Debian Linux vulnerabilities

CVE-2025-40011 CVE-2025-40011: linux - In the Linux kernel, the following vulnerability has been resolved: drm/gma500:... In the Linux kernel, the following vulnerability has been resolved: drm/gma500: Fix null dereference in hdmi teardown pci_set_drvdata sets the value of pdev->driver_data to NULL, after which the driver_data obtained from the same dev is dereferenced in oaktrail_hdmi_i2c_exit, and the i2c_dev is extracted from it. To prevent this, swap these calls. Found by Linux Verification

CVE-2023-53840 CVE-2023-53840: linux - In the Linux kernel, the following vulnerability has been resolved: usb: early:... In the Linux kernel, the following vulnerability has been resolved: usb: early: xhci-dbc: Fix a potential out-of-bound memory access If xdbc_bulk_write() fails, the values in 'buf' can be anything. So the string is not guaranteed to be NULL terminated when xdbc_trace() is called. Reserve an extra byte, which will be zeroed automatically because 'buf' is a static variable, in

CVE-2023-53833 CVE-2023-53833: linux - In the Linux kernel, the following vulnerability has been resolved: drm/i915: F... In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix NULL ptr deref by checking new_crtc_state intel_atomic_get_new_crtc_state can return NULL, unless crtc state wasn't obtained previously with intel_atomic_get_crtc_state, so we must check it for NULLness here, just as in many other places, where we can't guarantee that intel_atomic_get_crtc_stat

CVE-2019-19524 [MEDIUM] CVE-2019-19524: linux - In the Linux kernel before 5.3.12, there is a use-after-free bug that can be cau... In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memless.c driver, aka CID-fa3a5a1880c9. Scope: local bookworm: resolved (fixed in 5.3.15-1) bullseye: resolved (fixed in 5.3.15-1) forky: resolved (fixed in 5.3.15-1) sid: resolved (fixed in 5.3.15-1) trixie: resolved (fixed in 5.3.15

CVE-2025-40013 CVE-2025-40013: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom:... In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: audioreach: fix potential null pointer dereference It is possible that the topology parsing function audioreach_widget_load_module_common() could return NULL or an error pointer. Add missing NULL check so that we do not dereference it. Scope: local bookworm: resolved (fixed in 6.1.158-1) bullseye

CVE-2022-50566 CVE-2022-50566: linux - In the Linux kernel, the following vulnerability has been resolved: mtd: Fix de... In the Linux kernel, the following vulnerability has been resolved: mtd: Fix device name leak when register device failed in add_mtd_device() There is a kmemleak when register device failed: unreferenced object 0xffff888101aab550 (size 8): comm "insmod", pid 3922, jiffies 4295277753 (age 925.408s) hex dump (first 8 bytes): 6d 74 64 30 00 88 ff ff mtd0.... backtrace: [] __kma

CVE-2022-50576 CVE-2022-50576: linux - In the Linux kernel, the following vulnerability has been resolved: serial: pch... In the Linux kernel, the following vulnerability has been resolved: serial: pch: Fix PCI device refcount leak in pch_request_dma() As comment of pci_get_slot() says, it returns a pci_device with its refcount increased. The caller must decrement the reference count by calling pci_dev_put(). Since 'dma_dev' is only used to filter the channel in filter(), we can call pci_dev_pu

CVE-2022-49201 [MEDIUM] CVE-2022-49201: linux - In the Linux kernel, the following vulnerability has been resolved: ibmvnic: fi... In the Linux kernel, the following vulnerability has been resolved: ibmvnic: fix race between xmit and reset There is a race between reset and the transmit paths that can lead to ibmvnic_xmit() accessing an scrq after it has been freed in the reset path. It can result in a crash like: Kernel attempted to read user page (0) - exploit attempt? (uid: 0) BUG: Kernel NUL

CVE-2022-50777 CVE-2022-50777: linux - In the Linux kernel, the following vulnerability has been resolved: net: phy: x... In the Linux kernel, the following vulnerability has been resolved: net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe of_phy_find_device() return device node with refcount incremented. Call put_device() to relese it when not needed anymore. Scope: local bookworm: resolved (fixed in 6.1.7-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.

CVE-2022-50578 CVE-2022-50578: linux - In the Linux kernel, the following vulnerability has been resolved: class: fix ... In the Linux kernel, the following vulnerability has been resolved: class: fix possible memory leak in __class_register() If class_add_groups() returns error, the 'cp->subsys' need be unregister, and the 'cp' need be freed. We can not call kset_unregister() here, because the 'cls' will be freed in callback function class_release() and it's also freed in caller's error path,

CVE-2025-40146 CVE-2025-40146: linux - In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix... In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix potential deadlock while nr_requests grown Allocate and free sched_tags while queue is freezed can deadlock[1], this is a long term problem, hence allocate memory before freezing queue and free memory after queue is unfreezed. [1] https://lore.kernel.org/all/0659ea8d-a463-47c8-9180-43c719e106eb@l

CVE-2023-54091 CVE-2023-54091: linux - In the Linux kernel, the following vulnerability has been resolved: drm/client:... In the Linux kernel, the following vulnerability has been resolved: drm/client: Fix memory leak in drm_client_target_cloned dmt_mode is allocated and never freed in this function. It was found with the ast driver, but most drivers using generic fbdev setup are probably affected. This fixes the following kmemleak report: backtrace: [] drm_mode_duplicate+0x45/0x220 [drm] [] dr

CVE-2023-53848 CVE-2023-53848: linux - In the Linux kernel, the following vulnerability has been resolved: md/raid5-ca... In the Linux kernel, the following vulnerability has been resolved: md/raid5-cache: fix a deadlock in r5l_exit_log() Commit b13015af94cf ("md/raid5-cache: Clear conf->log after finishing work") introduce a new problem: // caller hold reconfig_mutex r5l_exit_log flush_work(&log->disable_writeback_work) r5c_disable_writeback_async wait_event /* * conf->log is not NULL, and mdd

CVE-2023-53852 CVE-2023-53852: linux - In the Linux kernel, the following vulnerability has been resolved: nvme-core: ... In the Linux kernel, the following vulnerability has been resolved: nvme-core: fix memory leak in dhchap_secret_store Free dhchap_secret in nvme_ctrl_dhchap_secret_store() before we return fix following kmemleack:- unreferenced object 0xffff8886376ea800 (size 64): comm "check", pid 22048, jiffies 4344316705 (age 92.199s) hex dump (first 32 bytes): 44 48 48 43 2d 31 3a 30 30

CVE-2023-53856 CVE-2023-53856: linux - In the Linux kernel, the following vulnerability has been resolved: of: overlay... In the Linux kernel, the following vulnerability has been resolved: of: overlay: Call of_changeset_init() early When of_overlay_fdt_apply() fails, the changeset may be partially applied, and the caller is still expected to call of_overlay_remove() to clean up this partial state. However, of_overlay_apply() calls of_resolve_phandles() before init_overlay_changeset(). Hence if

CVE-2022-50821 CVE-2022-50821: linux - In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Don... In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.4-1) sid: resolved (fixed in 6.1.4-1) trixie: resolved (fixed in 6.1.4-1)

CVE-2022-50770 CVE-2022-50770: linux - In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix ... In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix memory leak in ocfs2_mount_volume() There is a memory leak reported by kmemleak: unreferenced object 0xffff88810cc65e60 (size 32): comm "mount.ocfs2", pid 23753, jiffies 4302528942 (age 34735.105s) hex dump (first 32 bytes): 10 00 00 00 00 00 00 00 00 01 01 01 01 01 01 01 ................ 01 01 01

CVE-2025-40015 [LOW] CVE-2025-40015: linux - In the Linux kernel, the following vulnerability has been resolved: media: stm3... In the Linux kernel, the following vulnerability has been resolved: media: stm32-csi: Fix dereference before NULL check In 'stm32_csi_start', 'csidev->s_subdev' is dereferenced directly while assigning a value to the 'src_pad'. However the same value is being checked against NULL at a later point of time indicating that there are chances that the value can be NULL. Mov

CVE-2025-40219 CVE-2025-40219: linux - In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Fi... In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Fix race between SR-IOV enable/disable and hotplug Commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV") tried to fix a race between the VF removal inside sriov_del_vfs() and concurrent hot unplug by taking the PCI rescan/remove lock in sriov_del_vfs(). Simila

CVE-2025-40333 CVE-2025-40333: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: fix i... In the Linux kernel, the following vulnerability has been resolved: f2fs: fix infinite loop in __insert_extent_tree() When we get wrong extent info data, and look up extent_node in rb tree, it will cause infinite loop (CONFIG_F2FS_CHECK_FS=n). Avoiding this by return NULL and print some kernel messages in that case. Scope: local bookworm: open bullseye: open forky: resolved