Debian Linux vulnerabilities

CVE-2021-47337 [MEDIUM] CVE-2021-47337: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: core:... In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix bad pointer dereference when ehandler kthread is invalid Commit 66a834d09293 ("scsi: core: Fix error handling of scsi_host_alloc()") changed the allocation logic to call put_device() to perform host cleanup with the assumption that IDA removal and stopping the kthread would properly

CVE-2020-12352 [MEDIUM] CVE-2020-12352: linux - Improper access control in BlueZ may allow an unauthenticated user to potentiall... Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access. Scope: local bookworm: resolved (fixed in 5.9.1-1) bullseye: resolved (fixed in 5.9.1-1) forky: resolved (fixed in 5.9.1-1) sid: resolved (fixed in 5.9.1-1) trixie: resolved (fixed in 5.9.1-1)

CVE-2016-3955 [CRITICAL] CVE-2016-3955: linux - The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux k... The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted length value in a USB/IP packet. Scope: local bookworm: resolved (fixed in 4.5.2-1) bullseye: resolved (fixed in 4.5.2-1) forky: resolved

CVE-2026-31402 CVE-2026-31402: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: fix h... In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. This size was calculated based on OPEN responses and does not account for LOCK denied responses, which include the conflicting

CVE-2024-42252 [MEDIUM] CVE-2024-42252: linux - In the Linux kernel, the following vulnerability has been resolved: closures: C... In the Linux kernel, the following vulnerability has been resolved: closures: Change BUG_ON() to WARN_ON() If a BUG_ON() can be hit in the wild, it shouldn't be a BUG_ON() For reference, this has popped up once in the CI, and we'll need more info to debug it: 03240 ------------[ cut here ]------------ 03240 kernel BUG at lib/closure.c:21! 03240 kernel BUG at lib/clo

CVE-2015-3214 [MEDIUM] CVE-2015-3214: linux - The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before... The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2025-37924 [CRITICAL] CVE-2025-37924: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in kerberos authentication Setting sess->user = NULL was introduced to fix the dangling pointer created by ksmbd_free_user. However, it is possible another thread could be operating on the session and make use of sess->user after it has been passed to ksmbd_free_user but

CVE-2017-5754 [MEDIUM] CVE-2017-5754: linux - Systems with microprocessors utilizing speculative execution and indirect branch... Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache. Scope: local bookworm: resolved (fixed in 4.14.12-1) bullseye: resolved (fixed in 4.14.12-1) forky: resolved (fixed in 4.14.12-1) sid: resolved

CVE-2020-28374 [HIGH] CVE-2020-28374: linux - In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insuffi... In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains co

CVE-2019-14895 [CRITICAL] CVE-2019-14895: linux - A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.... A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection negotiation during the handling of the remote devices country settings. This could allow the remote device to cause a denial of service (system crash) or possibly execu

CVE-2017-1000405 [HIGH] CVE-2017-1000405: linux - The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdi... The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in the touch_pmd() function inside the THP implementation. touch_pmd() can be reached by get_user_pages(). In such case, the pmd will become dirty. This scenario breaks the new can_follow_write_pmd()'s logic - pmd can become dirty without going through a COW cycle. This bug is no

CVE-2022-47938 [MEDIUM] CVE-2022-47938: linux - An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.... An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2misc.c has an out-of-bounds read and OOPS for SMB2_TREE_CONNECT. Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved forky: resolved (fixed in 5.19.6-1) sid: resolved (fixed in 5.19.6-1) trixie: resolved (fixed in 5.19.6-1)

CVE-2017-18344 [MEDIUM] CVE-2017-18344: linux - The timer_create syscall implementation in kernel/time/posix-timers.c in the Lin... The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_PO

CVE-2018-1120 [LOW] CVE-2018-1120: linux - A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a ... A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc//cmdline (or /proc//environ) files to block indefinitely (den

CVE-2017-13715 [CRITICAL] CVE-2017-13715: linux - The __skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel... The __skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel before 4.3 does not ensure that n_proto, ip_proto, and thoff are initialized, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a single crafted MPLS packet. Scope: local bookworm: resolved (fixed in 4.3.1-1) bullseye: res

CVE-2016-4998 [HIGH] CVE-2016-4998: linux - The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in t... The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary. Scope: loc

CVE-2015-3290 [HIGH] CVE-2015-3290: linux - arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platfor... arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window. Scope: local bookworm: resolved (fixed in 4.0.8-2) bullseye: resolved (fixed in 4.0.8-2) forky: resolved (fixed in 4.0.8-2) sid:

CVE-2023-52440 [HIGH] CVE-2023-52440: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob() If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes. cifs_arc4_crypt copy to session key array from SessionKey from client. Scope: local bookworm: resolved (fixed in 6

CVE-2022-43945 [HIGH] CVE-2022-43945: linux - The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vul... The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data ad

CVE-2018-5333 [MEDIUM] CVE-2018-5333: linux - In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdm... In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference. Scope: local bookworm: resolved (fixed in 4.14.17-1) bullseye: resolved (fixed in 4.14.17-1) forky: resolved (fixed in 4.14.17-1) sid: resolved (fixed