Debian Linux vulnerabilities

CVE-2023-53768 CVE-2023-53768: linux - In the Linux kernel, the following vulnerability has been resolved: regmap-irq:... In the Linux kernel, the following vulnerability has been resolved: regmap-irq: Fix out-of-bounds access when allocating config buffers When allocating the 2D array for handling IRQ type registers in regmap_add_irq_chip_fwnode(), the intent is to allocate a matrix with num_config_bases rows and num_config_regs columns. This is currently handled by allocating a buffer to hold

CVE-2026-31401 [LOW] CVE-2026-31401: linux - In the Linux kernel, the following vulnerability has been resolved: HID: bpf: p... In the Linux kernel, the following vulnerability has been resolved: HID: bpf: prevent buffer overflow in hid_hw_request right now the returned value is considered to be always valid. However, when playing with HID-BPF, the return value can be arbitrary big, because it's the return value of dispatch_hid_bpf_raw_requests(), which calls the struct_ops and we have no guara

CVE-2026-23354 [LOW] CVE-2026-23354: linux - In the Linux kernel, the following vulnerability has been resolved: x86/fred: C... In the Linux kernel, the following vulnerability has been resolved: x86/fred: Correct speculative safety in fred_extint() array_index_nospec() is no use if the result gets spilled to the stack, as it makes the believed safe-under-speculation value subject to memory predictions. For all practical purposes, this means array_index_nospec() must be used in the expression t

CVE-2026-23281 CVE-2026-23281: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: liber... In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix use-after-free in lbs_free_adapter() The lbs_free_adapter() function uses timer_delete() (non-synchronous) for both command_timer and tx_lockup_timer before the structure is freed. This is incorrect because timer_delete() does not wait for any running timer callback to complete. If a time

CVE-2019-10142 [HIGH] CVE-2019-10142: linux - A flaw was found in the Linux kernel's freescale hypervisor manager implementati... A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, excluding 5.0.17. A parameter passed to an ioctl was incorrectly validated and used in size calculations for the page size calculation. An attacker can use this flaw to crash the system, corrupt memory, or create other adverse security affects. Scope: local

CVE-2021-47129 [MEDIUM] CVE-2021-47129: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: skip expectations for confirmed conntrack nft_ct_expect_obj_eval() calls nf_ct_ext_add() for a confirmed conntrack entry. However, nf_ct_ext_add() can only be called for !nf_ct_is_confirmed(). [ 1825.349056] WARNING: CPU: 0 PID: 1279 at net/netfilter/nf_conntrack_extend.c:48 nf_ct

CVE-2022-3565 [MEDIUM] CVE-2022-3565: linux - A vulnerability, which was classified as critical, has been found in Linux Kerne... A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211088. Scope: local bookw

CVE-2022-1729 [HIGH] CVE-2022-1729: linux - A race condition was found the Linux kernel in perf_event_open() which can be ex... A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary execution, etc. Scope: local bookworm: resolved (fixed in 5.17.11-1) bullseye: resolved (fixed in 5.10.120-1) forky: resolved (fixed

CVE-2023-3867 [HIGH] CVE-2023-3867: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds read in smb2_sess_setup ksmbd does not consider the case of that smb2 session setup is in compound request. If this is the second payload of the compound, OOB read issue occurs while processing the first payload in the smb2_sess_setup(). Scope: local bookworm: resolved (fixed in

CVE-2026-23195 [HIGH] CVE-2026-23195: linux - In the Linux kernel, the following vulnerability has been resolved: cgroup/dmem... In the Linux kernel, the following vulnerability has been resolved: cgroup/dmem: avoid pool UAF An UAF issue was observed: BUG: KASAN: slab-use-after-free in page_counter_uncharge+0x65/0x150 Write of size 8 at addr ffff888106715440 by task insmod/527 CPU: 4 UID: 0 PID: 527 Comm: insmod 6.19.0-rc7-next-20260129+ #11 Tainted: [O]=OOT_MODULE Call Trace: dump_stack_lvl+0x

CVE-2024-23307 [MEDIUM] CVE-2024-23307: linux - Integer Overflow or Wraparound vulnerability in Linux Linux kernel kernel on Lin... Integer Overflow or Wraparound vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (md, raid, raid5 modules) allows Forced Integer Overflow. Scope: local bookworm: resolved (fixed in 6.1.85-1) bullseye: open forky: resolved (fixed in 6.8.9-1) sid: resolved (fixed in 6.8.9-1) trixie: resolved (fixed in 6.8.9-1)

CVE-2016-8666 [HIGH] CVE-2016-8666: linux - The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a d... The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039. Scope: local bookworm: resolved (fixed i

CVE-2021-47489 [MEDIUM] CVE-2021-47489: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:... In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix even more out of bound writes from debugfs CVE-2021-42327 was fixed by: commit f23750b5b3d98653b31d4469592935ef6364ad67 Author: Thelford Williams Date: Wed Oct 13 16:04:13 2021 -0400 drm/amdgpu: fix out of bounds write but amdgpu_dm_debugfs.c contains more of the same issue so fix th

CVE-2024-0841 [MEDIUM] CVE-2024-0841: linux - A null pointer dereference flaw was found in the hugetlbfs_fill_super function i... A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 6.1.82-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6

CVE-2019-19044 [HIGH] CVE-2019-19044: linux - Two memory leaks in the v3d_submit_cl_ioctl() function in drivers/gpu/drm/v3d/v3... Two memory leaks in the v3d_submit_cl_ioctl() function in drivers/gpu/drm/v3d/v3d_gem.c in the Linux kernel before 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering kcalloc() or v3d_job_init() failures, aka CID-29cd13cfd762. Scope: local bookworm: resolved (fixed in 5.3.15-1) bullseye: resolved (fixed in 5.3.15-1) forky: resolved (

CVE-2019-12615 [HIGH] CVE-2019-12615: linux - An issue was discovered in get_vdev_port_node_info in arch/sparc/kernel/mdesc.c ... An issue was discovered in get_vdev_port_node_info in arch/sparc/kernel/mdesc.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup_const of node_info->vdev_port.name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). Scope: local bookworm: resolved (fixed in 5.2.6-1) bullseye: resolved (fixed in 5.2.6

CVE-2021-47189 [MEDIUM] CVE-2021-47189: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix ... In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory ordering between normal and ordered work functions Ordered work functions aren't guaranteed to be handled by the same thread which executed the normal work functions. The only way execution between normal/ordered functions is synchronized is via the WORK_DONE_BIT, unfortunately the

CVE-2016-2070 [HIGH] CVE-2016-2070: linux - The tcp_cwnd_reduction function in net/ipv4/tcp_input.c in the Linux kernel befo... The tcp_cwnd_reduction function in net/ipv4/tcp_input.c in the Linux kernel before 4.3.5 allows remote attackers to cause a denial of service (divide-by-zero error and system crash) via crafted TCP traffic. Scope: local bookworm: resolved (fixed in 4.3.5-1) bullseye: resolved (fixed in 4.3.5-1) forky: resolved (fixed in 4.3.5-1) sid: resolved (fixed in 4.3.5-1) trixie:

CVE-2024-27005 [MEDIUM] CVE-2024-27005: linux - In the Linux kernel, the following vulnerability has been resolved: interconnec... In the Linux kernel, the following vulnerability has been resolved: interconnect: Don't access req_list while it's being manipulated The icc_lock mutex was split into separate icc_lock and icc_bw_lock mutexes in [1] to avoid lockdep splats. However, this didn't adequately protect access to icc_node::req_list. The icc_set_bw() function will eventually iterate over re

CVE-2015-8746 [HIGH] CVE-2015-8746: linux - fs/nfs/nfs4proc.c in the NFS client in the Linux kernel before 4.2.2 does not pr... fs/nfs/nfs4proc.c in the NFS client in the Linux kernel before 4.2.2 does not properly initialize memory for migration recovery operations, which allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) via crafted network traffic. Scope: local bookworm: resolved (fixed in 4.3.1-1) bullseye: resolved (fixed in 4.3.1-1) forky: resolved