Debian Linux vulnerabilities

CVE-2013-1774 [MEDIUM] CVE-2013-1774: linux - The chase_port function in drivers/usb/serial/io_ti.c in the Linux kernel before... The chase_port function in drivers/usb/serial/io_ti.c in the Linux kernel before 3.7.4 allows local users to cause a denial of service (NULL pointer dereference and system crash) via an attempted /dev/ttyUSB read or write operation on a disconnected Edgeport USB serial converter. Scope: local bookworm: resolved (fixed in 3.2.38-1) bullseye: resolved (fixed in 3.2.38-1

CVE-2017-5967 [MEDIUM] CVE-2017-5967: linux - The time subsystem in the Linux kernel through 4.9.9, when CONFIG_TIMER_STATS is... The time subsystem in the Linux kernel through 4.9.9, when CONFIG_TIMER_STATS is enabled, allows local users to discover real PID values (as distinguished from PID values inside a PID namespace) by reading the /proc/timer_list file, related to the print_timer function in kernel/time/timer_list.c and the __timer_stats_timer_set_start_info function in kernel/time/timer.

CVE-2023-52584 [LOW] CVE-2023-52584: linux - In the Linux kernel, the following vulnerability has been resolved: spmi: media... In the Linux kernel, the following vulnerability has been resolved: spmi: mediatek: Fix UAF on device remove The pmif driver data that contains the clocks is allocated along with spmi_controller. On device remove, spmi_controller will be freed first, and then devres , including the clocks, will be cleanup. This leads to UAF because putting the clocks will access the cl

CVE-2019-17052 [LOW] CVE-2019-17052: linux - ax25_create in net/ax25/af_ax25.c in the AF_AX25 network module in the Linux ker... ax25_create in net/ax25/af_ax25.c in the AF_AX25 network module in the Linux kernel 3.16 through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-0614e2b73768. Scope: local bookworm: resolved (fixed in 5.3.7-1) bullseye: resolved (fixed in 5.3.7-1) forky: resolved (fixed in 5.3.7-1) sid: resolved (fixed in 5.3.7-1

CVE-2019-17056 [LOW] CVE-2019-17056: linux - llcp_sock_create in net/nfc/llcp_sock.c in the AF_NFC network module in the Linu... llcp_sock_create in net/nfc/llcp_sock.c in the AF_NFC network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-3a359798b176. Scope: local bookworm: resolved (fixed in 5.3.7-1) bullseye: resolved (fixed in 5.3.7-1) forky: resolved (fixed in 5.3.7-1) sid: resolved (fixed in 5.3.7-1

CVE-2017-17807 [LOW] CVE-2017-17807: linux - The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control c... The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current task's "default request-key keyring" via the request_key() system call, allowing a local user to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write permission) to that keyring, related to construct_get

CVE-2023-53993 CVE-2023-53993: linux - In the Linux kernel, the following vulnerability has been resolved: PCI/DOE: Fi... In the Linux kernel, the following vulnerability has been resolved: PCI/DOE: Fix memory leak with CONFIG_DEBUG_OBJECTS=y After a pci_doe_task completes, its work_struct needs to be destroyed to avoid a memory leak with CONFIG_DEBUG_OBJECTS=y. Scope: local bookworm: resolved (fixed in 6.1.25-1) bullseye: resolved forky: resolved (fixed in 6.1.25-1) sid: resolved (fixed in 6.1

CVE-2026-23473 CVE-2026-23473: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/po... In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: fix multishot recv missing EOF on wakeup race When a socket send and shutdown() happen back-to-back, both fire wake-ups before the receiver's task_work has a chance to run. The first wake gets poll ownership (poll_refs=1), and the second bumps it to 2. When io_poll_check_events() runs, it call

CVE-2019-18809 [MEDIUM] CVE-2019-18809: linux - A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-u... A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-2289adbfa559. Scope: local bookworm: resolved (fixed in 5.4.13-1) bullseye: resolved (fixed in 5.4.13-1) forky: resolved (fixed in 5.4.13-1) sid: resolved (fixed in 5

CVE-2019-19068 [MEDIUM] CVE-2019-19068: linux - A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/... A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-a2cdd07488e6. Scope: local bookworm: resolved (fixed in 5.4.13-1) bullseye: resolved (fixed in 5.4.13-1)

CVE-2020-15437 [MEDIUM] CVE-2020-15437: linux - The Linux kernel before version 5.8 is vulnerable to a NULL pointer dereference ... The Linux kernel before version 5.8 is vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() that allows local users to cause a denial of service by using the p->serial_in pointer which uninitialized. Scope: local bookworm: resolved (fixed in 5.7.17-1) bullseye: resolved (fixed in 5.7.17-1) forky: resolved (fixed

CVE-2019-19072 [MEDIUM] CVE-2019-19072: linux - A memory leak in the predicate_parse() function in kernel/trace/trace_events_fil... A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-96c5c6e6a5b6. Scope: local bookworm: resolved (fixed in 5.4.6-1) bullseye: resolved (fixed in 5.4.6-1) forky: resolved (fixed in 5.4.6-1) sid: resolved (fixed in 5.4.6-1)

CVE-2021-47534 [MEDIUM] CVE-2021-47534: linux - In the Linux kernel, the following vulnerability has been resolved: drm/vc4: km... In the Linux kernel, the following vulnerability has been resolved: drm/vc4: kms: Add missing drm_crtc_commit_put Commit 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before a commit") introduced a global state for the HVS, with each FIFO storing the current CRTC commit so that we can properly synchronize commits. However, the refcounting was off and we t

CVE-2012-5517 [MEDIUM] CVE-2012-5517: linux - The online_pages function in mm/memory_hotplug.c in the Linux kernel before 3.6 ... The online_pages function in mm/memory_hotplug.c in the Linux kernel before 3.6 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact in opportunistic circumstances by using memory that was hot-added by an administrator. Scope: local bookworm: resolved (fixed in 3.2.41-1) bullseye: resolve

CVE-2013-4270 [LOW] CVE-2013-4270: linux - The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before ... The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values, which allows local users to bypass intended /proc/sys/net restrictions via a crafted application. Scope: local bookworm: resolved (fixed in 3.11.5-1) bullseye: resolved (fixed in 3.11.5-1) forky: resolved (fixed in 3.11.5-1) sid: resolved

CVE-2013-0914 [LOW] CVE-2013-0914: linux - The flush_signal_handlers function in kernel/signal.c in the Linux kernel before... The flush_signal_handlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value of the sa_restorer field across an exec operation, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application containing a sigaction system call. Scope: local bookworm: resolved (fixed in 3.2.41-1) bullseye: resolved (fix

CVE-2021-45486 [LOW] CVE-2021-45486: linux - In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c h... In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small. Scope: local bookworm: resolved (fixed in 5.10.38-1) bullseye: resolved (fixed in 5.10.38-1) forky: resolved (fixed in 5.10.38-1) sid: resolved (fixed in 5.10.38-1) trixie: resolved (fixed in 5.10.38-1)

CVE-2019-19057 [LOW] CVE-2019-19057: linux - Two memory leaks in the mwifiex_pcie_init_evt_ring() function in drivers/net/wir... Two memory leaks in the mwifiex_pcie_init_evt_ring() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-d10dcb615c8e. Scope: local bookworm: resolved (fixed in 5.4.8-1) bullseye: resolved (fixed in 5.4.8-1) f

CVE-2014-8134 [LOW] CVE-2014-8134: linux - The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel thr... The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value. Scope: local bookworm: resolved (fixed in 3.16.7-ckt4-1) bullseye: resolved (fixed i

CVE-2022-33981 [LOW] CVE-2022-33981: linux - drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a deni... drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function. Scope: local bookworm: resolved (fixed in 5.17.6-1) bullseye: resolved (fixed in 5.10.113-1) forky: resolved (fixed in 5.17.6-1) sid: resolved (fixed in 5.17.6-1) trixie: re