Debian Linux vulnerabilities

CVE-2024-42287 [MEDIUM] CVE-2024-42287: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: qla2x... In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Complete command early within lock A crash was observed while performing NPIV and FW reset, BUG: kernel NULL pointer dereference, address: 000000000000001c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 1 PREEMPT_RT SMP NOP

CVE-2018-7995 [MEDIUM] CVE-2018-7995: linux - Race condition in the store_int_with_restart() function in arch/x86/kernel/cpu/m... Race condition in the store_int_with_restart() function in arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (panic) by leveraging root access to write to the check_interval file in a /sys/devices/system/machinecheck/machinecheck directory. NOTE: a third party has indicated that this report is not secur

CVE-2023-33288 [MEDIUM] CVE-2023-33288: linux - An issue was discovered in the Linux kernel before 6.2.9. A use-after-free was f... An issue was discovered in the Linux kernel before 6.2.9. A use-after-free was found in bq24190_remove in drivers/power/supply/bq24190_charger.c. It could allow a local attacker to crash the system due to a race condition. Scope: local bookworm: resolved (fixed in 6.1.25-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.25-1) sid: resolved (f

CVE-2023-52489 [MEDIUM] CVE-2023-52489: linux - In the Linux kernel, the following vulnerability has been resolved: mm/sparseme... In the Linux kernel, the following vulnerability has been resolved: mm/sparsemem: fix race in accessing memory_section->usage The below race is observed on a PFN which falls into the device memory region with the system memory configuration where PFN's are such that [ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL]. Since normal zone start and end pfn contains the device memory

CVE-2023-0468 [MEDIUM] CVE-2023-0468: linux - A use-after-free flaw was found in io_uring/poll.c in io_poll_check_events in th... A use-after-free flaw was found in io_uring/poll.c in io_poll_check_events in the io_uring subcomponent in the Linux Kernel due to a race condition of poll_refs. This flaw may cause a NULL pointer dereference. Scope: local bookworm: resolved (fixed in 6.0.12-1) bullseye: resolved forky: resolved (fixed in 6.0.12-1) sid: resolved (fixed in 6.0.12-1) trixie: resolved (f

CVE-2024-40905 [MEDIUM] CVE-2024-40905: linux - In the Linux kernel, the following vulnerability has been resolved: ipv6: fix p... In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible race in __fib6_drop_pcpu_from() syzbot found a race in __fib6_drop_pcpu_from() [1] If compiler reads more than once (*ppcpu_rt), second read could read NULL, if another cpu clears the value in rt6_get_pcpu_route(). Add a READ_ONCE() to prevent this race. Also add rcu_read_lock()/r

CVE-2020-27675 [MEDIUM] CVE-2020-27675: linux - An issue was discovered in the Linux kernel through 5.9.1, as used with Xen thro... An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device, aka CID-0

CVE-2016-6130 [MEDIUM] CVE-2016-6130: linux - Race condition in the sclp_ctl_ioctl_sccb function in drivers/s390/char/sclp_ctl... Race condition in the sclp_ctl_ioctl_sccb function in drivers/s390/char/sclp_ctl.c in the Linux kernel before 4.6 allows local users to obtain sensitive information from kernel memory by changing a certain length value, aka a "double fetch" vulnerability. Scope: local bookworm: resolved (fixed in 4.6.1-1) bullseye: resolved (fixed in 4.6.1-1) forky: resolved (fixed in

CVE-2022-50350 [MEDIUM] CVE-2022-50350: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: targe... In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix a race condition between login_work and the login thread In case a malicious initiator sends some random data immediately after a login PDU; the iscsi_target_sk_data_ready() callback will schedule the login_work and, at the same time, the negotiation may end without clearing

CVE-2014-4654 [MEDIUM] CVE-2014-4654: linux - The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implem... The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allows local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call. S

CVE-2024-46679 [MEDIUM] CVE-2024-46679: linux - In the Linux kernel, the following vulnerability has been resolved: ethtool: ch... In the Linux kernel, the following vulnerability has been resolved: ethtool: check device is present when getting link settings A sysfs reader can race with a device reset or removal, attempting to read device state when the device is not actually present. eg: [exception RIP: qed_get_current_link+17] #8 [ffffb9e4f2907c48] qede_get_link_ksettings at ffffffffc07a994a

CVE-2024-27415 [MEDIUM] CVE-2024-27415: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: confirm multicast packets before passing them up the stack conntrack nf_confirm logic cannot handle cloned skbs referencing the same nf_conn entry, which will happen for multicast (broadcast) frames on bridges. Example: macvlan0 | br0 / \ ethX ethY ethX (or Y) receives a L2 multic

CVE-2022-48869 [MEDIUM] CVE-2022-48869: linux - In the Linux kernel, the following vulnerability has been resolved: USB: gadget... In the Linux kernel, the following vulnerability has been resolved: USB: gadgetfs: Fix race between mounting and unmounting The syzbot fuzzer and Gerald Lee have identified a use-after-free bug in the gadgetfs driver, involving processes concurrently mounting and unmounting the gadgetfs filesystem. In particular, gadgetfs_fill_super() can race with gadgetfs_kill_sb(

CVE-2023-1990 [MEDIUM] CVE-2023-1990: linux - A use-after-free flaw was found in ndlc_remove in drivers/nfc/st-nci/ndlc.c in t... A use-after-free flaw was found in ndlc_remove in drivers/nfc/st-nci/ndlc.c in the Linux Kernel. This flaw could allow an attacker to crash the system due to a race problem. Scope: local bookworm: resolved (fixed in 6.1.25-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.25-1) sid: resolved (fixed in 6.1.25-1) trixie: resolved (fixed in 6.1.25

CVE-2021-47284 [MEDIUM] CVE-2021-47284: linux - In the Linux kernel, the following vulnerability has been resolved: isdn: mISDN... In the Linux kernel, the following vulnerability has been resolved: isdn: mISDN: netjet: Fix crash in nj_probe: 'nj_setup' in netjet.c might fail with -EIO and in this case 'card->irq' is initialized and is bigger than zero. A subsequent call to 'nj_release' will free the irq that has not been requested. Fix this bug by deleting the previous assignment to 'card->irq

CVE-2024-26623 [MEDIUM] CVE-2024-26623: linux - In the Linux kernel, the following vulnerability has been resolved: pds_core: P... In the Linux kernel, the following vulnerability has been resolved: pds_core: Prevent race issues involving the adminq There are multiple paths that can result in using the pdsc's adminq. [1] pdsc_adminq_isr and the resulting work from queue_work(), i.e. pdsc_work_thread()->pdsc_process_adminq() [2] pdsc_adminq_post() When the device goes through reset via PCIe rese

CVE-2024-39500 [MEDIUM] CVE-2024-39500: linux - In the Linux kernel, the following vulnerability has been resolved: sock_map: a... In the Linux kernel, the following vulnerability has been resolved: sock_map: avoid race between sock_map_close and sk_psock_put sk_psock_get will return NULL if the refcount of psock has gone to 0, which will happen when the last call of sk_psock_put is done. However, sk_psock_drop may not have finished yet, so the close callback will still point to sock_map_close

CVE-2022-49968 [MEDIUM] CVE-2022-49968: linux - In the Linux kernel, the following vulnerability has been resolved: ieee802154/... In the Linux kernel, the following vulnerability has been resolved: ieee802154/adf7242: defer destroy_workqueue call There is a possible race condition (use-after-free) like below (FREE) | (USE) adf7242_remove | adf7242_channel cancel_delayed_work_sync | destroy_workqueue (1) | adf7242_cmd_rx | mod_delayed_work (2) | The root cause for this race is that the upper la

CVE-2024-26862 [MEDIUM] CVE-2024-26862: linux - In the Linux kernel, the following vulnerability has been resolved: packet: ann... In the Linux kernel, the following vulnerability has been resolved: packet: annotate data-races around ignore_outgoing ignore_outgoing is read locklessly from dev_queue_xmit_nit() and packet_getsockopt() Add appropriate READ_ONCE()/WRITE_ONCE() annotations. syzbot reported: BUG: KCSAN: data-race in dev_queue_xmit_nit / packet_setsockopt write to 0xffff888107804542 o

CVE-2022-49215 [MEDIUM] CVE-2022-49215: linux - In the Linux kernel, the following vulnerability has been resolved: xsk: Fix ra... In the Linux kernel, the following vulnerability has been resolved: xsk: Fix race at socket teardown Fix a race in the xsk socket teardown code that can lead to a NULL pointer dereference splat. The current xsk unbind code in xsk_unbind_dev() starts by setting xs->state to XSK_UNBOUND, sets xs->dev to NULL and then waits for any NAPI processing to terminate using sy