Debian Linux vulnerabilities

CVE-2022-50510 [MEDIUM] CVE-2022-50510: linux - In the Linux kernel, the following vulnerability has been resolved: perf/smmuv3... In the Linux kernel, the following vulnerability has been resolved: perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() arm_smmu_pmu_init() won't remove the callback added by cpuhp_setup_state_multi() when platform_driver_register() failed. Remove the callback by cpuhp_remove_multi_state() in fail path. Similar to the handling of arm_ccn_init() in commit 2

CVE-2022-50402 [MEDIUM] CVE-2022-50402: linux - In the Linux kernel, the following vulnerability has been resolved: drivers/md/... In the Linux kernel, the following vulnerability has been resolved: drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() Check the return value of md_bitmap_get_counter() in case it returns NULL pointer, which will result in a null pointer dereference. v2: update the check to include other dereference Scope: local bookworm: resolved (fixed in 6.1.

CVE-2022-50352 [MEDIUM] CVE-2022-50352: linux - In the Linux kernel, the following vulnerability has been resolved: net: hns: f... In the Linux kernel, the following vulnerability has been resolved: net: hns: fix possible memory leak in hnae_ae_register() Inject fault while probing module, if device_register() fails, but the refcount of kobject is not decreased to 0, the name allocated in dev_set_name() is leaked. Fix this by calling put_device(), so that name can be freed in callback function

CVE-2025-39838 [MEDIUM] CVE-2025-39838: linux - In the Linux kernel, the following vulnerability has been resolved: cifs: preve... In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unchecked to cifs_strndup_to_utf16, which in turn passes it to cifs_local_to_utf16_bytes where '*from' is dereferenced,

CVE-2025-21908 [MEDIUM] CVE-2025-21908: linux - In the Linux kernel, the following vulnerability has been resolved: NFS: fix nf... In the Linux kernel, the following vulnerability has been resolved: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback Add PF_KCOMPACTD flag and current_is_kcompactd() helper to check for it so nfs_release_folio() can skip calling nfs_wb_folio() from kcompactd. Otherwise NFS can deadlock waiting for kcompactd enduced writeback which recurses back t

CVE-2025-39753 [MEDIUM] CVE-2025-39753: linux - In the Linux kernel, the following vulnerability has been resolved: gfs2: Set .... In the Linux kernel, the following vulnerability has been resolved: gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops Clears up the warning added in 7ee3647243e5 ("migrate: Remove call to ->writepage") that occurs in various xfstests, causing "something found in dmesg" failures. [ 341.136573] gfs2_meta_aops does not implement migrate_folio [ 341.136953] WARNING: CPU

CVE-2024-53086 [MEDIUM] CVE-2024-53086: linux - In the Linux kernel, the following vulnerability has been resolved: drm/xe: Dro... In the Linux kernel, the following vulnerability has been resolved: drm/xe: Drop VM dma-resv lock on xe_sync_in_fence_get failure in exec IOCTL Upon failure all locks need to be dropped before returning to the user. (cherry picked from commit 7d1a4258e602ffdce529f56686925034c1b3b095) Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.11.9

CVE-2023-53150 [MEDIUM] CVE-2023-53150: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: qla2x... In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Pointer may be dereferenced Klocwork tool reported pointer 'rport' returned from call to function fc_bsg_to_rport() may be NULL and will be dereferenced. Add a fix to validate rport before dereferencing. Scope: local bookworm: resolved (fixed in 6.1.52-1) bullseye: resolved (fixed in

CVE-2023-53223 [MEDIUM] CVE-2023-53223: linux - In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi... In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue as it may return NULL pointer and cause NULL pointer dereference. Patchwork: https://patchwork.freedesktop.org/patch/517646/ Scope: local bookworm: resolved (fixed in 6.1.20-1) bullse

CVE-2023-53277 [MEDIUM] CVE-2023-53277: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: iwl39... In the Linux kernel, the following vulnerability has been resolved: wifi: iwl3945: Add missing check for create_singlethread_workqueue Add the check for the return value of the create_singlethread_workqueue in order to avoid NULL pointer dereference. Scope: local bookworm: resolved (fixed in 6.1.20-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed i

CVE-2023-53476 [MEDIUM] CVE-2023-53476: linux - In the Linux kernel, the following vulnerability has been resolved: iw_cxgb4: F... In the Linux kernel, the following vulnerability has been resolved: iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() This condition needs to match the previous "if (epcp->state == LISTEN) {" exactly to avoid a NULL dereference of either "listen_ep" or "ep". The problem is that "epcp" has been re-assigned so just testing "if (epcp->state == LIS

CVE-2023-53375 [MEDIUM] CVE-2023-53375: linux - In the Linux kernel, the following vulnerability has been resolved: tracing: Fr... In the Linux kernel, the following vulnerability has been resolved: tracing: Free error logs of tracing instances When a tracing instance is removed, the error messages that hold errors that occurred in the instance needs to be freed. The following reports a memory leak: # cd /sys/kernel/tracing # mkdir instances/foo # echo 'hist:keys=x' > instances/foo/events/sched

CVE-2023-53498 [MEDIUM] CVE-2023-53498: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential null dereference The adev->dm.dc pointer can be NULL and dereferenced in amdgpu_dm_fini() without checking. Add a NULL pointer check before calling dc_dmub_srv_destroy(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Scope: local bookworm: resolved

CVE-2023-53164 [MEDIUM] CVE-2023-53164: linux - In the Linux kernel, the following vulnerability has been resolved: irqchip/ti-... In the Linux kernel, the following vulnerability has been resolved: irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak. Scope: local bookworm: resolved (fixed in 6.1.20-1) bu

CVE-2023-53239 [MEDIUM] CVE-2023-53239: linux - In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp... In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Add check for kzalloc As kzalloc may fail and return NULL pointer, it should be better to check the return value in order to avoid the NULL pointer dereference. Patchwork: https://patchwork.freedesktop.org/patch/514154/ Scope: local bookworm: resolved (fixed in 6.1.20-1) bullseye: reso

CVE-2023-53318 [MEDIUM] CVE-2023-53318: linux - In the Linux kernel, the following vulnerability has been resolved: recordmcoun... In the Linux kernel, the following vulnerability has been resolved: recordmcount: Fix memory leaks in the uwrite function Common realloc mistake: 'file_append' nulled but not freed upon failure Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 6.3.7-1) sid: resolved (fixed in 6.3.7-1) trixie: resol

CVE-2023-53191 [MEDIUM] CVE-2023-53191: linux - In the Linux kernel, the following vulnerability has been resolved: irqchip/alp... In the Linux kernel, the following vulnerability has been resolved: irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak. Scope: local bookworm: resolved (fixed in 6.1.20-1) bu

CVE-2022-50465 [MEDIUM] CVE-2022-50465: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: fix l... In the Linux kernel, the following vulnerability has been resolved: ext4: fix leaking uninitialized memory in fast-commit journal When space at the end of fast-commit journal blocks is unused, make sure to zero it out so that uninitialized memory is not leaked to disk. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixed in 5.10.178-1) forky:

CVE-2022-50480 [MEDIUM] CVE-2022-50480: linux - In the Linux kernel, the following vulnerability has been resolved: memory: pl3... In the Linux kernel, the following vulnerability has been resolved: memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe() The break of for_each_available_child_of_node() needs a corresponding of_node_put() when the reference 'child' is not used anymore. Here we do not need to call of_node_put() in fail path as '!match' means no break. While the of_platform_d

CVE-2022-50327 [MEDIUM] CVE-2022-50327: linux - In the Linux kernel, the following vulnerability has been resolved: ACPI: proce... In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value The return value of acpi_fetch_acpi_dev() could be NULL, which would cause a NULL pointer dereference to occur in acpi_device_hid(). [ rjw: Subject and changelog edits, added empty line after if () ] Scope: local bookworm: resolved (fix