Debian Linux vulnerabilities

CVE-2026-23174 [LOW] CVE-2026-23174: linux - In the Linux kernel, the following vulnerability has been resolved: nvme-pci: h... In the Linux kernel, the following vulnerability has been resolved: nvme-pci: handle changing device dma map requirements The initial state of dma_needs_unmap may be false, but change to true while mapping the data iterator. Enabling swiotlb is one such case that can change the result. The nvme driver needs to save the mapped dma vectors to be unmapped later, so alloca

CVE-2025-68281 [LOW] CVE-2025-68281: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA:... In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list "struct sdca_control" declares "values" field as integer array. But the memory allocated to it is of char array. This causes crash for sdca_parse_function API. This patch addresses the issue by allocating correct data size. Scope: local bookwo

CVE-2023-54030 CVE-2023-54030: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/ne... In the Linux kernel, the following vulnerability has been resolved: io_uring/net: don't overflow multishot recv Don't allow overflowing multishot recv CQEs, it might get out of hand, hurt performance, and in the worst case scenario OOM the task. Scope: local bookworm: open bullseye: resolved forky: resolved (fixed in 6.5.3-1) sid: resolved (fixed in 6.5.3-1) trixie: resolved

CVE-2014-3184 [MEDIUM] CVE-2014-3184: linux - The report_fixup functions in the HID subsystem in the Linux kernel before 3.16.... The report_fixup functions in the HID subsystem in the Linux kernel before 3.16.2 might allow physically proximate attackers to cause a denial of service (out-of-bounds write) via a crafted device that provides a small report descriptor, related to (1) drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c, (5) dr

CVE-2026-23044 [LOW] CVE-2026-23044: linux - In the Linux kernel, the following vulnerability has been resolved: PM: hiberna... In the Linux kernel, the following vulnerability has been resolved: PM: hibernate: Fix crash when freeing invalid crypto compressor When crypto_alloc_acomp() fails, it returns an ERR_PTR value, not NULL. The cleanup code in save_compressed_image() and load_compressed_image() unconditionally calls crypto_free_acomp() without checking for ERR_PTR, which causes crypto_aco

CVE-2026-23041 [LOW] CVE-2026-23041: linux - In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fi... In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup When bnxt_init_one() fails during initialization (e.g., bnxt_init_int_mode returns -ENODEV), the error path calls bnxt_free_hwrm_resources() which destroys the DMA pool and sets bp->hwrm_dma_pool to NULL. Subsequently, bnxt_ptp_cle

CVE-2026-23249 [LOW] CVE-2026-23249: linux - In the Linux kernel, the following vulnerability has been resolved: xfs: check ... In the Linux kernel, the following vulnerability has been resolved: xfs: check for deleted cursors when revalidating two btrees The free space and inode btree repair functions will rebuild both btrees at the same time, after which it needs to evaluate both btrees to confirm that the corruptions are gone. However, Jiaming Zhang ran syzbot and produced a crash in the sec

CVE-2026-23365 CVE-2026-23365: linux - In the Linux kernel, the following vulnerability has been resolved: net: usb: k... In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: validate USB endpoints The kalmia driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the driver will crash later on when it blindly accesses these e

CVE-2026-23439 CVE-2026-23439: linux - In the Linux kernel, the following vulnerability has been resolved: udp_tunnel:... In the Linux kernel, the following vulnerability has been resolved: udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n When CONFIG_IPV6 is disabled, the udp_sock_create6() function returns 0 (success) without actually creating a socket. Callers such as fou_create() then proceed to dereference the uninitialized socket pointer, resulting in a NULL pointer

CVE-2026-23446 CVE-2026-23446: linux - In the Linux kernel, the following vulnerability has been resolved: net: usb: a... In the Linux kernel, the following vulnerability has been resolved: net: usb: aqc111: Do not perform PM inside suspend callback syzbot reports "task hung in rpm_resume" This is caused by aqc111_suspend calling the PM variant of its write_cmd routine. The simplified call trace looks like this: rpm_suspend() usb_suspend_both() - here udev->dev.power.runtime_status == RPM_SUSPE

CVE-2026-23290 CVE-2026-23290: linux - In the Linux kernel, the following vulnerability has been resolved: net: usb: p... In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: validate USB endpoints The pegasus driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the driver will crash later on when it blindly accesses these

CVE-2026-23300 CVE-2026-23300: linux - In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ... In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop When a standalone IPv6 nexthop object is created with a loopback device (e.g., "ip -6 nexthop add id 100 dev lo"), fib6_nh_init() misclassifies it as a reject route. This is because nexthop objects have no destination prefix (fc_dst=::), c

CVE-2020-4788 [MEDIUM] CVE-2020-4788: linux - IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to o... IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296. Scope: local bookworm: resolved (fixed in 5.9.11-1) bullseye: resolved (fixed in 5.9.11-1) forky: resolved (fixed in 5.9.11-1) sid: resolved (fixed in 5.9.11-1) trixie: resolv

CVE-2026-23286 CVE-2026-23286: linux - In the Linux kernel, the following vulnerability has been resolved: atm: lec: f... In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix null-ptr-deref in lec_arp_clear_vccs syzkaller reported a null-ptr-deref in lec_arp_clear_vccs(). This issue can be easily reproduced using the syzkaller reproducer. In the ATM LANE (LAN Emulation) module, the same atm_vcc can be shared by multiple lec_arp_table entries (e.g., via entry->vcc or

CVE-2026-23352 CVE-2026-23352: linux - In the Linux kernel, the following vulnerability has been resolved: x86/efi: de... In the Linux kernel, the following vulnerability has been resolved: x86/efi: defer freeing of boot services memory efi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE and EFI_BOOT_SERVICES_DATA using memblock_free_late(). There are two issue with that: memblock_free_late() should be used for memory allocated with memblock_alloc() while the memory reserve

CVE-2026-23438 CVE-2026-23438: linux - In the Linux kernel, the following vulnerability has been resolved: net: mvpp2:... In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: guard flow control update with global_tx_fc in buffer switching mvpp2_bm_switch_buffers() unconditionally calls mvpp2_bm_pool_update_priv_fc() when switching between per-cpu and shared buffer pool modes. This function programs CM3 flow control registers via mvpp2_cm3_read()/mvpp2_cm3_write(), whi

CVE-2025-71239 [LOW] CVE-2025-71239: linux - In the Linux kernel, the following vulnerability has been resolved: audit: add ... In the Linux kernel, the following vulnerability has been resolved: audit: add fchmodat2() to change attributes class fchmodat2(), introduced in version 6.6 is currently not in the change attribute class of audit. Calling fchmodat2() to change a file attribute in the same fashion than chmod() or fchmodat() will bypass audit rules such as: -w /tmp/test -p rwa -k test_rw

CVE-2026-23309 [LOW] CVE-2026-23309: linux - In the Linux kernel, the following vulnerability has been resolved: tracing: Ad... In the Linux kernel, the following vulnerability has been resolved: tracing: Add NULL pointer check to trigger_data_free() If trigger_data_alloc() fails and returns NULL, event_hist_trigger_parse() jumps to the out_free error path. While kfree() safely handles a NULL pointer, trigger_data_free() does not. This causes a NULL pointer dereference in trigger_data_free() wh

CVE-2026-23310 CVE-2026-23310: linux - In the Linux kernel, the following vulnerability has been resolved: bpf/bonding... In the Linux kernel, the following vulnerability has been resolved: bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded bond_option_mode_set() already rejects mode changes that would make a loaded XDP program incompatible via bond_xdp_check(). However, bond_option_xmit_hash_policy_set() has no such guard. For 802.3ad and balance-xor modes, bond_xdp_che

CVE-2026-23367 CVE-2026-23367: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: radio... In the Linux kernel, the following vulnerability has been resolved: wifi: radiotap: reject radiotap with unknown bits The radiotap parser is currently only used with the radiotap namespace (not with vendor namespaces), but if the undefined field 18 is used, the alignment/size is unknown as well. In this case, iterator->_next_ns_data isn't initialized (it's only set for skipp