Debian Linux vulnerabilities

CVE-2023-53338 [HIGH] CVE-2023-53338: linux - In the Linux kernel, the following vulnerability has been resolved: lwt: Fix re... In the Linux kernel, the following vulnerability has been resolved: lwt: Fix return values of BPF xmit ops BPF encap ops can return different types of positive values, such like NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function skb_do_redirect and bpf_lwt_xmit_reroute. At the xmit hook, such return values would be treated implicitly as LWTUNNEL_XMIT_C

CVE-2022-49779 [HIGH] CVE-2022-49779: linux - In the Linux kernel, the following vulnerability has been resolved: kprobes: Sk... In the Linux kernel, the following vulnerability has been resolved: kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case In __unregister_kprobe_top(), if the currently unregistered probe has post_handler but other child probes of the aggrprobe do not have post_handler, the post_handler of the aggrprobe is cleared. If this is a ftrace-based probe, t

CVE-2022-49892 [HIGH] CVE-2022-49892: linux - In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix... In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix use-after-free for dynamic ftrace_ops KASAN reported a use-after-free with ftrace ops [1]. It was found from vmcore that perf had registered two ops with the same content successively, both dynamic. After unregistering the second ops, a use-after-free occurred. In ftrace_shutdown(), when t

CVE-2025-22097 [HIGH] CVE-2025-22097: linux - In the Linux kernel, the following vulnerability has been resolved: drm/vkms: F... In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix use after free and double free on init error If the driver initialization fails, the vkms_exit() function might access an uninitialized or freed default_config pointer and it might double free it. Fix both possible errors by initializing default_config only when the driver initialization

CVE-2023-53640 [HIGH] CVE-2023-53640: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: lpass... In the Linux kernel, the following vulnerability has been resolved: ASoC: lpass: Fix for KASAN use_after_free out of bounds When we run syzkaller we get below Out of Bounds error. "KASAN: slab-out-of-bounds Read in regcache_flat_read" Below is the backtrace of the issue: BUG: KASAN: slab-out-of-bounds in regcache_flat_read+0x10c/0x110 Read of size 4 at addr ffffff8088

CVE-2025-22068 [HIGH] CVE-2025-22068: linux - In the Linux kernel, the following vulnerability has been resolved: ublk: make ... In the Linux kernel, the following vulnerability has been resolved: ublk: make sure ubq->canceling is set when queue is frozen Now ublk driver depends on `ubq->canceling` for deciding if the request can be dispatched via uring_cmd & io_uring_cmd_complete_in_task(). Once ubq->canceling is set, the uring_cmd can be done via ublk_cancel_cmd() and io_uring_cmd_done(). So

CVE-2024-58060 [HIGH] CVE-2024-58060: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Reject... In the Linux kernel, the following vulnerability has been resolved: bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing There is a UAF report in the bpf_struct_ops when CONFIG_MODULES=n. In particular, the report is on tcp_congestion_ops that has a "struct module *owner" member. For struct_ops that has a "struct module *owner" mem

CVE-2022-50219 [HIGH] CVE-2022-50219: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix KA... In the Linux kernel, the following vulnerability has been resolved: bpf: Fix KASAN use-after-free Read in compute_effective_progs Syzbot found a Use After Free bug in compute_effective_progs(). The reproducer creates a number of BPF links, and causes a fault injected alloc to fail, while calling bpf_link_detach on them. Link detach triggers the link to be freed by bpf

CVE-2022-50212 [HIGH] CVE-2022-50212: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not allow CHAIN_ID to refer to another table When doing lookups for chains on the same batch by using its ID, a chain from a different table can be used. If a rule is added to a table but refers to a chain in a different table, it will be linked to the chain in table2, but wou

CVE-2023-52340 [HIGH] CVE-2023-52340: linux - The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c ma... The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed easily, e.g., leading to a denial of service (network is unreachable errors) when IPv6 packets are sent in a loop via a raw socket. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: resolved (fixed in 5.10.209-1) forky: resolved (fixed in 6

CVE-2025-21887 [HIGH] CVE-2025-21887: linux - In the Linux kernel, the following vulnerability has been resolved: ovl: fix UA... In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up The issue was caused by dput(upper) being called before ovl_dentry_update_reval(), while upper->d_flags was still accessed in ovl_dentry_remote(). Move dput(upper) after its last use to prevent use-after-free. BUG: KASAN: slab-use

CVE-2025-22020 [HIGH] CVE-2025-22020: linux - In the Linux kernel, the following vulnerability has been resolved: memstick: r... In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] Read of size 8 at addr ffff888136335380 by task

CVE-2025-21724 [HIGH] CVE-2025-21724: linux - In the Linux kernel, the following vulnerability has been resolved: iommufd/iov... In the Linux kernel, the following vulnerability has been resolved: iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() Resolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index() where shifting the constant "1" (of type int) by bitmap->mapped.pgshift (an unsigned long value) could result in undefined behavior. The constant "1"

CVE-2025-21966 [HIGH] CVE-2025-21966: linux - In the Linux kernel, the following vulnerability has been resolved: dm-flakey: ... In the Linux kernel, the following vulnerability has been resolved: dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature Fix memory corruption due to incorrect parameter being passed to bio_init Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.12.20-1) sid: resolved (fixed in 6.12.20-1) trixie: resolved (fixed in 6.12.20-

CVE-2023-53023 [HIGH] CVE-2023-53023: linux - In the Linux kernel, the following vulnerability has been resolved: net: nfc: F... In the Linux kernel, the following vulnerability has been resolved: net: nfc: Fix use-after-free in local_cleanup() Fix a use-after-free that occurs in kfree_skb() called from local_cleanup(). This could happen when killing nfc daemon (e.g. neard) after detaching an nfc device. When detaching an nfc device, local_cleanup() called from nfc_llcp_unregister_device() free

CVE-2023-52757 [HIGH] CVE-2023-52757: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential deadlock when releasing mids All release_mid() callers seem to hold a reference of @mid so there is no need to call kref_put(&mid->refcount, __release_mid) under @server->mid_lock spinlock. If they don't, then an use-after-free bug would have occurred anyways. By getting rid

CVE-2023-53021 [HIGH] CVE-2023-53021: linux - In the Linux kernel, the following vulnerability has been resolved: net/sched: ... In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_taprio: fix possible use-after-free syzbot reported a nasty crash [1] in net_tx_action() which made little sense until we got a repro. This repro installs a taprio qdisc, but providing an invalid TCA_RATE attribute. qdisc_create() has to destroy the just initialized taprio qdisc, and ta

CVE-2025-37913 [HIGH] CVE-2025-37913: linux - In the Linux kernel, the following vulnerability has been resolved: net_sched: ... In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of qfq, there won't be a UAF, but the code will add the same classifier to the

CVE-2025-21983 [HIGH] CVE-2025-21983: linux - In the Linux kernel, the following vulnerability has been resolved: mm/slab/kvf... In the Linux kernel, the following vulnerability has been resolved: mm/slab/kvfree_rcu: Switch to WQ_MEM_RECLAIM wq Currently kvfree_rcu() APIs use a system workqueue which is "system_unbound_wq" to driver RCU machinery to reclaim a memory. Recently, it has been noted that the following kernel warning can be observed: workqueue: WQ_MEM_RECLAIM nvme-wq:nvme_scan_work i

CVE-2020-0110 [HIGH] CVE-2020-0110: linux - In psi_write of psi.c, there is a possible out of bounds write due to a missing ... In psi_write of psi.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-148159562References: Upstream kernel Scope: local bookworm: resolved (fixed in