Debian Linux vulnerabilities

CVE-2024-50276 [HIGH] CVE-2024-50276: linux - In the Linux kernel, the following vulnerability has been resolved: net: vertex... In the Linux kernel, the following vulnerability has been resolved: net: vertexcom: mse102x: Fix possible double free of TX skb The scope of the TX skb is wider than just mse102x_tx_frame_spi(), so in case the TX skb room needs to be expanded, we should free the the temporary skb instead of the original skb. Otherwise the original TX skb pointer would be freed again i

CVE-2020-7053 [HIGH] CVE-2020-7053: linux - In the Linux kernel 4.14 longterm through 4.14.165 and 4.19 longterm through 4.1... In the Linux kernel 4.14 longterm through 4.14.165 and 4.19 longterm through 4.19.96 (and 5.x before 5.2), there is a use-after-free (write) in the i915_ppgtt_close function in drivers/gpu/drm/i915/i915_gem_gtt.c, aka CID-7dc40713618c. This is related to i915_gem_context_destroy_ioctl in drivers/gpu/drm/i915/i915_gem_context.c. Scope: local bookworm: resolved (fixed in

CVE-2023-52515 [HIGH] CVE-2023-52515: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: D... In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from srp_abort() After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call sc

CVE-2021-47536 [HIGH] CVE-2021-47536: linux - In the Linux kernel, the following vulnerability has been resolved: net/smc: fi... In the Linux kernel, the following vulnerability has been resolved: net/smc: fix wrong list_del in smc_lgr_cleanup_early smc_lgr_cleanup_early() meant to delete the link group from the link group list, but it deleted the list head by mistake. This may cause memory corruption since we didn't remove the real link group from the list and later memseted the link group str

CVE-2022-49770 [HIGH] CVE-2022-49770: linux - In the Linux kernel, the following vulnerability has been resolved: ceph: avoid... In the Linux kernel, the following vulnerability has been resolved: ceph: avoid putting the realm twice when decoding snaps fails When decoding the snaps fails it maybe leaving the 'first_realm' and 'realm' pointing to the same snaprealm memory. And then it'll put it twice and could cause random use-after-free, BUG_ON, etc issues. Scope: local bookworm: resolved (fixe

CVE-2025-37926 [HIGH] CVE-2025-37926: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_session_rpc_open A UAF issue can occur due to a race condition between ksmbd_session_rpc_open() and __session_rpc_close(). Add rpc_lock to the session to protect it. Scope: local bookworm: resolved (fixed in 6.1.162-1) bullseye: resolved forky: resolved (fixed in 6.1

CVE-2018-25015 [HIGH] CVE-2018-25015: linux - An issue was discovered in the Linux kernel before 4.14.16. There is a use-after... An issue was discovered in the Linux kernel before 4.14.16. There is a use-after-free in net/sctp/socket.c for a held lock after a peel off, aka CID-a0ff660058b8. Scope: local bookworm: resolved (fixed in 4.14.17-1) bullseye: resolved (fixed in 4.14.17-1) forky: resolved (fixed in 4.14.17-1) sid: resolved (fixed in 4.14.17-1) trixie: resolved (fixed in 4.14.17-1)

CVE-2023-53338 [HIGH] CVE-2023-53338: linux - In the Linux kernel, the following vulnerability has been resolved: lwt: Fix re... In the Linux kernel, the following vulnerability has been resolved: lwt: Fix return values of BPF xmit ops BPF encap ops can return different types of positive values, such like NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function skb_do_redirect and bpf_lwt_xmit_reroute. At the xmit hook, such return values would be treated implicitly as LWTUNNEL_XMIT_C

CVE-2019-19807 [HIGH] CVE-2019-19807: linux - In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free cause... In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a different purpose after refactoring. Scope: local bookworm: resolved

CVE-2024-27050 [MEDIUM] CVE-2024-27050: linux - In the Linux kernel, the following vulnerability has been resolved: libbpf: Use... In the Linux kernel, the following vulnerability has been resolved: libbpf: Use OPTS_SET() macro in bpf_xdp_query() When the feature_flags and xdp_zc_max_segs fields were added to the libbpf bpf_xdp_query_opts, the code writing them did not use the OPTS_SET() macro. This causes libbpf to write to those fields unconditionally, which means that programs compiled again

CVE-2016-9754 [HIGH] CVE-2016-9754: linux - The ring_buffer_resize function in kernel/trace/ring_buffer.c in the profiling s... The ring_buffer_resize function in kernel/trace/ring_buffer.c in the profiling subsystem in the Linux kernel before 4.6.1 mishandles certain integer calculations, which allows local users to gain privileges by writing to the /sys/kernel/debug/tracing/buffer_size_kb file. Scope: local bookworm: resolved (fixed in 4.6.1-1) bullseye: resolved (fixed in 4.6.1-1) forky: reso

CVE-2022-48851 [HIGH] CVE-2022-48851: linux - In the Linux kernel, the following vulnerability has been resolved: staging: gd... In the Linux kernel, the following vulnerability has been resolved: staging: gdm724x: fix use after free in gdm_lte_rx() The netif_rx_ni() function frees the skb so we can't dereference it to save the skb->len. Scope: local bookworm: resolved (fixed in 5.16.18-1) bullseye: resolved (fixed in 5.10.106-1) forky: resolved (fixed in 5.16.18-1) sid: resolved (fixed in 5.16

CVE-2021-47126 [MEDIUM] CVE-2021-47126: linux - In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix K... In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions Reported by syzbot: HEAD commit: 90c911ad Merge tag 'fixes' of git://git.kernel.org/pub/scm.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master dashboard link: https://syzkaller.appspot.com/bug?extid

CVE-2020-1749 [HIGH] CVE-2020-1749: linux - A flaw was found in the Linux kernel's implementation of some networking protoco... A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending the data unencrypted. This would allow anyone in between the two endpoints to read the traf

CVE-2017-7482 [HIGH] CVE-2017-7482: linux - In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using t... In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. This could possibly lead to memory corruption and possible privilege escalation. Scope: local bookworm: resolved (fixed in 4.1

CVE-2017-10662 [HIGH] CVE-2017-10662: linux - The sanity_check_raw_super function in fs/f2fs/super.c in the Linux kernel befor... The sanity_check_raw_super function in fs/f2fs/super.c in the Linux kernel before 4.11.1 does not validate the segment count, which allows local users to gain privileges via unspecified vectors. Scope: local bookworm: resolved (fixed in 4.9.30-1) bullseye: resolved (fixed in 4.9.30-1) forky: resolved (fixed in 4.9.30-1) sid: resolved (fixed in 4.9.30-1) trixie: resolv

CVE-2020-12653 [HIGH] CVE-2020-12653: linux - An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv... An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/marvell/mwifiex/scan.c allows local users to gain privileges or cause a denial of service because of an incorrect memcpy and buffer overflow, aka CID-b70261a288ea. Scope: local bookworm: resolved (fixed in 5.5.13-1) bullseye: resolved (fixed in 5.5.13-1)

CVE-2016-7425 [HIGH] CVE-2016-7425: linux - The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the ... The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2 does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code. Scope: local bookworm: resolved (fixed in 4.7.8-1) bullseye: resolved

CVE-2016-9576 [HIGH] CVE-2016-9576: linux - The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4... The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device. Scope: local bookworm: resolved (fixed in 4.8.15-1) bullseye: resolved

CVE-2023-52825 [MEDIUM] CVE-2023-52825: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd:... In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix a race condition of vram buffer unref in svm code prange->svm_bo unref can happen in both mmu callback and a callback after migrate to system ram. Both are async call in different tasks. Sync svm_bo unref operation to avoid random "use-after-free". Scope: local bookworm: resolved (fi