Debian Linux vulnerabilities

CVE-2016-3955 [CRITICAL] CVE-2016-3955: linux - The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux k... The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted length value in a USB/IP packet. Scope: local bookworm: resolved (fixed in 4.5.2-1) bullseye: resolved (fixed in 4.5.2-1) forky: resolved

CVE-2024-42252 [MEDIUM] CVE-2024-42252: linux - In the Linux kernel, the following vulnerability has been resolved: closures: C... In the Linux kernel, the following vulnerability has been resolved: closures: Change BUG_ON() to WARN_ON() If a BUG_ON() can be hit in the wild, it shouldn't be a BUG_ON() For reference, this has popped up once in the CI, and we'll need more info to debug it: 03240 ------------[ cut here ]------------ 03240 kernel BUG at lib/closure.c:21! 03240 kernel BUG at lib/clo

CVE-2020-28374 [HIGH] CVE-2020-28374: linux - In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insuffi... In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains co

CVE-2019-14895 [CRITICAL] CVE-2019-14895: linux - A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.... A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection negotiation during the handling of the remote devices country settings. This could allow the remote device to cause a denial of service (system crash) or possibly execu

CVE-2017-1000405 [HIGH] CVE-2017-1000405: linux - The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdi... The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in the touch_pmd() function inside the THP implementation. touch_pmd() can be reached by get_user_pages(). In such case, the pmd will become dirty. This scenario breaks the new can_follow_write_pmd()'s logic - pmd can become dirty without going through a COW cycle. This bug is no

CVE-2015-3214 [MEDIUM] CVE-2015-3214: linux - The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before... The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2017-18344 [MEDIUM] CVE-2017-18344: linux - The timer_create syscall implementation in kernel/time/posix-timers.c in the Lin... The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_PO

CVE-2022-47938 [MEDIUM] CVE-2022-47938: linux - An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.... An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2misc.c has an out-of-bounds read and OOPS for SMB2_TREE_CONNECT. Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved forky: resolved (fixed in 5.19.6-1) sid: resolved (fixed in 5.19.6-1) trixie: resolved (fixed in 5.19.6-1)

CVE-2018-1120 [LOW] CVE-2018-1120: linux - A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a ... A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc//cmdline (or /proc//environ) files to block indefinitely (den

CVE-2016-4998 [HIGH] CVE-2016-4998: linux - The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in t... The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary. Scope: loc

CVE-2026-31402 CVE-2026-31402: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: fix h... In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. This size was calculated based on OPEN responses and does not account for LOCK denied responses, which include the conflicting

CVE-2015-3290 [HIGH] CVE-2015-3290: linux - arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platfor... arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window. Scope: local bookworm: resolved (fixed in 4.0.8-2) bullseye: resolved (fixed in 4.0.8-2) forky: resolved (fixed in 4.0.8-2) sid:

CVE-2017-13715 [CRITICAL] CVE-2017-13715: linux - The __skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel... The __skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel before 4.3 does not ensure that n_proto, ip_proto, and thoff are initialized, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a single crafted MPLS packet. Scope: local bookworm: resolved (fixed in 4.3.1-1) bullseye: res

CVE-2022-43945 [HIGH] CVE-2022-43945: linux - The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vul... The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data ad

CVE-2019-14896 [CRITICAL] CVE-2019-14896: linux - A heap-based buffer overflow vulnerability was found in the Linux kernel, versio... A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. A remote attacker could cause a denial of service (system crash) or, possibly execute arbitrary code, when the lbs_ibss_join_existing function is called after a STA connects to an AP. Scope: local bookworm: resolved (fixed in 5.4.19-1) bull

CVE-2018-5333 [MEDIUM] CVE-2018-5333: linux - In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdm... In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference. Scope: local bookworm: resolved (fixed in 4.14.17-1) bullseye: resolved (fixed in 4.14.17-1) forky: resolved (fixed in 4.14.17-1) sid: resolved (fixed

CVE-2014-4943 [MEDIUM] CVE-2014-4943: linux - The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 a... The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket. Scope: local bookworm: resolved (fixed in 3.14.13-1) bullseye: resolved (fixed in 3.14.13-1) forky: resolved (fixed in 3.14.13-1) sid: resolved (fixed in 3.14.13-1) trix

CVE-2023-32254 [CRITICAL] CVE-2023-32254: linux - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB s... A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel. Scope: local book

CVE-2025-27558 [LOW] CVE-2025-27558: linux - IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. I... IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for C

CVE-2019-10126 [CRITICAL] CVE-2019-10126: linux - A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_ua... A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other consequences. Scope: local bookworm: resolved (fixed in 4.19.37-4) bullseye: resolved (fixed in 4.19.37-4) forky: resolved (fixed in 4.19.37-4) sid: resolved (fixed