Debian Linux vulnerabilities

CVE-2019-2025 [HIGH] CVE-2019-2025: linux - In binder_thread_read of binder.c, there is a possible use-after-free due to imp... In binder_thread_read of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-116855682References: Upstream kernel Scope: local bookworm: reso

CVE-2016-7117 [CRITICAL] CVE-2016-7117: linux - Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in t... Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel before 4.5.2 allows remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing. Scope: local bookworm: resolved (fixed in 4.5.2-1) bullseye: resolved (fixed in 4.5.2-1) forky: resolved (fixed in 4.5.2

CVE-2025-22037 [MEDIUM] CVE-2025-22037: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send malformed smb2 negotiate request. ksmbd return error response. Subsequently, the client can send smb2 session setup even thought conn->preauth_info is not allocated. This patch add KSMBD_SESS_NEED_SETUP status of connection

CVE-2016-1576 [HIGH] CVE-2016-1576: linux - The overlayfs implementation in the Linux kernel through 4.5.2 does not properly... The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program. Scope: local bookworm: resolved (fixed in 4.5.1-1) bullseye: resolved (fixed in 4.5.1-1) forky: resolved (f

CVE-2019-9162 [HIGH] CVE-2019-9162: linux - In the Linux kernel before 4.20.12, net/ipv4/netfilter/nf_nat_snmp_basic_main.c ... In the Linux kernel before 4.20.12, net/ipv4/netfilter/nf_nat_snmp_basic_main.c in the SNMP NAT module has insufficient ASN.1 length checks (aka an array index error), making out-of-bounds read and write operations possible, leading to an OOPS or local privilege escalation. This affects snmp_version and snmp_helper. Scope: local bookworm: resolved (fixed in 4.19.28-1) b

CVE-2019-19241 [HIGH] CVE-2019-19241: linux - In the Linux kernel before 5.4.2, the io_uring feature leads to requests that in... In the Linux kernel before 5.4.2, the io_uring feature leads to requests that inadvertently have UID 0 and full capabilities, aka CID-181e448d8709. This is related to fs/io-wq.c, fs/io_uring.c, and net/socket.c. For example, an attacker can bypass intended restrictions on adding an IPv4 address to the loopback interface. This occurs because IORING_OP_SENDMSG operation

CVE-2016-2854 [HIGH] CVE-2016-2854: linux - The aufs module for the Linux kernel 3.x and 4.x does not properly maintain POSI... The aufs module for the Linux kernel 3.x and 4.x does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory. Scope: local bookworm: resolved (fixed in 3.18-1~exp1) bullseye: resolved (fixed in 3.18-1~exp1) forky: resolved (fixed in 3.18-1~exp1) sid: resolved (fixed in 3.18-1~exp1) trixie:

CVE-2017-13216 [HIGH] CVE-2017-13216: linux - In ashmem_ioctl of ashmem.c, there is an out-of-bounds write due to insufficient... In ashmem_ioctl of ashmem.c, there is an out-of-bounds write due to insufficient locking when accessing asma. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-6695409

CVE-2016-1575 [HIGH] CVE-2016-1575: linux - The overlayfs implementation in the Linux kernel through 4.5.2 does not properly... The overlayfs implementation in the Linux kernel through 4.5.2 does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory. Scope: local bookworm: resolved (fixed in 4.5.1-1) bullseye: resolved (fixed in 4.5.1-1) forky: resolved (fixed in 4.5.1-1) sid: resolved (fixed in 4.5.1-1) trixie: re

CVE-2016-2853 [HIGH] CVE-2016-2853: linux - The aufs module for the Linux kernel 3.x and 4.x does not properly restrict the ... The aufs module for the Linux kernel 3.x and 4.x does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an aufs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program. Scope: local bookworm: resolved (fixed in 3.18-1~exp1) bullseye: resolved (fixed in 3.18-1~exp1) forky: resolved (fixed in 3.1

CVE-2025-37928 [HIGH] CVE-2025-37928: linux - In the Linux kernel, the following vulnerability has been resolved: dm-bufio: d... In the Linux kernel, the following vulnerability has been resolved: dm-bufio: don't schedule in atomic context A BUG was reported as below when CONFIG_DEBUG_ATOMIC_SLEEP and try_verify_in_tasklet are enabled. [ 129.444685][ T934] BUG: sleeping function called from invalid context at drivers/md/dm-bufio.c:2421 [ 129.444723][ T934] in_atomic(): 1, irqs_disabled(): 0, no

CVE-2017-11176 [HIGH] CVE-2017-11176: linux - The mq_notify function in the Linux kernel through 4.11.9 does not set the sock ... The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact. Scope: local bookworm: resolved (fixed in 4.11.11-1) bullseye: resolved (fixed in 4.1

CVE-2018-13405 [HIGH] CVE-2018-13405: linux - The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 all... The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The int

CVE-2025-40271 CVE-2025-40271: linux - In the Linux kernel, the following vulnerability has been resolved: fs/proc: fi... In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the erased node to EMPTY, then pde_subdir_next() will return NULL to avoid uaf access. We found an uaf issue while using

CVE-2025-21760 [HIGH] CVE-2025-21760: linux - In the Linux kernel, the following vulnerability has been resolved: ndisc: exte... In the Linux kernel, the following vulnerability has been resolved: ndisc: extend RCU protection in ndisc_send_skb() ndisc_send_skb() can be called without RTNL or RCU held. Acquire rcu_read_lock() earlier, so that we can use dev_net_rcu() and avoid a potential UAF. Scope: local bookworm: resolved (fixed in 6.1.129-1) bullseye: resolved (fixed in 5.10.237-1) forky: re

CVE-2016-9793 [HIGH] CVE-2016-9793: linux - The sock_setsockopt function in net/core/sock.c in the Linux kernel before 4.8.1... The sock_setsockopt function in net/core/sock.c in the Linux kernel before 4.8.14 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUF

CVE-2016-3672 [HIGH] CVE-2016-3672: linux - The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel thr... The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not properly randomize the legacy base address, which makes it easier for local users to defeat the intended restrictions on the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection mechanism for a setuid or setgid program, by disabling stack-consumption resource limits. Sc

CVE-2016-3135 [HIGH] CVE-2016-3135: linux - Integer overflow in the xt_alloc_table_info function in net/netfilter/x_tables.c... Integer overflow in the xt_alloc_table_info function in net/netfilter/x_tables.c in the Linux kernel through 4.5.2 on 32-bit platforms allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call. Scope: local bookworm: resolved (fixed in 4.4.6-1) bullseye: resolved (fixed in 4.4.6-1) forky: resolv

CVE-2024-8805 [HIGH] CVE-2024-8805: linux - BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulner... BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the HID over GATT Profile. The issue results from th

CVE-2015-8812 [CRITICAL] CVE-2015-8812: linux - drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5 does not pr... drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5 does not properly identify error conditions, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted packets. Scope: local bookworm: resolved (fixed in 4.4.2-1) bullseye: resolved (fixed in 4.4.2-1) forky: resolved (fixed in 4.4.2-1) sid: re