Debian Linux vulnerabilities

CVE-2021-20322 [HIGH] CVE-2021-20322: linux - A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP ... A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integri

CVE-2019-17133 [CRITICAL] CVE-2019-17133: linux - In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/we... In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow. Scope: local bookworm: resolved (fixed in 5.3.9-1) bullseye: resolved (fixed in 5.3.9-1) forky: resolved (fixed in 5.3.9-1) sid: resolved (fixed in 5.3.9-1) trixie: resolved (fixed in 5.3.9-1)

CVE-2020-25705 [HIGH] CVE-2020-25705: linux - A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan... A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well on the Linux Based Products (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALAN

CVE-2014-4699 [MEDIUM] CVE-2014-4699: linux - The Linux kernel before 3.15.4 on Intel processors does not properly restrict us... The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system call

CVE-2022-27223 [HIGH] CVE-2022-27223: linux - In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the e... In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated by the host for out-of-array access. Scope: local bookworm: resolved (fixed in 5.16.12-1) bullseye: resolved (fixed in 5.10.103-1) forky: resolved (fixed in 5.16.12-1) sid: resolved (fixed in 5.16.12-1) trixie: resolved (fixed in 5.16

CVE-2017-5897 [CRITICAL] CVE-2017-5897: linux - The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote ... The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access. Scope: local bookworm: resolved (fixed in 4.9.13-1) bullseye: resolved (fixed in 4.9.13-1) forky: resolved (fixed in 4.9.13-1) sid: resolved (fixed in 4.9.13-1)

CVE-2019-15794 [HIGH] CVE-2019-15794: linux - Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux ker... Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file in their mmap handlers. On error the original value is not restored, and the reference is put for the file to which vm_file points. On upstream kernels this is not an issue, as no callers dereference vm_file fo

CVE-2014-4014 [MEDIUM] CVE-2014-4014: linux - The capabilities implementation in the Linux kernel before 3.14.8 does not prope... The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root. Scope: local bookworm: resolved (fixed in 3.14.7-1)

CVE-2019-11599 [HIGH] CVE-2019-11599: linux - The coredump implementation in the Linux kernel before 5.0.10 does not use locki... The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is r

CVE-2021-33909 [HIGH] CVE-2021-33909: linux - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not pro... fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05. Scope: local bookworm: resolved (fixed in 5.10.46-2) bullseye: resolved (fixed in 5.10.46-2) forky: resolved (fixed in 5.10.4

CVE-2019-15504 [CRITICAL] CVE-2019-15504: linux - drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a D... drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traffic (which may be remote via usbip or usbredir). Scope: local bookworm: resolved (fixed in 5.2.17-1) bullseye: resolved (fixed in 5.2.17-1) forky: resolved (fixed in 5.2.17-1) sid: resolved (fixed in 5.2.17-1) trixie: resolved (fixed in 5.2.17-1)

CVE-2023-32258 [HIGH] CVE-2023-32258: linux - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB s... A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_LOGOFF and SMB2_CLOSE commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel. Scope: local bo

CVE-2016-10150 [CRITICAL] CVE-2016-10150: linux - Use-after-free vulnerability in the kvm_ioctl_create_device function in virt/kvm... Use-after-free vulnerability in the kvm_ioctl_create_device function in virt/kvm/kvm_main.c in the Linux kernel before 4.8.13 allows host OS users to cause a denial of service (host OS crash) or possibly gain privileges via crafted ioctl calls on the /dev/kvm device. Scope: local bookworm: resolved (fixed in 4.8.15-1) bullseye: resolved (fixed in 4.8.15-1) forky:

CVE-2023-32257 [HIGH] CVE-2023-32257: linux - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB s... A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP and SMB2_LOGOFF commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel. Scope:

CVE-2019-3846 [HIGH] CVE-2019-3846: linux - A flaw that allowed an attacker to corrupt memory and possibly escalate privileg... A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network. Scope: local bookworm: resolved (fixed in 4.19.37-4) bullseye: resolved (fixed in 4.19.37-4) forky: resolved (fixed in 4.19.37-4) sid: resolved (fixed in 4.19.37-4) trixie: resolved (fixed in 4.19.37-

CVE-2018-7273 [MEDIUM] CVE-2018-7273: linux - In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of k... In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables using printk calls within the function show_floppy in drivers/block/floppy.c. An attacker can read this information from dmesg and use the addresses to find the locations of kernel code and data and bypass kernel security protections such as KASLR. Scop

CVE-2023-1998 [MEDIUM] CVE-2023-1998: linux - The Linux kernel allows userspace processes to enable mitigations by calling prc... The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with

CVE-2020-14305 [HIGH] CVE-2020-14305: linux - An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Ove... An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVE-2023-38432 [CRITICAL] CVE-2023-38432: linux - An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2mis... An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification, leading to an out-of-bounds read. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved forky: resolved (fixed in 6.3.11-1) sid: resolved (fixed in 6.

CVE-2025-68263 [CRITICAL] CVE-2025-68263: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: ipc:... In the Linux kernel, the following vulnerability has been resolved: ksmbd: ipc: fix use-after-free in ipc_msg_send_request ipc_msg_send_request() waits for a generic netlink reply using an ipc_msg_table_entry on the stack. The generic netlink handler (handle_generic_event()/handle_response()) fills entry->response under ipc_msg_table_lock, but ipc_msg_send_request