Debian Linux vulnerabilities

CVE-2014-3180 [CRITICAL] CVE-2014-3180: linux - In kernel/compat.c in the Linux kernel before 3.17, as used in Google Chrome OS ... In kernel/compat.c in the Linux kernel before 3.17, as used in Google Chrome OS and other products, there is a possible out-of-bounds read. restart_syscall uses uninitialized data when restarting compat_sys_nanosleep. NOTE: this is disputed because the code path is unreachable Scope: local bookworm: resolved (fixed in 4.0.2-1) bullseye: resolved (fixed in 4.0.2-1) f

CVE-2023-5972 [HIGH] CVE-2023-5972: linux - A null pointer dereference flaw was found in the nft_inner.c functionality of ne... A null pointer dereference flaw was found in the nft_inner.c functionality of netfilter in the Linux kernel. This issue could allow a local user to crash the system or escalate their privileges on the system. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.5.10-1) sid: resolved (fixed in 6.5.10-1) trixie: resolved (fixed in 6.5.10-1)

CVE-2024-26976 [HIGH] CVE-2024-26976: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: Always... In the Linux kernel, the following vulnerability has been resolved: KVM: Always flush async #PF workqueue when vCPU is being destroyed Always flush the per-vCPU async #PF workqueue when a vCPU is clearing its completion queue, e.g. when a VM and all its vCPUs is being destroyed. KVM must ensure that none of its workqueue callbacks is running when the last reference to

CVE-2026-23013 [HIGH] CVE-2026-23013: linux - In the Linux kernel, the following vulnerability has been resolved: net: octeon... In the Linux kernel, the following vulnerability has been resolved: net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback octep_vf_request_irqs() requests MSI-X queue IRQs with dev_id set to ioq_vector. If request_irq() fails part-way, the rollback loop calls free_irq() with dev_id set to 'oct', which does not match the original dev_id and may leave the irqa

CVE-2019-19768 [HIGH] CVE-2019-19768: linux - In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add... In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer). Scope: local bookworm: resolved (fixed in 5.5.13-1) bullseye: resolved (fixed in 5.5.13-1) forky: resolved (fixed in 5.5.13-1) sid: resolved (fixed in 5.5.1

CVE-2024-26890 [MEDIUM] CVE-2024-26890: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: fix out of bounds memory access The problem is detected by KASAN. btrtl driver uses private hci data to store 'struct btrealtek_data'. If btrtl driver is used with btusb, then memory for private hci data is allocated in btusb. But no private data is allocated after hci_dev, when bt

CVE-2024-26768 [MEDIUM] CVE-2024-26768: linux - In the Linux kernel, the following vulnerability has been resolved: LoongArch: ... In the Linux kernel, the following vulnerability has been resolved: LoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC] With default config, the value of NR_CPUS is 64. When HW platform has more then 64 cpus, system will crash on these platforms. MAX_CORE_PIC is the maximum cpu number in MADT table (max physical number) which can exceed the suppo

CVE-2024-35854 [HIGH] CVE-2024-35854: linux - In the Linux kernel, the following vulnerability has been resolved: mlxsw: spec... In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash The rehash delayed work migrates filters from one region to another according to the number of available credits. The migrated from region is destroyed at the end of the work if the number of credits is non-negative as the assumption

CVE-2026-23098 [HIGH] CVE-2026-23098: linux - In the Linux kernel, the following vulnerability has been resolved: netrom: fix... In the Linux kernel, the following vulnerability has been resolved: netrom: fix double-free in nr_route_frame() In nr_route_frame(), old_skb is immediately freed without checking if nr_neigh->ax25 pointer is NULL. Therefore, if nr_neigh->ax25 is NULL, the caller function will free old_skb again, causing a double-free bug. Therefore, to prevent this, we need to modify

CVE-2018-12233 [HIGH] CVE-2018-12233: linux - In the ea_get function in fs/jfs/xattr.c in the Linux kernel through 4.17.1, a m... In the ea_get function in fs/jfs/xattr.c in the Linux kernel through 4.17.1, a memory corruption bug in JFS can be triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability can be triggered by an unprivileged user with the ability to create files and execute programs. A kmalloc call is incorrect, leading to sl

CVE-2023-52829 [MEDIUM] CVE-2023-52829: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12... In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix possible out-of-bound write in ath12k_wmi_ext_hal_reg_caps() reg_cap.phy_id is extracted from WMI event and could be an unexpected value in case some errors happen. As a result out-of-bound write may occur to soc->hal_reg_cap. Fix it by validating reg_cap.phy_id before using it. Th

CVE-2024-36910 [MEDIUM] CVE-2024-36910: linux - In the Linux kernel, the following vulnerability has been resolved: uio_hv_gene... In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decry

CVE-2022-48762 [MEDIUM] CVE-2022-48762: linux - In the Linux kernel, the following vulnerability has been resolved: arm64: exta... In the Linux kernel, the following vulnerability has been resolved: arm64: extable: fix load_unaligned_zeropad() reg indices In ex_handler_load_unaligned_zeropad() we erroneously extract the data and addr register indices from ex->type rather than ex->data. As ex->type will contain EX_TYPE_LOAD_UNALIGNED_ZEROPAD (i.e. 4): * We'll always treat X0 as the address regis

CVE-2016-7913 [HIGH] CVE-2016-7913: linux - The xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in the Lin... The xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) via vectors involving omission of the firmware name from a certain data structure. Scope: local bookworm: resolved (fixed in 4.6.1-1) bullseye: resolved (fixed in 4.6.1-1) forky: resolved

CVE-2019-19448 [HIGH] CVE-2019-19448: linux - In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image... In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to a right data structure. Scope: local bookworm: resolved (fix

CVE-2019-16714 [HIGH] CVE-2019-16714: linux - In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows a... In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive information from kernel stack memory because tos and flags fields are not initialized. Scope: local bookworm: resolved (fixed in 5.2.17-1) bullseye: resolved (fixed in 5.2.17-1) forky: resolved (fixed in 5.2.17-1) sid: resolved (fixed in 5.2.17-1) trixie: resol

CVE-2024-35948 [HIGH] CVE-2024-35948: linux - In the Linux kernel, the following vulnerability has been resolved: bcachefs: C... In the Linux kernel, the following vulnerability has been resolved: bcachefs: Check for journal entries overruning end of sb clean section Fix a missing bounds check in superblock validation. Note that we don't yet have repair code for this case - repair code for individual items is generally low priority, since the whole superblock is checksummed, validated prior to

CVE-2016-7911 [HIGH] CVE-2016-7911: linux - Race condition in the get_task_ioprio function in block/ioprio.c in the Linux ke... Race condition in the get_task_ioprio function in block/ioprio.c in the Linux kernel before 4.6.6 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call. Scope: local bookworm: resolved (fixed in 4.7.2-1) bullseye: resolved (fixed in 4.7.2-1) forky: resolved (fixed in 4.7.2-1) sid: resolved (fixed in 4.7.

CVE-2025-38512 [LOW] CVE-2025-38512: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: preve... In the Linux kernel, the following vulnerability has been resolved: wifi: prevent A-MSDU attacks in mesh networks This patch is a mitigation to prevent the A-MSDU spoofing vulnerability for mesh networks. The initial update to the IEEE 802.11 standard, in response to the FragAttacks, missed this case (CVE-2025-27558). It can be considered a variant of CVE-2020-24588 bu

CVE-2014-9922 [HIGH] CVE-2014-9922: linux - The eCryptfs subsystem in the Linux kernel before 3.18 allows local users to gai... The eCryptfs subsystem in the Linux kernel before 3.18 allows local users to gain privileges via a large filesystem stack that includes an overlayfs layer, related to fs/ecryptfs/main.c and fs/overlayfs/super.c. Scope: local bookworm: resolved (fixed in 4.0.2-1) bullseye: resolved (fixed in 4.0.2-1) forky: resolved (fixed in 4.0.2-1) sid: resolved (fixed in 4.0.2-1) tri