End of life since 30 June 2024
Debian 10 end of life
Debian 10 (buster) reached end of life on 30 June 2024. Freexian sells Extended LTS for Debian 10 until June 2029. Without that subscription, its packages stay at the versions below: the kernel, OpenSSH, OpenSSL, glibc, sudo and the rest. We backport security fixes to them, so the server keeps running while you plan the move.
- 16exploited vulnerabilities in its components
- 194critical
- 28months past end of life
What Debian 10 still runs
| Component | Version | Package | Known CVEs |
|---|---|---|---|
| Linux kernel | 4.19 | 4.19.316-1 | 5,540 |
| glibc | 2.28 | 2.28-10+deb10u4 | |
| OpenSSL | 1.1.1n | 1.1.1n-0+deb10u6 | 37 |
| OpenSSH | 7.9p1 | 1:7.9p1-10+deb10u4 | 39 |
| sudo | 1.8.27 | 1.8.27-1+deb10u6 | |
| bash | 5.0 | 5.0-4 | |
| curl | 7.64.0 | 7.64.0-4+deb10u9 | |
| polkit | 0.105 | 0.105-25+deb10u1 | |
| systemd | 241 | 241-7~deb10u10 | |
| PHP | 7.3.31 | 7.3.31-1~deb10u7 | |
| Python 2 | 2.7.16 | 2.7.16-2+deb10u4 | |
| Python 3 | 3.7.3 | 3.7.3-1 | |
| Apache httpd | 2.4.59 | 2.4.59-1~deb10u1 | |
| nginx | 1.14.2 | 1.14.2-2+deb10u5 | |
| MariaDB | 10.3.39 | 1:10.3.39-0+deb10u2 | |
| PostgreSQL | 11 | 11+200+deb10u5 | |
| OpenJDK | 11.0.23 | 11.0.23+9-1~deb10u1 |
Latest versions in the distribution's public repositories, 28 October 2026. Known CVEs: for the upstream version, from the US National Vulnerability Database. Distribution packages include fixes backported before end of life, so not every one of them applies; your assessment shows which risks are real.
Exploited vulnerabilities in Debian 10's components
Vulnerabilities in the upstream versions of Debian 10's kernel, OpenSSH, OpenSSL and PHP that are listed in the CISA catalogue of known exploited vulnerabilities, highest score first. Debian 10 packages may include fixes made before end of life.
| CVE | Component | Score | Severity | Published | Description |
|---|---|---|---|---|---|
| CVE-2021-22555 Exploited | Linux kernel | 8.3 | High | 2021-07-07 | A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space |
| CVE-2023-0266 Exploited | Linux kernel | 7.9 | High | 2023-01-30 | A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e |
| CVE-2019-13272 Exploited | Linux kernel | 7.8 | High | 2019-07-17 | In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments. |
| CVE-2022-0492 Exploited | Linux kernel | 7.8 | High | 2022-03-03 | A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly. |
| CVE-2024-1086 Exploited | Linux kernel | 7.8 | High | 2024-01-31 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660. |
| CVE-2024-36971 Exploited | Linux kernel | 7.8 | High | 2024-06-10 | In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets. |
| CVE-2024-53104 Exploited | Linux kernel | 7.8 | High | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming. |
| CVE-2024-53197 Exploited | Linux kernel | 7.8 | High | 2024-12-27 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration. |
| CVE-2025-38352 Exploited | Linux kernel | 7.8 | High | 2025-07-22 | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case. |
| CVE-2025-39964 Exploited | Linux kernel | 7.8 | High | 2025-10-13 | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing. |
| CVE-2026-31431 Exploited | Linux kernel | 7.8 | High | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly. |
| CVE-2026-46300 Exploited | Linux kernel | 7.8 | High | 2026-05-23 | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors. |
| CVE-2024-53150 Exploited | Linux kernel | 7.1 | High | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. |
| CVE-2021-0920 Exploited | Linux kernel | 6.4 | Medium | 2021-12-15 | In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel |
| CVE-2024-50302 Exploited | Linux kernel | 5.5 | Medium | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report. |
| CVE-2022-2586 Exploited | Linux kernel | 5.3 | Medium | 2024-01-08 | It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted. |
What you can do
Keep Debian 10, patched
We backport the security fixes to the Debian 10 packages you run: the kernel, OpenSSH, OpenSSL, glibc and the rest, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to Debian 13, once your applications can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.