Debian Linux vulnerabilities

CVE-2022-49633 [MEDIUM] CVE-2022-49633: linux - In the Linux kernel, the following vulnerability has been resolved: icmp: Fix d... In the Linux kernel, the following vulnerability has been resolved: icmp: Fix data-races around sysctl_icmp_echo_enable_probe. While reading sysctl_icmp_echo_enable_probe, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: resolved forky: resolved (fixed in 5.18.14-1) sid: r

CVE-2022-48784 [MEDIUM] CVE-2022-48784: linux - In the Linux kernel, the following vulnerability has been resolved: cfg80211: f... In the Linux kernel, the following vulnerability has been resolved: cfg80211: fix race in netlink owner interface destruction My previous fix here to fix the deadlock left a race where the exact same deadlock (see the original commit referenced below) can still happen if cfg80211_destroy_ifaces() already runs while nl80211_netlink_notify() is still marking some inte

CVE-2024-50260 [MEDIUM] CVE-2024-50260: linux - In the Linux kernel, the following vulnerability has been resolved: sock_map: f... In the Linux kernel, the following vulnerability has been resolved: sock_map: fix a NULL pointer dereference in sock_map_link_update_prog() The following race condition could trigger a NULL pointer dereference: sock_map_link_detach(): sock_map_link_update_prog(): mutex_lock(&sockmap_mutex); ... sockmap_link->map = NULL; mutex_unlock(&sockmap_mutex); mutex_lock(&sock

CVE-2024-50183 [MEDIUM] CVE-2024-50183: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc:... In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance Deleting an NPIV instance requires all fabric ndlps to be released before an NPIV's resources can be torn down. Failure to release fabric ndlps beforehand opens kref imbalance race conditions. Fix by forcing the DA_ID to c

CVE-2024-49872 [MEDIUM] CVE-2024-49872: linux - In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix... In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix memfd_pin_folios alloc race panic If memfd_pin_folios tries to create a hugetlb page, but someone else already did, then folio gets the value -EEXIST here: folio = memfd_alloc_folio(memfd, start_idx); if (IS_ERR(folio)) { ret = PTR_ERR(folio); if (ret != -EEXIST) goto err; then on the ne

CVE-2022-49967 [MEDIUM] CVE-2022-49967: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a ... In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a data-race around bpf_jit_limit. While reading bpf_jit_limit, it can be changed concurrently via sysctl, WRITE_ONCE() in __do_proc_doulongvec_minmax(). The size of bpf_jit_limit is long, so we need to add a paired READ_ONCE() to avoid load-tearing. Scope: local bookworm: resolved (fixed in

CVE-2025-37985 [MEDIUM] CVE-2025-37985: linux - In the Linux kernel, the following vulnerability has been resolved: USB: wdm: c... In the Linux kernel, the following vulnerability has been resolved: USB: wdm: close race between wdm_open and wdm_wwan_port_stop Clearing WDM_WWAN_IN_USE must be the last action or we can open a chardev whose URBs are still poisoned Scope: local bookworm: resolved (fixed in 6.1.137-1) bullseye: resolved forky: resolved (fixed in 6.12.27-1) sid: resolved (fixed in 6.

CVE-2013-7348 [MEDIUM] CVE-2013-7348: linux - Double free vulnerability in the ioctx_alloc function in fs/aio.c in the Linux k... Double free vulnerability in the ioctx_alloc function in fs/aio.c in the Linux kernel before 3.12.4 allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via vectors involving an error condition in the aio_setup_ring function. Scope: local bookworm: resolved (fixed in 3.13.4-1) bullseye: resolved (fixed in 3.13.4-1) f

CVE-2025-39754 [MEDIUM] CVE-2025-39754: linux - In the Linux kernel, the following vulnerability has been resolved: mm/smaps: f... In the Linux kernel, the following vulnerability has been resolved: mm/smaps: fix race between smaps_hugetlb_range and migration smaps_hugetlb_range() handles the pte without holdling ptl, and may be concurrenct with migration, leaing to BUG_ON in pfn_swap_entry_to_page(). The race is as follows. smaps_hugetlb_range migrate_pages huge_ptep_get remove_migration_ptes

CVE-2019-19067 [MEDIUM] CVE-2019-19067: linux - Four memory leaks in the acp_hw_init() function in drivers/gpu/drm/amd/amdgpu/am... Four memory leaks in the acp_hw_init() function in drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c in the Linux kernel before 5.3.8 allow attackers to cause a denial of service (memory consumption) by triggering mfd_add_hotplug_devices() or pm_genpd_add_device() failures, aka CID-57be09c6e874. NOTE: third parties dispute the relevance of this because the attacker must alrea

CVE-2019-3819 [MEDIUM] CVE-2019-3819: linux - A flaw was found in the Linux kernel in the function hid_debug_events_read() in ... A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ("root") can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable. Scope: local bookworm: resolved (fixed in 4.19.2

CVE-2017-14051 [MEDIUM] CVE-2017-14051: linux - An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/sc... An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel through 4.12.10 allows local users to cause a denial of service (memory corruption and system crash) by leveraging root access. Scope: local bookworm: resolved (fixed in 4.12.13-1) bullseye: resolved (fixed in 4.12.13-1) forky: resolved (fixed in

CVE-2020-25639 [MEDIUM] CVE-2020-25639: linux - A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driv... A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC. This flaw allows a local user to crash the system. Scope: local bookworm: resolved (fixed in 5.10.19-1) bullseye: resolved (fixed in 5.10.19-1) forky: resolved (fixed in 5.10.1

CVE-2020-11609 [MEDIUM] CVE-2020-11609: linux - An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.... An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. drivers/media/usb/gspca/stv06xx/stv06xx.c and drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c mishandle invalid descriptors, as demonstrated by a NULL pointer dereference, aka CID-485b06aadb93. Scope: local bookworm: resolved (fixed in 5.5.17-1) bullseye: resolved (fixed in 5.5.17-1)

CVE-2012-2372 [MEDIUM] CVE-2012-2372: linux - The rds_ib_xmit function in net/rds/ib_send.c in the Reliable Datagram Sockets (... The rds_ib_xmit function in net/rds/ib_send.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel 3.7.4 and earlier allows local users to cause a denial of service (BUG_ON and kernel panic) by establishing an RDS connection with the source IP address equal to the IPoIB interface's own IP address, as demonstrated by rds-ping. Scope: local

CVE-2023-52492 [MEDIUM] CVE-2023-52492: linux - In the Linux kernel, the following vulnerability has been resolved: dmaengine: ... In the Linux kernel, the following vulnerability has been resolved: dmaengine: fix NULL pointer in channel unregistration function __dma_async_device_channel_register() can fail. In case of failure, chan->local is freed (with free_percpu()), and chan->local is nullified. When dma_async_device_unregister() is called (because of managed API or intentionally by DMA con

CVE-2024-36950 [MEDIUM] CVE-2024-36950: linux - In the Linux kernel, the following vulnerability has been resolved: firewire: o... In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: mask bus reset interrupts between ISR and bottom half In the FireWire OHCI interrupt handler, if a bus reset interrupt has occurred, mask bus reset interrupts until bus_reset_work has serviced and cleared the interrupt. Normally, we always leave bus reset interrupts masked. We infer

CVE-2023-52617 [MEDIUM] CVE-2023-52617: linux - In the Linux kernel, the following vulnerability has been resolved: PCI: switch... In the Linux kernel, the following vulnerability has been resolved: PCI: switchtec: Fix stdev_release() crash after surprise hot remove A PCI device hot removal may occur while stdev->cdev is held open. The call to stdev_release() then happens during close or exit, at a point way past switchtec_pci_remove(). Otherwise the last ref would vanish with the trailing put_

CVE-2023-2269 [MEDIUM] CVE-2023-2269: linux - A denial of service problem was found, due to a possible recursive locking scena... A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 6.3.7-1) sid: resolved (fixed in 6.3.7-1

CVE-2016-5400 [MEDIUM] CVE-2016-5400: linux - Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in... Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect and disconnect operations. Scope: local bookworm: resolve