Debian Linux vulnerabilities

CVE-2023-53826 CVE-2023-53826: linux - In the Linux kernel, the following vulnerability has been resolved: ubi: Fix UA... In the Linux kernel, the following vulnerability has been resolved: ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() Wear-leveling entry could be freed in error path, which may be accessed again in eraseblk_count_seq_show(), for example: __erase_worker eraseblk_count_seq_show wl = ubi->lookuptbl[*block_number] if (wl) wl_entry_destroy ubi->lookuptbl[e->pnum] = N

CVE-2022-50810 CVE-2022-50810: linux - In the Linux kernel, the following vulnerability has been resolved: rapidio: de... In the Linux kernel, the following vulnerability has been resolved: rapidio: devices: fix missing put_device in mport_cdev_open When kfifo_alloc fails, the refcount of chdev->dev is left incremental. We should use put_device(&chdev->dev) to decrease the ref count of chdev->dev to avoid refcount leak. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixe

CVE-2022-50823 CVE-2022-50823: linux - In the Linux kernel, the following vulnerability has been resolved: clk: tegra:... In the Linux kernel, the following vulnerability has been resolved: clk: tegra: Fix refcount leak in tegra114_clock_init of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Scope: local bookworm: resolved (fixed in 6.0.3-1) bullseye: resolved (fixe

CVE-2022-50724 CVE-2022-50724: linux - In the Linux kernel, the following vulnerability has been resolved: regulator: ... In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix resource leak in regulator_register() I got some resource leak reports while doing fault injection test: OF: ERROR: memory leak, expected refcount 1 instead of 100, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /i2c/pmic@64/regulators/buck1 unreferenced

CVE-2023-53830 CVE-2023-53830: linux - In the Linux kernel, the following vulnerability has been resolved: platform/x8... In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix memory leak when showing current settings When retriving a item string with tlmi_setting(), the result has to be freed using kfree(). In current_value_show() however, malformed item strings are not freed, causing a memory leak. Fix this by eliminating the early return responsible

CVE-2022-50667 CVE-2022-50667: linux - In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx:... In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl() If the copy of the description string from userspace fails, then the page for the instance descriptor doesn't get freed before returning -EFAULT, which leads to a memleak. Scope: local bookworm: resolved (fixed in 6.0.3-1) bullseye: resolved forky: resol

CVE-2022-50641 CVE-2022-50641: linux - In the Linux kernel, the following vulnerability has been resolved: HSI: omap_s... In the Linux kernel, the following vulnerability has been resolved: HSI: omap_ssi: Fix refcount leak in ssi_probe When returning or breaking early from a for_each_available_child_of_node() loop, we need to explicitly call of_node_put() on the child node to possibly release the node. Scope: local bookworm: resolved (fixed in 6.0.3-1) bullseye: resolved (fixed in 5.10.158-1) f

CVE-2022-50825 CVE-2022-50825: linux - In the Linux kernel, the following vulnerability has been resolved: usb: typec:... In the Linux kernel, the following vulnerability has been resolved: usb: typec: wusb3801: fix fwnode refcount leak in wusb3801_probe() I got the following report while doing fault injection test: OF: ERROR: memory leak, expected refcount 1 instead of 4, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /i2c/tcpc@60/connector If wusb3801_hw_init

CVE-2022-50626 CVE-2022-50626: linux - In the Linux kernel, the following vulnerability has been resolved: media: dvb-... In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: fix memory leak in dvb_usb_adapter_init() Syzbot reports a memory leak in "dvb_usb_adapter_init()". The leak is due to not accounting for and freeing current iteration's adapter->priv in case of an error. Currently if an error occurs, it will exit before incrementing "num_adapters_initalized"

CVE-2013-4512 [MEDIUM] CVE-2013-4512: linux - Buffer overflow in the exitcode_proc_write function in arch/um/kernel/exitcode.c... Buffer overflow in the exitcode_proc_write function in arch/um/kernel/exitcode.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact by leveraging root privileges for a write operation. Scope: local bookworm: resolved (fixed in 3.11.8-1) bullseye: resolved (fixed in 3.11.8-1) forky: resolved (fixed

CVE-2022-50834 CVE-2022-50834: linux - In the Linux kernel, the following vulnerability has been resolved: nfc: Fix po... In the Linux kernel, the following vulnerability has been resolved: nfc: Fix potential resource leaks nfc_get_device() take reference for the device, add missing nfc_put_device() to release it when not need anymore. Also fix the style warnning by use error EOPNOTSUPP instead of ENOTSUPP. Scope: local bookworm: resolved (fixed in 6.1.7-1) bullseye: resolved (fixed in 5.10.178

CVE-2022-50824 CVE-2022-50824: linux - In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_ti... In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak In check_acpi_tpm2(), we get the TPM2 table just to make sure the table is there, not used after the init, so the acpi_put_table() should be added to release the ACPI memory. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved

CVE-2022-50742 CVE-2022-50742: linux - In the Linux kernel, the following vulnerability has been resolved: misc: ocxl:... In the Linux kernel, the following vulnerability has been resolved: misc: ocxl: fix possible refcount leak in afu_ioctl() eventfd_ctx_put need to be called to put the refcount that gotten by eventfd_ctx_fdget when ocxl_irq_set_handler fails. Scope: local bookworm: resolved (fixed in 6.0.3-1) bullseye: resolved (fixed in 5.10.158-1) forky: resolved (fixed in 6.0.3-1) sid: res

CVE-2025-40339 CVE-2025-40339: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix nullptr err of vm_handle_moved If a amdgpu_bo_va is fpriv->prt_va, the bo of this one is always NULL. So, such kind of amdgpu_bo_va should be updated separately before amdgpu_vm_handle_moved. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 6.17.8-1) sid: resolved (fixed i

CVE-2022-50775 CVE-2022-50775: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: F... In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix refcount leak in hns_roce_mmap rdma_user_mmap_entry_get_pgoff() takes the reference. Add missing rdma_user_mmap_entry_put() to release the reference. Acked-by Haoyue Xu Scope: local bookworm: resolved (fixed in 6.1.20-1) bullseye: resolved forky: resolved (fixed in 6.1.20-1) sid: resolved (fixe

CVE-2025-40022 CVE-2025-40022: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: af_... In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Commit 1b34cbbf4f01 ("crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg") changed some fields from bool to 1-bit bitfields of type u32. However, some assignments to these fields, specifically 'more' and 'merge', assign values greater tha

CVE-2023-54055 CVE-2023-54055: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma:... In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix memory leak of PBLE objects On rmmod of irdma, the PBLE object memory is not being freed. PBLE object memory are not statically pre-allocated at function initialization time unlike other HMC objects. PBLEs objects and the Segment Descriptors (SD) for it can be dynamically allocated during sca

CVE-2013-2899 [MEDIUM] CVE-2013-2899: linux - drivers/hid/hid-picolcd_core.c in the Human Interface Device (HID) subsystem in ... drivers/hid/hid-picolcd_core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_PICOLCD is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted device. Scope: local bookworm: resolved (fixed in 3.10.11-1) bullseye: resolved (fixed in 3.10.11-1) forky

CVE-2022-50809 CVE-2022-50809: linux - In the Linux kernel, the following vulnerability has been resolved: xhci: dbc: ... In the Linux kernel, the following vulnerability has been resolved: xhci: dbc: Fix memory leak in xhci_alloc_dbc() If DbC is already in use, then the allocated memory for the xhci_dbc struct doesn't get freed before returning NULL, which leads to a memleak. Scope: local bookworm: resolved (fixed in 6.0.3-1) bullseye: resolved forky: resolved (fixed in 6.0.3-1) sid: resolved

CVE-2022-50859 CVE-2022-50859: linux - In the Linux kernel, the following vulnerability has been resolved: cifs: Fix t... In the Linux kernel, the following vulnerability has been resolved: cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message Commit d5c7076b772a ("smb3: add smb3.1.1 to default dialect list") extend the dialects from 3 to 4, but forget to decrease the extended length when specific the dialect, then the message length is larger than expected. This maybe leak some info th