Debian Linux vulnerabilities

CVE-2022-50843 CVE-2022-50843: linux - In the Linux kernel, the following vulnerability has been resolved: dm clone: F... In the Linux kernel, the following vulnerability has been resolved: dm clone: Fix UAF in clone_dtr() Dm_clone also has the same UAF problem when dm_resume() and dm_destroy() are concurrent. Therefore, cancelling timer again in clone_dtr(). Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.4-1) sid: resol

CVE-2025-40116 CVE-2025-40116: linux - In the Linux kernel, the following vulnerability has been resolved: usb: host: ... In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup The kthread_run() function returns error pointers so the max3421_hcd->spi_thread pointer can be either error pointers or NULL. Check for both before dereferencing it. Scope: local bookworm: resolved (fixed in 6.1.158-1) bullseye: resolved

CVE-2023-54230 CVE-2023-54230: linux - In the Linux kernel, the following vulnerability has been resolved: amba: bus: ... In the Linux kernel, the following vulnerability has been resolved: amba: bus: fix refcount leak commit 5de1540b7bc4 ("drivers/amba: create devices from device tree") increases the refcount of of_node, but not releases it in amba_device_release, so there is refcount leak. By using of_node_put to avoid refcount leak. Scope: local bookworm: resolved (fixed in 6.1.55-1) bullsey

CVE-2022-50734 CVE-2022-50734: linux - In the Linux kernel, the following vulnerability has been resolved: nvmem: core... In the Linux kernel, the following vulnerability has been resolved: nvmem: core: Fix memleak in nvmem_register() dev_set_name will alloc memory for nvmem->dev.kobj.name in nvmem_register, when nvmem_validate_keepouts failed, nvmem's memory will be freed and return, but nobody will free memory for nvmem->dev.kobj.name, there will be memleak, so moving nvmem_validate_keepouts(

CVE-2025-40188 CVE-2025-40188: linux - In the Linux kernel, the following vulnerability has been resolved: pwm: berlin... In the Linux kernel, the following vulnerability has been resolved: pwm: berlin: Fix wrong register in suspend/resume The 'enable' register should be BERLIN_PWM_EN rather than BERLIN_PWM_ENABLE, otherwise, the driver accesses wrong address, there will be cpu exception then kernel panic during suspend/resume. Scope: local bookworm: resolved (fixed in 6.1.158-1) bullseye: reso

CVE-2022-50835 CVE-2022-50835: linux - In the Linux kernel, the following vulnerability has been resolved: jbd2: add m... In the Linux kernel, the following vulnerability has been resolved: jbd2: add miss release buffer head in fc_do_one_pass() In fc_do_one_pass() miss release buffer head after use which will lead to reference count leak. Scope: local bookworm: resolved (fixed in 6.0.3-1) bullseye: resolved (fixed in 5.10.158-1) forky: resolved (fixed in 6.0.3-1) sid: resolved (fixed in 6.0.3-1

CVE-2022-50703 CVE-2022-50703: linux - In the Linux kernel, the following vulnerability has been resolved: soc: qcom: ... In the Linux kernel, the following vulnerability has been resolved: soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe() There are two refcount leak bugs in qcom_smsm_probe(): (1) The 'local_node' is escaped out from for_each_child_of_node() as the break of iteration, we should call of_node_put() for it in error path or when it is not used anymore. (2) The 'node' is

CVE-2022-50820 CVE-2022-50820: linux - In the Linux kernel, the following vulnerability has been resolved: perf/arm_dm... In the Linux kernel, the following vulnerability has been resolved: perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init() dmc620_pmu_init() won't remove the callback added by cpuhp_setup_state_multi() when platform_driver_register() failed. Remove the callback by cpuhp_remove_multi_state() in fail path. Similar to the handling of arm_ccn_init() in commit 26242b3300

CVE-2022-50772 CVE-2022-50772: linux - In the Linux kernel, the following vulnerability has been resolved: netdevsim: ... In the Linux kernel, the following vulnerability has been resolved: netdevsim: fix memory leak in nsim_bus_dev_new() If device_register() failed in nsim_bus_dev_new(), the value of reference in nsim_bus_dev->dev is 1. obj->name in nsim_bus_dev->dev will not be released. unreferenced object 0xffff88810352c480 (size 16): comm "echo", pid 5691, jiffies 4294945921 (age 133.270s)

CVE-2026-23440 [LOW] CVE-2026-23440: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: ... In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix race condition during IPSec ESN update In IPSec full offload mode, the device reports an ESN (Extended Sequence Number) wrap event to the driver. The driver validates this event by querying the IPSec ASO and checking that the esn_event_arm field is 0x0, which indicates an event has occur

CVE-2022-50574 CVE-2022-50574: linux - In the Linux kernel, the following vulnerability has been resolved: drm/omap: d... In the Linux kernel, the following vulnerability has been resolved: drm/omap: dss: Fix refcount leak bugs In dss_init_ports() and __dss_uninit_ports(), we should call of_node_put() for the reference returned by of_graph_get_port_by_id() in fail path or when it is not used anymore. Scope: local bookworm: resolved (fixed in 6.0.3-1) bullseye: resolved (fixed in 5.10.158-1) for

CVE-2022-50886 CVE-2022-50886: linux - In the Linux kernel, the following vulnerability has been resolved: mmc: toshsd... In the Linux kernel, the following vulnerability has been resolved: mmc: toshsd: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value

CVE-2022-50866 CVE-2022-50866: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: pxa: ... In the Linux kernel, the following vulnerability has been resolved: ASoC: pxa: fix null-pointer dereference in filter() kasprintf() would return NULL pointer when kmalloc() fail to allocate. Need to check the return pointer before calling strcmp(). Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.4-1) s

CVE-2022-50646 CVE-2022-50646: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa:... In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa: Fix possible memory leak in hpsa_init_one() The hpda_alloc_ctlr_info() allocates h and its field reply_map. However, in hpsa_init_one(), if alloc_percpu() failed, the hpsa_init_one() jumps to clean1 directly, which frees h and leaks the h->reply_map. Fix by calling hpda_free_ctlr_info() to releas

CVE-2025-40056 CVE-2025-40056: linux - In the Linux kernel, the following vulnerability has been resolved: vhost: vrin... In the Linux kernel, the following vulnerability has been resolved: vhost: vringh: Fix copy_to_iter return value check The return value of copy_to_iter can't be negative, check whether the copied length is equal to the requested length instead of checking for negative values. Scope: local bookworm: resolved (fixed in 6.1.158-1) bullseye: resolved forky: resolved (fixed in 6.

CVE-2023-53719 CVE-2023-53719: linux - In the Linux kernel, the following vulnerability has been resolved: serial: arc... In the Linux kernel, the following vulnerability has been resolved: serial: arc_uart: fix of_iomap leak in `arc_serial_probe` Smatch reports: drivers/tty/serial/arc_uart.c:631 arc_serial_probe() warn: 'port->membase' from of_iomap() not released on lines: 631. In arc_serial_probe(), if uart_add_one_port() fails, port->membase is not released, which would cause a resource lea

CVE-2023-53783 CVE-2023-53783: linux - In the Linux kernel, the following vulnerability has been resolved: blk-iocost:... In the Linux kernel, the following vulnerability has been resolved: blk-iocost: fix divide by 0 error in calc_lcoefs() echo max of u64 to cost.model can cause divide by 0 error. # echo 8:0 rbps=18446744073709551615 > /sys/fs/cgroup/io.cost.model divide error: 0000 [#1] PREEMPT SMP RIP: 0010:calc_lcoefs+0x4c/0xc0 Call Trace: ioc_refresh_params+0x2b3/0x4f0 ioc_cost_model_write

CVE-2025-40059 [LOW] CVE-2025-40059: linux - In the Linux kernel, the following vulnerability has been resolved: coresight: ... In the Linux kernel, the following vulnerability has been resolved: coresight: Fix incorrect handling for return value of devm_kzalloc The return value of devm_kzalloc could be an null pointer, use "!desc.pdata" to fix incorrect handling return value of devm_kzalloc. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.17.6-1) sid: resolved (f

CVE-2025-40057 CVE-2025-40057: linux - In the Linux kernel, the following vulnerability has been resolved: ptp: Add a ... In the Linux kernel, the following vulnerability has been resolved: ptp: Add a upper bound on max_vclocks syzbot reported WARNING in max_vclocks_store. This occurs when the argument max is too large for kcalloc to handle. Extend the guard to guard against values that are too large for kcalloc Scope: local bookworm: open bullseye: resolved forky: resolved (fixed in 6.17.6-1)

CVE-2023-53708 CVE-2023-53708: linux - In the Linux kernel, the following vulnerability has been resolved: ACPI: x86: ... In the Linux kernel, the following vulnerability has been resolved: ACPI: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects If a badly constructed firmware includes multiple `ACPI_TYPE_PACKAGE` objects while evaluating the AMD LPS0 _DSM, there will be a memory leak. Explicitly guard against this. Scope: local bookworm: resolved (fixed in 6.1.55-1) bullseye: resolved fork