Debian Linux vulnerabilities

CVE-2025-38393 [MEDIUM] CVE-2025-38393: linux - In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS:... In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN We found a few different systems hung up in writeback waiting on the same page lock, and one task waiting on the NFS_LAYOUT_DRAIN bit in pnfs_update_layout(), however the pnfs_layout_hdr's plh_outstanding count was zero. It seems most likely that th

CVE-2016-3137 [MEDIUM] CVE-2016-3137: linux - drivers/usb/serial/cypress_m8.c in the Linux kernel before 4.5.1 allows physical... drivers/usb/serial/cypress_m8.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both an interrupt-in and an interrupt-out endpoint descriptor, related to the cypress_generic_port_probe and cypress_open functions. Scope: local bookworm: resolved (fix

CVE-2017-18224 [MEDIUM] CVE-2017-18224: linux - In the Linux kernel before 4.15, fs/ocfs2/aops.c omits use of a semaphore and co... In the Linux kernel before 4.15, fs/ocfs2/aops.c omits use of a semaphore and consequently has a race condition for access to the extent tree during read operations in DIRECT mode, which allows local users to cause a denial of service (BUG) by modifying a certain e_cpos field. Scope: local bookworm: resolved (fixed in 4.15.4-1) bullseye: resolved (fixed in 4.15.4-1)

CVE-2025-21655 [MEDIUM] CVE-2025-21655: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/ev... In the Linux kernel, the following vulnerability has been resolved: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period io_eventfd_do_signal() is invoked from an RCU callback, but when dropping the reference to the io_ev_fd, it calls io_eventfd_free() directly if the refcount drops to zero. This isn't correct, as any potential freeing of the io_ev

CVE-2022-48899 [MEDIUM] CVE-2022-48899: linux - In the Linux kernel, the following vulnerability has been resolved: drm/virtio:... In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix GEM handle creation UAF Userspace can guess the handle value and try to race GEM object creation with handle close, resulting in a use-after-free if we dereference the object after dropping the handle's reference. For that reason, dropping the handle's reference must be done *after*

CVE-2023-53186 [MEDIUM] CVE-2023-53186: linux - In the Linux kernel, the following vulnerability has been resolved: skbuff: Fix... In the Linux kernel, the following vulnerability has been resolved: skbuff: Fix a race between coalescing and releasing SKBs Commit 1effe8ca4e34 ("skbuff: fix coalescing for page_pool fragment recycling") allowed coalescing to proceed with non page pool page and page pool page when @from is cloned, i.e. to->pp_recycle --> false from->pp_recycle --> true skb_cloned(f

CVE-2015-5707 [MEDIUM] CVE-2015-5707: linux - Integer overflow in the sg_start_req function in drivers/scsi/sg.c in the Linux ... Integer overflow in the sg_start_req function in drivers/scsi/sg.c in the Linux kernel 2.6.x through 4.x before 4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a large iov_count value in a write request. Scope: local bookworm: resolved (fixed in 4.1.3-1) bullseye: resolved (fixed in 4.1.3-1) forky: resolved (fixed in 4

CVE-2024-26874 [MEDIUM] CVE-2024-26874: linux - In the Linux kernel, the following vulnerability has been resolved: drm/mediate... In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip It's possible that mtk_crtc->event is NULL in mtk_drm_crtc_finish_page_flip(). pending_needs_vblank value is set by mtk_crtc->event, but in mtk_drm_crtc_atomic_flush(), it's is not guarded by the same lock in mtk_drm_finish_page

CVE-2022-48997 [MEDIUM] CVE-2022-48997: linux - In the Linux kernel, the following vulnerability has been resolved: char: tpm: ... In the Linux kernel, the following vulnerability has been resolved: char: tpm: Protect tpm_pm_suspend with locks Currently tpm transactions are executed unconditionally in tpm_pm_suspend() function, which may lead to races with other tpm accessors in the system. Specifically, the hw_random tpm driver makes use of tpm_get_random(), and this function is called in a lo

CVE-2023-46862 [MEDIUM] CVE-2023-46862: linux - An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ... An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur. Scope: local bookworm: resolved (fixed in 6.1.64-1) bullseye: resolved (fixed in 5.10.205-2) forky: resolved (fixed in 6.5.10-1) sid: resolved (fixed in 6.5.10-1) trixie: resolved (fixed in 6.5.10

CVE-2015-2041 [MEDIUM] CVE-2015-2041: linux - net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 uses an incorrect data ... net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry. Scope: local bookworm: resolved (fixed in 3.16.7-ckt9-1) bullseye: resolved (fixed in 3.16.7-ckt9-1) forky:

CVE-2022-3903 [MEDIUM] CVE-2022-3903: linux - An incorrect read request flaw was found in the Infrared Transceiver USB driver ... An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs when a user attaches a malicious USB device. A local user could use this flaw to starve the resources, causing denial of service or potentially crashing the system. Scope: local bookworm: resolved (fixed in 5.19.11-1) bullseye: resolved (fixed in 5.10

CVE-2024-50192 [MEDIUM] CVE-2024-50192: linux - In the Linux kernel, the following vulnerability has been resolved: irqchip/gic... In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE Kunkun Jiang reported that there is a small window of opportunity for userspace to force a change of affinity for a VPE while the VPE has already been unmapped, but the corresponding doorbell interrupt still visible in /proc/irq/. Plug the race by c

CVE-2024-47679 [MEDIUM] CVE-2024-47679: linux - In the Linux kernel, the following vulnerability has been resolved: vfs: fix ra... In the Linux kernel, the following vulnerability has been resolved: vfs: fix race between evice_inodes() and find_inode()&iput() Hi, all Recently I noticed a bug[1] in btrfs, after digged it into and I believe it'a race in vfs. Let's assume there's a inode (ie ino 261) with i_count 1 is called by iput(), and there's a concurrent thread calling generic_shutdown_super

CVE-2024-56729 [MEDIUM] CVE-2024-56729: linux - In the Linux kernel, the following vulnerability has been resolved: smb: Initia... In the Linux kernel, the following vulnerability has been resolved: smb: Initialize cfid->tcon before performing network ops Avoid leaking a tcon ref when a lease break races with opening the cached directory. Processing the leak break might take a reference to the tcon in cached_dir_lease_break() and then fail to release the ref in cached_dir_offload_close, since c

CVE-2024-50174 [MEDIUM] CVE-2024-50174: linux - In the Linux kernel, the following vulnerability has been resolved: drm/panthor... In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix race when converting group handle to group object XArray provides it's own internal lock which protects the internal array when entries are being simultaneously added and removed. However there is still a race between retrieving the pointer from the XArray and incrementing the refer

CVE-2015-2042 [MEDIUM] CVE-2015-2042: linux - net/rds/sysctl.c in the Linux kernel before 3.19 uses an incorrect data type in ... net/rds/sysctl.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry. Scope: local bookworm: resolved (fixed in 3.16.7-ckt9-1) bullseye: resolved (fixed in 3.16.7-ckt9-1) forky: resolve

CVE-2023-2898 [MEDIUM] CVE-2023-2898: linux - There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/d... There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem. Scope: local bookworm: resolved (fixed in 6.1.52-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 6.4.4-1) sid: resolved (fixed in 6.4.4-1) trixie: resolved (fixed

CVE-2024-41020 [MEDIUM] CVE-2024-41020: linux - In the Linux kernel, the following vulnerability has been resolved: filelock: F... In the Linux kernel, the following vulnerability has been resolved: filelock: Fix fcntl/close race recovery compat path When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when fcntl/close race is detected"), I missed that there are two copies of the code I was patching: The normal version, and the version for 64-bit offsets on 32-bit kernels. Thanks

CVE-2024-27419 [MEDIUM] CVE-2024-27419: linux - In the Linux kernel, the following vulnerability has been resolved: netrom: Fix... In the Linux kernel, the following vulnerability has been resolved: netrom: Fix data-races around sysctl_net_busy_read We need to protect the reader reading the sysctl value because the value can be changed concurrently. Scope: local bookworm: resolved (fixed in 6.1.82-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.7.12-1) sid: resolved (fix