Debian Linux vulnerabilities

CVE-2024-27062 [MEDIUM] CVE-2024-27062: linux - In the Linux kernel, the following vulnerability has been resolved: nouveau: lo... In the Linux kernel, the following vulnerability has been resolved: nouveau: lock the client object tree. It appears the client object tree has no locking unless I've missed something else. Fix races around adding/removing client objects, mostly vram bar mappings. 4562.099306] general protection fault, probably for non-canonical address 0x6677ed422bceb80c: 0000 [#1]

CVE-2019-2181 [HIGH] CVE-2019-2181: linux - In binder_transaction of binder.c in the Android kernel, there is a possible out... In binder_transaction of binder.c in the Android kernel, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved

CVE-2022-1158 [HIGH] CVE-2022-1158: linux - A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was ... A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get the page's pfn. As vaddr and vm_pgoff are controllable by user-mode processes, this flaw allows unprivileged local users on the host to write outside the userspace region and potentially corrupt the kernel, resulting in a denial of service condition. Scop

CVE-2016-10907 [HIGH] CVE-2016-10907: linux - An issue was discovered in drivers/iio/dac/ad5755.c in the Linux kernel before 4... An issue was discovered in drivers/iio/dac/ad5755.c in the Linux kernel before 4.8.6. There is an out of bounds write in the function ad5755_parse_dt. Scope: local bookworm: resolved (fixed in 4.9.2-1) bullseye: resolved (fixed in 4.9.2-1) forky: resolved (fixed in 4.9.2-1) sid: resolved (fixed in 4.9.2-1) trixie: resolved (fixed in 4.9.2-1)

CVE-2024-53059 [HIGH] CVE-2024-53059: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwi... In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() 1. The size of the response packet is not validated. 2. The response buffer is not freed. Resolve these issues by switching to iwl_mvm_send_cmd_status(), which handles both size validation and frees the buffer. Scope: local bookw

CVE-2020-36387 [HIGH] CVE-2020-36387: linux - An issue was discovered in the Linux kernel before 5.8.2. fs/io_uring.c has a us... An issue was discovered in the Linux kernel before 5.8.2. fs/io_uring.c has a use-after-free related to io_async_task_func and ctx reference holding, aka CID-6d816e088c35. Scope: local bookworm: resolved (fixed in 5.7.17-1) bullseye: resolved (fixed in 5.7.17-1) forky: resolved (fixed in 5.7.17-1) sid: resolved (fixed in 5.7.17-1) trixie: resolved (fixed in 5.7.17-1)

CVE-2025-38724 [HIGH] CVE-2025-38724: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: handl... In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lea

CVE-2018-5848 [HIGH] CVE-2018-5848: linux - In the function wmi_set_ie(), the length validation code does not handle unsigne... In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel. Scope: local bookworm: resolved (fixed in 4.16.5-1) bullseye: resolved (fix

CVE-2017-13168 [HIGH] CVE-2017-13168: linux - An elevation of privilege vulnerability in the kernel scsi driver. Product: Andr... An elevation of privilege vulnerability in the kernel scsi driver. Product: Android. Versions: Android kernel. Android ID A-65023233. Scope: local bookworm: resolved (fixed in 4.17.6-1) bullseye: resolved (fixed in 4.17.6-1) forky: resolved (fixed in 4.17.6-1) sid: resolved (fixed in 4.17.6-1) trixie: resolved (fixed in 4.17.6-1)

CVE-2025-38574 [HIGH] CVE-2025-38574: linux - In the Linux kernel, the following vulnerability has been resolved: pptp: ensur... In the Linux kernel, the following vulnerability has been resolved: pptp: ensure minimal skb length in pptp_xmit() Commit aabc6596ffb3 ("net: ppp: Add bound checking for skb data on ppp_sync_txmung") fixed ppp_sync_txmunge() We need a similar fix in pptp_xmit(), otherwise we might read uninit data as reported by syzbot. BUG: KMSAN: uninit-value in pptp_xmit+0xc34/0x27

CVE-2023-53372 [HIGH] CVE-2023-53372: linux - In the Linux kernel, the following vulnerability has been resolved: sctp: fix a... In the Linux kernel, the following vulnerability has been resolved: sctp: fix a potential overflow in sctp_ifwdtsn_skip Currently, when traversing ifwdtsn skips with _sctp_walk_ifwdtsn, it only checks the pos against the end of the chunk. However, the data left for the last pos may be < sizeof(struct sctp_ifwdtsn_skip), and dereference it as struct sctp_ifwdtsn_skip m

CVE-2017-7294 [HIGH] CVE-2017-7294: linux - The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c... The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.6 does not validate addition of certain levels data, which allows local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/re

CVE-2016-9777 [HIGH] CVE-2016-9777: linux - KVM in the Linux kernel before 4.8.12, when I/O APIC is enabled, does not proper... KVM in the Linux kernel before 4.8.12, when I/O APIC is enabled, does not properly restrict the VCPU index, which allows guest OS users to gain host OS privileges or cause a denial of service (out-of-bounds array access and host OS crash) via a crafted interrupt request, related to arch/x86/kvm/ioapic.c and arch/x86/kvm/ioapic.h. Scope: local bookworm: resolved (fixed i

CVE-2019-19543 [HIGH] CVE-2019-19543: linux - In the Linux kernel before 5.1.6, there is a use-after-free in serial_ir_init_mo... In the Linux kernel before 5.1.6, there is a use-after-free in serial_ir_init_module() in drivers/media/rc/serial_ir.c. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved (fixed in 5.2.6-1) sid: resolved (fixed in 5.2.6-1) trixie: resolved (fixed in 5.2.6-1)

CVE-2023-26605 [HIGH] CVE-2023-26605: linux - In the Linux kernel 6.0.8, there is a use-after-free in inode_cgwb_move_to_attac... In the Linux kernel 6.0.8, there is a use-after-free in inode_cgwb_move_to_attached in fs/fs-writeback.c, related to __list_del_entry_valid. Scope: local bookworm: resolved (fixed in 6.0.12-1) bullseye: resolved forky: resolved (fixed in 6.0.12-1) sid: resolved (fixed in 6.0.12-1) trixie: resolved (fixed in 6.0.12-1)

CVE-2025-37777 [HIGH] CVE-2025-37777: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __smb2_lease_break_noti() Move tcp_transport free to ksmbd_conn_free. If ksmbd connection is referenced when ksmbd server thread terminates, It will not be freed, but conn->tcp_transport is freed. __smb2_lease_break_noti can be performed asynchronously when the connection

CVE-2024-49950 [HIGH] CVE-2024-49950: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix uaf in l2cap_connect [Syzbot reported] BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54 CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkal

CVE-2022-0998 [HIGH] CVE-2022-0998: linux - An integer overflow flaw was found in the Linux kernel’s virtio device driver co... An integer overflow flaw was found in the Linux kernel’s virtio device driver code in the way a user triggers the vhost_vdpa_config_validate function. This flaw allows a local user to crash or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved (fixed in 5.10.92-1) forky: resolved (fixed in 5.15.15

CVE-2024-50029 [HIGH] CVE-2024-50029: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync This checks if the ACL connection remains valid as it could be destroyed while hci_enhanced_setup_sync is pending on cmd_sync leading to the following trace: BUG: KASAN: slab-use-after-free in hci_enhanced_setup_sync+0x91b/0xa60 Read of size 1 at

CVE-2024-57995 [HIGH] CVE-2024-57995: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12... In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() In ath12k_mac_assign_vif_to_vdev(), if arvif is created on a different radio, it gets deleted from that radio through a call to ath12k_mac_unassign_link_vif(). This action frees the arvif pointer. Subsequently, there is a che