Debian Linux vulnerabilities

CVE-2022-29901 [MEDIUM] CVE-2022-29901: linux - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant th... Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions. Scope: local bookworm: reso

CVE-2024-0565 [MEDIUM] CVE-2024-0565: linux - An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/... An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service. Scope: local bookworm: resolved (fixed in 6.1.69-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in

CVE-2014-9428 [HIGH] CVE-2014-9428: linux - The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the ... The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of an amount of memory, which allows remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets. Scope: local bookworm: resolved (fixed in 3.1

CVE-2024-27394 [HIGH] CVE-2024-27394: linux - In the Linux kernel, the following vulnerability has been resolved: tcp: Fix Us... In the Linux kernel, the following vulnerability has been resolved: tcp: Fix Use-After-Free in tcp_ao_connect_init Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal of tcp_ao_connect_init, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent th

CVE-2025-40133 [LOW] CVE-2025-40133: linux - In the Linux kernel, the following vulnerability has been resolved: mptcp: Use ... In the Linux kernel, the following vulnerability has been resolved: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). mptcp_active_enable() is called from subflow_finish_connect(), which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always under RCU. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu(). Scope:

CVE-2025-40328 CVE-2025-40328: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_close_cached_fid() find_or_create_cached_dir() could grab a new reference after kref_put() had seen the refcount drop to zero but before cfid_list_lock is acquired in smb2_close_cached_fid(), leading to use-after-free. Switch to kref_put_lock() so cfid_release() is call

CVE-2025-68806 CVE-2025-68806: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix buffer validation by including null terminator size in EA length The smb2_set_ea function, which handles Extended Attributes (EA), was performing buffer validation checks that incorrectly omitted the size of the null terminating character (+1 byte) for EA Name. This patch fixes the issue by explic

CVE-2025-68315 CVE-2025-68315: linux - In the Linux kernel, the following vulnerability has been resolved: f2fs: fix t... In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to detect potential corrupted nid in free_nid_list As reported, on-disk footer.ino and footer.nid is the same and out-of-range, let's add sanity check on f2fs_alloc_nid() to detect any potential corruption in free_nid_list. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 6.17.8

CVE-2025-40277 CVE-2025-40277: linux - In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx:... In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing an out-of-bounds access. Scope: local bookworm: resolved (fixed in 6.1.159-1) bullseye: resolved (fixed in 5.10.247-1)

CVE-2022-50719 CVE-2022-50719: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: line6... In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: fix stack overflow in line6_midi_transmit Correctly calculate available space including the size of the chunk buffer. This fixes a buffer overflow when multiple MIDI sysex messages are sent to a PODxt device. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixed in 5.10.17

CVE-2012-0957 [MEDIUM] CVE-2012-0957: linux - The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 ... The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality. Scope: local bookworm: resolved (fixed in 3.2.32-1) bullseye: resolved (fixed in 3.2.32-1) forky: resolved (fixed in 3.2.32-1) sid: resolved (fixed

CVE-2025-68795 CVE-2025-68795: linux - In the Linux kernel, the following vulnerability has been resolved: ethtool: Av... In the Linux kernel, the following vulnerability has been resolved: ethtool: Avoid overflowing userspace buffer on stats query The ethtool -S command operates across three ioctl calls: ETHTOOL_GSSET_INFO for the size, ETHTOOL_GSTRINGS for the names, and ETHTOOL_GSTATS for the values. If the number of stats changes between these calls (e.g., due to device reconfiguration), us

CVE-2025-40058 [LOW] CVE-2025-40058: linux - In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d:... In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Disallow dirty tracking if incoherent page walk Dirty page tracking relies on the IOMMU atomically updating the dirty bit in the paging-structure entry. For this operation to succeed, the paging- structure memory must be coherent between the IOMMU and the CPU. In another word, if the iommu

CVE-2025-39970 CVE-2025-39970: linux - In the Linux kernel, the following vulnerability has been resolved: i40e: fix i... In the Linux kernel, the following vulnerability has been resolved: i40e: fix input validation logic for action_meta Fix condition to check 'greater or equal' to prevent OOB dereference. Scope: local bookworm: resolved (fixed in 6.1.158-1) bullseye: resolved (fixed in 5.10.247-1) forky: resolved (fixed in 6.16.10-1) sid: resolved (fixed in 6.16.10-1) trixie: resolved (fixed

CVE-2025-68352 [LOW] CVE-2025-68352: linux - In the Linux kernel, the following vulnerability has been resolved: spi: ch341:... In the Linux kernel, the following vulnerability has been resolved: spi: ch341: fix out-of-bounds memory access in ch341_transfer_one Discovered by Atuin - Automated Vulnerability Discovery Engine. The 'len' variable is calculated as 'min(32, trans->len + 1)', which includes the 1-byte command header. When copying data from 'trans->tx_buf' to 'ch341->tx_buf + 1', using

CVE-2025-68314 [LOW] CVE-2025-68314: linux - In the Linux kernel, the following vulnerability has been resolved: drm/msm: ma... In the Linux kernel, the following vulnerability has been resolved: drm/msm: make sure last_fence is always updated Update last_fence in the vm-bind path instead of kernel managed path. last_fence is used to wait for work to finish in vm_bind contexts but not used for kernel managed contexts. This fixes a bug where last_fence is not waited on context close leading to f

CVE-2023-53769 CVE-2023-53769: linux - In the Linux kernel, the following vulnerability has been resolved: virt/coco/s... In the Linux kernel, the following vulnerability has been resolved: virt/coco/sev-guest: Double-buffer messages The encryption algorithms read and write directly to shared unencrypted memory, which may leak information as well as permit the host to tamper with the message integrity. Instead, copy whole messages in or out as needed before doing any computation on them. Scope:

CVE-2022-47941 [HIGH] CVE-2022-47941: linux - An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.... An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c omits a kfree call in certain smb2_handle_negotiate error conditions, aka a memory leak. Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved forky: resolved (fixed in 5.19.6-1) sid: resolved (fixed in 5.19.6-1) trixie: resolved (fixed in 5.19.6-1

CVE-2018-10853 [HIGH] CVE-2018-10853: linux - A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated ins... A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest. Scope: local bookworm: resolved (fixed in 4.16.16-1)

CVE-2024-49982 [HIGH] CVE-2024-49982: linux - In the Linux kernel, the following vulnerability has been resolved: aoe: fix th... In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in more places For fixing CVE-2023-6270, f98364e92662 ("aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts") makes tx() calling dev_put() instead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs into use-after-free. Then Nicolai St