Debian Linux vulnerabilities

CVE-2023-53478 [MEDIUM] CVE-2023-53478: linux - In the Linux kernel, the following vulnerability has been resolved: tracing/syn... In the Linux kernel, the following vulnerability has been resolved: tracing/synthetic: Fix races on freeing last_cmd Currently, the "last_cmd" variable can be accessed by multiple processes asynchronously when multiple users manipulate synthetic_events node at the same time, it could lead to use-after-free or double-free. This patch add "lastcmd_mutex" to prevent "l

CVE-2023-53581 [MEDIUM] CVE-2023-53581: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: ... In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Check for NOT_READY flag state after locking Currently the check for NOT_READY flag is performed before obtaining the necessary lock. This opens a possibility for race condition when the flow is concurrently removed from unready_flows list by the workqueue task, which causes a double-remo

CVE-2025-38217 [MEDIUM] CVE-2025-38217: linux - In the Linux kernel, the following vulnerability has been resolved: hwmon: (fts... In the Linux kernel, the following vulnerability has been resolved: hwmon: (ftsteutates) Fix TOCTOU race in fts_read() In the fts_read() function, when handling hwmon_pwm_auto_channels_temp, the code accesses the shared variable data->fan_source[channel] twice without holding any locks. It is first checked against FTS_FAN_SOURCE_INVALID, and if the check passes, it

CVE-2026-23167 [MEDIUM] CVE-2026-23167: linux - In the Linux kernel, the following vulnerability has been resolved: nfc: nci: F... In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix race between rfkill and nci_unregister_device(). syzbot reported the splat below [0] without a repro. It indicates that struct nci_dev.cmd_wq had been destroyed before nci_close_device() was called via rfkill. nci_dev.cmd_wq is only destroyed in nci_unregister_device(), which (I think)

CVE-2026-23212 [MEDIUM] CVE-2026-23212: linux - In the Linux kernel, the following vulnerability has been resolved: bonding: an... In the Linux kernel, the following vulnerability has been resolved: bonding: annotate data-races around slave->last_rx slave->last_rx and slave->target_last_arp_rx[...] can be read and written locklessly. Add READ_ONCE() and WRITE_ONCE() annotations. syzbot reported: BUG: KCSAN: data-race in bond_rcv_validate / bond_rcv_validate write to 0xffff888149f0d428 of 8 byte

CVE-2026-23126 [MEDIUM] CVE-2026-23126: linux - In the Linux kernel, the following vulnerability has been resolved: netdevsim: ... In the Linux kernel, the following vulnerability has been resolved: netdevsim: fix a race issue related to the operation on bpf_bound_progs list The netdevsim driver lacks a protection mechanism for operations on the bpf_bound_progs list. When the nsim_bpf_create_prog() performs list_add_tail, it is possible that nsim_bpf_destroy_prog() is simultaneously performs li

CVE-2023-53329 [MEDIUM] CVE-2023-53329: linux - In the Linux kernel, the following vulnerability has been resolved: workqueue: ... In the Linux kernel, the following vulnerability has been resolved: workqueue: fix data race with the pwq->stats[] increment KCSAN has discovered a data race in kernel/workqueue.c:2598: [ 1863.554079] ================================================================== [ 1863.554118] BUG: KCSAN: data-race in process_one_work / process_one_work [ 1863.554142] write to

CVE-2019-19318 [MEDIUM] CVE-2019-19318: linux - In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rw... In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can_spin_on_owner in kernel/locking/rwsem.c) rwsem_owner_flags returns an already freed pointer, Scope: local bookworm: resolved (fixed in 5.4.6-1) bullseye: resolved (fixed in 5.4.6-1) forky: resolved (fixed in 5.4.6-1) sid: resol

CVE-2020-0067 [MEDIUM] CVE-2020-0067: linux - In f2fs_xattr_generic_list of xattr.c, there is a possible out of bounds read du... In f2fs_xattr_generic_list of xattr.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not required for exploitation.Product: Android. Versions: Android kernel. Android ID: A-120551147. Scope: local bookworm: resolved (fixed in 5.5.13-1) b

CVE-2019-15030 [MEDIUM] CVE-2019-15030: linux - In the Linux kernel through 5.2.14 on the powerpc platform, a local user can rea... In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable exception. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be cor

CVE-2023-42756 [MEDIUM] CVE-2023-42756: linux - A flaw was found in the Netfilter subsystem of the Linux kernel. A race conditio... A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local user to crash the system. Scope: local bookworm: resolved (fixed in 6.1.55-1) bullseye: resolved (fixed in 5.10.197-1) forky: resol

CVE-2019-9445 [MEDIUM] CVE-2019-9445: linux - In the Android kernel in F2FS driver there is a possible out of bounds read due ... In the Android kernel in F2FS driver there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved (fixed in 5.2.6-1) s

CVE-2024-42154 [MEDIUM] CVE-2024-42154: linux - In the Linux kernel, the following vulnerability has been resolved: tcp_metrics... In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: validate source addr length I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry for this attribute at all (neither does it for IPv6 but v6 is manually validated). Scope: local bookworm: resolved (fixed in 6.1.98-1

CVE-2021-4159 [MEDIUM] CVE-2021-4159: linux - A vulnerability was found in the Linux kernel's EBPF verifier when handling inte... A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. Scope: local bookwo

CVE-2020-27418 [MEDIUM] CVE-2020-27418: linux - A Use After Free vulnerability in Fedora Linux kernel 5.9.0-rc9 allows attackers... A Use After Free vulnerability in Fedora Linux kernel 5.9.0-rc9 allows attackers to obatin sensitive information via vgacon_invert_region() function. Scope: local bookworm: resolved (fixed in 5.5.13-1) bullseye: resolved (fixed in 5.5.13-1) forky: resolved (fixed in 5.5.13-1) sid: resolved (fixed in 5.5.13-1) trixie: resolved (fixed in 5.5.13-1)

CVE-2021-39657 [MEDIUM] CVE-2021-39657: linux - In ufshcd_eh_device_reset_handler of ufshcd.c, there is a possible out of bounds... In ufshcd_eh_device_reset_handler of ufshcd.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-194696049References: Upstream kernel Scope: local bookworm:

CVE-2023-47233 [MEDIUM] CVE-2023-47233: linux - The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_... The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in the device unplugging (disconnect the USB by hotplug) code. For physically proximate attackers with local access, this "could be exploited in a real world scenario." This is related to brcmf_cfg80211_escan_timeout_worker in drivers/net/wireless/broadcom/brcm80211

CVE-2022-1974 [MEDIUM] CVE-2022-1974: linux - A use-after-free flaw was found in the Linux kernel's NFC core functionality due... A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition between kobject creation and delete. This vulnerability allows a local attacker with CAP_NET_ADMIN privilege to leak kernel information. Scope: local bookworm: resolved (fixed in 5.17.11-1) bullseye: resolved (fixed in 5.10.120-1) forky: resolved (fixed in 5.17.11-1) s

CVE-2014-1690 [LOW] CVE-2014-1690: linux - The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.... The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers to obtain sensitive information from kernel memory by establishing an IRC DCC session in which incorrect packet data is transmitted during use of the NAT mangle feature. Scope: local bookworm: resolved (fixed in 3.12.8-1) bullseye: resolved (fixed in 3.12.8-1) forky:

CVE-2024-50170 [MEDIUM] CVE-2024-50170: linux - In the Linux kernel, the following vulnerability has been resolved: net: bcmasp... In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix potential memory leak in bcmasp_xmit() The bcmasp_xmit() returns NETDEV_TX_OK without freeing skb in case of mapping fails, add dev_kfree_skb() to fix it. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.11.6-1) sid: resolved (fixed in 6.11.6-1) trixie: