Debian Linux vulnerabilities

CVE-2026-22995 [HIGH] CVE-2026-22995: linux - In the Linux kernel, the following vulnerability has been resolved: ublk: fix u... In the Linux kernel, the following vulnerability has been resolved: ublk: fix use-after-free in ublk_partition_scan_work A race condition exists between the async partition scan work and device teardown that can lead to a use-after-free of ub->ub_disk: 1. ublk_ctrl_start_dev() schedules partition_scan_work after add_disk() 2. ublk_stop_dev() calls ublk_stop_dev_unlock

CVE-2025-71155 [HIGH] CVE-2025-71155: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: s390: ... In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix gmap_helper_zap_one_page() again A few checks were missing in gmap_helper_zap_one_page(), which can lead to memory corruption in the guest under specific circumstances. Add the missing checks. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.18.5-1) sid: re

CVE-2025-71092 [HIGH] CVE-2025-71092: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_r... In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats() Commit ef56081d1864 ("RDMA/bnxt_re: RoCE related hardware counters update") added three new counters and placed them after BNXT_RE_OUT_OF_SEQ_ERR. BNXT_RE_OUT_OF_SEQ_ERR acts as a boundary marker for allocating hardware statistics with different

CVE-2023-21106 [HIGH] CVE-2023-21106: linux - In adreno_set_param of adreno_gpu.c, there is a possible memory corruption due t... In adreno_set_param of adreno_gpu.c, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-265016072References: Upstream kernel Scope: local bookworm: resolved (fixe

CVE-2014-9428 [HIGH] CVE-2014-9428: linux - The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the ... The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of an amount of memory, which allows remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets. Scope: local bookworm: resolved (fixed in 3.1

CVE-2022-29901 [MEDIUM] CVE-2022-29901: linux - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant th... Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions. Scope: local bookworm: reso

CVE-2025-40048 CVE-2025-40048: linux - In the Linux kernel, the following vulnerability has been resolved: uio_hv_gene... In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Let userspace take care of interrupt mask Remove the logic to set interrupt mask by default in uio_hv_generic driver as the interrupt mask value is supposed to be controlled completely by the user space. If the mask bit gets changed by the driver, concurrently with user mode operating on the

CVE-2025-68337 CVE-2025-68337: linux - In the Linux kernel, the following vulnerability has been resolved: jbd2: avoid... In the Linux kernel, the following vulnerability has been resolved: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted There's issue when file system corrupted: ------------[ cut here ]------------ kernel BUG at fs/jbd2/transaction.c:1289! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 5 UID: 0 PID: 2031 Comm: mkdir Not tainted 6.18.0-rc1-n

CVE-2025-40168 CVE-2025-40168: linux - In the Linux kernel, the following vulnerability has been resolved: smc: Use __... In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). smc_clc_prfx_match() is called from smc_listen_work() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu(). Note that the returned value of smc_clc_prfx_match() is not used in the

CVE-2025-40046 [LOW] CVE-2025-40046: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/zc... In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix overshooting recv limit It's reported that sometimes a zcrx request can receive more than was requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for all received buffers including frag lists, but then doing recursive calls to process frag list skbs, which leads to des

CVE-2023-3338 [MEDIUM] CVE-2023-3338: linux - A null pointer dereference flaw was found in the Linux kernel's DECnet networkin... A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue could allow a remote user to crash the system. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 6.1.4-1) sid: resolved (fixed in 6.1.4-1) trixie: resolved (fixed in 6.1.4-1)

CVE-2025-68799 CVE-2025-68799: linux - In the Linux kernel, the following vulnerability has been resolved: caif: fix i... In the Linux kernel, the following vulnerability has been resolved: caif: fix integer underflow in cffrml_receive() The cffrml_receive() function extracts a length field from the packet header and, when FCS is disabled, subtracts 2 from this length without validating that len >= 2. If an attacker sends a malicious packet with a length field of 0 or 1 to an interface with FCS

CVE-2025-40277 CVE-2025-40277: linux - In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx:... In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing an out-of-bounds access. Scope: local bookworm: resolved (fixed in 6.1.159-1) bullseye: resolved (fixed in 5.10.247-1)

CVE-2012-0957 [MEDIUM] CVE-2012-0957: linux - The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 ... The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality. Scope: local bookworm: resolved (fixed in 3.2.32-1) bullseye: resolved (fixed in 3.2.32-1) forky: resolved (fixed in 3.2.32-1) sid: resolved (fixed

CVE-2025-68795 CVE-2025-68795: linux - In the Linux kernel, the following vulnerability has been resolved: ethtool: Av... In the Linux kernel, the following vulnerability has been resolved: ethtool: Avoid overflowing userspace buffer on stats query The ethtool -S command operates across three ioctl calls: ETHTOOL_GSSET_INFO for the size, ETHTOOL_GSTRINGS for the names, and ETHTOOL_GSTATS for the values. If the number of stats changes between these calls (e.g., due to device reconfiguration), us

CVE-2025-68352 [LOW] CVE-2025-68352: linux - In the Linux kernel, the following vulnerability has been resolved: spi: ch341:... In the Linux kernel, the following vulnerability has been resolved: spi: ch341: fix out-of-bounds memory access in ch341_transfer_one Discovered by Atuin - Automated Vulnerability Discovery Engine. The 'len' variable is calculated as 'min(32, trans->len + 1)', which includes the 1-byte command header. When copying data from 'trans->tx_buf' to 'ch341->tx_buf + 1', using

CVE-2025-40349 CVE-2025-40349: linux - In the Linux kernel, the following vulnerability has been resolved: hfs: valida... In the Linux kernel, the following vulnerability has been resolved: hfs: validate record offset in hfsplus_bmap_alloc hfsplus_bmap_alloc can trigger a crash if a record offset or length is larger than node_size [ 15.264282] BUG: KASAN: slab-out-of-bounds in hfsplus_bmap_alloc+0x887/0x8b0 [ 15.265192] Read of size 8 at addr ffff8881085ca188 by task test/183 [ 15.265949] [ 15.

CVE-2025-40262 CVE-2025-40262: linux - In the Linux kernel, the following vulnerability has been resolved: Input: imx_... In the Linux kernel, the following vulnerability has been resolved: Input: imx_sc_key - fix memory corruption on unload This is supposed to be "priv" but we accidentally pass "&priv" which is an address in the stack and so it will lead to memory corruption when the imx_sc_key_action() function is called. Remove the &. Scope: local bookworm: resolved (fixed in 6.1.159-1) bull

CVE-2019-10142 [HIGH] CVE-2019-10142: linux - A flaw was found in the Linux kernel's freescale hypervisor manager implementati... A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, excluding 5.0.17. A parameter passed to an ioctl was incorrectly validated and used in size calculations for the page size calculation. An attacker can use this flaw to crash the system, corrupt memory, or create other adverse security affects. Scope: local

CVE-2025-68314 [LOW] CVE-2025-68314: linux - In the Linux kernel, the following vulnerability has been resolved: drm/msm: ma... In the Linux kernel, the following vulnerability has been resolved: drm/msm: make sure last_fence is always updated Update last_fence in the vm-bind path instead of kernel managed path. last_fence is used to wait for work to finish in vm_bind contexts but not used for kernel managed contexts. This fixes a bug where last_fence is not waited on context close leading to f