tx timeout reporter mlx5e_safe_reopen_channels() requires the state lock taken. The referenced changed in the Fixes tag removed the lock to fix another issue. This patch adds it back but at a later point (when calling mlx5e_safe_reopen_channels()) to avoid the deadl

CVE-2024-35806 [MEDIUM] CVE-2024-35806: linux - In the Linux kernel, the following vulnerability has been resolved: soc: fsl: q... In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: Always disable interrupts when taking cgr_lock smp_call_function_single disables IRQs when executing the callback. To prevent deadlocks, we must disable IRQs when taking cgr_lock elsewhere. This is already done by qman_update_cgr and qman_delete_cgr; fix the other lockers. Scope: lo

CVE-2024-50068 [MEDIUM] CVE-2024-50068: linux - In the Linux kernel, the following vulnerability has been resolved: mm/damon/te... In the Linux kernel, the following vulnerability has been resolved: mm/damon/tests/sysfs-kunit.h: fix memory leak in damon_sysfs_test_add_targets() The sysfs_target->regions allocated in damon_sysfs_regions_alloc() is not freed in damon_sysfs_test_add_targets(), which cause the following memory leak, free it to fix it. unreferenced object 0xffffff80c2a8db80 (size 96

CVE-2023-53540 [MEDIUM] CVE-2023-53540: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80... In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: reject auth/assoc to AP with our address If the AP uses our own address as its MLD address or BSSID, then clearly something's wrong. Reject such connections so we don't try and fail later. Scope: local bookworm: resolved (fixed in 6.1.55-1) bullseye: open forky: resolved (fixed in 6.

CVE-2022-49747 [MEDIUM] CVE-2022-49747: linux - In the Linux kernel, the following vulnerability has been resolved: erofs/zmap.... In the Linux kernel, the following vulnerability has been resolved: erofs/zmap.c: Fix incorrect offset calculation Effective offset to add to length was being incorrectly calculated, which resulted in iomap->length being set to 0, triggering a WARN_ON in iomap_iter_done(). Fix that, and describe it in comments. This was reported as a crash by syzbot under an issue a

CVE-2024-58080 [MEDIUM] CVE-2024-58080: linux - In the Linux kernel, the following vulnerability has been resolved: clk: qcom: ... In the Linux kernel, the following vulnerability has been resolved: clk: qcom: dispcc-sm6350: Add missing parent_map for a clock If a clk_rcg2 has a parent, it should also have parent_map defined, otherwise we'll get a NULL pointer dereference when calling clk_set_rate like the following: [ 3.388105] Call trace: [ 3.390664] qcom_find_src_index+0x3c/0x70 (P) [ 3.3953