Debian Linux vulnerabilities

CVE-2023-52826 [MEDIUM] CVE-2023-52826: linux - In the Linux kernel, the following vulnerability has been resolved: drm/panel/p... In the Linux kernel, the following vulnerability has been resolved: drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference In tpg110_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Scope: local bookworm: resolved (fixed

CVE-2023-52821 [MEDIUM] CVE-2023-52821: linux - In the Linux kernel, the following vulnerability has been resolved: drm/panel: ... In the Linux kernel, the following vulnerability has been resolved: drm/panel: fix a possible null pointer dereference In versatile_panel_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Scope: local bookworm: resolved (fixed in 6.1.6

CVE-2021-47655 [MEDIUM] CVE-2021-47655: linux - In the Linux kernel, the following vulnerability has been resolved: media: venu... In the Linux kernel, the following vulnerability has been resolved: media: venus: vdec: fixed possible memory leak issue The venus_helper_alloc_dpb_bufs() implementation allows an early return on an error path when checking the id from ida_alloc_min() which would not release the earlier buffer allocation. Move the direct kfree() from the error checking of dma_alloc_

CVE-2021-47171 [MEDIUM] CVE-2021-47171: linux - In the Linux kernel, the following vulnerability has been resolved: net: usb: f... In the Linux kernel, the following vulnerability has been resolved: net: usb: fix memory leak in smsc75xx_bind Syzbot reported memory leak in smsc75xx_bind(). The problem was is non-freed memory in case of errors after memory allocation. backtrace: [] kmalloc include/linux/slab.h:556 [inline] [] kzalloc include/linux/slab.h:686 [inline] [] smsc75xx_bind+0x7a/0x334 d

CVE-2024-41022 [MEDIUM] CVE-2024-41022: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() The "instance" variable needs to be signed for the error handling to work. Scope: local bookworm: resolved (fixed in 6.1.106-1) bullseye: resolved (fixed in 5.10.223-1) forky: resolved (fixed in 6.9.12-1) sid: resolved (fixed in 6.9.12-1

CVE-2024-40926 [MEDIUM] CVE-2024-40926: linux - In the Linux kernel, the following vulnerability has been resolved: drm/nouveau... In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't attempt to schedule hpd_work on headless cards If the card doesn't have display hardware, hpd_work and hpd_lock are left uninitialized which causes BUG when attempting to schedule hpd_work on runtime PM resume. Fix it by adding headless flag to DRM and skip any hpd if it's set. Sc

CVE-2021-46988 [MEDIUM] CVE-2021-46988: linux - In the Linux kernel, the following vulnerability has been resolved: userfaultfd... In the Linux kernel, the following vulnerability has been resolved: userfaultfd: release page in error path to avoid BUG_ON Consider the following sequence of events: 1. Userspace issues a UFFD ioctl, which ends up calling into shmem_mfill_atomic_pte(). We successfully account the blocks, we shmem_alloc_page(), but then the copy_from_user() fails. We return -ENOENT.

CVE-2024-44963 [MEDIUM] CVE-2024-44963: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: do n... In the Linux kernel, the following vulnerability has been resolved: btrfs: do not BUG_ON() when freeing tree block after error When freeing a tree block, at btrfs_free_tree_block(), if we fail to create a delayed reference we don't deal with the error and just do a BUG_ON(). The error most likely to happen is -ENOMEM, and we have a comment mentioning that only -ENOM

CVE-2024-26839 [MEDIUM] CVE-2024-26839: linux - In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fi... In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix a memleak in init_credit_return When dma_alloc_coherent fails to allocate dd->cr_base[i].va, init_credit_return should deallocate dd->cr_base and dd->cr_base[i] that allocated before. Or those resources would be never freed and a memleak is triggered. Scope: local bookworm: resolved (fi

CVE-2021-47211 [MEDIUM] CVE-2021-47211: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-a... In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix null pointer dereference on pointer cs_desc The pointer cs_desc return from snd_usb_find_clock_source could be null, so there is a potential null pointer dereference issue. Fix this by adding a null check before dereference. Scope: local bookworm: resolved (fixed in 5.15.5-1) bu

CVE-2021-47522 [MEDIUM] CVE-2021-47522: linux - In the Linux kernel, the following vulnerability has been resolved: HID: bigben... In the Linux kernel, the following vulnerability has been resolved: HID: bigbenff: prevent null pointer dereference When emulating the device through uhid, there is a chance we don't have output reports and so report_field is null. Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved (fixed in 5.10.92-1) forky: resolved (fixed in 5.15.15-1) sid: r

CVE-2021-47601 [MEDIUM] CVE-2021-47601: linux - In the Linux kernel, the following vulnerability has been resolved: tee: amdtee... In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fix an IS_ERR() vs NULL bug The __get_free_pages() function does not return error pointers it returns NULL so fix this condition to avoid a NULL dereference. Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved (fixed in 5.10.92-1) forky: resolved (fixed in 5.15.15-1)

CVE-2021-47364 [MEDIUM] CVE-2021-47364: linux - In the Linux kernel, the following vulnerability has been resolved: comedi: Fix... In the Linux kernel, the following vulnerability has been resolved: comedi: Fix memory leak in compat_insnlist() `compat_insnlist()` handles the 32-bit version of the `COMEDI_INSNLIST` ioctl (whenwhen `CONFIG_COMPAT` is enabled). It allocates memory to temporarily hold an array of `struct comedi_insn` converted from the 32-bit version in user space. This memory is o

CVE-2024-26774 [MEDIUM] CVE-2024-26774: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: avoid... In the Linux kernel, the following vulnerability has been resolved: ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt Determine if bb_fragments is 0 instead of determining bb_free to eliminate the risk of dividing by zero when the block bitmap is corrupted. Scope: local bookworm: resolved (fixed in 6.1.82-1) bullseye: resolved fork

CVE-2024-27417 [MEDIUM] CVE-2024-27417: linux - In the Linux kernel, the following vulnerability has been resolved: ipv6: fix p... In the Linux kernel, the following vulnerability has been resolved: ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() It seems that if userspace provides a correct IFA_TARGET_NETNSID value but no IFA_ADDRESS and IFA_LOCAL attributes, inet6_rtm_getaddr() returns -EINVAL with an elevated "struct net" refcount. Scope: local bookworm: resolved (fixed in 6.1.8

CVE-2022-49106 [MEDIUM] CVE-2022-49106: linux - In the Linux kernel, the following vulnerability has been resolved: staging: vc... In the Linux kernel, the following vulnerability has been resolved: staging: vchiq_arm: Avoid NULL ptr deref in vchiq_dump_platform_instances vchiq_get_state() can return a NULL pointer. So handle this cases and avoid a NULL pointer derefence in vchiq_dump_platform_instances. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: open forky: resolved (fixed i

CVE-2022-49104 [MEDIUM] CVE-2022-49104: linux - In the Linux kernel, the following vulnerability has been resolved: staging: vc... In the Linux kernel, the following vulnerability has been resolved: staging: vchiq_core: handle NULL result of find_service_by_handle In case of an invalid handle the function find_servive_by_handle returns NULL. So take care of this and avoid a NULL pointer dereference. Scope: local bookworm: resolved (fixed in 5.17.3-1) bullseye: resolved (fixed in 5.10.113-1) for

CVE-2021-47177 [MEDIUM] CVE-2021-47177: linux - In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d:... In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix sysfs leak in alloc_iommu() iommu_device_sysfs_add() is called before, so is has to be cleaned on subsequent errors. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.46-1) forky: resolved (fixed in 5.14.6-1) sid: resolved (fixed in 5.14.6-1) trixi

CVE-2021-47054 [MEDIUM] CVE-2021-47054: linux - In the Linux kernel, the following vulnerability has been resolved: bus: qcom: ... In the Linux kernel, the following vulnerability has been resolved: bus: qcom: Put child node before return Put child node before return to fix potential reference count leak. Generally, the reference count of child is incremented and decremented automatically in the macro for_each_available_child_of_node() and should be decremented manually if the loop is broken in

CVE-2024-42068 [MEDIUM] CVE-2024-42068: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Take r... In the Linux kernel, the following vulnerability has been resolved: bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro() set_memory_ro() can fail, leaving memory unprotected. Check its return and take it into account as an error. Scope: local bookworm: resolved (fixed in 6.1.98-1) bullseye: open forky: resolved (fixed in 6.9.8-1) sid: resolved