Debian Linux vulnerabilities

CVE-2026-23257 CVE-2026-23257: linux - In the Linux kernel, the following vulnerability has been resolved: net: liquid... In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup In setup_nic_devices(), the initialization loop jumps to the label setup_nic_dev_free on failure. The current cleanup loop while(i--) skip the failing index i, causing a memory leak. Fix this by changing the loop to iterate from the curren

CVE-2026-23421 [LOW] CVE-2026-23421: linux - In the Linux kernel, the following vulnerability has been resolved: drm/xe/conf... In the Linux kernel, the following vulnerability has been resolved: drm/xe/configfs: Free ctx_restore_mid_bb in release ctx_restore_mid_bb memory is allocated in wa_bb_store(), but xe_config_device_release() only frees ctx_restore_post_bb. Free ctx_restore_mid_bb[0].cs as well to avoid leaking the allocation when the configfs device is removed. (cherry picked from comm

CVE-2026-23301 [LOW] CVE-2026-23301: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA:... In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add allocation failure check for Entity name Currently find_sdca_entity_iot() can allocate a string for the Entity name but it doesn't check if that allocation succeeded. Add the missing NULL check after the allocation. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fix

CVE-2026-23362 CVE-2026-23362: linux - In the Linux kernel, the following vulnerability has been resolved: can: bcm: f... In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix locking for bcm_op runtime updates Commit c2aba69d0c36 ("can: bcm: add locking for bcm_op runtime updates") added a locking for some variables that can be modified at runtime when updating the sending bcm_op with a new TX_SETUP command in bcm_tx_setup(). Usually the RX_SETUP only handles and fi

CVE-2013-2891 [MEDIUM] CVE-2013-2891: linux - drivers/hid/hid-steelseries.c in the Human Interface Device (HID) subsystem in t... drivers/hid/hid-steelseries.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_STEELSERIES is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device. Scope: local bookworm: resolved (fixed in 3.11.5-1) bullseye: resolved (fixed in 3.11.5-1) forky:

CVE-2022-48830 [MEDIUM] CVE-2022-48830: linux - In the Linux kernel, the following vulnerability has been resolved: can: isotp:... In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix potential CAN frame reception race in isotp_rcv() When receiving a CAN frame the current code logic does not consider concurrently receiving processes which do not show up in real world usage. Ziyang Xuan writes: The following syz problem is one of the scenarios. so->rx.len is change

CVE-2022-33744 [MEDIUM] CVE-2022-33744: linux - Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm... Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree to keep track of the foreign mappings. Updating of that rbtree is not always done completely with the related lock held, resulting in a small race window, which can be used by unprivileged guests via PV devices to cause inconsistencies of the rbtree. These incon

CVE-2022-3303 [MEDIUM] CVE-2022-3303: linux - A race condition flaw was found in the Linux kernel sound subsystem due to impro... A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system, resulting in a denial of service condition Scope: local bookworm: resolved (fixed in 5.19.

CVE-2025-39673 [MEDIUM] CVE-2025-39673: linux - In the Linux kernel, the following vulnerability has been resolved: ppp: fix ra... In the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in ppp_fill_forward_path ppp_fill_forward_path() has two race conditions: 1. The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_lock() is not held. If the only channel is deleted in ppp_disconnect_channel(), list_first_entry() may access an

CVE-2014-3611 [MEDIUM] CVE-2014-3611: linux - Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c i... Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through 3.17.2 allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation. Scope: local bookworm: resolved (fixed in 3.16.7-1) bullseye: resolved (fixed in 3.16.7-1) forky: resolved (fixed in 3.16.7-1) si

CVE-2025-38365 [MEDIUM] CVE-2025-38365: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix ... In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a race between renames and directory logging We have a race between a rename and directory inode logging that if it happens and we crash/power fail before the rename completes, the next time the filesystem is mounted, the log replay code will end up deleting the file that was being rename

CVE-2021-28964 [MEDIUM] CVE-2021-28964: linux - A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux... A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer before a cloning operation, aka CID-dbcc7d57bffc. Scope: local bookworm: resolved (fixed in 5.10.26-1) bullseye: resolved (fixed in 5.10.26-1) forky: resolved (

CVE-2014-4157 [MEDIUM] CVE-2014-4157: linux - arch/mips/include/asm/thread_info.h in the Linux kernel before 3.14.8 on the MIP... arch/mips/include/asm/thread_info.h in the Linux kernel before 3.14.8 on the MIPS platform does not configure _TIF_SECCOMP checks on the fast system-call path, which allows local users to bypass intended PR_SET_SECCOMP restrictions by executing a crafted application without invoking a trace or audit subsystem. Scope: local bookworm: resolved (fixed in 3.14.7-1) bullse

CVE-2025-38524 [MEDIUM] CVE-2025-38524: linux - In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ... In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix recv-recv race of completed call If a call receives an event (such as incoming data), the call gets placed on the socket's queue and a thread in recvmsg can be awakened to go and process it. Once the thread has picked up the call off of the queue, further events will cause it to be requeu

CVE-2024-42102 [MEDIUM] CVE-2024-42102: linux - In the Linux kernel, the following vulnerability has been resolved: Revert "mm/... In the Linux kernel, the following vulnerability has been resolved: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" Patch series "mm: Avoid possible overflows in dirty throttling". Dirty throttling logic assumes dirty limits in page units fit into 32-bits. This patch series makes sure this is true (see patch 2/2 for more details). This

CVE-2023-52478 [MEDIUM] CVE-2023-52478: linux - In the Linux kernel, the following vulnerability has been resolved: HID: logite... In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect hidpp_connect_event() has *four* time-of-check vs time-of-use (TOCTOU) races when it races with itself. hidpp_connect_event() primarily runs from a workqueue but it also runs on probe() and if a "device-connected" packet is received by

CVE-2021-46958 [MEDIUM] CVE-2021-46958: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix ... In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between transaction aborts and fsyncs leading to use-after-free There is a race between a task aborting a transaction during a commit, a task doing an fsync and the transaction kthread, which leads to an use-after-free of the log root tree. When this happens, it results in a stack tr

CVE-2019-19947 [MEDIUM] CVE-2019-19947: linux - In the Linux kernel through 5.4.6, there are information leaks of uninitialized ... In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in the drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c driver, aka CID-da2311a6385c. Scope: local bookworm: resolved (fixed in 5.4.8-1) bullseye: resolved (fixed in 5.4.8-1) forky: resolved (fixed in 5.4.8-1) sid: resolved (fixed in 5.4.8-1) trixie: resolved (fixe

CVE-2024-56788 [MEDIUM] CVE-2024-56788: linux - In the Linux kernel, the following vulnerability has been resolved: net: ethern... In the Linux kernel, the following vulnerability has been resolved: net: ethernet: oa_tc6: fix tx skb race condition between reference pointers There are two skb pointers to manage tx skb's enqueued from n/w stack. waiting_tx_skb pointer points to the tx skb which needs to be processed and ongoing_tx_skb pointer points to the tx skb which is being processed. SPI thr

CVE-2023-52896 [MEDIUM] CVE-2023-52896: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix ... In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between quota rescan and disable leading to NULL pointer deref If we have one task trying to start the quota rescan worker while another one is trying to disable quotas, we can end up hitting a race that results in the quota rescan worker doing a NULL pointer dereference. The steps f