Debian Linux vulnerabilities

CVE-2023-54064 CVE-2023-54064: linux - In the Linux kernel, the following vulnerability has been resolved: ipmi:ssif: ... In the Linux kernel, the following vulnerability has been resolved: ipmi:ssif: Fix a memory leak when scanning for an adapter The adapter scan ssif_info_find() sets info->adapter_name if the adapter info came from SMBIOS, as it's not set in that case. However, this function can be called more than once, and it will leak the adapter name if it had already been set. So check f

CVE-2025-68763 [LOW] CVE-2025-68763: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: sta... In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Correctly handle return of sg_nents_for_len The return value of sg_nents_for_len was assigned to an unsigned long in starfive_hash_digest, causing negative error codes to be converted to large positive integers. Add error checking for sg_nents_for_len and return immediately on failur

CVE-2025-40298 [LOW] CVE-2025-40298: linux - In the Linux kernel, the following vulnerability has been resolved: gve: Implem... In the Linux kernel, the following vulnerability has been resolved: gve: Implement settime64 with -EOPNOTSUPP ptp_clock_settime() assumes every ptp_clock has implemented settime64(). Stub it with -EOPNOTSUPP to prevent a NULL dereference. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.17.8-1) sid: resolved (fixed in 6.17.8-1) trixie: res

CVE-2022-50879 CVE-2022-50879: linux - In the Linux kernel, the following vulnerability has been resolved: objtool: Fi... In the Linux kernel, the following vulnerability has been resolved: objtool: Fix SEGFAULT find_insn() will return NULL in case of failure. Check insn in order to avoid a kernel Oops for NULL pointer dereference. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.4-1) sid: resolved (fixed in 6.1.4-1) trixi

CVE-2025-68348 [LOW] CVE-2025-68348: linux - In the Linux kernel, the following vulnerability has been resolved: block: fix ... In the Linux kernel, the following vulnerability has been resolved: block: fix memory leak in __blkdev_issue_zero_pages Move the fatal signal check before bio_alloc() to prevent a memory leak when BLKDEV_ZERO_KILLABLE is set and a fatal signal is pending. Previously, the bio was allocated before checking for a fatal signal. If a signal was pending, the code would break

CVE-2023-54307 CVE-2023-54307: linux - In the Linux kernel, the following vulnerability has been resolved: ptp_qoriq: ... In the Linux kernel, the following vulnerability has been resolved: ptp_qoriq: fix memory leak in probe() Smatch complains that: drivers/ptp/ptp_qoriq.c ptp_qoriq_probe() warn: 'base' from ioremap() not released. Fix this by revising the parameter from 'ptp_qoriq->base' to 'base'. This is only a bug if ptp_qoriq_init() returns on the first -ENODEV error path. For other error

CVE-2023-54304 CVE-2023-54304: linux - In the Linux kernel, the following vulnerability has been resolved: firmware: m... In the Linux kernel, the following vulnerability has been resolved: firmware: meson_sm: fix to avoid potential NULL pointer dereference of_match_device() may fail and returns a NULL pointer. Fix this by checking the return value of of_match_device. Scope: local bookworm: resolved (fixed in 6.1.55-1) bullseye: resolved (fixed in 5.10.197-1) forky: resolved (fixed in 6.5.3-1)

CVE-2023-54205 CVE-2023-54205: linux - In the Linux kernel, the following vulnerability has been resolved: pinctrl: st... In the Linux kernel, the following vulnerability has been resolved: pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak. Scope: local bookworm: resolved (fixed in 6.1.20-1) bullseye: res

CVE-2022-50698 CVE-2022-50698: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: da721... In the Linux kernel, the following vulnerability has been resolved: ASoC: da7219: Fix an error handling path in da7219_register_dai_clks() If clk_hw_register() fails, the corresponding clk should not be unregistered. To handle errors from loops, clean up partial iterations before doing the goto. So add a clk_hw_unregister(). Then use a while (--i >= 0) loop in the unwind sec

CVE-2023-54143 CVE-2023-54143: linux - In the Linux kernel, the following vulnerability has been resolved: media: medi... In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: fix resource leaks in vdec_msg_queue_init() If we encounter any error in the vdec_msg_queue_init() then we need to set "msg_queue->wdma_addr.size = 0;". Normally, this is done inside the vdec_msg_queue_deinit() function. However, if the first call to allocate &msg_queue->wdma_addr fa

CVE-2023-54152 CVE-2023-54152: linux - In the Linux kernel, the following vulnerability has been resolved: can: j1939:... In the Linux kernel, the following vulnerability has been resolved: can: j1939: prevent deadlock by moving j1939_sk_errqueue() This commit addresses a deadlock situation that can occur in certain scenarios, such as when running data TP/ETP transfer and subscribing to the error queue while receiving a net down event. The deadlock involves locks in the following order: 3 j1939

CVE-2026-23403 CVE-2026-23403: linux - In the Linux kernel, the following vulnerability has been resolved: apparmor: f... In the Linux kernel, the following vulnerability has been resolved: apparmor: fix memory leak in verify_header The function sets `*ns = NULL` on every call, leaking the namespace string allocated in previous iterations when multiple profiles are unpacked. This also breaks namespace consistency checking since *ns is always NULL when the comparison is made. Remove the incorrec

CVE-2023-53992 CVE-2023-53992: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80... In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: ocb: don't leave if not joined If there's no OCB state, don't ask the driver/mac80211 to leave, since that's just confusing. Since set/clear the chandef state, that's a simple check. Scope: local bookworm: resolved (fixed in 6.1.55-1) bullseye: open forky: resolved (fixed in 6.5.6-1) sid: res

CVE-2023-54011 CVE-2023-54011: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3m... In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix an issue found by KASAN Write only correct size (32 instead of 64 bytes). Scope: local bookworm: resolved (fixed in 6.1.20-1) bullseye: resolved forky: resolved (fixed in 6.1.20-1) sid: resolved (fixed in 6.1.20-1) trixie: resolved (fixed in 6.1.20-1)

CVE-2025-68739 [LOW] CVE-2025-68739: linux - In the Linux kernel, the following vulnerability has been resolved: PM / devfre... In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: hisi: Fix potential UAF in OPP handling Ensure all required data is acquired before calling dev_pm_opp_put(opp) to maintain correct resource acquisition and release order. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.17.13-1) sid: resolved (fixed in 6.17.

CVE-2025-68734 CVE-2025-68734: linux - In the Linux kernel, the following vulnerability has been resolved: isdn: mISDN... In the Linux kernel, the following vulnerability has been resolved: isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() In hfcsusb_probe(), the memory allocated for ctrl_urb gets leaked when setup_instance() fails with an error code. Fix that by freeing the urb before freeing the hw structure. Also change the error paths to use the goto ladder style. Compile tested only

CVE-2023-54190 CVE-2023-54190: linux - In the Linux kernel, the following vulnerability has been resolved: leds: led-c... In the Linux kernel, the following vulnerability has been resolved: leds: led-core: Fix refcount leak in of_led_get() class_find_device_by_of_node() calls class_find_device(), it will take the reference, use the put_device() to drop the reference when not need anymore. Scope: local bookworm: resolved (fixed in 6.1.20-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolve

CVE-2022-50882 CVE-2022-50882: linux - In the Linux kernel, the following vulnerability has been resolved: media: uvcv... In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix memory leak in uvc_gpio_parse Previously the unit buffer was allocated before checking the IRQ for privacy GPIO. In case of error, the unit buffer was leaked. Allocate the unit buffer after the IRQ to avoid it. Addresses-Coverity-ID: 1474639 ("Resource leak") Scope: local bookworm: resol

CVE-2022-50853 CVE-2022-50853: linux - In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix ... In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix a credential leak in _nfs4_discover_trunking() Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved forky: resolved (fixed in 6.1.4-1) sid: resolved (fixed in 6.1.4-1) trixie: resolved (fixed in 6.1.4-1)

CVE-2023-54013 CVE-2023-54013: linux - In the Linux kernel, the following vulnerability has been resolved: interconnec... In the Linux kernel, the following vulnerability has been resolved: interconnect: Fix locking for runpm vs reclaim For cases where icc_bw_set() can be called in callbaths that could deadlock against shrinker/reclaim, such as runpm resume, we need to decouple the icc locking. Introduce a new icc_bw_lock for cases where we need to serialize bw aggregation and update to decoupl