Debian Linux vulnerabilities

CVE-2025-38438 [MEDIUM] CVE-2025-38438: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ... In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. sof_pdata->tplg_filename can have address allocated by kstrdup() and can be overwritten. Memory leak was detected with kmemleak: unreferenced object 0xffff88812391ff60 (size 16): comm "kworker/4:1", pid 161, jiffies 4294802931 hex dump (fir

CVE-2025-38390 [MEDIUM] CVE-2025-38390: linux - In the Linux kernel, the following vulnerability has been resolved: firmware: a... In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix memory leak by freeing notifier callback node Commit e0573444edbf ("firmware: arm_ffa: Add interfaces to request notification callbacks") adds support for notifier callbacks by allocating and inserting a callback node into a hashtable during registration of notifiers. However,

CVE-2025-38356 [MEDIUM] CVE-2025-38356: linux - In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc:... In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Explicitly exit CT safe mode on unwind During driver probe we might be briefly using CT safe mode, which is based on a delayed work, but usually we are able to stop this once we have IRQ fully operational. However, if we abort the probe quite early then during unwind we might try to dest

CVE-2022-50528 [MEDIUM] CVE-2022-50528: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd:... In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix memory leakage This patch fixes potential memory leakage and seg fault in _gpuvm_import_dmabuf() function Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved forky: resolved (fixed in 6.1.4-1) sid: resolved (fixed in 6.1.4-1) trixie: resolved (fixed in 6.1.4-1)

CVE-2025-39920 [MEDIUM] CVE-2025-39920: linux - In the Linux kernel, the following vulnerability has been resolved: pcmcia: Add... In the Linux kernel, the following vulnerability has been resolved: pcmcia: Add error handling for add_interval() in do_validate_mem() In the do_validate_mem(), the call to add_interval() does not handle errors. If kmalloc() fails in add_interval(), it could result in a null pointer being inserted into the linked list, leading to illegal memory access when sub_inter

CVE-2022-50474 [MEDIUM] CVE-2022-50474: linux - In the Linux kernel, the following vulnerability has been resolved: macintosh: ... In the Linux kernel, the following vulnerability has been resolved: macintosh: fix possible memory leak in macio_add_one_device() Afer commit 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array"), the name of device is allocated dynamically. It needs to be freed when of_device_register() fails. Call put_device() to give up the reference that's

CVE-2025-38195 [MEDIUM] CVE-2025-38195: linux - In the Linux kernel, the following vulnerability has been resolved: LoongArch: ... In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() ERROR INFO: CPU 25 Unable to handle kernel paging request at virtual address 0x0 ... Call Trace: [] huge_pte_offset+0x3c/0x58 [] hugetlb_follow_page_mask+0x74/0x438 [] __get_user_pages+0xe0/0x4c8 [] faultin_page_range+0x84/0x380 [] madvise

CVE-2025-38251 [MEDIUM] CVE-2025-38251: linux - In the Linux kernel, the following vulnerability has been resolved: atm: clip: ... In the Linux kernel, the following vulnerability has been resolved: atm: clip: prevent NULL deref in clip_push() Blamed commit missed that vcc_destroy_socket() calls clip_push() with a NULL skb. If clip_devs is NULL, clip_push() then crashes when reading skb->truesize. Scope: local bookworm: resolved (fixed in 6.1.147-1) bullseye: resolved (fixed in 5.10.244-1) fork

CVE-2025-39931 [MEDIUM] CVE-2025-39931: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: af_... In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Set merge to zero early in af_alg_sendmsg If an error causes af_alg_sendmsg to abort, ctx->merge may contain a garbage value from the previous loop. This may then trigger a crash on the next entry into af_alg_sendmsg when it attempts to do a merge that can't be done. Fix this by set

CVE-2025-38151 [MEDIUM] CVE-2025-38151: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: F... In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work The cited commit fixed a crash when cma_netevent_callback was called for a cma_id while work on that id from a previous call had not yet started. The work item was re-initialized in the second call, which corrupted the work item curre

CVE-2025-38208 [MEDIUM] CVE-2025-38208: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: add NULL check in automount_fullpath page is checked for null in __build_path_from_dentry_optional_prefix when tcon->origin_fullpath is not set. However, the check is missing when it is set. Add a check to prevent a potential NULL pointer dereference. Scope: local bookworm: resolved bul

CVE-2024-58074 [MEDIUM] CVE-2024-58074: linux - In the Linux kernel, the following vulnerability has been resolved: drm/i915: G... In the Linux kernel, the following vulnerability has been resolved: drm/i915: Grab intel_display from the encoder to avoid potential oopsies Grab the intel_display from 'encoder' rather than 'state' in the encoder hooks to avoid the massive footgun that is intel_sanitize_encoder(), which passes NULL as the 'state' argument to encoder .disable() and .post_disable().

CVE-2023-53313 [MEDIUM] CVE-2023-53313: linux - In the Linux kernel, the following vulnerability has been resolved: md/raid10: ... In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix wrong setting of max_corr_read_errors There is no input check when echo md/max_read_errors and overflow might occur. Add check of input number. Scope: local bookworm: resolved (fixed in 6.1.52-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 6.4.4-1) sid: resolved

CVE-2022-50519 [MEDIUM] CVE-2022-50519: linux - In the Linux kernel, the following vulnerability has been resolved: nilfs2: rep... In the Linux kernel, the following vulnerability has been resolved: nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure If creation or finalization of a checkpoint fails due to anomalies in the checkpoint metadata on disk, a kernel warning is generated. This patch replaces the WARN_ONs by nilfs_error, so that a kernel, booted with panic_on_war

CVE-2022-50505 [MEDIUM] CVE-2022-50505: linux - In the Linux kernel, the following vulnerability has been resolved: iommu/amd: ... In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix pci device refcount leak in ppr_notifier() As comment of pci_get_domain_bus_and_slot() says, it returns a pci device with refcount increment, when finish using it, the caller must decrement the reference count by calling pci_dev_put(). So call it before returning from ppr_notifier() t

CVE-2022-50347 [MEDIUM] CVE-2022-50347: linux - In the Linux kernel, the following vulnerability has been resolved: mmc: rtsx_u... In the Linux kernel, the following vulnerability has been resolved: mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking

CVE-2022-50509 [MEDIUM] CVE-2022-50509: linux - In the Linux kernel, the following vulnerability has been resolved: media: coda... In the Linux kernel, the following vulnerability has been resolved: media: coda: Add check for kmalloc As the kmalloc may return NULL pointer, it should be better to check the return value in order to avoid NULL poineter dereference, same as the others. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed

CVE-2025-39847 [MEDIUM] CVE-2025-39847: linux - In the Linux kernel, the following vulnerability has been resolved: ppp: fix me... In the Linux kernel, the following vulnerability has been resolved: ppp: fix memory leak in pad_compress_skb If alloc_skb() fails in pad_compress_skb(), it returns NULL without releasing the old skb. The caller does: skb = pad_compress_skb(ppp, skb); if (!skb) goto drop; drop: kfree_skb(skb); When pad_compress_skb() returns NULL, the reference to the old skb is lost

CVE-2025-38300 [MEDIUM] CVE-2025-38300: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: sun... In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() Fix two DMA cleanup issues on the error path in sun8i_ce_cipher_prepare(): 1] If dma_map_sg() fails for areq->dst, the device driver would try to free DMA memory it has not allocated in the first place. To fix this, on the "th

CVE-2025-38319 [MEDIUM] CVE-2025-38319: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/pp:... In the Linux kernel, the following vulnerability has been resolved: drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table The function atomctrl_initialize_mc_reg_table() and atomctrl_initialize_mc_reg_table_v2_2() does not check the return value of smu_atom_get_data_table(). If smu_atom_get_data_table() fails to retrieve vram_info, i