Debian Linux vulnerabilities

CVE-2022-49860 [MEDIUM] CVE-2022-49860: linux - In the Linux kernel, the following vulnerability has been resolved: dmaengine: ... In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix memory leak when register device fail If device_register() fails, it should call put_device() to give up reference, the name allocated in dev_set_name() can be freed in callback function kobject_cleanup(). Scope: local bookworm: resolved (fixed in 6.0.10-1) bullseye:

CVE-2024-56712 [MEDIUM] CVE-2024-56712: linux - In the Linux kernel, the following vulnerability has been resolved: udmabuf: fi... In the Linux kernel, the following vulnerability has been resolved: udmabuf: fix memory leak on last export_udmabuf() error path In export_udmabuf(), if dma_buf_fd() fails because the FD table is full, a dma_buf owning the udmabuf has already been created; but the error handling in udmabuf_create() will tear down the udmabuf without doing anything about the containi

CVE-2024-57879 [MEDIUM] CVE-2024-57879: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: iso: Always release hdev at the end of iso_listen_bis Since hci_get_route holds the device before returning, the hdev should be released with hci_dev_put at the end of iso_listen_bis even if the function returns with an error. Scope: local bookworm: resolved bullseye: resolved forky: reso

CVE-2021-47570 [MEDIUM] CVE-2021-47570: linux - In the Linux kernel, the following vulnerability has been resolved: staging: r8... In the Linux kernel, the following vulnerability has been resolved: staging: r8188eu: fix a memory leak in rtw_wx_read32() Free "ptmp" before returning -EINVAL. Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved forky: resolved (fixed in 5.15.15-1) sid: resolved (fixed in 5.15.15-1) trixie: resolved (fixed in 5.15.15-1)

CVE-2022-49971 [MEDIUM] CVE-2022-49971: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm:... In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Fix a potential gpu_metrics_table memory leak Memory is allocated for gpu_metrics_table in smu_v13_0_4_init_smc_tables(), but not freed in smu_v13_0_4_fini_smc_tables(). This may cause memory leaks, fix it. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: resolved forky: reso

CVE-2023-53359 [MEDIUM] CVE-2023-53359: linux - In the Linux kernel, the following vulnerability has been resolved: USB: fix me... In the Linux kernel, the following vulnerability has been resolved: USB: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. Scope: local bookworm: reso

CVE-2023-53127 [MEDIUM] CVE-2023-53127: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3m... In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix expander node leak in mpi3mr_remove() Add a missing resource clean up in .remove. Scope: local bookworm: resolved (fixed in 6.1.25-1) bullseye: resolved forky: resolved (fixed in 6.1.25-1) sid: resolved (fixed in 6.1.25-1) trixie: resolved (fixed in 6.1.25-1)

CVE-2023-53132 [MEDIUM] CVE-2023-53132: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3m... In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove() Free mpi3mr_hba_port at .remove. Scope: local bookworm: resolved (fixed in 6.1.25-1) bullseye: resolved forky: resolved (fixed in 6.1.25-1) sid: resolved (fixed in 6.1.25-1) trixie: resolved (fixed in 6.1.25-1)

CVE-2023-53126 [MEDIUM] CVE-2023-53126: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3m... In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix sas_hba.phy memory leak in mpi3mr_remove() Free mrioc->sas_hba.phy at .remove. Scope: local bookworm: resolved (fixed in 6.1.25-1) bullseye: resolved forky: resolved (fixed in 6.1.25-1) sid: resolved (fixed in 6.1.25-1) trixie: resolved (fixed in 6.1.25-1)

CVE-2025-38612 [MEDIUM] CVE-2025-38612: linux - In the Linux kernel, the following vulnerability has been resolved: staging: fb... In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() In the error paths after fb_info structure is successfully allocated, the memory allocated in fb_deferred_io_init() for info->pagerefs is not freed. Fix that by adding the cleanup function on the error path. Scope: local bookworm

CVE-2021-47091 [MEDIUM] CVE-2021-47091: linux - In the Linux kernel, the following vulnerability has been resolved: mac80211: f... In the Linux kernel, the following vulnerability has been resolved: mac80211: fix locking in ieee80211_start_ap error path We need to hold the local->mtx to release the channel context, as even encoded by the lockdep_assert_held() there. Fix it. Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved (fixed in 5.10.92-1) forky: resolved (fixed in 5.1

CVE-2025-37980 [MEDIUM] CVE-2025-37980: linux - In the Linux kernel, the following vulnerability has been resolved: block: fix ... In the Linux kernel, the following vulnerability has been resolved: block: fix resource leak in blk_register_queue() error path When registering a queue fails after blk_mq_sysfs_register() is successful but the function later encounters an error, we need to clean up the blk_mq_sysfs resources. Add the missing blk_mq_sysfs_unregister() call in the error path to prope

CVE-2023-54031 [MEDIUM] CVE-2023-54031: linux - In the Linux kernel, the following vulnerability has been resolved: vdpa: Add q... In the Linux kernel, the following vulnerability has been resolved: vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_o

CVE-2023-53014 [MEDIUM] CVE-2023-53014: linux - In the Linux kernel, the following vulnerability has been resolved: dmaengine: ... In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra: Fix memory leak in terminate_all() Terminate vdesc when terminating an ongoing transfer. This will ensure that the vdesc is present in the desc_terminated list The descriptor will be freed later in desc_free_list(). This fixes the memory leaks which can happen when terminating an o

CVE-2022-50106 [MEDIUM] CVE-2022-50106: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/cel... In the Linux kernel, the following vulnerability has been resolved: powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address of_get_next_parent() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() in the error path to avoid refcount leak. Scope: local bookworm: resolved (fixed

CVE-2022-50140 [MEDIUM] CVE-2022-50140: linux - In the Linux kernel, the following vulnerability has been resolved: memstick/ms... In the Linux kernel, the following vulnerability has been resolved: memstick/ms_block: Fix a memory leak 'erased_blocks_bitmap' is never freed. As it is allocated at the same time as 'used_blocks_bitmap', it is likely that it should be freed also at the same time. Add the corresponding bitmap_free() in msb_data_clear(). Scope: local bookworm: resolved (fixed in 6.0.

CVE-2022-50139 [MEDIUM] CVE-2022-50139: linux - In the Linux kernel, the following vulnerability has been resolved: usb: aspeed... In the Linux kernel, the following vulnerability has been resolved: usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc() We should call of_node_put() for the reference returned by of_get_child_by_name() which has increased the refcount. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: resolved (fixed in 5.10.140-1) forky: resolved (fixed in 6.

CVE-2022-50119 [MEDIUM] CVE-2022-50119: linux - In the Linux kernel, the following vulnerability has been resolved: rpmsg: Fix ... In the Linux kernel, the following vulnerability has been resolved: rpmsg: Fix possible refcount leak in rpmsg_register_device_override() rpmsg_register_device_override need to call put_device to free vch when driver_set_override fails. Fix this by adding a put_device() to the error path. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: resolved (fixed i

CVE-2022-49774 [MEDIUM] CVE-2022-49774: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: x86/xe... In the Linux kernel, the following vulnerability has been resolved: KVM: x86/xen: Fix eventfd error handling in kvm_xen_eventfd_assign() Should not call eventfd_ctx_put() in case of error. [Introduce new goto target instead. - Paolo] Scope: local bookworm: resolved (fixed in 6.0.10-1) bullseye: resolved forky: resolved (fixed in 6.0.10-1) sid: resolved (fixed in 6.0

CVE-2022-50146 [MEDIUM] CVE-2022-50146: linux - In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: D... In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors If dw_pcie_ep_init() fails to perform any action after the EPC memory is initialized and the MSI memory region is allocated, the latter parts won't be undone thus causing a memory leak. Add a cleanup-on-error path to fix these leaks. [bhelg