Debian Linux vulnerabilities

CVE-2024-57935 [MEDIUM] CVE-2024-57935: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: F... In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix accessing invalid dip_ctx during destroying QP If it fails to modify QP to RTR, dip_ctx will not be attached. And during detroying QP, the invalid dip_ctx pointer will be accessed. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.12.9-1) sid: resolved (fix

CVE-2023-53361 [MEDIUM] CVE-2023-53361: linux - In the Linux kernel, the following vulnerability has been resolved: LoongArch: ... In the Linux kernel, the following vulnerability has been resolved: LoongArch: mm: Add p?d_leaf() definitions When I do LTP test, LTP test case ksm06 caused panic at break_ksm_pmd_entry -> pmd_leaf (Huge page table but False) -> pte_present (panic) The reason is pmd_leaf() is not defined, So like commit 501b81046701 ("mips: mm: add p?d_leaf() definitions") add p?d_l

CVE-2024-50210 [MEDIUM] CVE-2024-50210: linux - In the Linux kernel, the following vulnerability has been resolved: posix-clock... In the Linux kernel, the following vulnerability has been resolved: posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() If get_clock_desc() succeeds, it calls fget() for the clockid's fd, and get the clk->rwsem read lock, so the error path should release the lock to make the lock balance and fput the clockid's fd to make the refcount balance and r

CVE-2024-35953 [MEDIUM] CVE-2024-35953: linux - In the Linux kernel, the following vulnerability has been resolved: accel/ivpu:... In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix deadlock in context_xa ivpu_device->context_xa is locked both in kernel thread and IRQ context. It requires XA_FLAGS_LOCK_IRQ flag to be passed during initialization otherwise the lock could be acquired from a thread and interrupted by an IRQ that locks it for the second time causing

CVE-2021-47622 [MEDIUM] CVE-2021-47622: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: ... In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: Fix a deadlock in the error handler The following deadlock has been observed on a test setup: - All tags allocated - The SCSI error handler calls ufshcd_eh_host_reset_handler() - ufshcd_eh_host_reset_handler() queues work that calls ufshcd_err_handler() - ufshcd_err_handler() locks up as

CVE-2025-39676 [MEDIUM] CVE-2025-39676: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: qla4x... In the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: Prevent a potential error pointer dereference The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating the error pointers will lead to an Oops in the caller, so change the error pointers to NULL. Scope: local

CVE-2025-38664 [MEDIUM] CVE-2025-38664: linux - In the Linux kernel, the following vulnerability has been resolved: ice: Fix a ... In the Linux kernel, the following vulnerability has been resolved: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() Add check for the return value of devm_kmemdup() to prevent potential null pointer dereference. Scope: local bookworm: resolved (fixed in 6.1.148-1) bullseye: resolved (fixed in 5.10.244-1) forky: resolved (fixed in 6.16.3-1) sid: resolv

CVE-2024-57944 [MEDIUM] CVE-2024-57944: linux - In the Linux kernel, the following vulnerability has been resolved: iio: adc: t... In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1298: Add NULL check in ads1298_init devm_kasprintf() can return a NULL pointer on failure. A check on the return value of such a call in ads1298_init() is missing. Add it. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.12.10-1) sid: resolved (fixed in

CVE-2025-37953 [MEDIUM] CVE-2025-37953: linux - In the Linux kernel, the following vulnerability has been resolved: sch_htb: ma... In the Linux kernel, the following vulnerability has been resolved: sch_htb: make htb_deactivate() idempotent Alan reported a NULL pointer dereference in htb_next_rb_node() after we made htb_qlen_notify() idempotent. It turns out in the following case it introduced some regression: htb_dequeue_tree(): |-> fq_codel_dequeue() |-> qdisc_tree_reduce_backlog() |-> htb_ql

CVE-2025-37983 [MEDIUM] CVE-2025-37983: linux - In the Linux kernel, the following vulnerability has been resolved: qibfs: fix ... In the Linux kernel, the following vulnerability has been resolved: qibfs: fix _another_ leak failure to allocate inode => leaked dentry... this one had been there since the initial merge; to be fair, if we are that far OOM, the odds of failing at that particular allocation are low... Scope: local bookworm: resolved (fixed in 6.1.137-1) bullseye: resolved (fixed in

CVE-2023-53350 [MEDIUM] CVE-2023-53350: linux - In the Linux kernel, the following vulnerability has been resolved: accel/qaic:... In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Fix slicing memory leak The temporary buffer storing slicing configuration data from user is only freed on error. This is a memory leak. Free the buffer unconditionally. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.4.13-1) sid: resolved (fixed in 6.4.13-

CVE-2025-38363 [MEDIUM] CVE-2025-38363: linux - In the Linux kernel, the following vulnerability has been resolved: drm/tegra: ... In the Linux kernel, the following vulnerability has been resolved: drm/tegra: Fix a possible null pointer dereference In tegra_crtc_reset(), new memory is allocated with kzalloc(), but no check is performed. Before calling __drm_atomic_helper_crtc_reset, state should be checked to prevent possible null pointer dereference. Scope: local bookworm: resolved (fixed in

CVE-2025-38012 [MEDIUM] CVE-2025-38012: linux - In the Linux kernel, the following vulnerability has been resolved: sched_ext: ... In the Linux kernel, the following vulnerability has been resolved: sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator BPF programs may call next() and destroy() on BPF iterators even after new() returns an error value (e.g. bpf_for_each() macro ignores error returns from new()). bpf_iter_scx_dsq_new() could leave the iterator in an uninitialized st

CVE-2023-53008 [MEDIUM] CVE-2023-53008: linux - In the Linux kernel, the following vulnerability has been resolved: cifs: fix p... In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential memory leaks in session setup Make sure to free cifs_ses::auth_key.response before allocating it as we might end up leaking memory in reconnect or mounting. Scope: local bookworm: resolved (fixed in 6.1.11-1) bullseye: open forky: resolved (fixed in 6.1.11-1) sid: resolved (fixed

CVE-2022-50077 [MEDIUM] CVE-2022-50077: linux - In the Linux kernel, the following vulnerability has been resolved: apparmor: f... In the Linux kernel, the following vulnerability has been resolved: apparmor: fix reference count leak in aa_pivotroot() The aa_pivotroot() function has a reference counting bug in a specific path. When aa_replace_current_label() returns on success, the function forgets to decrement the reference count of “target”, which is increased earlier by build_pivotroot(), ca

CVE-2022-49829 [MEDIUM] CVE-2022-49829: linux - In the Linux kernel, the following vulnerability has been resolved: drm/schedul... In the Linux kernel, the following vulnerability has been resolved: drm/scheduler: fix fence ref counting We leaked dependency fences when processes were beeing killed. Additional to that grab a reference to the last scheduled fence. Scope: local bookworm: resolved (fixed in 6.0.10-1) bullseye: open forky: resolved (fixed in 6.0.10-1) sid: resolved (fixed in 6.0.10-

CVE-2025-38546 [MEDIUM] CVE-2025-38546: linux - In the Linux kernel, the following vulnerability has been resolved: atm: clip: ... In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix memory leak of struct clip_vcc. ioctl(ATMARP_MKIP) allocates struct clip_vcc and set it to vcc->user_back. The code assumes that vcc_destroy_socket() passes NULL skb to vcc->push() when the socket is close()d, and then clip_push() frees clip_vcc. However, ioctl(ATMARPD_CTRL) sets NULL

CVE-2022-50152 [MEDIUM] CVE-2022-50152: linux - In the Linux kernel, the following vulnerability has been resolved: usb: ohci-n... In the Linux kernel, the following vulnerability has been resolved: usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: resolved

CVE-2022-50104 [MEDIUM] CVE-2022-50104: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/xiv... In the Linux kernel, the following vulnerability has been resolved: powerpc/xive: Fix refcount leak in xive_get_max_prio of_find_node_by_path() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: resolved (fixed in

CVE-2022-50153 [MEDIUM] CVE-2022-50153: linux - In the Linux kernel, the following vulnerability has been resolved: usb: host: ... In the Linux kernel, the following vulnerability has been resolved: usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: resolved (fixe