Debian Linux vulnerabilities

CVE-2025-21945 [HIGH] CVE-2025-21945: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2_lock If smb_lock->zero_len has value, ->llist of smb_lock is not delete and flock is old one. It will cause use-after-free on error handling routine. Scope: local bookworm: resolved (fixed in 6.1.133-1) bullseye: resolved forky: resolved (fixed in 6.12.19-1) sid: reso

CVE-2024-26950 [MEDIUM] CVE-2024-26950: linux - In the Linux kernel, the following vulnerability has been resolved: wireguard: ... In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: access device through ctx instead of peer The previous commit fixed a bug that led to a NULL peer->device being dereferenced. It's actually easier and faster performance-wise to instead get the device from ctx->wg. This semantically makes more sense too, since ctx->wg->peer_allow

CVE-2019-14815 [HIGH] CVE-2019-14815: linux - A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mw... A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params() function of Marvell Wifi Driver. Scope: local bookworm: resolved (fixed in 5.2.17-1) bullseye: resolved (fixed in 5.2.17-1) forky: resolved (fixed in 5.2.17-1) sid: resolved (fixed in 5.2.17-1) trixie: resolved (fixed in 5.2.17-1)

CVE-2018-7566 [HIGH] CVE-2018-7566: linux - The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_PO... The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user. Scope: local bookworm: resolved (fixed in 4.15.11-1) bullseye: resolved (fixed in 4.15.11-1) forky: resolved (fixed in 4.15.11-1) sid: resolved (fixed in 4.15.11-1) trixie: resolved (fixed in 4.15.11-1)

CVE-2023-53652 [MEDIUM] CVE-2023-53652: linux - In the Linux kernel, the following vulnerability has been resolved: vdpa: Add f... In the Linux kernel, the following vulnerability has been resolved: vdpa: Add features attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops.

CVE-2024-41046 [HIGH] CVE-2024-41046: linux - In the Linux kernel, the following vulnerability has been resolved: net: ethern... In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix double free in detach The number of the currently released descriptor is never incremented which results in the same skb being released multiple times. Scope: local bookworm: resolved (fixed in 6.1.106-1) bullseye: resolved (fixed in 5.10.223-1) forky: resolved (fixed i

CVE-2018-5332 [HIGH] CVE-2018-5332: linux - In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not v... In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c). Scope: local bookworm: resolved (fixed in 4.14.17-1) bullseye: resolved (fixed in 4.14.17-1) forky: resolved (fixed in 4.14.17

CVE-2025-38437 [HIGH] CVE-2025-38437: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potential use-after-free in oplock/lease break ack If ksmbd_iov_pin_rsp return error, use-after-free can happen by accessing opinfo->state and opinfo_put and ksmbd_fd_put could called twice. Scope: local bookworm: resolved (fixed in 6.1.147-1) bullseye: resolved forky: resolved (fixed in 6.

CVE-2018-16276 [HIGH] CVE-2018-16276: linux - An issue was discovered in yurex_read in drivers/usb/misc/yurex.c in the Linux k... An issue was discovered in yurex_read in drivers/usb/misc/yurex.c in the Linux kernel before 4.17.7. Local attackers could use user access read/writes with incorrect bounds checking in the yurex USB driver to crash the kernel or potentially escalate privileges. Scope: local bookworm: resolved (fixed in 4.17.8-1) bullseye: resolved (fixed in 4.17.8-1) forky: resolved (

CVE-2017-10663 [HIGH] CVE-2017-10663: linux - The sanity_check_ckpt function in fs/f2fs/super.c in the Linux kernel before 4.1... The sanity_check_ckpt function in fs/f2fs/super.c in the Linux kernel before 4.12.4 does not validate the blkoff and segno arrays, which allows local users to gain privileges via unspecified vectors. Scope: local bookworm: resolved (fixed in 4.12.6-1) bullseye: resolved (fixed in 4.12.6-1) forky: resolved (fixed in 4.12.6-1) sid: resolved (fixed in 4.12.6-1) trixie: r

CVE-2024-26614 [MEDIUM] CVE-2024-26614: linux - In the Linux kernel, the following vulnerability has been resolved: tcp: make s... In the Linux kernel, the following vulnerability has been resolved: tcp: make sure init the accept_queue's spinlocks once When I run syz's reproduction C program locally, it causes the following issue: pvqspinlock: lock 0xffff9d181cd5c660 has corrupted value 0x0! WARNING: CPU: 19 PID: 21160 at __pv_queued_spin_unlock_slowpath (kernel/locking/qspinlock_paravirt.h:508

CVE-2017-0861 [HIGH] CVE-2017-0861: linux - Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem ... Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via unspecified vectors. Scope: local bookworm: resolved (fixed in 4.13.4-1) bullseye: resolved (fixed in 4.13.4-1) forky: resolved (fixed in 4.13.4-1) sid: resolved (fixed in 4.13.4-1) trixie: resolved (fixed in 4.13.4-1)

CVE-2023-53543 [MEDIUM] CVE-2023-53543: linux - In the Linux kernel, the following vulnerability has been resolved: vdpa: Add m... In the Linux kernel, the following vulnerability has been resolved: vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops.

CVE-2024-40920 [HIGH] CVE-2024-40920: linux - In the Linux kernel, the following vulnerability has been resolved: net: bridge... In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state I converted br_mst_set_state to RCU to avoid a vlan use-after-free but forgot to change the vlan group dereference helper. Switch to vlan group RCU deref helper to fix the suspicious rcu usage warning. Scope: local bookworm: resolved (fixe

CVE-2017-17450 [HIGH] CVE-2017-17450: linux - net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the C... net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allows local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces. Scope: local bookworm: resolved (fixed in 4.14.7-1) bullseye: resolved (fi

CVE-2017-5669 [HIGH] CVE-2017-5669: linux - The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not r... The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operation, which allows local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context. Scope: local bookworm: reso

CVE-2014-9888 [HIGH] CVE-2014-9888: linux - arch/arm/mm/dma-mapping.c in the Linux kernel before 3.13 on ARM platforms, as u... arch/arm/mm/dma-mapping.c in the Linux kernel before 3.13 on ARM platforms, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not prevent executable DMA mappings, which might allow local users to gain privileges via a crafted application, aka Android internal bug 28803642 and Qualcomm internal bug CR642735. Scope: local bookworm: resolved (fixed

CVE-2017-18552 [HIGH] CVE-2017-18552: linux - An issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. The... An issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. There is an out of bounds write and read in the function rds_recv_track_latency. Scope: local bookworm: resolved (fixed in 4.11.6-1) bullseye: resolved (fixed in 4.11.6-1) forky: resolved (fixed in 4.11.6-1) sid: resolved (fixed in 4.11.6-1) trixie: resolved (fixed in 4.11.6-1)

CVE-2023-26544 [HIGH] CVE-2023-26544: linux - In the Linux kernel 6.0.8, there is a use-after-free in run_unpack in fs/ntfs3/r... In the Linux kernel 6.0.8, there is a use-after-free in run_unpack in fs/ntfs3/run.c, related to a difference between NTFS sector size and media sector size. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved forky: resolved (fixed in 6.1.4-1) sid: resolved (fixed in 6.1.4-1) trixie: resolved (fixed in 6.1.4-1)

CVE-2025-21967 [HIGH] CVE-2025-21967: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix ... In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_free_work_struct ->interim_entry of ksmbd_work could be deleted after oplock is freed. We don't need to manage it with linked list. The interim request could be immediately sent whenever a oplock break wait is needed. Scope: local bookworm: open bullseye: resolved fo