Debian Linux vulnerabilities

CVE-2024-36481 [MEDIUM] CVE-2024-36481: linux - In the Linux kernel, the following vulnerability has been resolved: tracing/pro... In the Linux kernel, the following vulnerability has been resolved: tracing/probes: fix error check in parse_btf_field() btf_find_struct_member() might return NULL or an error via the ERR_PTR() macro. However, its caller in parse_btf_field() only checks for the NULL condition. Fix this by using IS_ERR() and returning the error up the stack. Scope: local bookworm: re

CVE-2024-42248 [MEDIUM] CVE-2024-42248: linux - In the Linux kernel, the following vulnerability has been resolved: tty: serial... In the Linux kernel, the following vulnerability has been resolved: tty: serial: ma35d1: Add a NULL check for of_node The pdev->dev.of_node can be NULL if the "serial" node is absent. Add a NULL check to return an error in such cases. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.9.10-1) sid: resolved (fixed in 6.9.10-1) trixie: reso

CVE-2022-49316 [MEDIUM] CVE-2022-49316: linux - In the Linux kernel, the following vulnerability has been resolved: NFSv4: Don'... In the Linux kernel, the following vulnerability has been resolved: NFSv4: Don't hold the layoutget locks across multiple RPC calls When doing layoutget as part of the open() compound, we have to be careful to release the layout locks before we can call any further RPC calls, such as setattr(). The reason is that those calls could trigger a recall, which could deadl

CVE-2024-35829 [MEDIUM] CVE-2024-35829: linux - In the Linux kernel, the following vulnerability has been resolved: drm/lima: f... In the Linux kernel, the following vulnerability has been resolved: drm/lima: fix a memleak in lima_heap_alloc When lima_vm_map_bo fails, the resources need to be deallocated, or there will be memleaks. Scope: local bookworm: resolved (fixed in 6.1.85-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.7.12-1) sid: resolved (fixed in 6.7.12-1) tr

CVE-2024-43870 [MEDIUM] CVE-2024-43870: linux - In the Linux kernel, the following vulnerability has been resolved: perf: Fix e... In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exit When a task is scheduled out, pending sigtrap deliveries are deferred to the target task upon resume to userspace via task_work. However failures while adding an event's callback to the task_work engine are ignored. And since the last call for events exit happen after

CVE-2024-35908 [MEDIUM] CVE-2024-35908: linux - In the Linux kernel, the following vulnerability has been resolved: tls: get ps... In the Linux kernel, the following vulnerability has been resolved: tls: get psock ref after taking rxlock to avoid leak At the start of tls_sw_recvmsg, we take a reference on the psock, and then call tls_rx_reader_lock. If that fails, we return directly without releasing the reference. Instead of adding a new label, just take the reference after locking has succeed

CVE-2024-35833 [MEDIUM] CVE-2024-35833: linux - In the Linux kernel, the following vulnerability has been resolved: dmaengine: ... In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA This dma_alloc_coherent() is undone neither in the remove function, nor in the error handling path of fsl_qdma_probe(). Switch to the managed version to fix both issues. Scope: local bookworm: resolved (fixed in 6.1.82-1) bullse

CVE-2024-42320 [MEDIUM] CVE-2024-42320: linux - In the Linux kernel, the following vulnerability has been resolved: s390/dasd: ... In the Linux kernel, the following vulnerability has been resolved: s390/dasd: fix error checks in dasd_copy_pair_store() dasd_add_busid() can return an error via ERR_PTR() if an allocation fails. However, two callsites in dasd_copy_pair_store() do not check the result, potentially resulting in a NULL pointer dereference. Fix this by checking the result with IS_ERR(

CVE-2024-42303 [MEDIUM] CVE-2024-42303: linux - In the Linux kernel, the following vulnerability has been resolved: media: imx-... In the Linux kernel, the following vulnerability has been resolved: media: imx-pxp: Fix ERR_PTR dereference in pxp_probe() devm_regmap_init_mmio() can fail, add a check and bail out in case of error. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.10.3-1) sid: resolved (fixed in 6.10.3-1) trixie: resolved (fixed in 6.10.3-1)

CVE-2024-36011 [MEDIUM] CVE-2024-36011: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HCI: Fix potential null-ptr-deref Fix potential null-ptr-deref in hci_le_big_sync_established_evt(). Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.8.11-1) sid: resolved (fixed in 6.8.11-1) trixie: resolved (fixed in 6.8.11-1)

CVE-2024-43857 [MEDIUM] CVE-2024-43857: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: fix n... In the Linux kernel, the following vulnerability has been resolved: f2fs: fix null reference error when checking end of zone This patch fixes a potentially null pointer being accessed by is_end_zone_blkaddr() that checks the last block of a zone when f2fs is mounted as a single device. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.10

CVE-2022-50007 [MEDIUM] CVE-2022-50007: linux - In the Linux kernel, the following vulnerability has been resolved: xfrm: fix r... In the Linux kernel, the following vulnerability has been resolved: xfrm: fix refcount leak in __xfrm_policy_check() The issue happens on an error path in __xfrm_policy_check(). When the fetching process of the object `pols[1]` fails, the function simply returns 0, forgetting to decrement the reference count of `pols[0]`, which is incremented earlier by either xfrm_

CVE-2022-48905 [MEDIUM] CVE-2022-48905: linux - In the Linux kernel, the following vulnerability has been resolved: ibmvnic: fr... In the Linux kernel, the following vulnerability has been resolved: ibmvnic: free reset-work-item when flushing Fix a tiny memory leak when flushing the reset work queue. Scope: local bookworm: resolved (fixed in 5.16.14-1) bullseye: resolved (fixed in 5.10.106-1) forky: resolved (fixed in 5.16.14-1) sid: resolved (fixed in 5.16.14-1) trixie: resolved (fixed in 5.16

CVE-2022-48768 [MEDIUM] CVE-2022-48768: linux - In the Linux kernel, the following vulnerability has been resolved: tracing/his... In the Linux kernel, the following vulnerability has been resolved: tracing/histogram: Fix a potential memory leak for kstrdup() kfree() is missing on an error path to free the memory allocated by kstrdup(): p = param = kstrdup(data->params[i], GFP_KERNEL); So it is better to free it via kfree(p). Scope: local bookworm: resolved (fixed in 5.16.7-1) bullseye: resolve

CVE-2022-48859 [MEDIUM] CVE-2022-48859: linux - In the Linux kernel, the following vulnerability has been resolved: net: marvel... In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr This node pointer is returned by of_find_compatible_node() with refcount incremented. Calling of_node_put() to aovid the refcount leak. Scope: local bookworm: resolved (fixed in 5.16.18-1) bullseye: open forky: re

CVE-2022-48924 [MEDIUM] CVE-2022-48924: linux - In the Linux kernel, the following vulnerability has been resolved: thermal: in... In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: fix memory leak in int3400_notify() It is easy to hit the below memory leaks in my TigerLake platform: unreferenced object 0xffff927c8b91dbc0 (size 32): comm "kworker/0:2", pid 112, jiffies 4294893323 (age 83.604s) hex dump (first 32 bytes): 4e 41 4d 45 3d 49 4e 54 33 34 30 30 20 5

CVE-2021-47466 [MEDIUM] CVE-2021-47466: linux - In the Linux kernel, the following vulnerability has been resolved: mm, slub: f... In the Linux kernel, the following vulnerability has been resolved: mm, slub: fix potential memoryleak in kmem_cache_open() In error path, the random_seq of slub cache might be leaked. Fix this by using __kmem_cache_release() to release all the relevant resources. Scope: local bookworm: resolved (fixed in 5.14.16-1) bullseye: resolved (fixed in 5.10.84-1) forky: res

CVE-2021-47473 [MEDIUM] CVE-2021-47473: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: qla2x... In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els() Commit 8c0eb596baa5 ("[SCSI] qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()"), intended to change: bsg_job->request->msgcode == FC_BSG_HST_ELS_NOLOGIN bsg_job->request->msgcode != FC_BSG_RPT_ELS but chan

CVE-2024-35826 [MEDIUM] CVE-2024-35826: linux - In the Linux kernel, the following vulnerability has been resolved: block: Fix ... In the Linux kernel, the following vulnerability has been resolved: block: Fix page refcounts for unaligned buffers in __bio_release_pages() Fix an incorrect number of pages being released for buffers that do not start at the beginning of a page. Scope: local bookworm: resolved (fixed in 6.1.85-1) bullseye: open forky: resolved (fixed in 6.7.12-1) sid: resolved (fix

CVE-2024-47754 [MEDIUM] CVE-2024-47754: linux - In the Linux kernel, the following vulnerability has been resolved: media: medi... In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix H264 multi stateless decoder smatch warning Fix a smatch static checker warning on vdec_h264_req_multi_if.c. Which leads to a kernel crash when fb is NULL. Scope: local bookworm: resolved (fixed in 6.1.133-1) bullseye: resolved forky: resolved (fixed in 6.11.2-1) sid: re