Debian Linux vulnerabilities

CVE-2025-71148 [LOW] CVE-2025-71148: linux - In the Linux kernel, the following vulnerability has been resolved: net/handsha... In the Linux kernel, the following vulnerability has been resolved: net/handshake: restore destructor on submit failure handshake_req_submit() replaces sk->sk_destruct but never restores it when submission fails before the request is hashed. handshake_sk_destruct() then returns early and the original destructor never runs, leaking the socket. Restore sk_destruct on the

CVE-2015-7872 [LOW] CVE-2015-7872: linux - The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel throug... The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 4.2.6 allows local users to cause a denial of service (OOPS) via crafted keyctl commands. Scope: local bookworm: resolved (fixed in 4.2.5-1) bullseye: resolved (fixed in 4.2.5-1) forky: resolved (fixed in 4.2.5-1) sid: resolved (fixed in 4.2.5-1) trixie: resolved (fixed in 4.2.5-1)

CVE-2014-3645 [LOW] CVE-2014-3645: linux - arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.12 does not... arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.12 does not have an exit handler for the INVEPT instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application. Scope: local bookworm: resolved (fixed in 3.12.6-1) bullseye: resolved (fixed in 3.12.6-1) forky: resolved (fixed in 3.12.6-1) sid: resolved (

CVE-2013-1956 [LOW] CVE-2013-1956: linux - The create_user_ns function in kernel/user_namespace.c in the Linux kernel befor... The create_user_ns function in kernel/user_namespace.c in the Linux kernel before 3.8.6 does not check whether a chroot directory exists that differs from the namespace root directory, which allows local users to bypass intended filesystem restrictions via a crafted clone system call. Scope: local bookworm: resolved (fixed in 3.8.11-1) bullseye: resolved (fixed in 3.8.11

CVE-2017-17864 [LOW] CVE-2017-17864: linux - kernel/bpf/verifier.c in the Linux kernel through 4.14.8 mishandles states_equal... kernel/bpf/verifier.c in the Linux kernel through 4.14.8 mishandles states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which allows local users to obtain potentially sensitive address information, aka a "pointer leak." Scope: local bookworm: resolved (fixed in 4.14.7-1) bullseye: resolved (fixed in 4.14.7-1) forky: resolved (fixed i

CVE-2022-48939 [LOW] CVE-2022-48939: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Add sc... In the Linux kernel, the following vulnerability has been resolved: bpf: Add schedule points in batch ops syzbot reported various soft lockups caused by bpf batch operations. INFO: task kworker/1:1:27 blocked for more than 140 seconds. INFO: task hung in rcu_barrier Nothing prevents batch ops to process huge amount of data, we need to add schedule points in them. Note

CVE-2025-21851 [LOW] CVE-2025-21851: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix so... In the Linux kernel, the following vulnerability has been resolved: bpf: Fix softlockup in arena_map_free on 64k page kernel On an aarch64 kernel with CONFIG_PAGE_SIZE_64KB=y, arena_htab tests cause a segmentation fault and soft lockup. The same failure is not observed with 4k pages on aarch64. It turns out arena_map_free() is calling apply_to_existing_page_range() wit

CVE-2022-3629 [LOW] CVE-2022-3629: linux - A vulnerability was found in Linux Kernel. It has been declared as problematic. ... A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects the function vsock_connect of the file net/vmw_vsock/af_vsock.c. The manipulation leads to memory leak. The complexity of an attack is rather high. The exploitation appears to be difficult. It is recommended to apply a patch to fix this issue. VDB-211930 is the iden

CVE-2023-52620 [LOW] CVE-2023-52620: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow timeout for anonymous sets Never used from userspace, disallow these parameters. Scope: local bookworm: resolved (fixed in 6.1.82-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.4.4-1) sid: resolved (fixed in 6.4.4-1) trixie: resolved (fixed in 6.4

CVE-2023-52746 [LOW] CVE-2023-52746: linux - In the Linux kernel, the following vulnerability has been resolved: xfrm/compat... In the Linux kernel, the following vulnerability has been resolved: xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() int type = nla_type(nla); if (type > XFRMA_MAX) { return -EOPNOTSUPP; } @type is then used as an array index and can be used as a Spectre v1 gadget. if (nla_len(nla) < compat_policy[type].len) { array_index_nospec() can be used to

CVE-2015-8569 [LOW] CVE-2015-8569: linux - The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in th... The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application. Scope: local bookworm: resolved (fixed in 4.3.3-3) bullseye: resolved (fixed in 4.3.3-

CVE-2021-3923 [LOW] CVE-2021-3923: linux - A flaw was found in the Linux kernel's implementation of RDMA over infiniband. A... A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms. Scope: local

CVE-2014-8133 [LOW] CVE-2014-8133: linux - arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Li... arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area system call and later reads a 16-bit value. Scope: local boo

CVE-2014-9585 [LOW] CVE-2014-9585: linux - The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2... The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD. Scope: local bookworm: resolved (fixed in 3.16.7-ckt4-1) bullseye: resolved (fixed in 3.16.7-ckt4-1) forky: r

CVE-2015-6252 [LOW] CVE-2015-6252: linux - The vhost_dev_ioctl function in drivers/vhost/vhost.c in the Linux kernel before... The vhost_dev_ioctl function in drivers/vhost/vhost.c in the Linux kernel before 4.1.5 allows local users to cause a denial of service (memory consumption) via a VHOST_SET_LOG_FD ioctl call that triggers permanent file-descriptor allocation. Scope: local bookworm: resolved (fixed in 4.1.5-1) bullseye: resolved (fixed in 4.1.5-1) forky: resolved (fixed in 4.1.5-1) sid: re

CVE-2014-9419 [LOW] CVE-2014-9419: linux - The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel thr... The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 does not ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address. Scope: local bookworm: resolved (fixed

CVE-2013-2147 [LOW] CVE-2013-2147: linux - The HP Smart Array controller disk-array driver and Compaq SMART2 controller dis... The HP Smart Array controller disk-array driver and Compaq SMART2 controller disk-array driver in the Linux kernel through 3.9.4 do not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via (1) a crafted IDAGETPCIINFO command for a /dev/ida device, related to the ida_locked_ioctl function in drivers/block/cpqa

CVE-2014-2038 [LOW] CVE-2014-2038: linux - The nfs_can_extend_write function in fs/nfs/write.c in the Linux kernel before 3... The nfs_can_extend_write function in fs/nfs/write.c in the Linux kernel before 3.13.3 relies on a write delegation to extend a write operation without a certain up-to-date verification, which allows local users to obtain sensitive information from kernel memory in opportunistic circumstances by writing to a file in an NFS filesystem and then reading the same file. Scope:

CVE-2015-3291 [LOW] CVE-2015-3291: linux - arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platfor... arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform does not properly determine when nested NMI processing is occurring, which allows local users to cause a denial of service (skipped NMI) by modifying the rsp register, issuing a syscall instruction, and triggering an NMI. Scope: local bookworm: resolved (fixed in 4.0.8-2) bullseye: resolved

CVE-2015-2830 [LOW] CVE-2015-2830: linux - arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent th... arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16. Scope: local bookworm: resolv