Debian Linux vulnerabilities

CVE-2022-39189 [HIGH] CVE-2022-39189: linux - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17... An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED situations. Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved (fixed in 5.10.191-1) forky: resolved (fixed in 5.19.6-1) sid: resolved (f

CVE-2024-49882 [HIGH] CVE-2024-49882: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: fix d... In the Linux kernel, the following vulnerability has been resolved: ext4: fix double brelse() the buffer of the extents path In ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been released, otherwise it may be released twice. An example of what triggers this is as follows: split2 map split1 |--------|-------|--------| ext4_ext_map_blocks ext4_ext_ha

CVE-2021-29266 [HIGH] CVE-2021-29266: linux - An issue was discovered in the Linux kernel before 5.11.9. drivers/vhost/vdpa.c ... An issue was discovered in the Linux kernel before 5.11.9. drivers/vhost/vdpa.c has a use-after-free because v->config_ctx has an invalid value upon re-opening a character device, aka CID-f6bbf0010ba0. Scope: local bookworm: resolved (fixed in 5.10.26-1) bullseye: resolved (fixed in 5.10.26-1) forky: resolved (fixed in 5.10.26-1) sid: resolved (fixed in 5.10.26-1) tri

CVE-2024-39494 [HIGH] CVE-2024-39494: linux - In the Linux kernel, the following vulnerability has been resolved: ima: Fix us... In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name ->d_name.name can change on rename and the earlier value can be freed; there are conditions sufficient to stabilize it (->d_lock on dentry, ->d_lock on its parent, ->i_rwsem exclusive on the parent's inode, rename_lock), but none of those are met at any

CVE-2017-13215 [HIGH] CVE-2017-13215: linux - A elevation of privilege vulnerability in the Upstream kernel skcipher. Product:... A elevation of privilege vulnerability in the Upstream kernel skcipher. Product: Android. Versions: Android kernel. Android ID: A-64386293. References: Upstream kernel. Scope: local bookworm: resolved (fixed in 4.4.2-1) bullseye: resolved (fixed in 4.4.2-1) forky: resolved (fixed in 4.4.2-1) sid: resolved (fixed in 4.4.2-1) trixie: resolved (fixed in 4.4.2-1)

CVE-2017-7889 [HIGH] CVE-2017-7889: linux - The mm subsystem in the Linux kernel through 3.2 does not properly enforce the C... The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file, related to arch/x86/mm/init.c and drivers/char/mem.c. Scope:

CVE-2023-52927 [HIGH] CVE-2023-52927: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the created ct will not be confirmed, like in OVS and TC conntrack

CVE-2024-46744 [HIGH] CVE-2024-46744: linux - In the Linux kernel, the following vulnerability has been resolved: Squashfs: s... In the Linux kernel, the following vulnerability has been resolved: Squashfs: sanity check symbolic link size Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately caused by a corrupted symbolic link size read from disk. The reason why the corrupted symlink size causes an uninitialised page is due to t

CVE-2024-40989 [HIGH] CVE-2024-40989: linux - In the Linux kernel, the following vulnerability has been resolved: KVM: arm64:... In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Disassociate vcpus from redistributor region on teardown When tearing down a redistributor region, make sure we don't have any dangling pointer to that region stored in a vcpu. Scope: local bookworm: resolved (fixed in 6.1.99-1) bullseye: resolved forky: resolved (fixed in 6.9.7-1) sid: re

CVE-2024-46713 [HIGH] CVE-2024-46713: linux - In the Linux kernel, the following vulnerability has been resolved: perf/aux: F... In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix AUX buffer serialization Ole reported that event->mmap_mutex is strictly insufficient to serialize the AUX buffer, add a per RB mutex to fully serialize it. Note that in the lock order comment the perf_event::mmap_mutex order was already wrong, that is, it nesting under mmap_lock is not

CVE-2016-10044 [HIGH] CVE-2016-10044: linux - The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not pro... The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call. Scope: local bookworm: resolved (fixed in 4.7.8-1) bullseye: resolved (fixed in 4.7.8-1) forky: resolved (

CVE-2022-49720 [HIGH] CVE-2022-49720: linux - In the Linux kernel, the following vulnerability has been resolved: block: Fix ... In the Linux kernel, the following vulnerability has been resolved: block: Fix handling of offline queues in blk_mq_alloc_request_hctx() This patch prevents that test nvme/004 triggers the following: UBSAN: array-index-out-of-bounds in block/blk-mq.h:135:9 index 512 is out of range for type 'long unsigned int [512]' Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x49

CVE-2022-49548 [HIGH] CVE-2022-49548: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix po... In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential array overflow in bpf_trampoline_get_progs() The cnt value in the 'cnt >= BPF_MAX_TRAMP_PROGS' check does not include BPF_TRAMP_MODIFY_RETURN bpf programs, so the number of the attached BPF_TRAMP_MODIFY_RETURN bpf programs in a trampoline can exceed BPF_MAX_TRAMP_PROGS. When this ha

CVE-2024-40920 [HIGH] CVE-2024-40920: linux - In the Linux kernel, the following vulnerability has been resolved: net: bridge... In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state I converted br_mst_set_state to RCU to avoid a vlan use-after-free but forgot to change the vlan group dereference helper. Switch to vlan group RCU deref helper to fix the suspicious rcu usage warning. Scope: local bookworm: resolved (fixe

CVE-2024-46673 [HIGH] CVE-2024-46673: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: aacra... In the Linux kernel, the following vulnerability has been resolved: scsi: aacraid: Fix double-free on probe failure aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but d

CVE-2022-49388 [HIGH] CVE-2022-49388: linux - In the Linux kernel, the following vulnerability has been resolved: ubi: ubi_cr... In the Linux kernel, the following vulnerability has been resolved: ubi: ubi_create_volume: Fix use-after-free when volume creation failed There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s error handling path: ubi_eba_replace_table(vol, eba_tbl) vol->eba_tbl = tbl out_mapping: ubi_eba_destroy_table(eba_tbl) // Free 'eba_tbl' out_unlock: put_dev

CVE-2025-37839 [HIGH] CVE-2025-37839: linux - In the Linux kernel, the following vulnerability has been resolved: jbd2: remov... In the Linux kernel, the following vulnerability has been resolved: jbd2: remove wrong sb->s_sequence check Journal emptiness is not determined by sb->s_sequence == 0 but rather by sb->s_start == 0 (which is set a few lines above). Furthermore 0 is a valid transaction ID so the check can spuriously trigger. Remove the invalid WARN_ON. Scope: local bookworm: resolved (

CVE-2024-40913 [HIGH] CVE-2024-40913: linux - In the Linux kernel, the following vulnerability has been resolved: cachefiles:... In the Linux kernel, the following vulnerability has been resolved: cachefiles: defer exposing anon_fd until after copy_to_user() succeeds After installing the anonymous fd, we can now see it in userland and close it. However, at this point we may not have gotten the reference count of the cache, but we will put it during colse fd, so this may cause a cache UAF. So gr

CVE-2024-53239 [HIGH] CVE-2024-53239: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire... In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Release resources at card release The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might be still in use (as we're calling snd_card_free_when_closed()). For avoid potential UAFs, move the release of re

CVE-2024-40903 [HIGH] CVE-2024-40903: linux - In the Linux kernel, the following vulnerability has been resolved: usb: typec:... In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps There could be a potential use-after-free case in tcpm_register_source_caps(). This could happen when: * new (say invalid) source caps are advertised * the existing source caps are unregistered * tcpm_register_source_caps() returns