Debian Linux vulnerabilities

CVE-2022-50863 CVE-2022-50863: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89... In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: free unused skb to prevent memory leak This avoid potential memory leak under power saving mode. Scope: local bookworm: resolved (fixed in 6.0.3-1) bullseye: resolved forky: resolved (fixed in 6.0.3-1) sid: resolved (fixed in 6.0.3-1) trixie: resolved (fixed in 6.0.3-1)

CVE-2013-7026 [MEDIUM] CVE-2013-7026: linux - Multiple race conditions in ipc/shm.c in the Linux kernel before 3.12.2 allow lo... Multiple race conditions in ipc/shm.c in the Linux kernel before 3.12.2 allow local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted application that uses shmctl IPC_RMID operations in conjunction with other shm system calls. Scope: local bookworm: resolved (fixed in 3.12.5-1) bullseye: resolv

CVE-2023-54228 [LOW] CVE-2023-54228: linux - In the Linux kernel, the following vulnerability has been resolved: regulator: ... In the Linux kernel, the following vulnerability has been resolved: regulator: raa215300: Fix resource leak in case of error The clk_register_clkdev() allocates memory by calling vclkdev_alloc() and this memory is not freed in the error path. Similarly, resources allocated by clk_register_fixed_rate() are not freed in the error path. Fix these issues by using devm_clk_

CVE-2019-15807 [MEDIUM] CVE-2019-15807: linux - In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas... In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas/sas_expander.c when SAS expander discovery fails. This will cause a BUG and denial of service. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved (fixed in 5.2.6-1) sid: resolved (fixed in 5.2.6-1) trixie: resolved (fixed in 5.2.6-1)

CVE-2019-19056 [MEDIUM] CVE-2019-19056: linux - A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wir... A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-db8fd2cde932. Scope: local bookworm: resolved (fixed in 5.4.13-1) bullseye: resolved (fixed in 5.4.1

CVE-2019-19058 [MEDIUM] CVE-2019-19058: linux - A memory leak in the alloc_sgtable() function in drivers/net/wireless/intel/iwlw... A memory leak in the alloc_sgtable() function in drivers/net/wireless/intel/iwlwifi/fw/dbg.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering alloc_page() failures, aka CID-b4b814fec1a5. Scope: local bookworm: resolved (fixed in 5.4.6-1) bullseye: resolved (fixed in 5.4.6-1) forky: resolved (fixed in

CVE-2026-23430 [LOW] CVE-2026-23430: linux - In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx:... In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Don't overwrite KMS surface dirty tracker We were overwriting the surface's dirty tracker here causing a memory leak. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.19.10-1) sid: resolved (fixed in 6.19.10-1) trixie: resolved

CVE-2026-23431 [LOW] CVE-2026-23431: linux - In the Linux kernel, the following vulnerability has been resolved: spi: amlogi... In the Linux kernel, the following vulnerability has been resolved: spi: amlogic-spisg: Fix memory leak in aml_spisg_probe() In aml_spisg_probe(), ctlr is allocated by spi_alloc_target()/spi_alloc_host(), but fails to call spi_controller_put() in several error paths. This leads to a memory leak whenever the driver fails to probe after the initial allocation. Convert to

CVE-2016-6213 [MEDIUM] CVE-2016-6213: linux - fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts ... fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of mounts. Scope: local bookworm: resolved (fixed in 4.8.11-1) bu

CVE-2026-23337 [LOW] CVE-2026-23337: linux - In the Linux kernel, the following vulnerability has been resolved: pinctrl: pi... In the Linux kernel, the following vulnerability has been resolved: pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config() In pinconf_generic_parse_dt_config(), if parse_dt_cfg() fails, it returns directly. This bypasses the cleanup logic and results in a memory leak of the cfg buffer. Fix this by jumping to the out label on failure, ensuring kf

CVE-2026-31391 CVE-2026-31391: linux - In the Linux kernel, the following vulnerability has been resolved: crypto: atm... In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - Fix OOM ->tfm_count leak If memory allocation fails, decrement ->tfm_count to avoid blocking future reads. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 6.19.10-1) sid: resolved (fixed in 6.19.10-1) trixie: open

CVE-2026-23418 [LOW] CVE-2026-23418: linux - In the Linux kernel, the following vulnerability has been resolved: drm/xe/reg_... In the Linux kernel, the following vulnerability has been resolved: drm/xe/reg_sr: Fix leak on xa_store failure Free the newly allocated entry when xa_store() fails to avoid a memory leak on the error path. v2: use goto fail_free. (Bala) (cherry picked from commit 6bc6fec71ac45f52db609af4e62bdb96b9f5fadb) Scope: local bookworm: resolved bullseye: resolved forky: resolv

CVE-2013-3231 [MEDIUM] CVE-2013-3231: linux - The llc_ui_recvmsg function in net/llc/af_llc.c in the Linux kernel before 3.9-r... The llc_ui_recvmsg function in net/llc/af_llc.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. Scope: local bookworm: resolved (fixed in 3.8.11-1) bullseye: resolved (fixed in 3.8.11-1) forky: resolved (fix

CVE-2026-23283 [LOW] CVE-2026-23283: linux - In the Linux kernel, the following vulnerability has been resolved: regulator: ... In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix PM runtime reference leak in fp9931_hwmon_read() In fp9931_hwmon_read(), if regmap_read() failed, the function returned the error code without calling pm_runtime_put_autosuspend(), causing a PM reference leak. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fi

CVE-2026-23463 CVE-2026-23463: linux - In the Linux kernel, the following vulnerability has been resolved: soc: fsl: q... In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: fix race condition in qman_destroy_fq When QMAN_FQ_FLAG_DYNAMIC_FQID is set, there's a race condition between fq_table[fq->idx] state and freeing/allocating from the pool and WARN_ON(fq_table[fq->idx]) in qman_create_fq() gets triggered. Indeed, we can have: Thread A Thread B qman_destroy_fq

CVE-2026-23420 CVE-2026-23420: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: wlcor... In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: Fix a locking bug Make sure that wl->mutex is locked before it is unlocked. This has been detected by the Clang thread-safety analyzer. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 6.19.8-1) sid: resolved (fixed in 6.19.8-1) trixie: open

CVE-2026-23302 CVE-2026-23302: linux - In the Linux kernel, the following vulnerability has been resolved: net: annota... In the Linux kernel, the following vulnerability has been resolved: net: annotate data-races around sk->sk_{data_ready,write_space} skmsg (and probably other layers) are changing these pointers while other cpus might read them concurrently. Add corresponding READ_ONCE()/WRITE_ONCE() annotations for UDP, TCP and AF_UNIX. Scope: local bookworm: open bullseye: open forky: resol

CVE-2013-1957 [MEDIUM] CVE-2013-1957: linux - The clone_mnt function in fs/namespace.c in the Linux kernel before 3.8.6 does n... The clone_mnt function in fs/namespace.c in the Linux kernel before 3.8.6 does not properly restrict changes to the MNT_READONLY flag, which allows local users to bypass an intended read-only property of a filesystem by leveraging a separate mount namespace. Scope: local bookworm: resolved (fixed in 3.8.13-1) bullseye: resolved (fixed in 3.8.13-1) forky: resolved (fix

CVE-2016-2187 [MEDIUM] CVE-2016-2187: linux - The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel throu... The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor. Scope: local bookworm: resolved (fixed in 4.5.2-1) bullseye: resolved (fixed in 4.5.2-1) forky: resolved (fixed

CVE-2015-4170 [MEDIUM] CVE-2015-4170: linux - Race condition in the ldsem_cmpxchg function in drivers/tty/tty_ldsem.c in the L... Race condition in the ldsem_cmpxchg function in drivers/tty/tty_ldsem.c in the Linux kernel before 3.13-rc4-next-20131218 allows local users to cause a denial of service (ldsem_down_read and ldsem_down_write deadlock) by establishing a new tty thread during shutdown of a previous tty thread. Scope: local bookworm: resolved (fixed in 3.13.4-1) bullseye: resolved (fixed