Debian Linux vulnerabilities

CVE-2023-54215 [LOW] CVE-2023-54215: linux - In the Linux kernel, the following vulnerability has been resolved: virtio-vdpa... In the Linux kernel, the following vulnerability has been resolved: virtio-vdpa: Fix cpumask memory leak in virtio_vdpa_find_vqs() Free the cpumask allocated by create_affinity_masks() before returning from the function. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.4.13-1) sid: resolved (fixed in 6.4.13-1) trixie: resolved (fixed in 6.

CVE-2026-23051 [LOW] CVE-2026-23051: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix drm panic null pointer when driver not support atomic When driver not support atomic, fb using plane->fb rather than plane->state->fb. (cherry picked from commit 2f2a72de673513247cd6fae14e53f6c40c5841ef) Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.18.8

CVE-2020-29372 [MEDIUM] CVE-2020-29372: linux - An issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before... An issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operations and the IORING_OP_MADVISE implementation, aka CID-bc0c4d1e176e. Scope: local bookworm: resolved (fixed in 5.6.14-1) bullseye: resolved (fixed in 5.6.14-1) forky: resolved (fixed in 5.6.14-1) sid: resolved (fixed in 5.6.14-1) t

CVE-2026-23040 [LOW] CVE-2026-23040: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80... In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: fix typo in frequency notification The NAN notification is for 5745 MHz which corresponds to channel 149 and not 5475 which is not actually a valid channel. This could result in a NULL pointer dereference in cfg80211_next_nan_dw_notif. Scope: local bookworm: resolved bullseye: res

CVE-2013-2015 [MEDIUM] CVE-2013-2015: linux - The ext4_orphan_del function in fs/ext4/namei.c in the Linux kernel before 3.7.3... The ext4_orphan_del function in fs/ext4/namei.c in the Linux kernel before 3.7.3 does not properly handle orphan-list entries for non-journal filesystems, which allows physically proximate attackers to cause a denial of service (system hang) via a crafted filesystem on removable media, as demonstrated by the e2fsprogs tests/f_orphan_extents_inode/image.gz test. Scope:

CVE-2023-37453 [MEDIUM] CVE-2023-37453: linux - An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. ... An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in drivers/usb/core/sysfs.c. Scope: local bookworm: resolved (fixed in 6.1.55-1) bullseye: resolved (fixed in 5.10.197-1) forky: resolved (fixed in 6.5.3-1) sid: resolved (fixed in 6.5.3-1) trixie: resolved (fixed in 6.5.3-1)

CVE-2019-19059 [MEDIUM] CVE-2019-19059: linux - Multiple memory leaks in the iwl_pcie_ctxt_info_gen3_init() function in drivers/... Multiple memory leaks in the iwl_pcie_ctxt_info_gen3_init() function in drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering iwl_pcie_init_fw_sec() or dma_alloc_coherent() failures, aka CID-0f4f199443fa. Scope: local bookworm: resolved (fixed in 5.4

CVE-2014-8086 [MEDIUM] CVE-2014-8086: linux - Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Lin... Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17 allows local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation for the O_DIRECT flag. Scope: local bookworm: resolved (fixed in 3.16.7-ckt2-1) bullseye: resolved (fixed in 3.16.7-ckt2-1) forky:

CVE-2026-23339 CVE-2026-23339: linux - In the Linux kernel, the following vulnerability has been resolved: nfc: nci: f... In the Linux kernel, the following vulnerability has been resolved: nfc: nci: free skb on nci_transceive early error paths nci_transceive() takes ownership of the skb passed by the caller, but the -EPROTO, -EINVAL, and -EBUSY error paths return without freeing it. Due to issues clearing NCI_DATA_EXCHANGE fixed by subsequent changes the nci/nci_dev selftest hits the error pat

CVE-2026-23464 [LOW] CVE-2026-23464: linux - In the Linux kernel, the following vulnerability has been resolved: soc: microc... In the Linux kernel, the following vulnerability has been resolved: soc: microchip: mpfs: Fix memory leak in mpfs_sys_controller_probe() In mpfs_sys_controller_probe(), if of_get_mtd_device_by_node() fails, the function returns immediately without freeing the allocated memory for sys_controller, leading to a memory leak. Fix this by jumping to the out_free label to ens

CVE-2026-23314 [LOW] CVE-2026-23314: linux - In the Linux kernel, the following vulnerability has been resolved: regulator: ... In the Linux kernel, the following vulnerability has been resolved: regulator: bq257xx: Fix device node reference leak in bq257xx_reg_dt_parse_gpio() In bq257xx_reg_dt_parse_gpio(), if fails to get subchild, it returns without calling of_node_put(child), causing the device node reference leak. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in

CVE-2026-23426 CVE-2026-23426: linux - In the Linux kernel, the following vulnerability has been resolved: drm/logicvc... In the Linux kernel, the following vulnerability has been resolved: drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse() The logicvc_drm_config_parse() function calls of_get_child_by_name() to find the "layers" node but fails to release the reference, leading to a device node reference leak. Fix this by using the __free(device_node) cleanup attribute to

CVE-2026-31390 [LOW] CVE-2026-31390: linux - In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix... In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix memory leak in xe_vm_madvise_ioctl When check_bo_args_are_sane() validation fails, jump to the new free_vmas cleanup label to properly free the allocated resources. This ensures proper cleanup in this error path. (cherry picked from commit 29bd06faf727a4b76663e4be0f7d770e2d2a7965) Scope: lo

CVE-2013-1928 [MEDIUM] CVE-2013-1928: linux - The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel b... The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel before 3.6.5 on unspecified architectures lacks a certain error check, which might allow local users to obtain sensitive information from kernel stack memory via a crafted VIDEO_SET_SPU_PALETTE ioctl call on a /dev/dvb device. Scope: local bookworm: resolved (fixed in 3.2.35-1) bullseye: re

CVE-2026-23470 [LOW] CVE-2026-23470: linux - In the Linux kernel, the following vulnerability has been resolved: drm/imagina... In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix deadlock in soft reset sequence The soft reset sequence is currently executed from the threaded IRQ handler, hence it cannot call disable_irq() which internally waits for IRQ handlers, i.e. itself, to complete. Use disable_irq_nosync() during a soft reset instead. Scope: local book

CVE-2026-23452 CVE-2026-23452: linux - In the Linux kernel, the following vulnerability has been resolved: PM: runtime... In the Linux kernel, the following vulnerability has been resolved: PM: runtime: Fix a race condition related to device removal The following code in pm_runtime_work() may dereference the dev->parent pointer after the parent device has been freed: /* Maybe the parent is now able to suspend. */ if (parent && !parent->power.ignore_children) { spin_unlock(&dev->power.lock); spi

CVE-2026-23469 [LOW] CVE-2026-23469: linux - In the Linux kernel, the following vulnerability has been resolved: drm/imagina... In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Synchronize interrupts before suspending the GPU The runtime PM suspend callback doesn't know whether the IRQ handler is in progress on a different CPU core and doesn't wait for it to finish. Depending on timing, the IRQ handler could be running while the GPU is suspended, leading to k

CVE-2026-23342 [LOW] CVE-2026-23342: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix ra... In the Linux kernel, the following vulnerability has been resolved: bpf: Fix race in cpumap on PREEMPT_RT On PREEMPT_RT kernels, the per-CPU xdp_bulk_queue (bq) can be accessed concurrently by multiple preemptible tasks on the same CPU. The original code assumes bq_enqueue() and __cpu_map_flush() run atomically with respect to each other on the same CPU, relying on loc

CVE-2026-23348 CVE-2026-23348: linux - In the Linux kernel, the following vulnerability has been resolved: cxl: Fix ra... In the Linux kernel, the following vulnerability has been resolved: cxl: Fix race of nvdimm_bus object when creating nvdimm objects Found issue during running of cxl-translate.sh unit test. Adding a 3s sleep right before the test seems to make the issue reproduce fairly consistently. The cxl_translate module has dependency on cxl_acpi and causes orphaned nvdimm objects to re

CVE-2016-3689 [MEDIUM] CVE-2016-3689: linux - The ims_pcu_parse_cdc_data function in drivers/input/misc/ims-pcu.c in the Linux... The ims_pcu_parse_cdc_data function in drivers/input/misc/ims-pcu.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (system crash) via a USB device without both a master and a slave interface. Scope: local bookworm: resolved (fixed in 4.5.1-1) bullseye: resolved (fixed in 4.5.1-1) forky: resolved (fixed in 4.5.1-1) s