Debian Linux vulnerabilities

CVE-2024-35914 [MEDIUM] CVE-2024-35914: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix e... In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix error cleanup path in nfsd_rename() Commit a8b0026847b8 ("rename(): avoid a deadlock in the case of parents having no common ancestor") added an error bail out path. However this path does not drop the remount protection that has been acquired. Fix the cleanup path to properly drop the rem

CVE-2023-22998 [MEDIUM] CVE-2023-22998: linux - In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misint... In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer). Scope: local bookworm: resolved (fixed in 6.0.3-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.0.3-1) sid: resolved (fixed in 6

CVE-2025-37874 [MEDIUM] CVE-2025-37874: linux - In the Linux kernel, the following vulnerability has been resolved: net: ngbe: ... In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix memory leak in ngbe_probe() error path When ngbe_sw_init() is called, memory is allocated for wx->rss_key in wx_init_rss_key(). However, in ngbe_probe() function, the subsequent error paths after ngbe_sw_init() don't free the rss_key. Fix that by freeing it in error path along with wx

CVE-2025-37872 [MEDIUM] CVE-2025-37872: linux - In the Linux kernel, the following vulnerability has been resolved: net: txgbe:... In the Linux kernel, the following vulnerability has been resolved: net: txgbe: fix memory leak in txgbe_probe() error path When txgbe_sw_init() is called, memory is allocated for wx->rss_key in wx_init_rss_key(). However, in txgbe_probe() function, the subsequent error paths after txgbe_sw_init() don't free the rss_key. Fix that by freeing it in error path along wi

CVE-2019-0147 [MEDIUM] CVE-2019-0147: linux - Insufficient input validation in i40e driver for Intel(R) Ethernet 700 Series Co... Insufficient input validation in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable a denial of service via local access. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved (fixed in 5.2.6-1) sid: resolved (fixed in 5.2.6-1) trixie: res

CVE-2019-0149 [MEDIUM] CVE-2019-0149: linux - Insufficient input validation in i40e driver for Intel(R) Ethernet 700 Series Co... Insufficient input validation in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 2.8.43 may allow an authenticated user to potentially enable a denial of service via local access. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved (fixed in 5.2.6-1) sid: resolved (fixed in 5.2.6-1) trixie:

CVE-2025-37836 [MEDIUM] CVE-2025-37836: linux - In the Linux kernel, the following vulnerability has been resolved: PCI: Fix re... In the Linux kernel, the following vulnerability has been resolved: PCI: Fix reference leak in pci_register_host_bridge() If device_register() fails, call put_device() to give up the reference to avoid a memory leak, per the comment at device_register(). Found by code review. [bhelgaas: squash Dan Carpenter's double free fix from https://lore.kernel.org/r/db806a6c-a

CVE-2022-49389 [MEDIUM] CVE-2022-49389: linux - In the Linux kernel, the following vulnerability has been resolved: usb: usbip:... In the Linux kernel, the following vulnerability has been resolved: usb: usbip: fix a refcount leak in stub_probe() usb_get_dev() is called in stub_device_alloc(). When stub_probe() fails after that, usb_put_dev() needs to be called to release the reference. Fix this by moving usb_put_dev() to sdev_free error path handling. Find this by code review. Scope: local boo

CVE-2022-49370 [MEDIUM] CVE-2022-49370: linux - In the Linux kernel, the following vulnerability has been resolved: firmware: d... In the Linux kernel, the following vulnerability has been resolved: firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle kobject_init_and_add() takes reference even when it fails. According to the doc of kobject_init_and_add() If this function returns an error, kobject_put() must be called to properly clean up the memory associated with the object. Fix

CVE-2024-41025 [MEDIUM] CVE-2024-41025: linux - In the Linux kernel, the following vulnerability has been resolved: misc: fastr... In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix memory leak in audio daemon attach operation Audio PD daemon send the name as part of the init IOCTL call. This name needs to be copied to kernel for which memory is allocated. This memory is never freed which might result in memory leak. Free the memory when it is not needed. Sco

CVE-2023-52465 [MEDIUM] CVE-2023-52465: linux - In the Linux kernel, the following vulnerability has been resolved: power: supp... In the Linux kernel, the following vulnerability has been resolved: power: supply: Fix null pointer dereference in smb2_probe devm_kasprintf and devm_kzalloc return a pointer to dynamically allocated memory which can be NULL upon failure. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.6.15-1) sid: resolved (fixed in 6.6.15-1) trixie:

CVE-2023-23004 [MEDIUM] CVE-2023-23004: linux - In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterpre... In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer). Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 5.19.6-1) sid: resolved (fixed in 5.19.6-1) trixie:

CVE-2021-33098 [MEDIUM] CVE-2021-33098: linux - Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before... Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow an authenticated user to potentially enable denial of service via local access. Scope: local bookworm: resolved (fixed in 5.10.46-1) bullseye: resolved (fixed in 5.10.46-1) forky: resolved (fixed in 5.10.46-1) sid: resolved (fixed in 5.10.46-1) trixie: resolved

CVE-2021-33061 [MEDIUM] CVE-2021-33061: linux - Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers... Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access. Scope: local bookworm: resolved (fixed in 5.18.2-1) bullseye: open forky: resolved (fixed in 5.18.2-1) sid: resolved (fixed in 5.18.2-1) trixie: resolved (fixed in 5.18.2-1)

CVE-2025-37873 [MEDIUM] CVE-2025-37873: linux - In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: ... In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix missing ring index trim on error path Commit under Fixes converted tx_prod to be free running but missed masking it on the Tx error path. This crashes on error conditions, for example when DMA mapping fails. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in

CVE-2022-49716 [MEDIUM] CVE-2022-49716: linux - In the Linux kernel, the following vulnerability has been resolved: irqchip/gic... In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. When kcalloc fails, it missing of_node_put() and results in refcount leak. Fix this by goto out_put_node

CVE-2023-52467 [MEDIUM] CVE-2023-52467: linux - In the Linux kernel, the following vulnerability has been resolved: mfd: syscon... In the Linux kernel, the following vulnerability has been resolved: mfd: syscon: Fix null pointer dereference in of_syscon_register() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: resolved (fixed in 5.10.209-1) forky: resolved (fixed in 6.6.15-1) sid: resolv

CVE-2022-49715 [MEDIUM] CVE-2022-49715: linux - In the Linux kernel, the following vulnerability has been resolved: irqchip/gic... In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions of_find_node_by_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Scope: local bookworm: resolved (fixed in 5.18.14-1)

CVE-2022-49653 [MEDIUM] CVE-2022-49653: linux - In the Linux kernel, the following vulnerability has been resolved: i2c: piix4:... In the Linux kernel, the following vulnerability has been resolved: i2c: piix4: Fix a memory leak in the EFCH MMIO support The recently added support for EFCH MMIO regions introduced a memory leak in that code path. The leak is caused by the fact that release_resource() merely removes the resource from the tree but does not free its memory. We need to call release_m

CVE-2024-41002 [MEDIUM] CVE-2024-41002: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: his... In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec - Fix memory leak for sec resource release The AIV is one of the SEC resources. When releasing resources, it need to release the AIV resources at the same time. Otherwise, memory leakage occurs. The aiv resource release is added to the sec resource release function. Scope: loca