Debian Linux vulnerabilities

CVE-2016-9576 [HIGH] CVE-2016-9576: linux - The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4... The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device. Scope: local bookworm: resolved (fixed in 4.8.15-1) bullseye: resolved

CVE-2020-12653 [HIGH] CVE-2020-12653: linux - An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv... An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/marvell/mwifiex/scan.c allows local users to gain privileges or cause a denial of service because of an incorrect memcpy and buffer overflow, aka CID-b70261a288ea. Scope: local bookworm: resolved (fixed in 5.5.13-1) bullseye: resolved (fixed in 5.5.13-1)

CVE-2016-7425 [HIGH] CVE-2016-7425: linux - The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the ... The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2 does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code. Scope: local bookworm: resolved (fixed in 4.7.8-1) bullseye: resolved

CVE-2019-2181 [HIGH] CVE-2019-2181: linux - In binder_transaction of binder.c in the Android kernel, there is a possible out... In binder_transaction of binder.c in the Android kernel, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved

CVE-2023-53543 [MEDIUM] CVE-2023-53543: linux - In the Linux kernel, the following vulnerability has been resolved: vdpa: Add m... In the Linux kernel, the following vulnerability has been resolved: vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops.

CVE-2016-10907 [HIGH] CVE-2016-10907: linux - An issue was discovered in drivers/iio/dac/ad5755.c in the Linux kernel before 4... An issue was discovered in drivers/iio/dac/ad5755.c in the Linux kernel before 4.8.6. There is an out of bounds write in the function ad5755_parse_dt. Scope: local bookworm: resolved (fixed in 4.9.2-1) bullseye: resolved (fixed in 4.9.2-1) forky: resolved (fixed in 4.9.2-1) sid: resolved (fixed in 4.9.2-1) trixie: resolved (fixed in 4.9.2-1)

CVE-2022-1158 [HIGH] CVE-2022-1158: linux - A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was ... A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get the page's pfn. As vaddr and vm_pgoff are controllable by user-mode processes, this flaw allows unprivileged local users on the host to write outside the userspace region and potentially corrupt the kernel, resulting in a denial of service condition. Scop

CVE-2020-36387 [HIGH] CVE-2020-36387: linux - An issue was discovered in the Linux kernel before 5.8.2. fs/io_uring.c has a us... An issue was discovered in the Linux kernel before 5.8.2. fs/io_uring.c has a use-after-free related to io_async_task_func and ctx reference holding, aka CID-6d816e088c35. Scope: local bookworm: resolved (fixed in 5.7.17-1) bullseye: resolved (fixed in 5.7.17-1) forky: resolved (fixed in 5.7.17-1) sid: resolved (fixed in 5.7.17-1) trixie: resolved (fixed in 5.7.17-1)

CVE-2017-13168 [HIGH] CVE-2017-13168: linux - An elevation of privilege vulnerability in the kernel scsi driver. Product: Andr... An elevation of privilege vulnerability in the kernel scsi driver. Product: Android. Versions: Android kernel. Android ID A-65023233. Scope: local bookworm: resolved (fixed in 4.17.6-1) bullseye: resolved (fixed in 4.17.6-1) forky: resolved (fixed in 4.17.6-1) sid: resolved (fixed in 4.17.6-1) trixie: resolved (fixed in 4.17.6-1)

CVE-2017-18552 [HIGH] CVE-2017-18552: linux - An issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. The... An issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. There is an out of bounds write and read in the function rds_recv_track_latency. Scope: local bookworm: resolved (fixed in 4.11.6-1) bullseye: resolved (fixed in 4.11.6-1) forky: resolved (fixed in 4.11.6-1) sid: resolved (fixed in 4.11.6-1) trixie: resolved (fixed in 4.11.6-1)

CVE-2023-26544 [HIGH] CVE-2023-26544: linux - In the Linux kernel 6.0.8, there is a use-after-free in run_unpack in fs/ntfs3/r... In the Linux kernel 6.0.8, there is a use-after-free in run_unpack in fs/ntfs3/run.c, related to a difference between NTFS sector size and media sector size. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved forky: resolved (fixed in 6.1.4-1) sid: resolved (fixed in 6.1.4-1) trixie: resolved (fixed in 6.1.4-1)

CVE-2017-7294 [HIGH] CVE-2017-7294: linux - The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c... The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.6 does not validate addition of certain levels data, which allows local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/re

CVE-2016-9777 [HIGH] CVE-2016-9777: linux - KVM in the Linux kernel before 4.8.12, when I/O APIC is enabled, does not proper... KVM in the Linux kernel before 4.8.12, when I/O APIC is enabled, does not properly restrict the VCPU index, which allows guest OS users to gain host OS privileges or cause a denial of service (out-of-bounds array access and host OS crash) via a crafted interrupt request, related to arch/x86/kvm/ioapic.c and arch/x86/kvm/ioapic.h. Scope: local bookworm: resolved (fixed i

CVE-2019-19543 [HIGH] CVE-2019-19543: linux - In the Linux kernel before 5.1.6, there is a use-after-free in serial_ir_init_mo... In the Linux kernel before 5.1.6, there is a use-after-free in serial_ir_init_module() in drivers/media/rc/serial_ir.c. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved (fixed in 5.2.6-1) sid: resolved (fixed in 5.2.6-1) trixie: resolved (fixed in 5.2.6-1)

CVE-2019-25162 [HIGH] CVE-2019-25162: linux - In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a ... In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. [wsa: added comment to the code, added Fixes tag] Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved (fixed in

CVE-2018-5848 [HIGH] CVE-2018-5848: linux - In the function wmi_set_ie(), the length validation code does not handle unsigne... In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel. Scope: local bookworm: resolved (fixed in 4.16.5-1) bullseye: resolved (fix

CVE-2017-13166 [HIGH] CVE-2017-13166: linux - An elevation of privilege vulnerability in the kernel v4l2 video driver. Product... An elevation of privilege vulnerability in the kernel v4l2 video driver. Product: Android. Versions: Android kernel. Android ID A-34624167. Scope: local bookworm: resolved (fixed in 4.15.4-1) bullseye: resolved (fixed in 4.15.4-1) forky: resolved (fixed in 4.15.4-1) sid: resolved (fixed in 4.15.4-1) trixie: resolved (fixed in 4.15.4-1)

CVE-2025-38574 [HIGH] CVE-2025-38574: linux - In the Linux kernel, the following vulnerability has been resolved: pptp: ensur... In the Linux kernel, the following vulnerability has been resolved: pptp: ensure minimal skb length in pptp_xmit() Commit aabc6596ffb3 ("net: ppp: Add bound checking for skb data on ppp_sync_txmung") fixed ppp_sync_txmunge() We need a similar fix in pptp_xmit(), otherwise we might read uninit data as reported by syzbot. BUG: KMSAN: uninit-value in pptp_xmit+0xc34/0x27

CVE-2025-38724 [HIGH] CVE-2025-38724: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: handl... In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lea

CVE-2024-50264 [HIGH] CVE-2024-50264: linux - In the Linux kernel, the following vulnerability has been resolved: vsock/virti... In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans During loopback communication, a dangling pointer can be created in vsk->trans, potentially leading to a Use-After-Free condition. This issue is resolved by initializing vsk->trans to NULL. Scope: local bookworm: resolved (fi