Debian Linux vulnerabilities

CVE-2025-39699 [MEDIUM] CVE-2025-39699: linux - In the Linux kernel, the following vulnerability has been resolved: iommu/riscv... In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: prevent NULL deref in iova_to_phys The riscv_iommu_pte_fetch() function returns either NULL for unmapped/never-mapped iova, or a valid leaf pte pointer that requires no further validation. riscv_iommu_iova_to_phys() failed to handle NULL returns. Prevent null pointer dereference in risc

CVE-2025-39690 [MEDIUM] CVE-2025-39690: linux - In the Linux kernel, the following vulnerability has been resolved: iio: accel:... In the Linux kernel, the following vulnerability has been resolved: iio: accel: sca3300: fix uninitialized iio scan data Fix potential leak of uninitialized stack data to userspace by ensuring that the `channels` array is zeroed before use. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.16.5-1) sid: resolved (fixed in 6.16.5-1) trixie

CVE-2023-53571 [MEDIUM] CVE-2023-53571: linux - In the Linux kernel, the following vulnerability has been resolved: drm/i915: M... In the Linux kernel, the following vulnerability has been resolved: drm/i915: Make intel_get_crtc_new_encoder() less oopsy The point of the WARN was to print something, not oops straight up. Currently that is precisely what happens if we can't find the connector for the crtc in the atomic state. Get the dev pointer from the atomic state instead of the potentially NU

CVE-2025-38489 [MEDIUM] CVE-2025-38489: linux - In the Linux kernel, the following vulnerability has been resolved: s390/bpf: F... In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again Commit 7ded842b356d ("s390/bpf: Fix bpf_plt pointer arithmetic") has accidentally removed the critical piece of commit c730fce7c70c ("s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL"), causing intermittent kernel panics in e.g.

CVE-2023-53255 [MEDIUM] CVE-2023-53255: linux - In the Linux kernel, the following vulnerability has been resolved: firmware: s... In the Linux kernel, the following vulnerability has been resolved: firmware: stratix10-svc: Fix a potential resource leak in svc_create_memory_pool() svc_create_memory_pool() is only called from stratix10_svc_drv_probe(). Most of resources in the probe are managed, but not this memremap() call. There is also no memunmap() call in the file. So switch to devm_memrema

CVE-2023-53425 [MEDIUM] CVE-2023-53425: linux - In the Linux kernel, the following vulnerability has been resolved: media: plat... In the Linux kernel, the following vulnerability has been resolved: media: platform: mediatek: vpu: fix NULL ptr dereference If pdev is NULL, then it is still dereferenced. This fixes this smatch warning: drivers/media/platform/mediatek/vpu/mtk_vpu.c:570 vpu_load_firmware() warn: address of NULL pointer 'pdev' Scope: local bookworm: resolved (fixed in 6.1.52-1) bull

CVE-2023-53437 [MEDIUM] CVE-2023-53437: linux - In the Linux kernel, the following vulnerability has been resolved: media: uvcv... In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Handle cameras with invalid descriptors If the source entity does not contain any pads, do not create a link. Scope: local bookworm: resolved (fixed in 6.1.20-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.20-1) sid: resolved (fixed in 6.1.20-1) trixie: re

CVE-2023-53302 [MEDIUM] CVE-2023-53302: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: iwl49... In the Linux kernel, the following vulnerability has been resolved: wifi: iwl4965: Add missing check for create_singlethread_workqueue() Add the check for the return value of the create_singlethread_workqueue() in order to avoid NULL pointer dereference. Scope: local bookworm: resolved (fixed in 6.1.20-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fix

CVE-2023-53603 [MEDIUM] CVE-2023-53603: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: qla2x... In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid fcport pointer dereference Klocwork reported warning of NULL pointer may be dereferenced. The routine exits when sa_ctl is NULL and fcport is allocated after the exit call thus causing NULL fcport pointer to dereference at the time of exit. To avoid fcport pointer dereference, e

CVE-2023-53288 [MEDIUM] CVE-2023-53288: linux - In the Linux kernel, the following vulnerability has been resolved: drm/client:... In the Linux kernel, the following vulnerability has been resolved: drm/client: Fix memory leak in drm_client_modeset_probe When a new mode is set to modeset->mode, the previous mode should be freed. This fixes the following kmemleak report: drm_mode_duplicate+0x45/0x220 [drm] drm_client_modeset_probe+0x944/0xf50 [drm] __drm_fb_helper_initial_config_and_unlock+0xb4/

CVE-2023-53568 [MEDIUM] CVE-2023-53568: linux - In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt... In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: don't leak memory if dev_set_name() fails When dev_set_name() fails, zcdn_create() doesn't free the newly allocated resources. Do it. Scope: local bookworm: resolved (fixed in 6.1.55-1) bullseye: resolved (fixed in 5.10.197-1) forky: resolved (fixed in 6.5.6-1) sid: resolved (fixed in 6

CVE-2023-53324 [MEDIUM] CVE-2023-53324: linux - In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp... In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Don't leak some plane state Apparently no one noticed that mdp5 plane states leak like a sieve ever since we introduced plane_state->commit refcount a few years ago in 21a01abbe32a ("drm/atomic: Fix freeing connector/plane state too early by tracking commits, v3.") Fix it by using the

CVE-2025-39829 [MEDIUM] CVE-2025-39829: linux - In the Linux kernel, the following vulnerability has been resolved: trace/fgrap... In the Linux kernel, the following vulnerability has been resolved: trace/fgraph: Fix the warning caused by missing unregister notifier This warning was triggered during testing on v6.16: notifier callback ftrace_suspend_notifier_call already registered WARNING: CPU: 2 PID: 86 at kernel/notifier.c:23 notifier_chain_register+0x44/0xb0 ... Call Trace: blocking_notifie

CVE-2025-39899 [MEDIUM] CVE-2025-39899: linux - In the Linux kernel, the following vulnerability has been resolved: mm/userfaul... In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE With CONFIG_HIGHPTE on 32-bit ARM, move_pages_pte() maps PTE pages using kmap_local_page(), which requires unmapping in Last-In-First-Out order. The current code maps dst_pte first, then src_pte, but unmaps them in the same order (dst_p

CVE-2025-39852 [MEDIUM] CVE-2025-39852: linux - In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fi... In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 When tcp_ao_copy_all_matching() fails in tcp_v6_syn_recv_sock() it just exits the function. This ends up causing a memory-leak: unreferenced object 0xffff0000281a8200 (size 2496): comm "softirq", pid 0, jiffies 4295174684 hex dump (

CVE-2023-53602 [MEDIUM] CVE-2023-53602: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ath11... In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix memory leak in WMI firmware stats Memory allocated for firmware pdev, vdev and beacon statistics are not released during rmmod. Fix it by calling ath11k_fw_stats_free() function before hardware unregister. While at it, avoid calling ath11k_fw_stats_free() while processing the firmw

CVE-2023-53681 [MEDIUM] CVE-2023-53681: linux - In the Linux kernel, the following vulnerability has been resolved: bcache: Fix... In the Linux kernel, the following vulnerability has been resolved: bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent In some specific situations, the return value of __bch_btree_node_alloc may be NULL. This may lead to a potential NULL pointer dereference in caller function like a calling chain : btree_split->bch_btree_node_alloc->__bch_btr

CVE-2023-53605 [MEDIUM] CVE-2023-53605: linux - In the Linux kernel, the following vulnerability has been resolved: drm: amd: d... In the Linux kernel, the following vulnerability has been resolved: drm: amd: display: Fix memory leakage This commit fixes memory leakage in dc_construct_ctx() function. Scope: local bookworm: resolved (fixed in 6.1.20-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.20-1) sid: resolved (fixed in 6.1.20-1) trixie: resolved (fixed in 6.1.20-

CVE-2023-53666 [MEDIUM] CVE-2023-53666: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: codec... In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd938x: fix missing mbhc init error handling MBHC initialisation can fail so add the missing error handling to avoid dereferencing an error pointer when later configuring the jack: Unable to handle kernel paging request at virtual address fffffffffffffff8 pc : wcd_mbhc_start+0x28/0x38

CVE-2023-53250 [MEDIUM] CVE-2023-53250: linux - In the Linux kernel, the following vulnerability has been resolved: firmware: d... In the Linux kernel, the following vulnerability has been resolved: firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle KASAN reported a null-ptr-deref error: KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 1373 Comm: modprobe Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:dmi_sysfs_entry_release .