Debian Linux vulnerabilities

CVE-2024-49964 [MEDIUM] CVE-2024-49964: linux - In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb:... In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix memfd_pin_folios free_huge_pages leak memfd_pin_folios followed by unpin_folios fails to restore free_huge_pages if the pages were not already faulted in, because the folio refcount for pages created by memfd_alloc_folio never goes to 0. memfd_pin_folios needs another folio_put to un

CVE-2024-46801 [MEDIUM] CVE-2024-46801: linux - In the Linux kernel, the following vulnerability has been resolved: libfs: fix ... In the Linux kernel, the following vulnerability has been resolved: libfs: fix get_stashed_dentry() get_stashed_dentry() tries to optimistically retrieve a stashed dentry from a provided location. It needs to ensure to hold rcu lock before it dereference the stashed location to prevent UAF issues. Use rcu_dereference() instead of READ_ONCE() it's effectively equival

CVE-2023-52939 [MEDIUM] CVE-2023-52939: linux - In the Linux kernel, the following vulnerability has been resolved: mm: memcg: ... In the Linux kernel, the following vulnerability has been resolved: mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() As commit 18365225f044 ("hwpoison, memcg: forcibly uncharge LRU pages"), hwpoison will forcibly uncharg a LRU hwpoisoned page, the folio_memcg could be NULl, then, mem_cgroup_track_foreign_dirty_slowpath() could occurs a NULL p

CVE-2023-52938 [MEDIUM] CVE-2023-52938: linux - In the Linux kernel, the following vulnerability has been resolved: usb: typec:... In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Don't attempt to resume the ports before they exist This will fix null pointer dereference that was caused by the driver attempting to resume ports that were not yet registered. Scope: local bookworm: resolved (fixed in 6.1.11-1) bullseye: resolved forky: resolved (fixed in 6.1.11-

CVE-2023-52673 [MEDIUM] CVE-2023-52673: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix a debugfs null pointer error [WHY & HOW] Check whether get_subvp_en() callback exists before calling it. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.7.7-1) sid: resolved (fixed in 6.7.7-1) trixie: resolved (fixed in 6.7.7-1)

CVE-2022-49009 [MEDIUM] CVE-2022-49009: linux - In the Linux kernel, the following vulnerability has been resolved: hwmon: (asu... In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus-ec-sensors) Add checks for devm_kcalloc As the devm_kcalloc may return NULL, the return value needs to be checked to avoid NULL poineter dereference. Scope: local bookworm: resolved (fixed in 6.0.12-1) bullseye: resolved forky: resolved (fixed in 6.0.12-1) sid: resolved (fixed in 6.0.12

CVE-2022-50111 [MEDIUM] CVE-2022-50111: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: mt635... In the Linux kernel, the following vulnerability has been resolved: ASoC: mt6359: Fix refcount leak bug In mt6359_parse_dt() and mt6359_accdet_parse_dt(), we should call of_node_put() for the reference returned by of_get_child_by_name() which has increased the refcount. Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: open forky: resolved (fixed in 5.19

CVE-2022-50172 [MEDIUM] CVE-2022-50172: linux - In the Linux kernel, the following vulnerability has been resolved: mt76: mt76x... In the Linux kernel, the following vulnerability has been resolved: mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg Free the skb if mt76u_bulk_msg fails in __mt76x02u_mcu_send_msg routine. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: resolved (fixed in 5.10.140-1) forky: resolved (fixed in 6.0.2-1) sid: resolved (fixed in 6.0.2-1)

CVE-2022-49966 [MEDIUM] CVE-2022-49966: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm:... In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: add missing ->fini_microcode interface for Sienna Cichlid To avoid any potential memory leak. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: resolved (fixed in 5.10.148-1) forky: resolved (fixed in 6.0.2-1) sid: resolved (fixed in 6.0.2-1) trixie: resolved (fixed in 6.0.2-1

CVE-2025-22071 [MEDIUM] CVE-2025-22071: linux - In the Linux kernel, the following vulnerability has been resolved: spufs: fix ... In the Linux kernel, the following vulnerability has been resolved: spufs: fix a leak in spufs_create_context() Leak fixes back in 2008 missed one case - if we are trying to set affinity and spufs_mkdir() fails, we need to drop the reference to neighbor. Scope: local bookworm: resolved (fixed in 6.1.135-1) bullseye: open forky: resolved (fixed in 6.12.25-1) sid: res

CVE-2025-22047 [MEDIUM] CVE-2025-22047: linux - In the Linux kernel, the following vulnerability has been resolved: x86/microco... In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix __apply_microcode_amd()'s return value When verify_sha256_digest() fails, __apply_microcode_amd() should propagate the failure by returning false (and not -1 which is promoted to true). Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.12.25-1) sid

CVE-2024-50144 [MEDIUM] CVE-2024-50144: linux - In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix... In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix unbalanced rpm put() with fence_fini() Currently we can call fence_fini() twice if something goes wrong when sending the GuC CT for the tlb request, since we signal the fence and return an error, leading to the caller also calling fini() on the error path in the case of stack version of

CVE-2024-53115 [MEDIUM] CVE-2024-53115: linux - In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx:... In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: avoid null_ptr_deref in vmw_framebuffer_surface_create_handle The 'vmw_user_object_buffer' function may return NULL with incorrect inputs. To avoid possible null pointer dereference, add a check whether the 'bo' is NULL in the vmw_framebuffer_surface_create_handle. Scope: local bookworm:

CVE-2022-49994 [MEDIUM] CVE-2022-49994: linux - In the Linux kernel, the following vulnerability has been resolved: bootmem: re... In the Linux kernel, the following vulnerability has been resolved: bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem The vmemmap pages is marked by kmemleak when allocated from memblock. Remove it from kmemleak when freeing the page. Otherwise, when we reuse the page, kmemleak may report such an error and then stop working. kmemleak: Cannot insert

CVE-2022-50113 [MEDIUM] CVE-2022-50113: linux - In the Linux kernel, the following vulnerability has been resolved: ASoc: audio... In the Linux kernel, the following vulnerability has been resolved: ASoc: audio-graph-card2: Fix refcount leak bug in __graph_get_type() We should call of_node_put() for the reference before its replacement as it returned by of_get_parent() which has increased the refcount. Besides, we should also call of_node_put() before return. Scope: local bookworm: resolved (fi

CVE-2025-23148 [MEDIUM] CVE-2025-23148: linux - In the Linux kernel, the following vulnerability has been resolved: soc: samsun... In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() soc_dev_attr->revision could be NULL, thus, a pointer check is added to prevent potential NULL pointer dereference. This is similar to the fix in commit 3027e7b15b02 ("ice: Fix some null pointer dereference issues in ice_pt

CVE-2024-57916 [MEDIUM] CVE-2024-57916: linux - In the Linux kernel, the following vulnerability has been resolved: misc: micro... In the Linux kernel, the following vulnerability has been resolved: misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling Resolve kernel panic caused by improper handling of IRQs while accessing GPIO values. This is done by replacing generic_handle_irq with handle_nested_irq. Scope: local bookworm: resolved (fixed in 6.1.128-1) bullseye: resolved

CVE-2025-22081 [MEDIUM] CVE-2025-22081: linux - In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: F... In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix a couple integer overflows on 32bit systems On 32bit systems the "off + sizeof(struct NTFS_DE)" addition can have an integer wrapping issue. Fix it by using size_add(). Scope: local bookworm: resolved (fixed in 6.1.135-1) bullseye: resolved forky: resolved (fixed in 6.12.25-1) sid: res

CVE-2025-22007 [MEDIUM] CVE-2025-22007: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix error code in chan_alloc_skb_cb() The chan_alloc_skb_cb() function is supposed to return error pointers on error. Returning NULL will lead to a NULL dereference. Scope: local bookworm: resolved (fixed in 6.1.133-1) bullseye: resolved (fixed in 5.10.237-1) forky: resolved (fixed in 6.1

CVE-2025-37848 [MEDIUM] CVE-2025-37848: linux - In the Linux kernel, the following vulnerability has been resolved: accel/ivpu:... In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix PM related deadlocks in MS IOCTLs Prevent runtime resume/suspend while MS IOCTLs are in progress. Failed suspend will call ivpu_ms_cleanup() that would try to acquire file_priv->ms_lock, which is already held by the IOCTLs. Scope: local bookworm: resolved bullseye: resolved forky: re