Debian Linux vulnerabilities

CVE-2021-46994 [MEDIUM] CVE-2021-46994: linux - In the Linux kernel, the following vulnerability has been resolved: can: mcp251... In the Linux kernel, the following vulnerability has been resolved: can: mcp251x: fix resume from sleep before interface was brought up Since 8ce8c0abcba3 the driver queues work via priv->restart_work when resuming after suspend, even when the interface was not previously enabled. This causes a null dereference error as the workqueue is only allocated and initialize

CVE-2021-47331 [MEDIUM] CVE-2021-47331: linux - In the Linux kernel, the following vulnerability has been resolved: usb: common... In the Linux kernel, the following vulnerability has been resolved: usb: common: usb-conn-gpio: fix NULL pointer dereference of charger When power on system with OTG cable, IDDIG's interrupt arises before the charger registration, it will cause a NULL pointer dereference, fix the issue by registering the power supply before requesting IDDIG/VBUS irq. Scope: local bo

CVE-2021-47050 [MEDIUM] CVE-2021-47050: linux - In the Linux kernel, the following vulnerability has been resolved: memory: ren... In the Linux kernel, the following vulnerability has been resolved: memory: renesas-rpc-if: fix possible NULL pointer dereference of resource The platform_get_resource_byname() can return NULL which would be immediately dereferenced by resource_size(). Instead dereference it after validating the resource. Addresses-Coverity: Dereference null return value Scope: loca

CVE-2024-43829 [MEDIUM] CVE-2024-43829: linux - In the Linux kernel, the following vulnerability has been resolved: drm/qxl: Ad... In the Linux kernel, the following vulnerability has been resolved: drm/qxl: Add check for drm_cvt_mode Add check for the return value of drm_cvt_mode() and return the error if it fails in order to avoid NULL pointer dereference. Scope: local bookworm: resolved (fixed in 6.1.106-1) bullseye: resolved (fixed in 5.10.226-1) forky: resolved (fixed in 6.10.3-1) sid: res

CVE-2024-43832 [MEDIUM] CVE-2024-43832: linux - In the Linux kernel, the following vulnerability has been resolved: s390/uv: Do... In the Linux kernel, the following vulnerability has been resolved: s390/uv: Don't call folio_wait_writeback() without a folio reference folio_wait_writeback() requires that no spinlocks are held and that a folio reference is held, as documented. After we dropped the PTL, the folio could get freed concurrently. So grab a temporary reference. Scope: local bookworm: r

CVE-2021-47416 [MEDIUM] CVE-2021-47416: linux - In the Linux kernel, the following vulnerability has been resolved: phy: mdio: ... In the Linux kernel, the following vulnerability has been resolved: phy: mdio: fix memory leak Syzbot reported memory leak in MDIO bus interface, the problem was in wrong state logic. MDIOBUS_ALLOCATED indicates 2 states: 1. Bus is only allocated 2. Bus allocated and __mdiobus_register() fails, but device_register() was called In case of device_register() has been c

CVE-2021-47296 [MEDIUM] CVE-2021-47296: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: F... In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak vcpu_put is not called if the user copy fails. This can result in preempt notifier corruption and crashes, among other issues. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.70-1) forky: resolved (fixed in 5.14.6

CVE-2024-42069 [MEDIUM] CVE-2024-42069: linux - In the Linux kernel, the following vulnerability has been resolved: net: mana: ... In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix possible double free in error handling path When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), callback function adev_release calls kfree(madev). We shouldn't call kfree(madev) again in the error handling path. Set 'madev' to NULL. Scope: local bookwor

CVE-2024-42067 [MEDIUM] CVE-2024-42067: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Take r... In the Linux kernel, the following vulnerability has been resolved: bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro() set_memory_rox() can fail, leaving memory unprotected. Check return and bail out when bpf_jit_binary_lock_ro() returns an error. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.9.8-1) sid

CVE-2024-53148 [MEDIUM] CVE-2024-53148: linux - In the Linux kernel, the following vulnerability has been resolved: comedi: Flu... In the Linux kernel, the following vulnerability has been resolved: comedi: Flush partial mappings in error case If some remap_pfn_range() calls succeeded before one failed, we still have buffer pages mapped into the userspace page tables when we drop the buffer reference with comedi_buf_map_put(bm). The userspace mappings are only cleaned up later in the mmap error

CVE-2022-48639 [MEDIUM] CVE-2022-48639: linux - In the Linux kernel, the following vulnerability has been resolved: net: sched:... In the Linux kernel, the following vulnerability has been resolved: net: sched: fix possible refcount leak in tc_new_tfilter() tfilter_put need to be called to put the refount got by tp->ops->get to avoid possible refcount leak when chain->tmplt_ops != NULL and chain->tmplt_ops != tp->ops. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: resolved (fixed

CVE-2022-48643 [MEDIUM] CVE-2022-48643: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain() syzbot is reporting underflow of nft_counters_enabled counter at nf_tables_addchain() [1], for commit 43eb8949cfdffa76 ("netfilter: nf_tables: do not leave chain stats enabled on error") missed that nf_tables_chain_dest

CVE-2021-47550 [MEDIUM] CVE-2021-47550: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/amd... In the Linux kernel, the following vulnerability has been resolved: drm/amd/amdgpu: fix potential memleak In function amdgpu_get_xgmi_hive, when kobject_init_and_add failed There is a potential memleak if not call kobject_put. Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved (fixed in 5.10.84-1) forky: resolved (fixed in 5.15.15-1) sid: resolv

CVE-2024-46732 [MEDIUM] CVE-2024-46732: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Assign linear_pitch_alignment even for VM [Description] Assign linear_pitch_alignment so we don't cause a divide by 0 error in VM environments Scope: local bookworm: resolved (fixed in 6.1.112-1) bullseye: open forky: resolved (fixed in 6.10.9-1) sid: resolved (fixed in 6.10.9-1) tr

CVE-2024-47710 [MEDIUM] CVE-2024-47710: linux - In the Linux kernel, the following vulnerability has been resolved: sock_map: A... In the Linux kernel, the following vulnerability has been resolved: sock_map: Add a cond_resched() in sock_hash_free() Several syzbot soft lockup reports all have in common sock_hash_free() If a map with a large number of buckets is destroyed, we need to yield the cpu when needed. Scope: local bookworm: resolved (fixed in 6.1.115-1) bullseye: resolved (fixed in 5.10

CVE-2024-50009 [MEDIUM] CVE-2024-50009: linux - In the Linux kernel, the following vulnerability has been resolved: cpufreq: am... In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value cpufreq_cpu_get may return NULL. To avoid NULL-dereference check it and return in case of error. Found by Linux Verification Center (linuxtesting.org) with SVACE. Scope: local bookworm: open bullseye: resolved forky: resolved (fixed i

CVE-2023-52532 [MEDIUM] CVE-2023-52532: linux - In the Linux kernel, the following vulnerability has been resolved: net: mana: ... In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TX CQE error handling For an unknown TX CQE error type (probably from a newer hardware), still free the SKB, update the queue tail, etc., otherwise the accounting will be wrong. Also, TX errors can be triggered by injecting corrupted packets, so replace the WARN_ONCE to ratelimited er

CVE-2022-48965 [MEDIUM] CVE-2022-48965: linux - In the Linux kernel, the following vulnerability has been resolved: gpio/rockch... In the Linux kernel, the following vulnerability has been resolved: gpio/rockchip: fix refcount leak in rockchip_gpiolib_register() The node returned by of_get_parent() with refcount incremented, of_node_put() needs be called when finish using it. So add it in the end of of_pinctrl_get(). Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved forky: r

CVE-2025-40325 [MEDIUM] CVE-2025-40325: linux - In the Linux kernel, the following vulnerability has been resolved: md/raid10: ... In the Linux kernel, the following vulnerability has been resolved: md/raid10: wait barrier before returning discard request with REQ_NOWAIT raid10_handle_discard should wait barrier before returning a discard bio which has REQ_NOWAIT. And there is no need to print warning calltrace if a discard bio has REQ_NOWAIT flag. Quality engineer usually checks dmesg and repo

CVE-2021-47121 [MEDIUM] CVE-2021-47121: linux - In the Linux kernel, the following vulnerability has been resolved: net: caif: ... In the Linux kernel, the following vulnerability has been resolved: net: caif: fix memory leak in cfusbl_device_notify In case of caif_enroll_dev() fail, allocated link_support won't be assigned to the corresponding structure. So simply free allocated pointer in case of error. Scope: local bookworm: resolved (fixed in 5.10.46-1) bullseye: resolved (fixed in 5.10.46-