Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - mm/mremap修正已停用重新對應事件的 uffd 的 WARN。在跨越至少一個 PMD 的 VMA 上註冊 userfaultd然後 mremap() 發現 VMA 在從因頁面而導致的頁面表格移動失敗中復原時會觸發 WARN表格配置錯誤。程式碼最後會做正確的事 (遞迴避免移動實際的頁面表格)但觸發 WARN 是不愉快的 警告在 mm/mremap.c:357 move_normal_pmd mm/mremap.c:357 的 CPU: 2 PID: 6133 mm/mremap.c:357 [內嵌] 警告 CPU: 2 PID: 6133 at mm/mremap.c:357 move_pgt_entry mm/mremap.c:595 [內嵌] 警告: CPU: 2 PID: 6133 at mm/mremap.c:357 move_page_tables+0x3832/0x44a0 mm/mremap.c:852 模組連結於 CPU2 UID0 PID6133 Comm syz.0.19 未污染 6.17.0-rc1-syzkaller-00004-g53e760d89498 #0 PREEMPT(完整) 硬體名稱 QEMU Standard PC (Q35 + ICH9, 2009)BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP0010:move_normal_pmd mm/mremap.c:357 [內嵌] RIP0010:move_pgt_entry mm/mremap.c:595 [內嵌] RIP0010:move_page_tables+0x3832/0x44a0 mm/mremap.c:852 程式碼... RSP0018:ffffc900037a76d8 EFLAGS00010293 RAX0000000000000000 RBX
    0000000032930007 RCX: ffffffff820c6645 RDX: ffff88802e56a440 RSI: ffffffff820c7201 RDI: 0000000000000007 RBP: ffff888037728fc0 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000032930007 R11:
     R120000000000000000  : 0000000000000000 R13: ffffc900037a79a8 R14: 0000000000000001 R15: dffffc0000000000 FS: 000055556316a500(0000) GS:ffff8880d68bc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b30863fff CR3: 0000000050171000 CR40000000000352ef0 呼叫追踪 <TASK> copy_vma_and_data+0x468/0x790 mm/mremap.c:1215 move_vma+0x548/0x1780 mm/mremap.c:1282 mremap_to+0x1b7/0x450 mm/mremap.c:1406 x1 do_mremap+0xfad/01f80 mm /mremap.c:1921 __do_sys_mremap+0x119/0x170 mm/mremap.c:1977 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [內嵌] do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe +0x77/0x7f RIP0033:0x7f00d0b8ebe9 程式碼...
    RSP002b00007ffe5ea5ee98 EFLAGS00000246 ORIG_RAX0000000000000019 RAXffffffffffffffda RBX
    00007f00d0db5fa0 RCX: 00007f00d0b8ebe9 RDX: 0000000000400000 RSI: 0000000000c00000 RDI: 0000200000000000 RBP: 00007ffe5ea5eef0 R08: 0000200000c00000 R09: 0000000000000000 R10: 0000000000000003 R11:
    0000000000000246 R120000000000000002 R1300007f00d0db5fa0 R14: 00007f00d0db5fa0 R150000000000000005 </TASK> 根本問題是我們在原始頁面表格移動期間發生遞回而非在復原移動期間發生。透過檢查兩個 VMA 並在 pmd_none() 功能健全檢查之前執行檢查來修正此問題。在我們執行+記錄 PMD 和 PUD 層級的地方新增協助程式。感謝 Harry 平分。 (CVE-2025-39775)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - mm/mremap修复具有禁用了 remap 事件的 uffd 的 WARN在至少跨越一个 PMD 的 VMA 上注册 userfaultd然后进行 mremap()'ing从由于页面 导致的页表移动失败中恢复时VMA 可触发 WARN表分配错误。代码最终做了正确的事情递归、避免移动实际的页表但触发该警告是令人不快的 WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_normal_pmd mm/mremap.c:357 [ inline] 警告CPU:2 PID: 6133 at mm/mremap.c:357 move_pgt_entry mm/mremap.c:595 [inline] 警告CPU:2 PID: 6133 at mm/mremap.c:357 move_page_tables+0x3832/0x44a0 mm/mremap.c:852 模块中链接到了 CPU: 2 UID: 0 PID: 6133 Comm: syz.0.19 Not tainted 6.17.0-rc1-syzkaller-00004-g53e760d89498 #0 PREEMPT(full) 硬件名称: QEMU Standard PCQ35 + ICH92009BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:move_normal_pmd mm/mremap.c:357 [inline] RIP: 0010:move_pgt_entry mm/mremap.c:595 [inline] RIP: 0010:move_page_tables+0x3832/0x44a0 mm/mremap.c:852 代码... RSP0018ffffc900037a76d8 EFLAGS00010293 RAX0000000000000000 RBX
    0000000032930007 RCX: ffffffff820c6645 RDX: ffff88802e56a440 RSI: ffffffff820c7201 RDI: 0000000000000007 RBP: ffff888037728fc0 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000032930007 R11:
     R120000000000000000  : 0000000000000000 R13: ffffc900037a79a8 R14: 0000000000000001 R15: dffffc0000000000 FS: 000055556316a500(0000) GS:ffff8880d68bc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b30863fff CR3: 0000000050171000 CR4: 0000000000352ef0 调用跟踪 <TASK> copy_vma_and_data+0x468/0x790 mm/mremap.c:1215 move_vma+0x548/0x1780 mm/mremap.c:1282 mremap_to+0x1b7/0x450 mm/mremap.c:1406 do_mremap+0x1ffad/0x1f80 mm0x1f80 mm /mremap.c:1921 __do_sys_mremap+0x119/0x170 mm/mremap.c:1977 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [内联] do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe +0x77/0x7f RIP0033:0x7f00d0b8ebe9 代码...
    RSP002b:00007ffe5ea5ee98 EFLAGS00000246 ORIG_RAX: 0000000000000019 RAXffffffffffffffda RBX
    00007f00d0db5fa0 RCX: 00007f00d0b8ebe9 RDX: 0000000000400000 RSI: 0000000000c00000 RDI: 0000200000000000 RBP: 00007ffe5ea5eef0 R08: 0000200000c00000 R09: 0000000000000000 R10: 0000000000000003 R11:
    0000000000000246 R120000000000000002 R1300007f00d0db5fa0 R1400007f00d0db5fa0 R150000000000000005 </TASK> 最根本的问题是我们在原始页表移动期间递归但在恢复移动期间不递归。通过检查两个 VMA 并在 pmd_none() 健全性检查之前执行检查来修复此问题。添加新的帮助程序在其中执行+记录检查 PMD 和 PUD 级别。感谢 Harry 平分。 (CVE-2025-39775)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - mm/mremapリマップイベントが無効になっている uffd で WARN を修正します。少なくとも 1 つの PMD をスキャンする VMA への userfaultd の登録と、ページによって失敗したページテーブル移動からの回復時に、VMA が WARN を発生させる可能性があります。テーブル割り当てエラー。コードは最終的に正しいことを行う再帰、実際のページテーブルの移動を回避、警告をトリガーするのは不適切です 警告CPU2 PID6133 at mm/mremap.c:357 move_normal_pmd mm/mremap.c:357 [インライン] 警告CPU2 PID6133 at mm/mremap.c:357 move_pgt_entry mm/mremap.c:595 [インライン] 警告CPU2 PID6133 at mm/mremap.c:357 move_page_tables+0x3832/0x44a0 mm/mremap.c:852 モジュールのリンク CPU: 2 UID: 0 PID: 6133 通信: syz.0.19 汚染されていない 6.17.0-rc1-syzkaller-00004-g53e760d89498 #0 PREEMPT(full) ハードウェア名: QEMU Standard PCQ35 + ICH9、2009、BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP0010:move_normal_pmd mm/mremap.c:357[インライン] RIP0010:move_pgt_entry mm/mremap.c:595 [インライン] RIP: 0010:move_page_tables+0x3832/0x44a0 mm/mremap.c:852 コード: ... RSP: 0018:ffffc900037a76d8 EFLAGS: 00010293 RAX: 0000000000000000 RBX:
    0000000032930007 RCX: ffffffff820c6645 RDX: ffff88802e56a440 RSI: ffffffff820c7201 RDI: 0000000000000007 RBP: ffff888037728fc0 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000032930007 R11:
     R120000000000000000  : 0000000000000000 R13: ffffc900037a79a8 R14: 0000000000000001 R15: dffffc0000000000 FS: 000055556316a500(0000) GS:ffff8880d68bc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b30863fff CR3: 0000000050171000 CR40000000000352ef0 Call Trace <TASK> copy_vma_and_data+0x468/0x790 mm/mremap.c:1215 move_vma+0x548/0x1780 mm/mremap.c:1282 mremap_to+0x1b7/0x450 mm/mremap.c:1406 do_mremap+0xfad mm0x1 /mremap.c:1921 __do_sys_mremap+0x119/0x170 mm/mremap.c:1977 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_frame_64 +0x77/0x7f RIP: 0033:0x7f00d0b8ebe9 コード
    RSP002b:00007ffe5ea5ee98 EFLAGS00000246 ORIG_RAX000000000000000000000000 RAXffffffffffffda RBX
    00007f00d0db5fa0 RCX: 00007f00d0b8ebe9 RDX: 0000000000400000 RSI: 0000000000c00000 RDI: 0000200000000000 RBP: 00007ffe5ea5eef0 R08: 0000200000c00000 R09: 0000000000000000 R10: 0000000000000003 R11:
    0000000000000246 R12000000000000002 R1300007f00d0db5fa0 R1400007f00ddb5fa0 </TASK>R1500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 VMA の両方をチェックし、pmd_none() サニティチェックの前にチェックを行うことで、これを修正します。PMD および PUD レベルをチェックする実行+文書化を行う新しいヘルパーを追加します。bisected の Harry に感謝の意を表します。CVE-2025-39775

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20081-1 advisory.

    The SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2 kernel was updated to receive various     security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
    - CVE-2024-57891: sched_ext: Fix invalid irq restore in scx_ops_bypass() (bsc#1235953).
    - CVE-2024-57951: hrtimers: Handle CPU state correctly on hotplug (bsc#1237108).
    - CVE-2024-57952: Revert libfs: fix infinite directory reads for offset dir (bsc#1237131).
    - CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
    - CVE-2025-22034: mm/rmap: avoid -EBUSY from make_device_exclusive() (bsc#1241435).
    - CVE-2025-22077: Revert smb: client: fix TCP timers deadlock after rmmod (bsc#1241403).
    - CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses     (bsc#1242782).
    - CVE-2025-37821: sched/eevdf: Fix se->slice being set to U64_MAX and resulting (bsc#1242864).
    - CVE-2025-37849: KVM: arm64: Tear down vGIC on failed vCPU creation (bsc#1243000).
    - CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
    - CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
    - CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
    - CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
    - CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
    - CVE-2025-38019: mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (bsc#1245000).
    - CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
    - CVE-2025-38038: cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (bsc#1244812).
    - CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
    - CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
    - CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
    - CVE-2025-38101: ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (bsc#1245659).
    - CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
    - CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
    - CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
    - CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
    - CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
    - CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
    - CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
    - CVE-2025-38168: perf: arm-ni: Unregister PMUs on probe failure (bsc#1245763).
    - CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
    - CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
    - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
    - CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
    - CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
    - CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
    - CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
    - CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
    - CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
    - CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).
    - CVE-2025-38222: ext4: inline: fix len overflow in ext4_prepare_inline_data (bsc#1245976).
    - CVE-2025-38242: mm: userfaultfd: fix race of userfaultfd_move and swap cache (bsc#1246176).
    - CVE-2025-38244: smb: client: fix potential deadlock when reconnecting channels (bsc#1246183).
    - CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
    - CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
    - CVE-2025-38256: io_uring/rsrc: fix folio unpinning (bsc#1246188).
    - CVE-2025-38258: mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write     (bsc#1246185).
    - CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
    - CVE-2025-38267: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (bsc#1246245).
    - CVE-2025-38270: net: drv: netdevsim: do not napi_complete() from netpoll (bsc#1246252).
    - CVE-2025-38272: net: dsa: b53: do not enable EEE on bcm63xx (bsc#1246268).
    - CVE-2025-38301: nvmem: zynqmp_nvmem: unbreak driver after cleanup (bsc#1246351).
    - CVE-2025-38306: fs/fhandle.c: fix a race in call of has_locked_children() (bsc#1246366).
    - CVE-2025-38311: iavf: get rid of the crit lock (bsc#1246376).
    - CVE-2025-38318: perf: arm-ni: Fix missing platform_set_drvdata() (bsc#1246444).
    - CVE-2025-38322: perf/x86/intel: Fix crash in icl_update_topdown_event() (bsc#1246447).
    - CVE-2025-38323: net: atm: add lec_mutex (bsc#1246473).
    - CVE-2025-38337: jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (bsc#1246253).
    - CVE-2025-38341: eth: fbnic: avoid double free when failing to DMA-map FW msg (bsc#1246260).
    - CVE-2025-38349: eventpoll: do not decrement ep refcount while still holding the ep mutex (bsc#1246777).
    - CVE-2025-38350: net/sched: Always pass notifications when child class becomes empty (bsc#1246781).
    - CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
    - CVE-2025-38352: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()     (bsc#1246911).
    - CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).
    - CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
    - CVE-2025-38365: btrfs: fix a race between renames and directory logging (bsc#1247023).
    - CVE-2025-38374: optee: ffa: fix sleep in atomic context (bsc#1247024).
    - CVE-2025-38382: btrfs: fix iteration of extrefs during log replay (bsc#1247031).
    - CVE-2025-38383: mm/vmalloc: fix data race in show_numa_info() (bsc#1247250).
    - CVE-2025-38392: idpf: convert control queue mutex to a spinlock (bsc#1247169).
    - CVE-2025-38396: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (bsc#1247156).
    - CVE-2025-38399: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()     (bsc#1247097).
    - CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
    - CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
    - CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
    - CVE-2025-38419: remoteproc: core: Cleanup acquired resources when       rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
    - CVE-2025-38426: drm/amdgpu: Add basic validation for RAS header (bsc#1247252).
    - CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
    - CVE-2025-38440: net/mlx5e: Fix race between DIM disable and net_dim() (bsc#1247290).
    - CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()     (bsc#1247167).
    - CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
    - CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
    - CVE-2025-38451: md/md-bitmap: fix GPF in bitmap_get_stats() (bsc#1247102).
    - CVE-2025-38453: kABI: io_uring: msg_ring ensure io_kiocb freeing is deferred (bsc#1247234).
    - CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
    - CVE-2025-38457: net/sched: Abort __tc_modify_qdisc if parent class does not exist (bsc#1247098).
    - CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
    - CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
    - CVE-2025-38460: atm: clip: Fix potential null-ptr-deref in to_atmarpd() (bsc#1247143).
    - CVE-2025-38463: tcp: Correct signedness in skb remaining space calculation (bsc#1247113).
    - CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
    - CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime     (bsc#1247288).
    - CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
    - CVE-2025-38475: smc: Fix various oops due to inet_sock type confusion (bsc#1247308).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
    - CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
    - CVE-2025-38493: tracing/osnoise: Fix crash in timerlat_dump_stack() (bsc#1247283).
    - CVE-2025-38497: usb: gadget: configfs: Fix OOB read on empty string write (bsc#1247347).
    - CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns     (bsc#1247976).
    - CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface     (bsc#1248088).
    - CVE-2025-38508: x86/sev: Use TSC_FACTOR for Secure TSC frequency calculation (bsc#1248190).
    - CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
    - CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
    - CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
    - CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
    - CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
    - CVE-2025-38539: tracing: Add down_write(trace_event_sem) when adding trace event (bsc#1248211).
    - CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
    - CVE-2025-38545: net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info     (bsc#1248224).
    - CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
    - CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
    - CVE-2025-38554: mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped (bsc#1248299).
    - CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
    - CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
    - CVE-2025-38566: sunrpc: fix handling of server side tls alerts (bsc#1248374).
    - CVE-2025-38571: sunrpc: fix client side handling of tls alerts (bsc#1248401).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
    - CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
    - CVE-2025-38588: ipv6: prevent infinite loop in rt6_nlmsg_size() (bsc#1248368).
    - CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
    - CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port     (bsc#1248378).
    - CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
    - CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
    - CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
    - CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).
    - CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
    - CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
    - CVE-2025-38628: vdpa/mlx5: Fix release of uninitialized resources on error path (bsc#1248616).
    - CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
    - CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
    - CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
    - CVE-2025-38644: wifi: mac80211: reject TDLS operations when station is not associated (bsc#1248748).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
    - CVE-2025-38686: userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (bsc#1249160).
    - CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated     (bsc#1249182).
    - CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
    - CVE-2025-38709: loop: Avoid updating block size under exclusive owner (bsc#1249199).
    - CVE-2025-38710: gfs2: Validate i_depth for exhash directories (bsc#1249201).
    - CVE-2025-38730: io_uring/net: commit partial buffers on retry (bsc#1249172).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).
    - CVE-2025-39677: net/sched: Fix backlog accounting in qdisc_dequeue_internal (bsc#1249300).
    - CVE-2025-39681: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (bsc#1249303).
    - CVE-2025-39682: tls: fix handling of zero-length records on the rx_list (bsc#1249284).
    - CVE-2025-39683: tracing: Limit access to parser->buffer when trace_get_user failed (bsc#1249286).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39698: io_uring/futex: ensure io_futex_wait() cleans up properly on failure (bsc#1249322).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39723: kABI: netfs: handle new netfs_io_stream flag (bsc#1249314).
    - CVE-2025-39744: rcu: Fix rcu_read_unlock() deadloop due to IRQ work (bsc#1249494).
    - CVE-2025-39749: rcu: Protect ->defer_qs_iw_pending from data race (bsc#1249533).
    - CVE-2025-39754: mm/smaps: fix race between smaps_hugetlb_range and migration (bsc#1249524).
    - CVE-2025-39766: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (bsc#1249510).
    - CVE-2025-39770: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (bsc#1249508).
    - CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
    - CVE-2025-39775: mm/mremap: fix WARN with uffd that has remap events disabled (bsc#1249500).
    - CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
    - CVE-2025-39791: dm: dm-crypt: Do not partially accept write BIOs with zoned targets (bsc#1249550).
    - CVE-2025-39792: dm: Always split write BIOs to zoned device limits (bsc#1249618).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39813: ftrace: Also allocate and copy hash for reading of filter files (bsc#1250032).
    - CVE-2025-39816: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths     (bsc#1249906).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39825: smb: client: fix race with concurrent opens in rename(2) (bsc#1250179).
    - CVE-2025-39828: kABI workaround for struct atmdev_ops extension (bsc#1250205).
    - CVE-2025-39830: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (bsc#1249974).
    - CVE-2025-39838: cifs: prevent NULL pointer dereference in UTF16 conversion (bsc#1250365).
    - CVE-2025-39842: ocfs2: prevent release journal inode after journal shutdown (bsc#1250267).
    - CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
    - CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
    - CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).
    - CVE-2025-39852: net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (bsc#1250258).
    - CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
    - CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
    - CVE-2025-39857: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (bsc#1250251).
    - CVE-2025-39865: tee: fix NULL pointer dereference in tee_shm_put (bsc#1250294).
    - CVE-2025-39875: igb: Fix NULL pointer dereference in ethtool loopback test (bsc#1250398).
    - CVE-2025-39885: ocfs2: fix recursive semaphore deadlock in fiemap call (bsc#1250407).
    - CVE-2025-39898: e1000e: fix heap overflow in e1000_set_eeprom (bsc#1250742).
    - CVE-2025-39900: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (bsc#1250758).
    - CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).
    - CVE-2025-39922: ixgbe: fix incorrect map used in eee linkmode (bsc#1250722).
    - CVE-2025-39926: genetlink: fix genl_bind() invoking bind() after -EPERM (bsc#1250737).
    - CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
    - CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).
    - CVE-2025-40300: x86/vmscape: Warn when STIBP is disabled with SMT (bsc#1247483).
    - CVE-2025-38264: nvme-tcp: sanitize request list handling (bsc#1246387).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mm/mremap: fix WARN with uffd that has remap events disabled Registering userfaultd on a VMA that spans at     least one PMD and then mremap()'ing that VMA can trigger a WARN when recovering from a failed page table     move due to a page table allocation error. The code ends up doing the right thing (recurse, avoiding     moving actual page tables), but triggering that WARN is unpleasant: WARNING: CPU: 2 PID: 6133 at     mm/mremap.c:357 move_normal_pmd mm/mremap.c:357 [inline] WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357     move_pgt_entry mm/mremap.c:595 [inline] WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357     move_page_tables+0x3832/0x44a0 mm/mremap.c:852 Modules linked in: CPU: 2 UID: 0 PID: 6133 Comm: syz.0.19     Not tainted 6.17.0-rc1-syzkaller-00004-g53e760d89498 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35     + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:move_normal_pmd mm/mremap.c:357     [inline] RIP: 0010:move_pgt_entry mm/mremap.c:595 [inline] RIP: 0010:move_page_tables+0x3832/0x44a0     mm/mremap.c:852 Code: ... RSP: 0018:ffffc900037a76d8 EFLAGS: 00010293 RAX: 0000000000000000 RBX:
    0000000032930007 RCX: ffffffff820c6645 RDX: ffff88802e56a440 RSI: ffffffff820c7201 RDI: 0000000000000007     RBP: ffff888037728fc0 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000032930007 R11:
    0000000000000000 R12: 0000000000000000 R13: ffffc900037a79a8 R14: 0000000000000001 R15: dffffc0000000000     FS: 000055556316a500(0000) GS:ffff8880d68bc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000     CR0: 0000000080050033 CR2: 0000001b30863fff CR3: 0000000050171000 CR4: 0000000000352ef0 Call Trace: <TASK>     copy_vma_and_data+0x468/0x790 mm/mremap.c:1215 move_vma+0x548/0x1780 mm/mremap.c:1282     mremap_to+0x1b7/0x450 mm/mremap.c:1406 do_mremap+0xfad/0x1f80 mm/mremap.c:1921 __do_sys_mremap+0x119/0x170     mm/mremap.c:1977 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4c0     arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f00d0b8ebe9 Code: ...
    RSP: 002b:00007ffe5ea5ee98 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 RAX: ffffffffffffffda RBX:
    00007f00d0db5fa0 RCX: 00007f00d0b8ebe9 RDX: 0000000000400000 RSI: 0000000000c00000 RDI: 0000200000000000     RBP: 00007ffe5ea5eef0 R08: 0000200000c00000 R09: 0000000000000000 R10: 0000000000000003 R11:
    0000000000000246 R12: 0000000000000002 R13: 00007f00d0db5fa0 R14: 00007f00d0db5fa0 R15: 0000000000000005     </TASK> The underlying issue is that we recurse during the original page table move, but not during the     recovery move. Fix it by checking for both VMAs and performing the check before the pmd_none() sanity     check. Add a new helper where we perform+document that check for the PMD and PUD level. Thanks to Harry     for bisecting. (CVE-2025-39775)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
264764	Linux Distros 未修補的弱點：CVE-2025-39775	Nessus	Misc.	2025/9/14	2026/4/29	medium
264764	Linux Distros 未修补的漏洞：CVE-2025-39775	Nessus	Misc.	2025/9/14	2026/4/29	medium
264764	Linux Distros のパッチ未適用の脆弱性: CVE-2025-39775	Nessus	Misc.	2025/9/14	2026/4/29	medium
277010	openSUSE 16 セキュリティ更新カーネルopenSUSE-SU-2025-20081-1]	Nessus	SuSE Local Security Checks	2025/12/2	2026/3/3	high
277010	openSUSE 16 Security Update : kernel (openSUSE-SU-2025-20081-1)	Nessus	SuSE Local Security Checks	2025/12/2	2026/3/3	high
264764	Linux Distros Unpatched Vulnerability : CVE-2025-39775	Nessus	Misc.	2025/9/14	2026/4/29	medium

检测

插件搜索

medium

medium

medium

high

high

medium