The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:02137-1 advisory.

    This update for the Linux Kernel 4.12.14-122_255 fixes one issue.

    The following security issue was fixed:

    - CVE-2022-49179: block, bfq: do not move oom_bfqq (bsc#1241331).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7627-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - PowerPC architecture;

    - Block layer subsystem;

    - ACPI drivers;

    - NILFS2 file system;

    - File systems infrastructure;

    - Memory management;

    - Network traffic control;

    - USB sound devices; (CVE-2025-37932, CVE-2024-53197, CVE-2024-50116, CVE-2021-47379, CVE-2024-49958,     CVE-2022-49179, CVE-2024-46787, CVE-2024-41070, CVE-2025-38000, CVE-2024-56662, CVE-2022-49176,     CVE-2025-37798)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.355-276.618. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2826 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    block, bfq: don't move oom_bfqq (CVE-2022-49179)

    In the Linux kernel, the following vulnerability has been resolved:

    macsec: fix UAF bug for real_dev (CVE-2022-49390)

    In the Linux kernel, the following vulnerability has been resolved:

    block: Fix handling of offline queues in blk_mq_alloc_request_hctx() (CVE-2022-49720)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: aovid use-after-free in ext4_ext_insert_extent() (CVE-2024-49883)

    In the Linux kernel, the following vulnerability has been resolved:

    slip: make slhc_remember() more robust against malicious packets (CVE-2024-50033)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (CVE-2024-53057)

    In the Linux kernel, the following vulnerability has been resolved:

    hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer (CVE-2024-53103)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: fix LED ID check in led_tg_check() (CVE-2024-56650)

    In the Linux kernel, the following vulnerability has been resolved:

    net: defer final 'struct net' free in netns dismantle (CVE-2024-56658)

    In the Linux kernel, the following vulnerability has been resolved:

    pps: Fix a use-after-free (CVE-2024-57979)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: don't allow reconnect after disconnect (CVE-2025-21731)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix use-after-free when attempting to join an aborted transaction (CVE-2025-21753)

    In the Linux kernel, the following vulnerability has been resolved:

    ndisc: extend RCU protection in ndisc_send_skb() (CVE-2025-21760)

    In the Linux kernel, the following vulnerability has been resolved:

    arp: use RCU protection in arp_xmit() (CVE-2025-21762)

    In the Linux kernel, the following vulnerability has been resolved:

    ndisc: use RCU protection in ndisc_alloc_skb() (CVE-2025-21764)

    In the Linux kernel, the following vulnerability has been resolved:

    udp: Fix memory accounting leak. (CVE-2025-22058)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8267 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

    * use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

    * smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)

    * NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

    * swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

    * uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)

    * race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

    * use-after-free and memory errors in ext4 when mounting and operating on a corrupted image     (CVE-2022-1184)

    * concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280)

    * kernel info leak issue in pfkey_register (CVE-2022-1353)

    * use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)

    * NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

    * fanotify misuses fd_install() which could lead to use-after-free (CVE-2022-1998)

    * nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)

    * integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

    * slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

    * incomplete clean-up of multi-core shared buffers (aka SBDR) (CVE-2022-21123)

    * incomplete clean-up of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125)

    * incomplete clean-up in specific special register write operations (aka DRPW) (CVE-2022-21166)

    * possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

    * AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816,     CVE-2022-29900)

    * AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)

    * Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

    * double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

    * use after free in SUNRPC subsystem (CVE-2022-28893)

    * use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

    * Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

    * DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

    * nf_tables disallow binding to already bound chain (CVE-2022-39190)

    * nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01600-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-47659: drm/plane: Move range check for format_count earlier (bsc#1237839).
    - CVE-2022-49044: dm integrity: fix memory corruption when tag_size is less than digest size     (bsc#1237840).
    - CVE-2022-49055: drm/amdkfd: Check for potential null return of kmalloc_array() (bsc#1237868).
    - CVE-2022-49060: net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() (bsc#1237845).
    - CVE-2022-49086: net: openvswitch: fix leak of nested actions (bsc#1238037).
    - CVE-2022-49111: Bluetooth: Fix use after free in hci_send_acl (bsc#1237984).
    - CVE-2022-49118: scsi: hisi_sas: Free irq vectors in order for v3 HW (bsc#1237979).
    - CVE-2022-49121: scsi: pm8001: Fix tag leaks on error (bsc#1237926).
    - CVE-2022-49137: drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj (bsc#1238155).
    - CVE-2022-49175: PM: core: keep irq flags in device_pm_check_callbacks() (bsc#1238099).
    - CVE-2022-49176: bfq: fix use-after-free in bfq_dispatch_request (bsc#1238097).
    - CVE-2022-49179: block, bfq: do not move oom_bfqq (bsc#1238092).
    - CVE-2022-49188: remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region (bsc#1238138).
    - CVE-2022-49197: af_netlink: Fix shift out of bounds in group mask calculation (bsc#1238455).
    - CVE-2022-49205: bpf, sockmap: Fix double uncharge the mem of sk_msg (bsc#1238335).
    - CVE-2022-49232: drm/amd/display: Fix a NULL pointer dereference in     amdgpu_dm_connector_add_common_modes() (bsc#1238139).
    - CVE-2022-49290: mac80211: fix potential double free on mesh join (bsc#1238156).
    - CVE-2022-49305: drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() (bsc#1238645).
    - CVE-2022-49325: tcp: add accessors to read/set tp->snd_cwnd (bsc#1238398).
    - CVE-2022-49335: drm/amdgpu/cs: make commands with 0 chunks illegal behaviour (bsc#1238377).
    - CVE-2022-49351: net: altera: Fix refcount leak in altera_tse_mdio_create (bsc#1237939).
    - CVE-2022-49385: driver: base: fix UAF when driver_attach failed (bsc#1237951).
    - CVE-2022-49390: macsec: fix UAF bug for real_dev (bsc#1238233).
    - CVE-2022-49411: bfq: Make sure bfqg for which we are queueing requests is online (bsc#1238307).
    - CVE-2022-49442: drivers/base/node.c: fix compaction sysfs file leak (bsc#1238243).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49478: media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init (bsc#1238000).
    - CVE-2022-49489: drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm     runtime resume (bsc#1238244).
    - CVE-2022-49504: scsi: lpfc: Inhibit aborts if external loopback plug is inserted (bsc#1238835).
    - CVE-2022-49521: scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() (bsc#1238938).
    - CVE-2022-49525: media: cx25821: Fix the warning when removing the module (bsc#1238022).
    - CVE-2022-49534: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT (bsc#1238893).
    - CVE-2022-49535: scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI     (bsc#1238937).
    - CVE-2022-49536: scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock (bsc#1238838).
    - CVE-2022-49537: scsi: lpfc: Fix call trace observed during I/O with CMF enabled (bsc#1238930).
    - CVE-2022-49542: scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg() (bsc#1238722).
    - CVE-2022-49561: netfilter: conntrack: re-fetch conntrack after insertion (bsc#1238537).
    - CVE-2022-49590: igmp: Fix data-races around sysctl_igmp_llm_reports (bsc#1238844).
    - CVE-2022-49658: bpf, selftests: Add verifier test case for imm=0,umin=0,umax=1 scalar (bsc#1238803).
    - CVE-2022-49668: PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events (bsc#1237957).
    - CVE-2022-49693: drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf (bsc#1237954).
    - CVE-2022-49725: i40e: Fix call trace in setup_tx_descriptors (bsc#1238016).
    - CVE-2022-49728: kABI workaround for changeing the variable length type to size_t (bsc#1239111).
    - CVE-2022-49730: scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted (bsc#1239070).
    - CVE-2022-49749: i2c: designware: use casting of u64 in clock multiplication to avoid overflow     (bsc#1240243).
    - CVE-2022-49753: dmaengine: Fix double increment of client_count in dma_chan_get() (bsc#1240250).
    - CVE-2023-53023: net: nfc: Fix use-after-free in local_cleanup() (bsc#1240309).
    - CVE-2023-53032: netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function     (bsc#1240270).
    - CVE-2024-49994: block: fix integer overflow in BLKSECDISCARD (bsc#1237757).
    - CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
    - CVE-2024-50272: filemap: Fix bounds checking in filemap_read() (bsc#1233461 bsc#1234209).
    - CVE-2024-52559: drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit() (bsc#1238507).
    - CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
    - CVE-2024-56590: skbuff: introduce skb_pull_data (bsc#1235038).
    - CVE-2024-56641: net/smc: initialize close_work early to avoid warning (bsc#1235526).
    - CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
    - CVE-2024-57980: media: uvcvideo: Fix double free in error path (bsc#1237911).
    - CVE-2024-57981: usb: xhci: Fix NULL pointer dereference on certain command aborts (bsc#1237912).
    - CVE-2024-58005: tpm: Change to kvalloc() in eventlog/acpi.c (bsc#1237873).
    - CVE-2024-58009: Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc (bsc#1238760).
    - CVE-2024-58017: printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX (bsc#1237950     bsc#1239112).
    - CVE-2024-58063: wifi: rtlwifi: fix memory leaks and invalid access at probe error path (bsc#1238984).
    - CVE-2024-58093: PCI/ASPM: Fix link state exit during switch upstream function removal (bsc#1241347).
    - CVE-2025-21635: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy (bsc#1236111).
    - CVE-2025-21735: NFC: nci: Add bounds checking in nci_hci_create_pipe() (bsc#1238497).
    - CVE-2025-21750: wifi: brcmfmac: Check the return value of of_property_read_string_index() (bsc#1238905).
    - CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
    - CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21779: KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel     (bsc#1238768).
    - CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
    - CVE-2025-21862: drop_monitor: fix incorrect initialization order (bsc#1239474).
    - CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
    - CVE-2025-21909: wifi: nl80211: reject cooked mode if it is set along with other flags (bsc#1240590).
    - CVE-2025-21910: wifi: cfg80211: regulatory: improve invalid hints checking (bsc#1240583).
    - CVE-2025-21926: net: gso: fix ownership in __udp_gso_segment (bsc#1240712).
    - CVE-2025-21927: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (bsc#1240714).
    - CVE-2025-21931: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio (bsc#1240709).
    - CVE-2025-21941: drm/amd/display: Fix null check for pipe_ctx->plane_state in (bsc#1240701).
    - CVE-2025-21948: HID: appleir: Fix potential NULL dereference at raw event handle (bsc#1240703).
    - CVE-2025-21956: drm/amd/display: Assign normalized_pix_clk when color depth = 14 (bsc#1240739).
    - CVE-2025-21957: scsi: qla1280: Fix kernel oops when debug level > 2 (bsc#1240742).
    - CVE-2025-21963: cifs: Fix integer overflow while processing acdirmax mount option (bsc#1240717).
    - CVE-2025-21964: cifs: Fix integer overflow while processing acregmax mount option (bsc#1240740).
    - CVE-2025-21976: fbdev: hyperv_fb: Allow graceful removal of framebuffer (bsc#1241145).
    - CVE-2025-22004: net: atm: fix use after free in lec_send() (bsc#1240835).
    - CVE-2025-22008: regulator: check that dummy regulator has been probed before using it (bsc#1240942).
    - CVE-2025-22010: RDMA/hns: Fix soft lockup during bt pages loop (bsc#1240943).
    - CVE-2025-22018: atm: Fix NULL pointer dereference (bsc#1241266).
    - CVE-2025-22053: net: ibmveth: make veth_pool_store stop hanging (bsc#1241373).
    - CVE-2025-22055: net: fix geneve_opt length integer overflow (bsc#1241371).
    - CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
    - CVE-2025-22086: RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (bsc#1241458).
    - CVE-2025-23131: dlm: prevent NPD when writing a positive value to event_done (bsc#1241601).
    - CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1241-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
    - CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync     (bsc#1239095).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02101-1 advisory.

    This update for the Linux Kernel 4.12.14-122_231 fixes several issues.

    The following security issues were fixed:

    - CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
    - CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
    - CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
    - CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()     (bsc#1235062).
    - CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
    - CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238730).
    - CVE-2022-49179: block, bfq: do not move oom_bfqq (bsc#1241331).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02131-1 advisory.

    This update for the Linux Kernel 4.12.14-122_222 fixes several issues.

    The following security issues were fixed:

    - CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
    - CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
    - CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
    - CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()     (bsc#1235062).
    - CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
    - CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227903).
    - CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238730).
    - CVE-2022-49179: block, bfq: do not move oom_bfqq (bsc#1241331).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02135-1 advisory.

    This update for the Linux Kernel 4.12.14-122_250 fixes several issues.

    The following security issues were fixed:

    - CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238730).
    - CVE-2022-49179: block, bfq: do not move oom_bfqq (bsc#1241331).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005006 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    block, bfq: don't move oom_bfqq

    Our test report a UAF:

    [ 2073.019181] ==================================================================     [ 2073.019188] BUG: KASAN: use-after-free in __bfq_put_async_bfqq+0xa0/0x168     [ 2073.019191] Write of size 8 at addr ffff8000ccf64128 by task rmmod/72584     [ 2073.019192]     [ 2073.019196] CPU: 0 PID: 72584 Comm: rmmod Kdump: loaded Not tainted 4.19.90-yk #5     [ 2073.019198] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015     [ 2073.019200] Call trace:
    [ 2073.019203]  dump_backtrace+0x0/0x310     [ 2073.019206]  show_stack+0x28/0x38     [ 2073.019210]  dump_stack+0xec/0x15c     [ 2073.019216]  print_address_description+0x68/0x2d0     [ 2073.019220]  kasan_report+0x238/0x2f0     [ 2073.019224]  __asan_store8+0x88/0xb0     [ 2073.019229]  __bfq_put_async_bfqq+0xa0/0x168     [ 2073.019233]  bfq_put_async_queues+0xbc/0x208     [ 2073.019236]  bfq_pd_offline+0x178/0x238     [ 2073.019240]  blkcg_deactivate_policy+0x1f0/0x420     [ 2073.019244]  bfq_exit_queue+0x128/0x178     [ 2073.019249]  blk_mq_exit_sched+0x12c/0x160     [ 2073.019252]  elevator_exit+0xc8/0xd0     [ 2073.019256]  blk_exit_queue+0x50/0x88     [ 2073.019259]  blk_cleanup_queue+0x228/0x3d8     [ 2073.019267]  null_del_dev+0xfc/0x1e0 [null_blk]     [ 2073.019274]  null_exit+0x90/0x114 [null_blk]     [ 2073.019278]  __arm64_sys_delete_module+0x358/0x5a0     [ 2073.019282]  el0_svc_common+0xc8/0x320     [ 2073.019287]  el0_svc_handler+0xf8/0x160     [ 2073.019290]  el0_svc+0x10/0x218     [ 2073.019291]     [ 2073.019294] Allocated by task 14163:
    [ 2073.019301]  kasan_kmalloc+0xe0/0x190     [ 2073.019305]  kmem_cache_alloc_node_trace+0x1cc/0x418     [ 2073.019308]  bfq_pd_alloc+0x54/0x118     [ 2073.019313]  blkcg_activate_policy+0x250/0x460     [ 2073.019317]  bfq_create_group_hierarchy+0x38/0x110     [ 2073.019321]  bfq_init_queue+0x6d0/0x948     [ 2073.019325]  blk_mq_init_sched+0x1d8/0x390     [ 2073.019330]  elevator_switch_mq+0x88/0x170     [ 2073.019334]  elevator_switch+0x140/0x270     [ 2073.019338]  elv_iosched_store+0x1a4/0x2a0     [ 2073.019342]  queue_attr_store+0x90/0xe0     [ 2073.019348]  sysfs_kf_write+0xa8/0xe8     [ 2073.019351]  kernfs_fop_write+0x1f8/0x378     [ 2073.019359]  __vfs_write+0xe0/0x360     [ 2073.019363]  vfs_write+0xf0/0x270     [ 2073.019367]  ksys_write+0xdc/0x1b8     [ 2073.019371]  __arm64_sys_write+0x50/0x60     [ 2073.019375]  el0_svc_common+0xc8/0x320     [ 2073.019380]  el0_svc_handler+0xf8/0x160     [ 2073.019383]  el0_svc+0x10/0x218     [ 2073.019385]     [ 2073.019387] Freed by task 72584:
    [ 2073.019391]  __kasan_slab_free+0x120/0x228     [ 2073.019394]  kasan_slab_free+0x10/0x18     [ 2073.019397]  kfree+0x94/0x368     [ 2073.019400]  bfqg_put+0x64/0xb0     [ 2073.019404]  bfqg_and_blkg_put+0x90/0xb0     [ 2073.019408]  bfq_put_queue+0x220/0x228     [ 2073.019413]  __bfq_put_async_bfqq+0x98/0x168     [ 2073.019416]  bfq_put_async_queues+0xbc/0x208     [ 2073.019420]  bfq_pd_offline+0x178/0x238     [ 2073.019424]  blkcg_deactivate_policy+0x1f0/0x420     [ 2073.019429]  bfq_exit_queue+0x128/0x178     [ 2073.019433]  blk_mq_exit_sched+0x12c/0x160     [ 2073.019437]  elevator_exit+0xc8/0xd0     [ 2073.019440]  blk_exit_queue+0x50/0x88     [ 2073.019443]  blk_cleanup_queue+0x228/0x3d8     [ 2073.019451]  null_del_dev+0xfc/0x1e0 [null_blk]     [ 2073.019459]  null_exit+0x90/0x114 [null_blk]     [ 2073.019462]  __arm64_sys_delete_module+0x358/0x5a0     [ 2073.019467]  el0_svc_common+0xc8/0x320     [ 2073.019471]  el0_svc_handler+0xf8/0x160     [ 2073.019474]  el0_svc+0x10/0x218     [ 2073.019475]     [ 2073.019479] The buggy address belongs to the object at ffff8000ccf63f00      which belongs to the cache kmalloc-1024 of size 1024     [ 2073.019484] The buggy address is located 552 bytes inside of      1024-byte region [ffff8000ccf63f00, ffff8000ccf64300)     [ 2073.019486] The buggy address belongs to the page:
    [ 2073.019492] page:ffff7e000333d800 count:1 mapcount:0 mapping:ffff8000c0003a00 index:0x0     compound_mapcount: 0     [ 2073.020123] flags: 0x7ffff0000008100(slab|head)     [ 2073.020403] raw: 07ffff0000008100 ffff7e0003334c08 ffff7e00001f5a08 ffff8000c0003a00     [ 2073.020409] ra
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4123-1 advisory.

    This update for the SUSE Linux Enterprise kernel 4.12.14-122.231 fixes various security issues

    The following security issues were fixed:

    - CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1232637).
    - CVE-2022-49014: net: tun: Fix use-after-free in tun_detach() (bsc#1232818).
    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237930).
    - CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
    - CVE-2022-49179: block, bfq: don't move oom_bfqq (bsc#1241331).
    - CVE-2022-49465: blk-throttle: set BIO_THROTTLED when bio has been throttled (bsc#1238920).
    - CVE-2022-49545: ALSA: usb-audio: cancel pending work at closing a MIDI substream (bsc#1238730).
    - CVE-2022-49563: crypto: qat - add param check for RSA (bsc#1238788).
    - CVE-2022-49564: crypto: qat - add param check for DH (bsc#1238790).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249847).
    - CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250302).
    - CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230998).
    - CVE-2024-46818: drm/amd/display: check gpio_id before used as array index (bsc#1231204).
    - CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231676).
    - CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231993).
    - CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231943).
    - CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231862).
    - CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1233019).
    - CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
    - CVE-2024-50154: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink() (bsc#1233072).
    - CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans     (bsc#1233712).
    - CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
    - CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
    - CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233679).
    - CVE-2024-53104: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format     (bsc#1236783).
    - CVE-2024-53146: NFSD: prevent a potential integer overflow (bsc#1234854).
    - CVE-2024-53156: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() (bsc#1234847).
    - CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
    - CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234892).
    - CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235005).
    - CVE-2024-56600: net: inet6: do not leave a dangling sk pointer in inet6_create() (bsc#1235218).
    - CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
    - CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()     (bsc#1235062).
    - CVE-2024-56650: netfilter: x_tables: fix LED ID check in led_tg_check() (bsc#1235431).
    - CVE-2024-56664: bpf, sockmap: fix race between element replace and close() (bsc#1235250).
    - CVE-2024-57893: ALSA: seq: oss: fix races at processing SysEx messages (bsc#1235921).
    - CVE-2024-57996: net_sched: sch_sfq: don't allow 1 packet limit (bsc#1239077).
    - CVE-2024-8805: BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability     (bsc#1240840).
    - CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1245797).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).
    - CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).
    - CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1245794).
    - CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1245776).
    - CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1245793).
    - CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1245775).
    - CVE-2025-38079: crypto: algif_hash - fix double free in hash_accept (bsc#1245218).
    - CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245350).
    - CVE-2025-38177: kernel: sch_hfsc: make hfsc_qlen_notify() idempotent (bsc#1246356).
    - CVE-2025-38181: calipso: fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246001).
    - CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246030).
    - CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
    - CVE-2025-38494: HID: core: do not bypass hid_hw_raw_request (bsc#1247350).
    - CVE-2025-38495: HID: core: ensure the allocated report buffer can contain the reserved report ID     (bsc#1247351).
    - CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247499).
    - CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns     (bsc#1248673).
    - CVE-2025-38617: net/packet: fix a race in packet_set_ring() and packet_notifier() (bsc#1249208).
    - CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1249207).
    - CVE-2025-38644: wifi: mac80211: reject TDLS operations when station is not associated (bsc#1248749).

    The following non security issues were fixed:

    - Add the git commit and branch to the package description (bsc#920633)
    - Fix description in rpm spec file Spec file description mentions initial kGraft patch which is only true     for real initial patch. Make it more neutral. (bsc#930408)
    - Mark the module as supported (bsc#904970)
    - Provide common kallsyms wrapper API With bsc#1103203, the need for disambiguating between a multiply     defined symbol arose. This is something the kallsyms_lookup_name() based code snippet we used to     copy&paste to every individual CVE fix can't handle. Implement a proper wrapper API for doing the kallsyms     lookups.
    - Require exact kernel version in the patch (bsc#920615)
    - Revert 'Require exact kernel version in the patch' This needs to be done differently, so that modprobe
    --force works as expected. (bsc#920615) This reverts commit c62c11aecd4e3f8822e1b835fea403acc3148c5a.
    - Set immediate flag for the initial patch Setting immediate to true will simplify installation of the     initial patch and possibly also of the further updates. (bsc#907150)
    - The stubs' signatures have changed: each argument used to get mapped to either long or long long, but on     x86_64, the stubs are now receiving a single struct pt_regs only -- it's their responsibility to extract     the arguments as appropriate. In order to not require each and every live patch touching syscalls to     include an insane amount of ifdeffery, provide a set of #defines hiding it: 1.) KLP_SYSCALL_SYM(name)     expands to the syscall stub name for 64 bits as defined by _SYSCALL_DEFINEx(x, _name, ...). 2.) If the     architeture requires 32bit specific stubs for syscalls sharing a common implementation between 32 and     64bits, the KLP_ARCH_HAS_SYSCALL_COMPAT_STUBS macro is defined. 3.) If KLP_ARCH_HAS_SYSCALL_COMPAT_STUBS     is defined, then KLP_SYSCALL_COMPAT_STUB_SYM(name) expands to the syscall stub name for 32 bits as defined     by _SYSCALL_DEFINEx(x, _name, ...). 4.) For syscalls not sharing a common implementation between 32 and 64     bits, i.e. those defined by COMPAT_SYSCALL_DEFINEx(), the macro KLP_COMPAT_SYSCALL_SYM(name) expands to     the stub name defined as defined by COMPAT_SYSCALL_DEFINEx(x, _name, ...). 5.) Finally, for hiding     differences between the signatures, provide the macro KLP_SYSCALL_DECLx(x, sym, ...) which expands to a     declaration of sym, with the x arguments either mapped to long resp. long long each, or collapsed to a     single struct pt_regs argument as appropriate for the architecture. Note that these macros are defined as     appropriate on kernels before and after 4.17, so that live patch code can be shared. (bsc#1149841)
    - bsc#1249208: fix livepatching target module name (bsc#1252946)
    - uname_patch: convert to the syscall stub wrapper macros from klp_syscalls.h In order to make the live     patch to the newuname() syscall work on kernels >= 4.17 again, convert it to the KLP_SYSCALL_*() wrapper     macros provided by klp_syscalls.h. (bsc#1149841)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
240715	SUSE SLES12 Security Update : kernel (Live Patch 67 for SLE 12 SP5) (SUSE-SU-2025:02137-1)	Nessus	SuSE Local Security Checks	2025/6/27	2025/6/27	high
241626	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-7627-1)	Nessus	Ubuntu Local Security Checks	2025/7/9	2025/7/9	high
234515	Amazon Linux 2 : kernel (ALAS-2025-2826)	Nessus	Amazon Linux Local Security Checks	2025/4/17	2026/2/24	high
167620	RHEL 9 : kernel (RHSA-2022:8267)	Nessus	Red Hat Local Security Checks	2022/11/16	2025/9/12	high
237099	SUSE SLES12 Security Update : kernel (SUSE-SU-2025:01600-1)	Nessus	SuSE Local Security Checks	2025/5/22	2025/12/30	high
234407	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1241-1)	Nessus	SuSE Local Security Checks	2025/4/15	2025/12/30	high
240599	SUSE SLES12 Security Update : kernel (Live Patch 61 for SLE 12 SP5) (SUSE-SU-2025:02101-1)	Nessus	SuSE Local Security Checks	2025/6/26	2025/6/26	high
240725	SUSE SLES12 Security Update : kernel (Live Patch 58 for SLE 12 SP5) (SUSE-SU-2025:02131-1)	Nessus	SuSE Local Security Checks	2025/6/27	2025/6/27	high
240734	SUSE SLES12 Security Update : kernel (Live Patch 66 for SLE 12 SP5) (SUSE-SU-2025:02135-1)	Nessus	SuSE Local Security Checks	2025/6/27	2025/6/27	high
296707	Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005006)	Nessus	Unity Linux Local Security Checks	2026/1/27	2026/1/27	high
275755	SUSE SLES12 Security Update : kernel (Live Patch 61 for SUSE Linux Enterprise 12 SP5) (SUSE-SU-2025:4123-1)	Nessus	SuSE Local Security Checks	2025/11/19	2025/11/19	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high