Debian Linux vulnerabilities

CVE-2022-50269 [MEDIUM] CVE-2022-50269: linux - In the Linux kernel, the following vulnerability has been resolved: drm/vkms: F... In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix memory leak in vkms_init() A memory leak was reported after the vkms module install failed. unreferenced object 0xffff88810bc28520 (size 16): comm "modprobe", pid 9662, jiffies 4298009455 (age 42.590s) hex dump (first 16 bytes): 01 01 00 64 81 88 ff ff 00 00 dc 0a 81 88 ff ff ...d.....

CVE-2022-50319 [MEDIUM] CVE-2022-50319: linux - In the Linux kernel, the following vulnerability has been resolved: coresight: ... In the Linux kernel, the following vulnerability has been resolved: coresight: trbe: remove cpuhp instance node before remove cpuhp state cpuhp_state_add_instance() and cpuhp_state_remove_instance() should be used in pairs. Or there will lead to the warn on cpuhp_remove_multi_state() since the cpuhp_step list is not empty. The following is the error log with 'rmmod

CVE-2022-50438 [MEDIUM] CVE-2022-50438: linux - In the Linux kernel, the following vulnerability has been resolved: net: hinic:... In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix memory leak when reading function table When the input parameter idx meets the expected case option in hinic_dbg_get_func_table(), read_data is not released. Fix it. Scope: local bookworm: resolved (fixed in 6.0.7-1) bullseye: resolved (fixed in 5.10.158-1) forky: resolved (fixed in

CVE-2022-50524 [MEDIUM] CVE-2022-50524: linux - In the Linux kernel, the following vulnerability has been resolved: iommu/media... In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: Check return value after calling platform_get_resource() platform_get_resource() may return NULL pointer, we need check its return value to avoid null-ptr-deref in resource_size(). Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved forky: resolved (fixed in 6.1.4-1

CVE-2022-50267 [MEDIUM] CVE-2022-50267: linux - In the Linux kernel, the following vulnerability has been resolved: mmc: rtsx_p... In the Linux kernel, the following vulnerability has been resolved: mmc: rtsx_pci: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the re

CVE-2022-50340 [MEDIUM] CVE-2022-50340: linux - In the Linux kernel, the following vulnerability has been resolved: media: vimc... In the Linux kernel, the following vulnerability has been resolved: media: vimc: Fix wrong function called when vimc_init() fails In vimc_init(), when platform_driver_register(&vimc_pdrv) fails, platform_driver_unregister(&vimc_pdrv) is wrongly called rather than platform_device_unregister(&vimc_pdev), which causes kernel warning: Unexpected driver unregister! WARNI

CVE-2022-50293 [MEDIUM] CVE-2022-50293: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: do n... In the Linux kernel, the following vulnerability has been resolved: btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range If we get -ENOMEM while dropping file extent items in a given range, at btrfs_drop_extents(), due to failure to allocate memory when attempting to increment the reference count for an extent or drop the reference count, we handl

CVE-2025-39800 [MEDIUM] CVE-2025-39800: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: abor... In the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() If we find an unexpected generation for the extent buffer we are cloning at btrfs_copy_root(), we just WARN_ON() and don't error out and abort the transaction, meaning we allow to persist metadata with an unexpected generation

CVE-2025-39707 [MEDIUM] CVE-2025-39707: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities HUBBUB structure is not initialized on DCE hardware, so check if it is NULL to avoid null dereference while accessing amdgpu_dm_capabilities file in debugfs. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 6.1

CVE-2025-39762 [MEDIUM] CVE-2025-39762: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: add null check [WHY] Prevents null pointer dereferences to enhance function robustness [HOW] Adds early null check and return false if invalid. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 6.16.3-1) sid: resolved (fixed in 6.16.3-1) trixie: open

CVE-2025-38541 [MEDIUM] CVE-2025-38541: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mt76:... In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() devm_kasprintf() returns NULL on error. Currently, mt7925_thermal_init() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue. Scope: local bookworm: reso

CVE-2023-53168 [MEDIUM] CVE-2023-53168: linux - In the Linux kernel, the following vulnerability has been resolved: usb: ucsi_a... In the Linux kernel, the following vulnerability has been resolved: usb: ucsi_acpi: Increase the command completion timeout Commit 130a96d698d7 ("usb: typec: ucsi: acpi: Increase command completion timeout value") increased the timeout from 5 seconds to 60 seconds due to issues related to alternate mode discovery. After the alternate mode discovery switch to polled

CVE-2023-53209 [MEDIUM] CVE-2023-53209: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80... In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: Fix possible NULL dereference In a call to mac80211_hwsim_select_tx_link() the sta pointer might be NULL, thus need to check that it is not NULL before accessing it. Scope: local bookworm: resolved (fixed in 6.1.52-1) bullseye: resolved forky: resolved (fixed in 6.4.11-1) sid:

CVE-2023-53177 [MEDIUM] CVE-2023-53177: linux - In the Linux kernel, the following vulnerability has been resolved: media: hi84... In the Linux kernel, the following vulnerability has been resolved: media: hi846: fix usage of pm_runtime_get_if_in_use() pm_runtime_get_if_in_use() does not only return nonzero values when the device is in use, it can return a negative errno too. And especially during resuming from system suspend, when runtime pm is not yet up again, -EAGAIN is being returned, so t

CVE-2023-53207 [MEDIUM] CVE-2023-53207: linux - In the Linux kernel, the following vulnerability has been resolved: ublk: fail ... In the Linux kernel, the following vulnerability has been resolved: ublk: fail to recover device if queue setup is interrupted In ublk_ctrl_end_recovery(), if wait_for_completion_interruptible() is interrupted by signal, queues aren't setup successfully yet, so we have to fail UBLK_CMD_END_USER_RECOVERY, otherwise kernel oops can be triggered. Scope: local bookworm:

CVE-2023-53483 [MEDIUM] CVE-2023-53483: linux - In the Linux kernel, the following vulnerability has been resolved: ACPI: proce... In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Check for null return of devm_kzalloc() in fch_misc_setup() devm_kzalloc() may fail, clk_data->name might be NULL and will cause a NULL pointer dereference later. [ rjw: Subject and changelog edits ] Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved forky: resol

CVE-2023-53181 [MEDIUM] CVE-2023-53181: linux - In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma... In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-resv: Stop leaking on krealloc() failure Currently dma_resv_get_fences() will leak the previously allocated array if the fence iteration got restarted and the krealloc_array() fails. Free the old array by hand, and make sure we still clear the returned *fences so the caller won't end up

CVE-2022-50331 [MEDIUM] CVE-2022-50331: linux - In the Linux kernel, the following vulnerability has been resolved: wwan_hwsim:... In the Linux kernel, the following vulnerability has been resolved: wwan_hwsim: fix possible memory leak in wwan_hwsim_dev_new() Inject fault while probing module, if device_register() fails, but the refcount of kobject is not decreased to 0, the name allocated in dev_set_name() is leaked. Fix this by calling put_device(), so that name can be freed in callback funct

CVE-2022-50287 [MEDIUM] CVE-2022-50287: linux - In the Linux kernel, the following vulnerability has been resolved: drm/i915/bi... In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: fix a memory leak in generate_lfp_data_ptrs When (size != 0 || ptrs->lvds_ entries != 3), the program tries to free() the ptrs. However, the ptrs is not created by calling kzmalloc(), but is obtained by pointer offset operation. This may lead to memory leaks or undefined behavior. Fix

CVE-2022-50539 [MEDIUM] CVE-2022-50539: linux - In the Linux kernel, the following vulnerability has been resolved: ARM: OMAP2+... In the Linux kernel, the following vulnerability has been resolved: ARM: OMAP2+: omap4-common: Fix refcount leak bug In omap4_sram_init(), of_find_compatible_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. Scope: local bookworm: resolved (fixed in 6.1.20-1) bullseye: open forky: resolved (fixed in