Debian Linux vulnerabilities

CVE-2022-33743 [HIGH] CVE-2022-33743: linux - network backend may cause Linux netfront to use freed SKBs While adding logic to... network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further processing to nevertheless be freed. Scope: local bookworm: resolved (fixed in 5.18.14-1) bullseye: resolved (fixed in 5.10.127-2) forky: resolved (fixed in

CVE-2019-15925 [HIGH] CVE-2019-15925: linux - An issue was discovered in the Linux kernel before 5.2.3. An out of bounds acces... An issue was discovered in the Linux kernel before 5.2.3. An out of bounds access exists in the function hclge_tm_schd_mode_vnet_base_cfg in the file drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c. Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6-1) forky: resolved (fixed in 5.2.6-1) sid: resolved (fixed in 5.2.6-1) trixie:

CVE-2021-26930 [HIGH] CVE-2021-26930: linux - An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen... An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence s

CVE-2025-21967 [HIGH] CVE-2025-21967: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_free_work_struct ->interim_entry of ksmbd_work could be deleted after oplock is freed. We don't need to manage it with linked list. The interim request could be immediately sent whenever a oplock break wait is needed. Scope: local bookworm: open bullseye: resolved fo

CVE-2024-27000 [HIGH] CVE-2024-27000: linux - In the Linux kernel, the following vulnerability has been resolved: serial: mxs... In the Linux kernel, the following vulnerability has been resolved: serial: mxs-auart: add spinlock around changing cts state The uart_handle_cts_change() function in serial_core expects the caller to hold uport->lock. For example, I have seen the below kernel splat, when the Bluetooth driver is loaded on an i.MX28 board. [ 85.119255] ------------[ cut here ]---------

CVE-2022-48788 [HIGH] CVE-2022-48788: linux - In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: ... In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix possible use-after-free in transport error_recovery work While nvme_rdma_submit_async_event_work is checking the ctrl and queue state before preparing the AER command and scheduling io_work, in order to fully prevent a race where this check is not reliable the error recovery work must f

CVE-2025-37777 [HIGH] CVE-2025-37777: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __smb2_lease_break_noti() Move tcp_transport free to ksmbd_conn_free. If ksmbd connection is referenced when ksmbd server thread terminates, It will not be freed, but conn->tcp_transport is freed. __smb2_lease_break_noti can be performed asynchronously when the connection

CVE-2018-18653 [HIGH] CVE-2018-18653: linux - The Linux kernel, as used in Ubuntu 18.10 and when booted with UEFI Secure Boot ... The Linux kernel, as used in Ubuntu 18.10 and when booted with UEFI Secure Boot enabled, allows privileged local users to bypass intended Secure Boot restrictions and execute untrusted code by loading arbitrary kernel modules. This occurs because a modified kernel/module.c, in conjunction with certain configuration options, leads to mishandling of the result of signat

CVE-2022-48626 [HIGH] CVE-2022-48626: linux - In the Linux kernel, the following vulnerability has been resolved: moxart: fix... In the Linux kernel, the following vulnerability has been resolved: moxart: fix potential use-after-free on remove path It was reported that the mmc host structure could be accessed after it was freed in moxart_remove(), so fix this by saving the base register of the device and using it instead of the pointer dereference. Scope: local bookworm: resolved (fixed in 5.16

CVE-2025-38552 [HIGH] CVE-2025-38552: linux - In the Linux kernel, the following vulnerability has been resolved: mptcp: plug... In the Linux kernel, the following vulnerability has been resolved: mptcp: plug races between subflow fail and subflow creation We have races similar to the one addressed by the previous patch between subflow failing and additional subflow creation. They are just harder to trigger. The solution is similar. Use a separate flag to track the condition 'socket state preve

CVE-2024-40906 [HIGH] CVE-2024-40906: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: A... In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Always stop health timer during driver removal Currently, if teardown_hca fails to execute during driver removal, mlx5 does not stop the health timer. Afterwards, mlx5 continue with driver teardown. This may lead to a UAF bug, which results in page fault Oops[1], since the health timer invok

CVE-2024-53061 [HIGH] CVE-2024-53061: linux - In the Linux kernel, the following vulnerability has been resolved: media: s5p-... In the Linux kernel, the following vulnerability has been resolved: media: s5p-jpeg: prevent buffer overflows The current logic allows word to be less than 2. If this happens, there will be buffer overflows, as reported by smatch. Add extra checks to prevent it. While here, remove an unused word = 0 assignment. Scope: local bookworm: resolved (fixed in 6.1.119-1) bull

CVE-2021-28375 [HIGH] CVE-2021-28375: linux - An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_inv... An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages, aka CID-20c40794eb85. This is a related issue to CVE-2019-2308. Scope: local bookworm: resolved (fixed in 5.10.24-1) bullseye: resolved (fixed in 5.10.24-1) forky: resolved (fixed in 5.10.24-

CVE-2025-39880 [HIGH] CVE-2025-39880: linux - In the Linux kernel, the following vulnerability has been resolved: libceph: fi... In the Linux kernel, the following vulnerability has been resolved: libceph: fix invalid accesses to ceph_connection_v1_info There is a place where generic code in messenger.c is reading and another place where it is writing to con->v1 union member without checking that the union member is active (i.e. msgr1 is in use). On 64-bit systems, con->v1.auth_retry overlaps w

CVE-2024-41028 [HIGH] CVE-2024-41028: linux - In the Linux kernel, the following vulnerability has been resolved: platform/x8... In the Linux kernel, the following vulnerability has been resolved: platform/x86: toshiba_acpi: Fix array out-of-bounds access In order to use toshiba_dmi_quirks[] together with the standard DMI matching functions, it must be terminated by a empty entry. Since this entry is missing, an array out-of-bounds access occurs every time the quirk list is processed. Fix this

CVE-2022-49291 [HIGH] CVE-2022-49291: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: ... In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix races among concurrent hw_params and hw_free calls Currently we have neither proper check nor protection against the concurrent calls of PCM hw_params and hw_free ioctls, which may result in a UAF. Since the existing PCM stream lock can't be used for protecting the whole ioctl operation

CVE-2023-23559 [HIGH] CVE-2023-23559: linux - In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel thro... In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition. Scope: local bookworm: resolved (fixed in 6.1.11-1) bullseye: resolved (fixed in 5.10.178-1) forky: resolved (fixed in 6.1.11-1) sid: resolved (fixed in 6.1.11-1) trixie: resolved (fixed in 6.1.11-1)

CVE-2023-52439 [HIGH] CVE-2023-52439: linux - In the Linux kernel, the following vulnerability has been resolved: uio: Fix us... In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_de

CVE-2024-38552 [HIGH] CVE-2024-38552: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis... In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential index out of bounds in color transformation function Fixes index out of bounds issue in the color transformation function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS). The fix adds a check to ensure 'i' i

CVE-2022-49508 [HIGH] CVE-2022-49508: linux - In the Linux kernel, the following vulnerability has been resolved: HID: elan: ... In the Linux kernel, the following vulnerability has been resolved: HID: elan: Fix potential double free in elan_input_configured 'input' is a managed resource allocated with devm_input_allocate_device(), so there is no need to call input_free_device() explicitly or there will be a double free. According to the doc of devm_input_allocate_device(): * Managed input devi