Debian Linux vulnerabilities

CVE-2020-12114 [MEDIUM] CVE-2020-12114: linux - A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4... A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before 4.9.221, 4.14.x before 4.14.178, 4.19.x before 4.19.119, and 5.x before 5.3 allows local users to cause a denial of service (panic) by corrupting a mountpoint reference counter. Scope: local bookworm: resolved (fixed in 5.3.7-1) bullseye: resolved (fixed in 5.3.7-1)

CVE-2025-38561 [MEDIUM] CVE-2025-38561: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Preauh_HashValue race condition If client send multiple session setup requests to ksmbd, Preauh_HashValue race condition could happen. There is no need to free sess->Preauh_HashValue at session setup phase. It can be freed together with session at connection termination phase. Scope: loca

CVE-2025-68759 CVE-2025-68759: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: rtl81... In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() In rtl8180_init_rx_ring(), memory is allocated for skb packets and DMA allocations in a loop. When an allocation fails, the previously successful allocations are not freed on exit. Fix that by jumping to err_free_rings label on error, which

CVE-2025-40217 [LOW] CVE-2025-40217: linux - In the Linux kernel, the following vulnerability has been resolved: pidfs: vali... In the Linux kernel, the following vulnerability has been resolved: pidfs: validate extensible ioctls Validate extensible ioctls stricter than we do now. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.17.6-1) sid: resolved (fixed in 6.17.6-1) trixie: open

CVE-2026-23053 [LOW] CVE-2026-23053: linux - In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a ... In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a deadlock involving nfs_release_folio() Wang Zhaolong reports a deadlock involving NFSv4.1 state recovery waiting on kthreadd, which is attempting to reclaim memory by calling nfs_release_folio(). The latter cannot make progress due to state recovery being needed. It seems that the only safe

CVE-2023-54033 CVE-2023-54033: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: fix a ... In the Linux kernel, the following vulnerability has been resolved: bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps The LRU and LRU_PERCPU maps allocate a new element on update before locking the target hash table bucket. Right after that the maps try to lock the bucket. If this fails, then maps return -EBUSY to the caller without releasing the allocated element.

CVE-2025-68334 CVE-2025-68334: linux - In the Linux kernel, the following vulnerability has been resolved: platform/x8... In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Add support for Van Gogh SoC The ROG Xbox Ally (non-X) SoC features a similar architecture to the Steam Deck. While the Steam Deck supports S3 (s2idle causes a crash), this support was dropped by the Xbox Ally which only S0ix suspend. Since the handler is missing here, this causes the d

CVE-2019-15291 [MEDIUM] CVE-2019-15291: linux - An issue was discovered in the Linux kernel through 5.2.9. There is a NULL point... An issue was discovered in the Linux kernel through 5.2.9. There is a NULL pointer dereference caused by a malicious USB device in the flexcop_usb_probe function in the drivers/media/usb/b2c2/flexcop-usb.c driver. Scope: local bookworm: resolved (fixed in 5.3.15-1) bullseye: resolved (fixed in 5.3.15-1) forky: resolved (fixed in 5.3.15-1) sid: resolved (fixed in 5.3

CVE-2025-68791 [LOW] CVE-2025-68791: linux - In the Linux kernel, the following vulnerability has been resolved: fuse: missi... In the Linux kernel, the following vulnerability has been resolved: fuse: missing copy_finish in fuse-over-io-uring argument copies Fix a possible reference count leak of payload pages during fuse argument copies. [Joanne: simplified error cleanup] Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.18.3-1) sid: resolved (fixed in 6.18.3-1) t

CVE-2023-54233 CVE-2023-54233: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ... In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: avoid a NULL dereference with unsupported widgets If an IPC4 topology contains an unsupported widget, its .module_info field won't be set, then sof_ipc4_route_setup() will cause a kernel Oops trying to dereference it. Add a check for such cases. Scope: local bookworm: open bullseye: resolved forky

CVE-2023-54263 CVE-2023-54263: linux - In the Linux kernel, the following vulnerability has been resolved: drm/nouveau... In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP Fixes OOPS on boards with ANX9805 DP encoders. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 6.4.11-1) sid: resolved (fixed in 6.4.11-1) trixie: resolved (fixed in 6.4.11-1)

CVE-2025-68752 [LOW] CVE-2025-68752: linux - In the Linux kernel, the following vulnerability has been resolved: iavf: Imple... In the Linux kernel, the following vulnerability has been resolved: iavf: Implement settime64 with -EOPNOTSUPP ptp_clock_settime() assumes every ptp_clock has implemented settime64(). Stub it with -EOPNOTSUPP to prevent a NULL dereference. The fix is similar to commit 329d050bbe63 ("gve: Implement settime64 with -EOPNOTSUPP"). Scope: local bookworm: resolved bullseye:

CVE-2025-68754 [LOW] CVE-2025-68754: linux - In the Linux kernel, the following vulnerability has been resolved: rtc: amlogi... In the Linux kernel, the following vulnerability has been resolved: rtc: amlogic-a4: fix double free caused by devm The clock obtained via devm_clk_get_enabled() is automatically managed by devres and will be disabled and freed on driver detach. Manually calling clk_disable_unprepare() in error path and remove function causes double free. Remove the redundant clk_disab

CVE-2023-54038 [LOW] CVE-2023-54038: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link hci_connect_sco currently returns NULL when there is no link (i.e. when hci_conn_link() returns NULL). sco_connect() expects an ERR_PTR in case of any error (see line 266 in sco.c). Thus, hcon set as NULL passes through to sco_co

CVE-2022-50784 CVE-2022-50784: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwi... In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: fix potential NULL-ptr deref after clone If cloning the SKB fails, don't try to use it, but rather return as if we should pass it. Coverity CID: 1503456 Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved forky: resolved (fixed in 6.1.4-1) sid: resolved (fixed in 6.1.4-1

CVE-2014-2673 [MEDIUM] CVE-2014-2673: linux - The arch_dup_task_struct function in the Transactional Memory (TM) implementatio... The arch_dup_task_struct function in the Transactional Memory (TM) implementation in arch/powerpc/kernel/process.c in the Linux kernel before 3.13.7 on the powerpc platform does not properly interact with the clone and fork system calls, which allows local users to cause a denial of service (Program Check and system crash) via certain instructions that are executed wi

CVE-2026-23043 [LOW] CVE-2026-23043: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix ... In the Linux kernel, the following vulnerability has been resolved: btrfs: fix NULL pointer dereference in do_abort_log_replay() Coverity reported a NULL pointer dereference issue (CID 1666756) in do_abort_log_replay(). When btrfs_alloc_path() fails in replay_one_buffer(), wc->subvol_path is NULL, but btrfs_abort_log_replay() calls do_abort_log_replay() which unconditi

CVE-2021-43976 [MEDIUM] CVE-2021-43976: linux - In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/mar... In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic). Scope: local bookworm: resolved (fixed in 5.15.15-2) bullseye: resolved (fixed in 5.10.92-2) forky: resolved (fixed in 5.15.15-2) sid: resolved (fixed in 5.15.15-2)

CVE-2013-2896 [MEDIUM] CVE-2013-2896: linux - drivers/hid/hid-ntrig.c in the Human Interface Device (HID) subsystem in the Lin... drivers/hid/hid-ntrig.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_NTRIG is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted device. Scope: local bookworm: resolved (fixed in 3.10.11-1) bullseye: resolved (fixed in 3.10.11-1) forky: resolve

CVE-2019-19082 [MEDIUM] CVE-2019-19082: linux - Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/disp... Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption). This affects the dce120_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c, the dce110_create_resource_pool() function in drivers/gpu/drm/a