Debian Linux vulnerabilities

CVE-2022-48841 [MEDIUM] CVE-2022-48841: linux - In the Linux kernel, the following vulnerability has been resolved: ice: fix NU... In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL pointer dereference in ice_update_vsi_tx_ring_stats() It is possible to do NULL pointer dereference in routine that updates Tx ring stats. Currently only stats and bytes are updated when ring pointer is valid, but later on ring is accessed to propagate gathered Tx stats onto VSI stats.

CVE-2024-50069 [MEDIUM] CVE-2024-50069: linux - In the Linux kernel, the following vulnerability has been resolved: pinctrl: ap... In the Linux kernel, the following vulnerability has been resolved: pinctrl: apple: check devm_kasprintf() returned value devm_kasprintf() can return a NULL pointer on failure but this returned value is not checked. Fix this lack and check the returned value. Found by code review. Scope: local bookworm: resolved (fixed in 6.1.115-1) bullseye: resolved forky: resolve

CVE-2024-58021 [MEDIUM] CVE-2024-58021: linux - In the Linux kernel, the following vulnerability has been resolved: HID: winwin... In the Linux kernel, the following vulnerability has been resolved: HID: winwing: Add NULL check in winwing_init_led() devm_kasprintf() can return a NULL pointer on failure,but this returned value in winwing_init_led() is not checked. Add NULL check in winwing_init_led(), to handle kernel NULL pointer dereference error. Scope: local bookworm: resolved bullseye: reso

CVE-2024-50070 [MEDIUM] CVE-2024-50070: linux - In the Linux kernel, the following vulnerability has been resolved: pinctrl: st... In the Linux kernel, the following vulnerability has been resolved: pinctrl: stm32: check devm_kasprintf() returned value devm_kasprintf() can return a NULL pointer on failure but this returned value is not checked. Fix this lack and check the returned value. Found by code review. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.11.5-1)

CVE-2021-47446 [MEDIUM] CVE-2021-47446: linux - In the Linux kernel, the following vulnerability has been resolved: drm/msm/a4x... In the Linux kernel, the following vulnerability has been resolved: drm/msm/a4xx: fix error handling in a4xx_gpu_init() This code returns 1 on error instead of a negative error. It leads to an Oops in the caller. A second problem is that the check for "if (ret != -ENODATA)" cannot be true because "ret" is set to 1. Scope: local bookworm: resolved (fixed in 5.14.16-1

CVE-2021-47447 [MEDIUM] CVE-2021-47447: linux - In the Linux kernel, the following vulnerability has been resolved: drm/msm/a3x... In the Linux kernel, the following vulnerability has been resolved: drm/msm/a3xx: fix error handling in a3xx_gpu_init() These error paths returned 1 on failure, instead of a negative error code. This would lead to an Oops in the caller. A second problem is that the check for "if (ret != -ENODATA)" did not work because "ret" was set to 1. Scope: local bookworm: resol

CVE-2024-56752 [MEDIUM] CVE-2024-56752: linux - In the Linux kernel, the following vulnerability has been resolved: drm/nouveau... In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new() When the call to gf100_grctx_generate() fails, unlock gr->fecs.mutex before returning the error. Fixes smatch warning: drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c:480 gf100_gr_chan_new() warn: inconsistent returns '&gr->fecs.mutex'.

CVE-2022-49012 [MEDIUM] CVE-2022-49012: linux - In the Linux kernel, the following vulnerability has been resolved: afs: Fix se... In the Linux kernel, the following vulnerability has been resolved: afs: Fix server->active leak in afs_put_server The atomic_read was accidentally replaced with atomic_inc_return, which prevents the server from getting cleaned up and causes rmmod to hang with a warning: Can't purge s=00000001 Scope: local bookworm: resolved (fixed in 6.0.12-1) bullseye: resolved fo

CVE-2021-47530 [MEDIUM] CVE-2021-47530: linux - In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fi... In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix wait_fence submitqueue leak We weren't dropping the submitqueue reference in all paths. In particular, when the fence has already been signalled. Split out a helper to simplify handling this in the various different return paths. Scope: local bookworm: resolved (fixed in 5.15.15-1) bull

CVE-2021-47526 [MEDIUM] CVE-2021-47526: linux - In the Linux kernel, the following vulnerability has been resolved: serial: lit... In the Linux kernel, the following vulnerability has been resolved: serial: liteuart: Fix NULL pointer dereference in ->remove() drvdata has to be set in _probe() - otherwise platform_get_drvdata() causes null pointer dereference BUG in _remove(). Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved forky: resolved (fixed in 5.15.15-1) sid: resolv

CVE-2024-53056 [MEDIUM] CVE-2024-53056: linux - In the Linux kernel, the following vulnerability has been resolved: drm/mediate... In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() In mtk_crtc_create(), if the call to mbox_request_channel() fails then we set the "mtk_crtc->cmdq_client.chan" pointer to NULL. In that situation, we do not call cmdq_pkt_create(). During the cleanup, we need to check if the "mtk_crt

CVE-2023-53058 [MEDIUM] CVE-2023-53058: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E... In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch, Fix an Oops in error handling code The error handling dereferences "vport". There is nothing we can do if it is an error pointer except returning the error code. Scope: local bookworm: resolved (fixed in 6.1.25-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in

CVE-2024-46769 [MEDIUM] CVE-2024-46769: linux - In the Linux kernel, the following vulnerability has been resolved: spi: intel:... In the Linux kernel, the following vulnerability has been resolved: spi: intel: Add check devm_kasprintf() returned value intel_spi_populate_chip() use devm_kasprintf() to set pdata->name. This can return a NULL pointer on failure but this returned value is not checked. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.10.11-1) sid: reso

CVE-2024-53117 [MEDIUM] CVE-2024-53117: linux - In the Linux kernel, the following vulnerability has been resolved: virtio/vsoc... In the Linux kernel, the following vulnerability has been resolved: virtio/vsock: Improve MSG_ZEROCOPY error handling Add a missing kfree_skb() to prevent memory leaks. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.11.10-1) sid: resolved (fixed in 6.11.10-1) trixie: resolved (fixed in 6.11.10-1)

CVE-2022-50199 [MEDIUM] CVE-2022-50199: linux - In the Linux kernel, the following vulnerability has been resolved: ARM: OMAP2+... In the Linux kernel, the following vulnerability has been resolved: ARM: OMAP2+: Fix refcount leak in omapdss_init_of omapdss_find_dss_of_node() calls of_find_compatible_node() to get device node. of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() in later error path and

CVE-2022-50108 [MEDIUM] CVE-2022-50108: linux - In the Linux kernel, the following vulnerability has been resolved: mfd: max776... In the Linux kernel, the following vulnerability has been resolved: mfd: max77620: Fix refcount leak in max77620_initialise_fps of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye:

CVE-2022-50112 [MEDIUM] CVE-2022-50112: linux - In the Linux kernel, the following vulnerability has been resolved: rpmsg: qcom... In the Linux kernel, the following vulnerability has been resolved: rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: resolved (fixed in 5.10.140-1) forky: resolved (fixed in 6.0.2-1) s

CVE-2022-50197 [MEDIUM] CVE-2022-50197: linux - In the Linux kernel, the following vulnerability has been resolved: cpufreq: zy... In the Linux kernel, the following vulnerability has been resolved: cpufreq: zynq: Fix refcount leak in zynq_get_revision of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: resolved (fixe

CVE-2022-50198 [MEDIUM] CVE-2022-50198: linux - In the Linux kernel, the following vulnerability has been resolved: ARM: OMAP2+... In the Linux kernel, the following vulnerability has been resolved: ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: r

CVE-2024-58051 [MEDIUM] CVE-2024-58051: linux - In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb:... In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: Add check devm_kasprintf() returned value devm_kasprintf() can return a NULL pointer on failure but this returned value is not checked. Scope: local bookworm: resolved (fixed in 6.1.129-1) bullseye: resolved (fixed in 5.10.237-1) forky: resolved (fixed in 6.12.13-1) sid: resolved (fixed