Debian Linux vulnerabilities

CVE-2022-49300 [MEDIUM] CVE-2022-49300: linux - In the Linux kernel, the following vulnerability has been resolved: nbd: fix ra... In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between nbd_alloc_config() and module removal When nbd module is being removing, nbd_alloc_config() may be called concurrently by nbd_genl_connect(), although try_module_get() will return false, but nbd_alloc_config() doesn't handle it. The race may lead to the leak of nbd_config and i

CVE-2022-49089 [MEDIUM] CVE-2022-49089: linux - In the Linux kernel, the following vulnerability has been resolved: IB/rdmavt: ... In the Linux kernel, the following vulnerability has been resolved: IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition The documentation of the function rvt_error_qp says both r_lock and s_lock need to be held when calling that function. It also asserts using lockdep that both of those locks are held. However, the commit I referenced in Fixes ac

CVE-2022-49344 [MEDIUM] CVE-2022-49344: linux - In the Linux kernel, the following vulnerability has been resolved: af_unix: Fi... In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix a data-race in unix_dgram_peer_wake_me(). unix_dgram_poll() calls unix_dgram_peer_wake_me() without `other`'s lock held and check if its receive queue is full. Here we need to use unix_recvq_full_lockless() instead of unix_recvq_full(), otherwise KCSAN will report a data-race. Scope: lo

CVE-2024-26878 [MEDIUM] CVE-2024-26878: linux - In the Linux kernel, the following vulnerability has been resolved: quota: Fix ... In the Linux kernel, the following vulnerability has been resolved: quota: Fix potential NULL pointer dereference Below race may cause NULL pointer dereference P1 P2 dquot_free_inode quota_off drop_dquot_ref remove_dquot_ref dquots = i_dquot(inode) dquots = i_dquot(inode) srcu_read_lock dquots[cnt]) != NULL (1) dquots[type] = NULL (2) spin_lock(&dquots[cnt]->dq_dqb_

CVE-2022-49414 [MEDIUM] CVE-2022-49414: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: fix r... In the Linux kernel, the following vulnerability has been resolved: ext4: fix race condition between ext4_write and ext4_convert_inline_data Hulk Robot reported a BUG_ON: ================================================================== EXT4-fs error (device loop3): ext4_mb_generate_buddy:805: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free c

CVE-2022-49603 [MEDIUM] CVE-2022-49603: linux - In the Linux kernel, the following vulnerability has been resolved: ip: Fix dat... In the Linux kernel, the following vulnerability has been resolved: ip: Fix data-races around sysctl_ip_fwd_update_priority. While reading sysctl_ip_fwd_update_priority, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Scope: local bookworm: resolved (fixed in 5.18.16-1) bullseye: resolved (fixed in 5.10.136-1) forky: resolved (fixed

CVE-2022-49600 [MEDIUM] CVE-2022-49600: linux - In the Linux kernel, the following vulnerability has been resolved: ip: Fix a d... In the Linux kernel, the following vulnerability has been resolved: ip: Fix a data-race around sysctl_ip_autobind_reuse. While reading sysctl_ip_autobind_reuse, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Scope: local bookworm: resolved (fixed in 5.18.16-1) bullseye: resolved (fixed in 5.10.136-1) forky: resolved (fixed in 5.18.16

CVE-2022-49604 [MEDIUM] CVE-2022-49604: linux - In the Linux kernel, the following vulnerability has been resolved: ip: Fix dat... In the Linux kernel, the following vulnerability has been resolved: ip: Fix data-races around sysctl_ip_fwd_use_pmtu. While reading sysctl_ip_fwd_use_pmtu, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Scope: local bookworm: resolved (fixed in 5.18.16-1) bullseye: resolved (fixed in 5.10.136-1) forky: resolved (fixed in 5.18.16-1)

CVE-2022-49589 [MEDIUM] CVE-2022-49589: linux - In the Linux kernel, the following vulnerability has been resolved: igmp: Fix d... In the Linux kernel, the following vulnerability has been resolved: igmp: Fix data-races around sysctl_igmp_qrv. While reading sysctl_igmp_qrv, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. This test can be packed into a helper, so such changes will be in the follow-up series after net is merged into net-next. qrv ?: READ_ONCE(net-

CVE-2022-49607 [MEDIUM] CVE-2022-49607: linux - In the Linux kernel, the following vulnerability has been resolved: perf/core: ... In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix data race between perf_event_set_output() and perf_mmap_close() Yang Jihing reported a race between perf_event_set_output() and perf_mmap_close(): CPU1 CPU2 perf_mmap_close(e2) if (atomic_dec_and_test(&e2->rb->mmap_count)) // 1 - > 0 detach_rest = true ioctl(e1, IOC_SET_OUTPUT, e2) pe

CVE-2022-49590 [MEDIUM] CVE-2022-49590: linux - In the Linux kernel, the following vulnerability has been resolved: igmp: Fix d... In the Linux kernel, the following vulnerability has been resolved: igmp: Fix data-races around sysctl_igmp_llm_reports. While reading sysctl_igmp_llm_reports, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. This test can be packed into a helper, so such changes will be in the follow-up series after net is merged into net-next. if (i

CVE-2022-49602 [MEDIUM] CVE-2022-49602: linux - In the Linux kernel, the following vulnerability has been resolved: ip: Fix a d... In the Linux kernel, the following vulnerability has been resolved: ip: Fix a data-race around sysctl_fwmark_reflect. While reading sysctl_fwmark_reflect, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Scope: local bookworm: resolved (fixed in 5.18.16-1) bullseye: resolved (fixed in 5.10.136-1) forky: resolved (fixed in 5.18.16-1) si

CVE-2022-49578 [MEDIUM] CVE-2022-49578: linux - In the Linux kernel, the following vulnerability has been resolved: ip: Fix dat... In the Linux kernel, the following vulnerability has been resolved: ip: Fix data-races around sysctl_ip_prot_sock. sysctl_ip_prot_sock is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing. Scope: local bookworm: resolved (fixed in 5.18.16-1) bullseye: resolved (fixed i

CVE-2024-56576 [MEDIUM] CVE-2024-56576: linux - In the Linux kernel, the following vulnerability has been resolved: media: i2c:... In the Linux kernel, the following vulnerability has been resolved: media: i2c: tc358743: Fix crash in the probe error path when using polling If an error occurs in the probe() function, we should remove the polling timer that was alarmed earlier, otherwise the timer is called with arguments that are already freed, which results in a crash. ------------[ cut here ]-

CVE-2022-49634 [MEDIUM] CVE-2022-49634: linux - In the Linux kernel, the following vulnerability has been resolved: sysctl: Fix... In the Linux kernel, the following vulnerability has been resolved: sysctl: Fix data-races in proc_dou8vec_minmax(). A sysctl variable is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing. This patch changes proc_dou8vec_minmax() to use READ_ONCE() and WRITE_ONCE() int

CVE-2019-19526 [MEDIUM] CVE-2019-19526: linux - In the Linux kernel before 5.3.9, there is a use-after-free bug that can be caus... In the Linux kernel before 5.3.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/nfc/pn533/usb.c driver, aka CID-6af3aa57a098. Scope: local bookworm: resolved (fixed in 5.3.9-1) bullseye: resolved (fixed in 5.3.9-1) forky: resolved (fixed in 5.3.9-1) sid: resolved (fixed in 5.3.9-1) trixie: resolved (fixed in 5.3.9-1)

CVE-2023-52740 [MEDIUM] CVE-2023-52740: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/64s... In the Linux kernel, the following vulnerability has been resolved: powerpc/64s/interrupt: Fix interrupt exit race with security mitigation switch The RFI and STF security mitigation options can flip the interrupt_exit_not_reentrant static branch condition concurrently with the interrupt exit code which tests that branch. Interrupt exit tests this condition to set M

CVE-2023-52785 [MEDIUM] CVE-2023-52785: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: ... In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR If command timeout happens and cq complete IRQ is raised at the same time, ufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the ISR. Error log: ufshcd_abort: Device abort task at tag 18 Unable to handle kernel

CVE-2024-56637 [MEDIUM] CVE-2024-56637: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Hold module reference while requesting a module User space may unload ip_set.ko while it is itself requesting a set type backend module, leading to a kernel crash. The race condition may be provoked by inserting an mdelay() right after the nfnl_unlock() call. Scope: local bookworm:

CVE-2025-21825 [MEDIUM] CVE-2025-21825: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel... In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT During the update procedure, when overwrite element in a pre-allocated htab, the freeing of old_element is protected by the bucket lock. The reason why the bucket lock is necessary is that the old_element has already been stashed in ht