Debian Linux vulnerabilities

CVE-2026-23444 CVE-2026-23444: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80... In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure ieee80211_tx_prepare_skb() has three error paths, but only two of them free the skb. The first error path (ieee80211_tx_prepare() returning TX_DROP) does not free it, while invoke_tx_handlers() failure and the fragmentation check both do.

CVE-2026-23335 CVE-2026-23335: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma:... In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() struct irdma_create_ah_resp { // 8 bytes, no padding __u32 ah_id; // offset 0 - SET (uresp.ah_id = ah->sc_ah.ah_info.ah_idx) __u8 rsvd[4]; // offset 4 - NEVER SET <- LEAK }; rsvd[4]: 4 bytes of stack memory leaked unconditionally. Only ah_id is assi

CVE-2026-23360 [LOW] CVE-2026-23360: linux - In the Linux kernel, the following vulnerability has been resolved: nvme: fix a... In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin queue leak on controller reset When nvme_alloc_admin_tag_set() is called during a controller reset, a previous admin queue may still exist. Release it properly before allocating a new one to avoid orphaning the old queue. This fixes a regression introduced by commit 03b3bcd319b3 ("nvme:

CVE-2026-23284 CVE-2026-23284: linux - In the Linux kernel, the following vulnerability has been resolved: net: ethern... In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() Reset eBPF program pointer to old_prog and do not decrease its ref-count if mtk_open routine in mtk_xdp_setup() fails. Scope: local bookworm: open bullseye: resolved forky: resolved (fixed in 6.19.8-1) sid: resolved (f

CVE-2026-23289 CVE-2026-23289: linux - In the Linux kernel, the following vulnerability has been resolved: IB/mthca: A... In the Linux kernel, the following vulnerability has been resolved: IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() Fix a user triggerable leak on the system call failure path. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 6.19.8-1) sid: resolved (fixed in 6.19.8-1) trixie: open

CVE-2026-23313 [LOW] CVE-2026-23313: linux - In the Linux kernel, the following vulnerability has been resolved: i40e: Fix p... In the Linux kernel, the following vulnerability has been resolved: i40e: Fix preempt count leak in napi poll tracepoint Using get_cpu() in the tracepoint assignment causes an obvious preempt count leak because nothing invokes put_cpu() to undo it: softirq: huh, entered softirq 3 NET_RX with preempt_count 00000100, exited with 00000101? This clearly has seen a lot of t

CVE-2026-23285 [LOW] CVE-2026-23285: linux - In the Linux kernel, the following vulnerability has been resolved: drbd: fix n... In the Linux kernel, the following vulnerability has been resolved: drbd: fix null-pointer dereference on local read error In drbd_request_endio(), READ_COMPLETED_WITH_ERROR is passed to __req_mod() with a NULL peer_device: __req_mod(req, what, NULL, &m); The READ_COMPLETED_WITH_ERROR handler then unconditionally passes this NULL peer_device to drbd_set_out_of_sync(),

CVE-2026-23251 [LOW] CVE-2026-23251: linux - In the Linux kernel, the following vulnerability has been resolved: xfs: only c... In the Linux kernel, the following vulnerability has been resolved: xfs: only call xf{array,blob}_destroy if we have a valid pointer Only call the xfarray and xfblob destructor if we have a valid pointer, and be sure to null out that pointer afterwards. Note that this patch fixes a large number of commits, most of which were merged between 6.9 and 6.10. Scope: local bo

CVE-2026-23338 [LOW] CVE-2026-23338: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings Userspace can either deliberately pass in the too small num_fences, or the required number can legitimately grow between the two calls to the userq wait ioctl. In both cases we do not want the emit the kernel warning backtrace

CVE-2026-23349 [LOW] CVE-2026-23349: linux - In the Linux kernel, the following vulnerability has been resolved: HID: pidff:... In the Linux kernel, the following vulnerability has been resolved: HID: pidff: Fix condition effect bit clearing As reported by MPDarkGuy on discord, NULL pointer dereferences were happening because not all the conditional effects bits were cleared. Properly clear all conditional effect bits from ffbit Scope: local bookworm: resolved bullseye: resolved forky: resolved

CVE-2026-23358 [LOW] CVE-2026-23358: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix error handling in slot reset If the device has not recovered after slot reset is called, it goes to out label for error handling. There it could make decision based on uninitialized hive pointer and could result in accessing an uninitialized list. Initialize the list and hive properly s

CVE-2026-23299 [LOW] CVE-2026-23299: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: purge error queues in socket destructors When TX timestamping is enabled via SO_TIMESTAMPING, SKBs may be queued into sk_error_queue and will stay there until consumed. If userspace never gets to read the timestamps, or if the controller is removed unexpectedly, these SKBs will leak. Fix by

CVE-2026-23366 [LOW] CVE-2026-23366: linux - In the Linux kernel, the following vulnerability has been resolved: drm/client:... In the Linux kernel, the following vulnerability has been resolved: drm/client: Do not destroy NULL modes 'modes' in drm_client_modeset_probe may fail to kcalloc. If this occurs, we jump to 'out', calling modes_destroy on it, which dereferences it. This may result in a NULL pointer dereference in the error case. Prevent that. Scope: local bookworm: resolved bullseye: r

CVE-2026-23282 [LOW] CVE-2026-23282: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: fix oops due to uninitialised var in smb2_unlink() If SMB2_open_init() or SMB2_close_init() fails (e.g. reconnect), the iovs set @rqst will be left uninitialised, hence calling SMB2_open_free(), SMB2_close_free() or smb2_set_related() on them will oops. Fix this by initialising @close_iov

CVE-2026-23399 CVE-2026-23399: linux - In the Linux kernel, the following vulnerability has been resolved: nf_tables: ... In the Linux kernel, the following vulnerability has been resolved: nf_tables: nft_dynset: fix possible stateful expression memleak in error path If cloning the second stateful expression in the element via GFP_ATOMIC fails, then the first stateful expression remains in place without being released. unreferenced object (percpu) 0x607b97e9cab8 (size 16): comm "softirq", pid 0

CVE-2026-23373 [LOW] CVE-2026-23373: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: ... In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config This triggers a WARN_ON in ieee80211_hw_conf_init and isn't the expected behavior from the driver - other drivers default to 0 too. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.19.8-1) sid: resolved (fixed

CVE-2026-31394 [LOW] CVE-2026-31394: linux - In the Linux kernel, the following vulnerability has been resolved: mac80211: f... In the Linux kernel, the following vulnerability has been resolved: mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations ieee80211_chan_bw_change() iterates all stations and accesses link->reserved.oper via sta->sdata->link[link_id]. For stations on AP_VLAN interfaces (e.g. 4addr WDS clients), sta->sdata points to the VLAN sdata, whose link never partic

CVE-2026-23256 CVE-2026-23256: linux - In the Linux kernel, the following vulnerability has been resolved: net: liquid... In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup In setup_nic_devices(), the initialization loop jumps to the label setup_nic_dev_free on failure. The current cleanup loop while(i--) skip the failing index i, causing a memory leak. Fix this by changing the loop to iterate from the curren

CVE-2022-1205 [MEDIUM] CVE-2022-1205: linux - A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX... A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system. Scope: local bookworm: resolved (fixed in 5.17.6-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed in 5.17.6-1) sid: resolved (fixed in 5.17.6-1) tri

CVE-2026-23384 [LOW] CVE-2026-23384: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic:... In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Fix kernel stack leak in ionic_create_cq() struct ionic_cq_resp resp { __u32 cqid[2]; // offset 0 - PARTIALLY SET (see below) __u8 udma_mask; // offset 8 - SET (resp.udma_mask = vcq->udma_mask) __u8 rsvd[7]; // offset 9 - NEVER SET udma_mask & BIT(udma_idx)). The array has 2 entries but udm