Debian Linux vulnerabilities

CVE-2026-23147 [MEDIUM] CVE-2026-23147: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: zlib... In the Linux kernel, the following vulnerability has been resolved: btrfs: zlib: fix the folio leak on S390 hardware acceleration [BUG] After commit aa60fe12b4f4 ("btrfs: zlib: refactor S390x HW acceleration buffer preparation"), we no longer release the folio of the page cache of folio returned by btrfs_compress_filemap_get_folio() for S390 hardware acceleration pa

CVE-2026-23067 [MEDIUM] CVE-2026-23067: linux - In the Linux kernel, the following vulnerability has been resolved: iommu/io-pg... In the Linux kernel, the following vulnerability has been resolved: iommu/io-pgtable-arm: fix size_t signedness bug in unmap path __arm_lpae_unmap() returns size_t but was returning -ENOENT (negative error code) when encountering an unmapped PTE. Since size_t is unsigned, -ENOENT (typically -2) becomes a huge positive value (0xFFFFFFFFFFFFFFFE on 64-bit systems). Th

CVE-2025-38362 [MEDIUM] CVE-2025-38362: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null pointer check for get_first_active_display() The function mod_hdcp_hdcp1_enable_encryption() calls the function get_first_active_display(), but does not check its return value. The return value is a null pointer if the display list is empty. This will lead to a null pointer

CVE-2026-22987 [MEDIUM] CVE-2026-22987: linux - In the Linux kernel, the following vulnerability has been resolved: net/sched: ... In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy syzbot reported a crash in tc_act_in_hw() during netns teardown where tcf_idrinfo_destroy() passed an ERR_PTR(-EBUSY) value as a tc_action pointer, leading to an invalid dereference. Guard against ERR_PTR entries when iterating t

CVE-2026-23196 [MEDIUM] CVE-2026-23196: linux - In the Linux kernel, the following vulnerability has been resolved: HID: Intel-... In the Linux kernel, the following vulnerability has been resolved: HID: Intel-thc-hid: Intel-thc: Add safety check for reading DMA buffer Add DMA buffer readiness check before reading DMA buffer to avoid unexpected NULL pointer accessing. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.18.10-1) sid: resolved (fixed in 6.18.10-1) trixi

CVE-2026-23218 [MEDIUM] CVE-2026-23218: linux - In the Linux kernel, the following vulnerability has been resolved: gpio: loong... In the Linux kernel, the following vulnerability has been resolved: gpio: loongson-64bit: Fix incorrect NULL check after devm_kcalloc() Fix incorrect NULL check in loongson_gpio_init_irqchip(). The function checks chip->parent instead of chip->irq.parents. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.18.10-1) sid: resolved (fixed in

CVE-2026-23149 [MEDIUM] CVE-2026-23149: linux - In the Linux kernel, the following vulnerability has been resolved: drm: Do not... In the Linux kernel, the following vulnerability has been resolved: drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() Since GEM bo handles are u32 in the uapi and the internal implementation uses idr_alloc() which uses int ranges, passing a new handle larger than INT_MAX trivially triggers a kernel warning: idr_alloc(): ... if (

CVE-2026-23117 [MEDIUM] CVE-2026-23117: linux - In the Linux kernel, the following vulnerability has been resolved: ice: add mi... In the Linux kernel, the following vulnerability has been resolved: ice: add missing ice_deinit_hw() in devlink reinit path devlink-reload results in ice_init_hw failed error, and then removing the ice driver causes a NULL pointer dereference. [ +0.102213] ice 0000:ca:00.0: ice_init_hw failed: -16 ... [ +0.000001] Call Trace: [ +0.000003] [ +0.000006] ice_unload+0x8

CVE-2026-23197 [MEDIUM] CVE-2026-23197: linux - In the Linux kernel, the following vulnerability has been resolved: i2c: imx: p... In the Linux kernel, the following vulnerability has been resolved: i2c: imx: preserve error state in block data length handler When a block read returns an invalid length, zero or >I2C_SMBUS_BLOCK_MAX, the length handler sets the state to IMX_I2C_STATE_FAILED. However, i2c_imx_master_isr() unconditionally overwrites this with IMX_I2C_STATE_READ_CONTINUE, causing an

CVE-2025-68333 [MEDIUM] CVE-2025-68333: linux - In the Linux kernel, the following vulnerability has been resolved: sched_ext: ... In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix possible deadlock in the deferred_irq_workfn() For PREEMPT_RT=y kernels, the deferred_irq_workfn() is executed in the per-cpu irq_work/* task context and not disable-irq, if the rq returned by container_of() is current CPU's rq, the following scenarios may occur: lock(&rq->__lock); lo

CVE-2025-38158 [MEDIUM] CVE-2025-38158: linux - In the Linux kernel, the following vulnerability has been resolved: hisi_acc_vf... In the Linux kernel, the following vulnerability has been resolved: hisi_acc_vfio_pci: fix XQE dma address error The dma addresses of EQE and AEQE are wrong after migration and results in guest kernel-mode encryption services failure. Comparing the definition of hardware registers, we found that there was an error when the data read from the register was combined in

CVE-2022-50277 [MEDIUM] CVE-2022-50277: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: don't... In the Linux kernel, the following vulnerability has been resolved: ext4: don't allow journal inode to have encrypt flag Mounting a filesystem whose journal inode has the encrypt flag causes a NULL dereference in fscrypt_limit_io_blocks() when the 'inlinecrypt' mount option is used. The problem is that when jbd2_journal_init_inode() calls bmap(), it eventually finds

CVE-2025-71079 [MEDIUM] CVE-2025-71079: linux - In the Linux kernel, the following vulnerability has been resolved: net: nfc: f... In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write A deadlock can occur between nfc_unregister_device() and rfkill_fop_write() due to lock ordering inversion between device_lock and rfkill_global_mutex. The problematic lock order is: Thread A (rfkill_fop_write): rfkill_fop_wri

CVE-2020-16120 [MEDIUM] CVE-2020-16120: linux - Overlayfs did not properly perform permission checking when copying up files in ... Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a mountpoint controlled by the user, like a removable device. This was introdu

CVE-2016-2545 [MEDIUM] CVE-2016-2545: linux - The snd_timer_interrupt function in sound/core/timer.c in the Linux kernel befor... The snd_timer_interrupt function in sound/core/timer.c in the Linux kernel before 4.4.1 does not properly maintain a certain linked list, which allows local users to cause a denial of service (race condition and system crash) via a crafted ioctl call. Scope: local bookworm: resolved (fixed in 4.4.2-1) bullseye: resolved (fixed in 4.4.2-1) forky: resolved (fixed in 4.4

CVE-2016-6480 [MEDIUM] CVE-2016-6480: linux - Race condition in the ioctl_send_fib function in drivers/scsi/aacraid/commctrl.c... Race condition in the ioctl_send_fib function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value, aka a "double fetch" vulnerability. Scope: local bookworm: resolved (fixed in 4.7.2-1) bullseye: resolved (fixed in 4.7.2-1) forky: reso

CVE-2016-2544 [MEDIUM] CVE-2016-2544: linux - Race condition in the queue_delete function in sound/core/seq/seq_queue.c in the... Race condition in the queue_delete function in sound/core/seq/seq_queue.c in the Linux kernel before 4.4.1 allows local users to cause a denial of service (use-after-free and system crash) by making an ioctl call at a certain time. Scope: local bookworm: resolved (fixed in 4.4.2-1) bullseye: resolved (fixed in 4.4.2-1) forky: resolved (fixed in 4.4.2-1) sid: resolved

CVE-2024-26847 [MEDIUM] CVE-2024-26847: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/rta... In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: use correct function name for resetting TCE tables The PAPR spec spells the function name as "ibm,reset-pe-dma-windows" but in practice firmware uses the singular form: "ibm,reset-pe-dma-window" in the device tree. Since we have the wrong spelling in the RTAS function table, reverse lo

CVE-2024-1312 [MEDIUM] CVE-2024-1312: linux - A use-after-free flaw was found in the Linux kernel's Memory Management subsyste... A use-after-free flaw was found in the Linux kernel's Memory Management subsystem when a user wins two races at the same time with a fail in the mas_prev_slot function. This issue could allow a local user to crash the system. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.4.11-1) sid: resolved (fixed in 6.4.11-1) trixie: resolved (fixed

CVE-2023-52654 [MEDIUM] CVE-2023-52654: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/af... In the Linux kernel, the following vulnerability has been resolved: io_uring/af_unix: disable sending io_uring over sockets File reference cycles have caused lots of problems for io_uring in the past, and it still doesn't work exactly right and races with unix_stream_read_generic(). The safest fix would be to completely disallow sending io_uring files via sockets vi