Debian Linux vulnerabilities

CVE-2026-23433 [LOW] CVE-2026-23433: linux - In the Linux kernel, the following vulnerability has been resolved: arm_mpam: F... In the Linux kernel, the following vulnerability has been resolved: arm_mpam: Fix null pointer dereference when restoring bandwidth counters When an MSC supporting memory bandwidth monitoring is brought offline and then online, mpam_restore_mbwu_state() calls __ris_msmon_read() via ipi to restore the configuration of the bandwidth counters. It doesn't care about the va

CVE-2026-23341 [LOW] CVE-2026-23341: linux - In the Linux kernel, the following vulnerability has been resolved: accel/amdxd... In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix crash when destroying a suspended hardware context If userspace issues an ioctl to destroy a hardware context that has already been automatically suspended, the driver may crash because the mailbox channel pointer is NULL for the suspended context. Fix this by checking the mailbox ch

CVE-2026-23328 [LOW] CVE-2026-23328: linux - In the Linux kernel, the following vulnerability has been resolved: accel/amdxd... In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix NULL pointer dereference of mgmt_chann mgmt_chann may be set to NULL if the firmware returns an unexpected error in aie2_send_mgmt_msg_wait(). This can later lead to a NULL pointer dereference in aie2_hw_stop(). Fix this by introducing a dedicated helper to destroy mgmt_chann and by

CVE-2026-23263 [LOW] CVE-2026-23263: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/zc... In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix page array leak d9f595b9a65e ("io_uring/zcrx: fix leaking pages on sg init fail") fixed a page leakage but didn't free the page array, release it as well. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.18.10-1) sid: resolved (fixed in 6.18.10-1) trixie

CVE-2026-23357 CVE-2026-23357: linux - In the Linux kernel, the following vulnerability has been resolved: can: mcp251... In the Linux kernel, the following vulnerability has been resolved: can: mcp251x: fix deadlock in error path of mcp251x_open The mcp251x_open() function call free_irq() in its error path with the mpc_lock mutex held. But if an interrupt already occurred the interrupt handler will be waiting for the mpc_lock and free_irq() will deadlock waiting for the handler to finish. This

CVE-2026-23441 [LOW] CVE-2026-23441: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: ... In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent concurrent access to IPSec ASO context The query or updating IPSec offload object is through Access ASO WQE. The driver uses a single mlx5e_ipsec_aso struct for each PF, which contains a shared DMA-mapped context for all ASO operations. A race condition exists because the ASO spinloc

CVE-2026-23394 CVE-2026-23394: linux - In the Linux kernel, the following vulnerability has been resolved: af_unix: Gi... In the Linux kernel, the following vulnerability has been resolved: af_unix: Give up GC if MSG_PEEK intervened. Igor Ushakov reported that GC purged the receive queue of an alive socket due to a race with MSG_PEEK with a nice repro. This is the exact same issue previously fixed by commit cbcf01128d0a ("af_unix: fix garbage collect vs MSG_PEEK"). After GC was replaced with th

CVE-2026-23295 [LOW] CVE-2026-23295: linux - In the Linux kernel, the following vulnerability has been resolved: accel/amdxd... In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix dead lock for suspend and resume When an application issues a query IOCTL while auto suspend is running, a deadlock can occur. The query path holds dev_lock and then calls pm_runtime_resume_and_get(), which waits for the ongoing suspend to complete. Meanwhile, the suspend callback at

CVE-2025-38617 [MEDIUM] CVE-2025-38617: linux - In the Linux kernel, the following vulnerability has been resolved: net/packet:... In the Linux kernel, the following vulnerability has been resolved: net/packet: fix a race in packet_set_ring() and packet_notifier() When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process an NETDEV_UP event. This race and the fix are both similar to that of commit 15fe076edea7 ("net/packet: fix a race in packet_bind() an

CVE-2023-26545 [MEDIUM] CVE-2023-26545: linux - In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c ... In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device. Scope: local bookworm: resolved (fixed in 6.1.15-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.15-1) sid: resolved (fixed in 6.1.15-1) trixie: r

CVE-2023-31083 [MEDIUM] CVE-2023-31083: linux - An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2... An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu->proto is set. A NULL pointer dereference may occur. Scope: local bookworm: resolved (fixed in 6.1.112-1) bullseye: resolved (fixed in 5.10.226-1) forky: re

CVE-2017-18203 [MEDIUM] CVE-2017-18203: linux - The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4... The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local users to cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and removal of DM devices. Scope: local bookworm: resolved (fixed in 4.14.7-1) bullseye: resolved (fixed in 4.14.7-1) forky: resolved (fixed in 4.14.7-1) sid: resol

CVE-2024-39293 [MEDIUM] CVE-2024-39293: linux - In the Linux kernel, the following vulnerability has been resolved: Revert "xsk... In the Linux kernel, the following vulnerability has been resolved: Revert "xsk: Support redirect to any socket bound to the same umem" This reverts commit 2863d665ea41282379f108e4da6c8a2366ba66db. This patch introduced a potential kernel crash when multiple napi instances redirect to the same AF_XDP socket. By removing the queue_index check, it is possible for mult

CVE-2022-48816 [MEDIUM] CVE-2022-48816: linux - In the Linux kernel, the following vulnerability has been resolved: SUNRPC: loc... In the Linux kernel, the following vulnerability has been resolved: SUNRPC: lock against ->sock changing during sysfs read ->sock can be set to NULL asynchronously unless ->recv_mutex is held. So it is important to hold that mutex. Otherwise a sysfs read can trigger an oops. Commit 17f09d3f619a ("SUNRPC: Check if the xprt is connected before handling sysfs reads") a

CVE-2024-50297 [MEDIUM] CVE-2024-50297: linux - In the Linux kernel, the following vulnerability has been resolved: net: xilinx... In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts Enqueue packets in dql after dma engine starts causes race condition. Tx transfer starts once dma engine is started and may execute dql dequeue in completion before it gets queued. It results in following kernel crash while runn

CVE-2019-19535 [MEDIUM] CVE-2019-19535: linux - In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused b... In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_fd.c driver, aka CID-30a8beeb3042. Scope: local bookworm: resolved (fixed in 5.2.9-1) bullseye: resolved (fixed in 5.2.9-1) forky: resolved (fixed in 5.2.9-1) sid: resolved (fixed in 5.2.9-1) trixie: resolved (fixed in

CVE-2014-4653 [MEDIUM] CVE-2014-4653: linux - sound/core/control.c in the ALSA control implementation in the Linux kernel befo... sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure possession of a read/write lock, which allows local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access. Scope: local bookworm: resolved (fixed in 3.14.9-1) bullseye: resol

CVE-2024-43892 [MEDIUM] CVE-2024-43892: linux - In the Linux kernel, the following vulnerability has been resolved: memcg: prot... In the Linux kernel, the following vulnerability has been resolved: memcg: protect concurrent access to mem_cgroup_idr Commit 73f576c04b94 ("mm: memcontrol: fix cgroup creation failure after many small jobs") decoupled the memcg IDs from the CSS ID space to fix the cgroup creation failures. It introduced IDR to maintain the memcg ID space. The IDR depends on externa

CVE-2022-49295 [MEDIUM] CVE-2022-49295: linux - In the Linux kernel, the following vulnerability has been resolved: nbd: call g... In the Linux kernel, the following vulnerability has been resolved: nbd: call genl_unregister_family() first in nbd_cleanup() Otherwise there may be race between module removal and the handling of netlink command, which can lead to the oops as shown below: BUG: kernel NULL pointer dereference, address: 0000000000000098 Oops: 0002 [#1] SMP PTI CPU: 1 PID: 31299 Comm:

CVE-2014-8989 [MEDIUM] CVE-2014-8989: linux - The Linux kernel through 3.17.4 does not properly restrict dropping of supplemen... The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to