Debian Linux vulnerabilities

CVE-2025-22060 [MEDIUM] CVE-2025-22060: linux - In the Linux kernel, the following vulnerability has been resolved: net: mvpp2:... In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: Prevent parser TCAM memory corruption Protect the parser TCAM/SRAM memory, and the cached (shadow) SRAM information, from concurrent modifications. Both the TCAM and SRAM tables are indirectly accessed by configuring an index register that selects the row to read or write to. This means

CVE-2025-38078 [MEDIUM] CVE-2025-38078: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: ... In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix race of buffer access at PCM OSS layer The PCM OSS layer tries to clear the buffer with the silence data at initialization (or reconfiguration) of a stream with the explicit call of snd_pcm_format_set_silence() with runtime->dma_area. But this may lead to a UAF because the accessed ru

CVE-2025-38687 [MEDIUM] CVE-2025-38687: linux - In the Linux kernel, the following vulnerability has been resolved: comedi: fix... In the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still active on the wait_queue_head inside of it. This can cause a use-after-free when the poll en

CVE-2023-53368 [MEDIUM] CVE-2023-53368: linux - In the Linux kernel, the following vulnerability has been resolved: tracing: Fi... In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race issue between cpu buffer write and swap Warning happened in rb_end_commit() at code: if (RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing))) WARNING: CPU: 0 PID: 139 at kernel/trace/ring_buffer.c:3142 rb_commit+0x402/0x4a0 Call Trace: ring_buffer_unlock_commit+0x42/0x250

CVE-2026-23004 [MEDIUM] CVE-2026-23004: linux - In the Linux kernel, the following vulnerability has been resolved: dst: fix ra... In the Linux kernel, the following vulnerability has been resolved: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() syzbot was able to crash the kernel in rt6_uncached_list_flush_dev() in an interesting way [1] Crash happens in list_del_init()/INIT_LIST_HEAD() while writing list->prev, while the prior write on list->next went well. static inline

CVE-2022-20008 [MEDIUM] CVE-2022-20008: linux - In mmc_blk_read_single of block.c, there is a possible way to read kernel heap m... In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized data. This could lead to local information disclosure if reading from an SD card that triggers errors, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-21648103

CVE-2023-53178 [MEDIUM] CVE-2023-53178: linux - In the Linux kernel, the following vulnerability has been resolved: mm: fix zsw... In the Linux kernel, the following vulnerability has been resolved: mm: fix zswap writeback race condition The zswap writeback mechanism can cause a race condition resulting in memory corruption, where a swapped out page gets swapped in with data that was written to a different page. The race unfolds like this: 1. a page with data A and swap offset X is stored in zs

CVE-2023-53490 [MEDIUM] CVE-2023-53490: linux - In the Linux kernel, the following vulnerability has been resolved: mptcp: fix ... In the Linux kernel, the following vulnerability has been resolved: mptcp: fix disconnect vs accept race Despite commit 0ad529d9fd2b ("mptcp: fix possible divide by zero in recvmsg()"), the mptcp protocol is still prone to a race between disconnect() (or shutdown) and accept. The root cause is that the mentioned commit checks the msk-level flag, but mptcp_stream_acc

CVE-2025-71074 [MEDIUM] CVE-2025-71074: linux - In the Linux kernel, the following vulnerability has been resolved: functionfs:... In the Linux kernel, the following vulnerability has been resolved: functionfs: fix the open/removal races ffs_epfile_open() can race with removal, ending up with file->private_data pointing to freed object. There is a total count of opened files on functionfs (both ep0 and dynamic ones) and when it hits zero, dynamic files get removed. Unfortunately, that removal c

CVE-2026-23110 [MEDIUM] CVE-2026-23110: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: core:... In the Linux kernel, the following vulnerability has been resolved: scsi: core: Wake up the error handler when final completions race against each other The fragile ordering between marking commands completed or failed so that the error handler only wakes when the last running command completes or times out has race conditions. These race conditions can cause the SC

CVE-2025-71111 [MEDIUM] CVE-2025-71111: linux - In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83... In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83791d) Convert macros to functions to avoid TOCTOU The macro FAN_FROM_REG evaluates its arguments multiple times. When used in lockless contexts involving shared driver data, this leads to Time-of-Check to Time-of-Use (TOCTOU) race conditions, potentially causing divide-by-zero errors. Con

CVE-2026-22986 [MEDIUM] CVE-2026-22986: linux - In the Linux kernel, the following vulnerability has been resolved: gpiolib: fi... In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix race condition for gdev->srcu If two drivers were calling gpiochip_add_data_with_key(), one may be traversing the srcu-protected list in gpio_name_to_desc(), meanwhile other has just added its gdev in gpiodev_add_to_list_unlocked(). This creates a non-mutexed and non-protected timeframe

CVE-2023-53447 [MEDIUM] CVE-2023-53447: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: don't... In the Linux kernel, the following vulnerability has been resolved: f2fs: don't reset unchangable mount option in f2fs_remount() syzbot reports a bug as below: general protection fault, probably for non-canonical address 0xdffffc0000000009: 0000 [#1] PREEMPT SMP KASAN RIP: 0010:__lock_acquire+0x69/0x2000 kernel/locking/lockdep.c:4942 Call Trace: lock_acquire+0x1e3/0

CVE-2026-23115 [MEDIUM] CVE-2026-23115: linux - In the Linux kernel, the following vulnerability has been resolved: serial: Fix... In the Linux kernel, the following vulnerability has been resolved: serial: Fix not set tty->port race condition Revert commit bfc467db60b7 ("serial: remove redundant tty_port_link_device()") because the tty_port_link_device() is not redundant: the tty->port has to be confured before we call uart_configure_port(), otherwise user-space can open console without TTY li

CVE-2021-27363 [MEDIUM] CVE-2021-27363: linux - An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer lea... An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, t

CVE-2022-20132 [MEDIUM] CVE-2022-20132: linux - In lg_probe and related functions of hid-lg.c and other USB HID files, there is ... In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure if a malicious USB HID device were plugged in, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android

CVE-2019-15031 [MEDIUM] CVE-2019-15031: linux - In the Linux kernel through 5.2.14 on the powerpc platform, a local user can rea... In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via an interrupt. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the valu

CVE-2021-4002 [MEDIUM] CVE-2021-4002: linux - A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the... A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data. Scope: local bookworm: resolved (fixed in 5.15.5-1) bullseye: resolved (fi

CVE-2020-29660 [MEDIUM] CVE-2020-29660: linux - A locking inconsistency issue was discovered in the tty subsystem of the Linux k... A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may allow a read-after-free attack against TIOCGSID, aka CID-c8bcd9c5be24. Scope: local bookworm: resolved (fixed in 5.9.15-1) bullseye: resolved (fixed in 5.9.15-1) forky: resolved (fixed in 5.9.15-1) sid: resolved

CVE-2022-0494 [MEDIUM] CVE-2022-0494: linux - A kernel information leak flaw was identified in the scsi_ioctl function in driv... A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or CAP_SYS_RAWIO) to create issues with confidentiality. Scope: local bookworm: resolved (fixed in 5.16.14-1) bullseye: resolved (fixed in 5.10.120-1) forky: resolved (