Debian Linux vulnerabilities

CVE-2025-38471 [HIGH] CVE-2025-38471: linux - In the Linux kernel, the following vulnerability has been resolved: tls: always... In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old skb when checking if all skbs in the queue have matching decrypt state and geometry. BUG: KASAN: slab-use-after-f

CVE-2022-48919 [HIGH] CVE-2022-48919: linux - In the Linux kernel, the following vulnerability has been resolved: cifs: fix d... In the Linux kernel, the following vulnerability has been resolved: cifs: fix double free race when mount fails in cifs_get_root() When cifs_get_root() fails during cifs_smb3_do_mount() we call deactivate_locked_super() which eventually will call delayed_free() which will free the context. In this situation we should not proceed to enter the out: section in cifs_smb3_

CVE-2021-47427 [HIGH] CVE-2021-47427: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi... In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi: Fix iscsi_task use after free Commit d39df158518c ("scsi: iscsi: Have abort handler get ref to conn") added iscsi_get_conn()/iscsi_put_conn() calls during abort handling but then also changed the handling of the case where we detect an already completed task where we now end up doing a go

CVE-2024-46796 [HIGH] CVE-2024-46796: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2_set_path_size() If smb2_compound_op() is called with a valid @cfile and returned -EINVAL, we need to call cifs_get_writable_path() before retrying it as the reference of @cfile was already dropped by previous call. This fixes the following KASAN splat when

CVE-2023-3111 [HIGH] CVE-2023-3111: linux - A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relo... A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag(). Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 5.19.6-1) sid: resolved (fix

CVE-2021-20226 [HIGH] CVE-2021-20226: linux - A use-after-free flaw was found in the io_uring in Linux kernel, where a local a... A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem on the system The issue results from the lack of validating the existence of an object prior to performing operations on the object by not incrementing the file reference counter while in use. The highest threat from thi

CVE-2017-15868 [HIGH] CVE-2017-15868: linux - The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kerne... The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel before 3.19 does not ensure that an l2cap socket is available, which allows local users to gain privileges via a crafted application. Scope: local bookworm: resolved (fixed in 4.0.2-1) bullseye: resolved (fixed in 4.0.2-1) forky: resolved (fixed in 4.0.2-1) sid: resolved (fixed in 4.0.2-

CVE-2019-15927 [HIGH] CVE-2019-15927: linux - An issue was discovered in the Linux kernel before 4.20.2. An out-of-bounds acce... An issue was discovered in the Linux kernel before 4.20.2. An out-of-bounds access exists in the function build_audio_procunit in the file sound/usb/mixer.c. Scope: local bookworm: resolved (fixed in 4.19.16-1) bullseye: resolved (fixed in 4.19.16-1) forky: resolved (fixed in 4.19.16-1) sid: resolved (fixed in 4.19.16-1) trixie: resolved (fixed in 4.19.16-1)

CVE-2017-11473 [HIGH] CVE-2017-11473: linux - Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi... Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux kernel through 3.2 allows local users to gain privileges via a crafted ACPI table. Scope: local bookworm: resolved (fixed in 4.13.4-1) bullseye: resolved (fixed in 4.13.4-1) forky: resolved (fixed in 4.13.4-1) sid: resolved (fixed in 4.13.4-1) trixie: resolved (fixed i

CVE-2021-38160 [HIGH] CVE-2021-38160: linux - In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corrupt... In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE: the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anom

CVE-2025-38211 [HIGH] CVE-2025-38211: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: ... In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction The commit 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") simplified cm_id resource management by freeing cm_id once all references to the cm_id were removed. The references are removed either upon completion of iw_c

CVE-2019-19252 [HIGH] CVE-2019-19252: linux - vcs_write in drivers/tty/vt/vc_screen.c in the Linux kernel through 5.3.13 does ... vcs_write in drivers/tty/vt/vc_screen.c in the Linux kernel through 5.3.13 does not prevent write access to vcsu devices, aka CID-0c9acb1af77a. Scope: local bookworm: resolved (fixed in 5.4.6-1) bullseye: resolved (fixed in 5.4.6-1) forky: resolved (fixed in 5.4.6-1) sid: resolved (fixed in 5.4.6-1) trixie: resolved (fixed in 5.4.6-1)

CVE-2023-26606 [HIGH] CVE-2023-26606: linux - In the Linux kernel 6.0.8, there is a use-after-free in ntfs_trim_fs in fs/ntfs3... In the Linux kernel 6.0.8, there is a use-after-free in ntfs_trim_fs in fs/ntfs3/bitmap.c. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved forky: resolved (fixed in 6.1.4-1) sid: resolved (fixed in 6.1.4-1) trixie: resolved (fixed in 6.1.4-1)

CVE-2025-21735 [HIGH] CVE-2025-21735: linux - In the Linux kernel, the following vulnerability has been resolved: NFC: nci: A... In the Linux kernel, the following vulnerability has been resolved: NFC: nci: Add bounds checking in nci_hci_create_pipe() The "pipe" variable is a u8 which comes from the network. If it's more than 127, then it results in memory corruption in the caller, nci_hci_connect_gate(). Scope: local bookworm: resolved (fixed in 6.1.129-1) bullseye: resolved (fixed in 5.10.237

CVE-2021-28952 [HIGH] CVE-2021-28952: linux - An issue was discovered in the Linux kernel through 5.11.8. The sound/soc/qcom/s... An issue was discovered in the Linux kernel through 5.11.8. The sound/soc/qcom/sdm845.c soundwire device driver has a buffer overflow when an unexpected port ID number is encountered, aka CID-1c668e1c0a0f. (This has been fixed in 5.12-rc4.) Scope: local bookworm: resolved (fixed in 5.10.26-1) bullseye: resolved (fixed in 5.10.26-1) forky: resolved (fixed in 5.10.26-1)

CVE-2022-49023 [HIGH] CVE-2022-49023: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80... In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix buffer overflow in elem comparison For vendor elements, the code here assumes that 5 octets are present without checking. Since the element itself is already checked to fit, we only need to check the length. Scope: local bookworm: resolved (fixed in 6.0.12-1) bullseye: resolved (fi

CVE-2021-42252 [HIGH] CVE-2021-42252: linux - An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc... An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a certain comparison uses values that are not memory sizes. Scope: l

CVE-2025-37952 [HIGH] CVE-2025-37952: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix UAF in __close_file_table_ids A use-after-free is possible if one thread destroys the file via __ksmbd_close_fd while another thread holds a reference to it. The existing checks on fp->refcount are not sufficient to prevent this. The fix takes ft->lock around the section which removes the f

CVE-2022-50241 [HIGH] CVE-2022-50241: linux - In the Linux kernel, the following vulnerability has been resolved: NFSD: fix u... In the Linux kernel, the following vulnerability has been resolved: NFSD: fix use-after-free on source server when doing inter-server copy Use-after-free occurred when the laundromat tried to free expired cpntf_state entry on the s2s_cp_stateids list after inter-server copy completed. The sc_cp_list that the expired copy state was inserted on was already freed. When C

CVE-2024-50264 [HIGH] CVE-2024-50264: linux - In the Linux kernel, the following vulnerability has been resolved: vsock/virti... In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans During loopback communication, a dangling pointer can be created in vsk->trans, potentially leading to a Use-After-Free condition. This issue is resolved by initializing vsk->trans to NULL. Scope: local bookworm: resolved (fi