Debian Linux vulnerabilities

CVE-2024-50012 [MEDIUM] CVE-2024-50012: linux - In the Linux kernel, the following vulnerability has been resolved: cpufreq: Av... In the Linux kernel, the following vulnerability has been resolved: cpufreq: Avoid a bad reference count on CPU node In the parse_perf_domain function, if the call to of_parse_phandle_with_args returns an error, then the reference to the CPU device node that was acquired at the start of the function would not be properly decremented. Address this by declaring the va

CVE-2024-39475 [MEDIUM] CVE-2024-39475: linux - In the Linux kernel, the following vulnerability has been resolved: fbdev: sava... In the Linux kernel, the following vulnerability has been resolved: fbdev: savage: Handle err return when savagefb_check_var failed The commit 04e5eac8f3ab("fbdev: savage: Error out if pixclock equals zero") checks the value of pixclock to avoid divide-by-zero error. However the function savagefb_probe doesn't handle the error return of savagefb_check_var. When pixc

CVE-2024-41018 [MEDIUM] CVE-2024-41018: linux - In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: A... In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add a check for attr_names and oatbl Added out-of-bound checking for *ane (ATTR_NAME_ENTRY). Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.9.12-1) sid: resolved (fixed in 6.9.12-1) trixie: resolved (fixed in 6.9.12-1)

CVE-2024-26829 [MEDIUM] CVE-2024-26829: linux - In the Linux kernel, the following vulnerability has been resolved: media: ir_t... In the Linux kernel, the following vulnerability has been resolved: media: ir_toy: fix a memleak in irtoy_tx When irtoy_command fails, buf should be freed since it is allocated by irtoy_tx, or there is a memleak. Scope: local bookworm: resolved (fixed in 6.1.82-1) bullseye: resolved forky: resolved (fixed in 6.7.7-1) sid: resolved (fixed in 6.7.7-1) trixie: resolved

CVE-2024-53076 [MEDIUM] CVE-2024-53076: linux - In the Linux kernel, the following vulnerability has been resolved: iio: gts-he... In the Linux kernel, the following vulnerability has been resolved: iio: gts-helper: Fix memory leaks for the error path of iio_gts_build_avail_scale_table() If per_time_scales[i] or per_time_gains[i] kcalloc fails in the for loop of iio_gts_build_avail_scale_table(), the err_free_out will fail to call kfree() each time when i is reduced to 0, so all the per_time_sc

CVE-2024-50300 [MEDIUM] CVE-2024-50300: linux - In the Linux kernel, the following vulnerability has been resolved: regulator: ... In the Linux kernel, the following vulnerability has been resolved: regulator: rtq2208: Fix uninitialized use of regulator_config Fix rtq2208 driver uninitialized use to cause kernel error. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.11.9-1) sid: resolved (fixed in 6.11.9-1) trixie: resolved (fixed in 6.11.9-1)

CVE-2024-40928 [MEDIUM] CVE-2024-40928: linux - In the Linux kernel, the following vulnerability has been resolved: net: ethtoo... In the Linux kernel, the following vulnerability has been resolved: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() Clang static checker (scan-build) warning: net/ethtool/ioctl.c:line 2233, column 2 Called function pointer is null (null dereference). Return '-EOPNOTSUPP' when 'ops->get_ethtool_phy_stats' is NULL to fix this typo error. Scope

CVE-2022-48693 [MEDIUM] CVE-2022-48693: linux - In the Linux kernel, the following vulnerability has been resolved: soc: brcmst... In the Linux kernel, the following vulnerability has been resolved: soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs In brcmstb_pm_probe(), there are two kinds of leak bugs: (1) we need to add of_node_put() when for_each__matching_node() breaks (2) we need to add iounmap() for each iomap in fail path Scope: local bookworm: resolved (fixed in 5.19.11-1)

CVE-2021-47122 [MEDIUM] CVE-2021-47122: linux - In the Linux kernel, the following vulnerability has been resolved: net: caif: ... In the Linux kernel, the following vulnerability has been resolved: net: caif: fix memory leak in caif_device_notify In case of caif_enroll_dev() fail, allocated link_support won't be assigned to the corresponding structure. So simply free allocated pointer in case of error Scope: local bookworm: resolved (fixed in 5.10.46-1) bullseye: resolved (fixed in 5.10.46-1)

CVE-2024-58020 [MEDIUM] CVE-2024-58020: linux - In the Linux kernel, the following vulnerability has been resolved: HID: multit... In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Add NULL check in mt_input_configured devm_kasprintf() can return a NULL pointer on failure,but this returned value in mt_input_configured() is not checked. Add NULL check in mt_input_configured(), to handle kernel NULL pointer dereference error. Scope: local bookworm: resolved (fix

CVE-2024-35904 [MEDIUM] CVE-2024-35904: linux - In the Linux kernel, the following vulnerability has been resolved: selinux: av... In the Linux kernel, the following vulnerability has been resolved: selinux: avoid dereference of garbage after mount failure In case kern_mount() fails and returns an error pointer return in the error branch instead of continuing and dereferencing the error pointer. While on it drop the never read static variable selinuxfs_mount. Scope: local bookworm: open bullsey

CVE-2024-26977 [MEDIUM] CVE-2024-26977: linux - In the Linux kernel, the following vulnerability has been resolved: pci_iounmap... In the Linux kernel, the following vulnerability has been resolved: pci_iounmap(): Fix MMIO mapping leak The #ifdef ARCH_HAS_GENERIC_IOPORT_MAP accidentally also guards iounmap(), which means MMIO mappings are leaked. Move the guard so we call iounmap() for MMIO mappings. Scope: local bookworm: resolved (fixed in 6.1.85-1) bullseye: resolved forky: resolved (fixed i

CVE-2024-42309 [MEDIUM] CVE-2024-42309: linux - In the Linux kernel, the following vulnerability has been resolved: drm/gma500:... In the Linux kernel, the following vulnerability has been resolved: drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes In psb_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a possible NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Scope: local bookworm

CVE-2024-42310 [MEDIUM] CVE-2024-42310: linux - In the Linux kernel, the following vulnerability has been resolved: drm/gma500:... In the Linux kernel, the following vulnerability has been resolved: drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes In cdv_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Scope: local bookworm: resolve

CVE-2023-52690 [MEDIUM] CVE-2023-52690: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/pow... In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv: Add a null pointer check to scom_debug_init_one() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Add a null pointer check, and release 'ent' to avoid memory leaks. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: resolved (

CVE-2021-47207 [MEDIUM] CVE-2021-47207: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: gus: ... In the Linux kernel, the following vulnerability has been resolved: ALSA: gus: fix null pointer dereference on pointer block The pointer block return from snd_gf1_dma_next_block could be null, so there is a potential null pointer dereference issue. Fix this by adding a null check before dereference. Scope: local bookworm: resolved (fixed in 5.15.5-1) bullseye: resol

CVE-2021-47445 [MEDIUM] CVE-2021-47445: linux - In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fi... In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix null pointer dereference on pointer edp The initialization of pointer dev dereferences pointer edp before edp is null checked, so there is a potential null pointer deference issue. Fix this by only dereferencing edp after edp has been null checked. Addresses-Coverity: ("Dereference befo

CVE-2021-47149 [MEDIUM] CVE-2021-47149: linux - In the Linux kernel, the following vulnerability has been resolved: net: fujits... In the Linux kernel, the following vulnerability has been resolved: net: fujitsu: fix potential null-ptr-deref In fmvj18x_get_hwinfo(), if ioremap fails there will be NULL pointer deref. To fix this, check the return value of ioremap and return -1 to the caller in case of failure. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.

CVE-2021-47257 [MEDIUM] CVE-2021-47257: linux - In the Linux kernel, the following vulnerability has been resolved: net: ieee80... In the Linux kernel, the following vulnerability has been resolved: net: ieee802154: fix null deref in parse dev addr Fix a logic error that could result in a null deref if the user sets the mode incorrectly for the given addr type. Scope: local bookworm: resolved (fixed in 5.10.46-1) bullseye: resolved (fixed in 5.10.46-1) forky: resolved (fixed in 5.10.46-1) sid:

CVE-2021-46924 [MEDIUM] CVE-2021-46924: linux - In the Linux kernel, the following vulnerability has been resolved: NFC: st21nf... In the Linux kernel, the following vulnerability has been resolved: NFC: st21nfca: Fix memory leak in device probe and remove 'phy->pending_skb' is alloced when device probe, but forgot to free in the error handling path and remove path, this cause memory leak as follows: unreferenced object 0xffff88800bc06800 (size 512): comm "8", pid 11775, jiffies 4295159829 (age