It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-148 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace (CVE-2022-49932)

    A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve     local privilege escalation.

    The perf_group_detach function did not check the event's siblings' attach_state before calling     add_event_to_groups(), but remove_on_exec made it possible to call list_del_event() on before detaching     from their group, making it possible to use a dangling pointer causing a use-after-free vulnerability.

    We recommend upgrading past commit fd0815f632c24878e325821943edccc7fde947a2. (CVE-2023-2235)

    do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading     to a race condition (with a resultant use-after-free or NULL pointer dereference). (CVE-2023-28466)

    An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64     lacks consistency checks for CR0 and CR4. (CVE-2023-30456)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent (CVE-2023-53070)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix invalid address access in lookup_rec() when index is 0 (CVE-2023-53075)

    In the Linux kernel, the following vulnerability has been resolved:

    ocfs2: fix data corruption after failed write (CVE-2023-53081)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/shmem-helper: Remove another errant put in error path (CVE-2023-53084)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/active: Fix misuse of non-idle barriers as fence trackers (CVE-2023-53087)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix task hung in ext4_xattr_delete_inode (CVE-2023-53089)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: update s_journal_inum if it changes after journal replay (CVE-2023-53091)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/ttm: Fix a NULL pointer dereference (CVE-2023-53095)

    In the Linux kernel, the following vulnerability has been resolved:

    interconnect: fix mem leak when freeing nodes (CVE-2023-53096)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix WARNING in ext4_update_inline_data (CVE-2023-53100)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: zero i_disksize when initializing the bootloader inode (CVE-2023-53101)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails (CVE-2023-53103)

    In the Linux kernel, the following vulnerability has been resolved:

    veth: Fix use after free in XDP_REDIRECT (CVE-2023-53107)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tunnels: annotate lockless accesses to dev->needed_headroom (CVE-2023-53109)

    In the Linux kernel, the following vulnerability has been resolved:

    loop: Fix use-after-free issues (CVE-2023-53111)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/sseu: fix max_subslices array-index-out-of-bounds access (CVE-2023-53112)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: prevent out-of-bounds array speculation when closing a file descriptor (CVE-2023-53117)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: tcp_make_synack() can be called from process context (CVE-2023-53121)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: s390: Fix use-after-free of PCI resources with per-function hotplug (CVE-2023-53123)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Fix a server shutdown leak (CVE-2023-53131)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() (CVE-2023-53133)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: fix struct pid leaks in OOB support (CVE-2023-53136)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: Fix possible corruption when moving a directory (CVE-2023-53137)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Remove the /proc/scsi/${proc_name} directory earlier (CVE-2023-53140)

    In the Linux kernel, the following vulnerability has been resolved:

    ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() (CVE-2023-53141)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix another off-by-one fsmap error on 1k block filesystems (CVE-2023-53143)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/resctrl: Clear staged_config[] before and after it is used (CVE-2023-53169)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1771078945 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: pid: take a reference when     initializing `cad_pid` During boot, kernel_init_freeable() initializes `cad_pid` to the init task's struct     pid. Later on, we may change `cad_pid` via a sysctl, and when this happens proc_do_cad_pid() will     increment the refcount on the new pid via get_pid(), and will decrement the refcount on the old pid via     put_pid(). As we never called get_pid() when we initialized `cad_pid`, we decrement a reference we never     incremented, can therefore free the init task's struct pid early. As there can be dangling references to     the struct pid, we can later encounter a use-after-free (e.g. when delivering signals). This was spotted     when fuzzing v5.13-rc3 with Syzkaller, but seems to have been around since the conversion of `cad_pid` to     struct pid in commit 9ec52099e4b8 ([PATCH] replace cad_pid by a struct pid) from the pre-KASAN stone age     of v2.6.19. Fix this by getting a reference to the init task's struct pid when we assign it to `cad_pid`.
    Full KASAN splat below. ================================================================== BUG: KASAN:
    use-after-free in ns_of_pid include/linux/pid.h:153 [inline] BUG: KASAN: use-after-free in     task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 Read of size 4 at addr ffff23794dda0004 by task syz-     executor.0/273 CPU: 1 PID: 273 Comm: syz-executor.0 Not tainted 5.12.0-00001-g9aef892b2d15 #1 Hardware     name: linux,dummy-virt (DT) Call trace: ns_of_pid include/linux/pid.h:153 [inline]     task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 do_notify_parent+0x308/0xe60 kernel/signal.c:1950     exit_notify kernel/exit.c:682 [inline] do_exit+0x2334/0x2bd0 kernel/exit.c:845 do_group_exit+0x108/0x2c8     kernel/exit.c:922 get_signal+0x4e4/0x2a88 kernel/signal.c:2781 do_signal arch/arm64/kernel/signal.c:882     [inline] do_notify_resume+0x300/0x970 arch/arm64/kernel/signal.c:936 work_pending+0xc/0x2dc Allocated by     task 0: slab_post_alloc_hook+0x50/0x5c0 mm/slab.h:516 slab_alloc_node mm/slub.c:2907 [inline] slab_alloc     mm/slub.c:2915 [inline] kmem_cache_alloc+0x1f4/0x4c0 mm/slub.c:2920 alloc_pid+0xdc/0xc00 kernel/pid.c:180     copy_process+0x2794/0x5e18 kernel/fork.c:2129 kernel_clone+0x194/0x13c8 kernel/fork.c:2500     kernel_thread+0xd4/0x110 kernel/fork.c:2552 rest_init+0x44/0x4a0 init/main.c:687     arch_call_rest_init+0x1c/0x28 start_kernel+0x520/0x554 init/main.c:1064 0x0 Freed by task 270:
    slab_free_hook mm/slub.c:1562 [inline] slab_free_freelist_hook+0x98/0x260 mm/slub.c:1600 slab_free     mm/slub.c:3161 [inline] kmem_cache_free+0x224/0x8e0 mm/slub.c:3177 put_pid.part.4+0xe0/0x1a8     kernel/pid.c:114 put_pid+0x30/0x48 kernel/pid.c:109 proc_do_cad_pid+0x190/0x1b0 kernel/sysctl.c:1401     proc_sys_call_handler+0x338/0x4b0 fs/proc/proc_sysctl.c:591 proc_sys_write+0x34/0x48     fs/proc/proc_sysctl.c:617 call_write_iter include/linux/fs.h:1977 [inline] new_sync_write+0x3ac/0x510     fs/read_write.c:518 vfs_write fs/read_write.c:605 [inline] vfs_write+0x9c4/0x1018 fs/read_write.c:585     ksys_write+0x124/0x240 fs/read_write.c:658 __do_sys_write fs/read_write.c:670 [inline] __se_sys_write     fs/read_write.c:667 [inline] __arm64_sys_write+0x78/0xb0 fs/read_write.c:667 __invoke_syscall     arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall arch/arm64/kernel/syscall.c:49 [inline]     el0_svc_common.constprop.1+0x16c/0x388 arch/arm64/kernel/syscall.c:129 do_el0_svc+0xf8/0x150     arch/arm64/kernel/syscall.c:168 el0_svc+0x28/0x38 arch/arm64/kernel/entry-common.c:416     el0_sync_handler+0x134/0x180 arch/arm64/kernel/entry-common.c:432 el0_sync+0x154/0x180     arch/arm64/kernel/entry.S:701 The buggy address belongs to the object at ffff23794dda0000 which belongs to     the cache pid of size 224 The buggy address is located 4 bytes inside of 224-byte region [ff
    ---truncated--- (CVE-2021-47118)

  - In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Don't generate an interrupt     on bus reset Now that the i2c-i801 driver supports interrupts, setting the KILL bit in a attempt to     recover from a timed out transaction triggers an interrupt. Unfortunately, the interrupt handler     (i801_isr) is not prepared for this situation and will try to process the interrupt as if it was signaling     the end of a successful transaction. In the case of a block transaction, this can result in an out-of-     range memory access. This condition was reproduced several times by syzbot:
    https://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e     https://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e     https://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e     https://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb     https://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a     https://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79 So disable interrupts while trying to reset     the bus. Interrupts will be enabled again for the following transaction. (CVE-2021-47153)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITE_SAME No Data     Buffer crash In newer version of the SBC specs, we have a NDOB bit that indicates there is no data buffer     that gets written out. If this bit is set using commands like sg_write_same --ndob we will crash in     target_core_iblock/file's execute_write_same handlers when we go to access the se_cmd->t_data_sg because     its NULL. This patch adds a check for the NDOB bit in the common WRITE SAME code because we don't support     it. And, it adds a check for zero SG elements in each handler in case the initiator tries to send a normal     WRITE SAME with no data buffer. (CVE-2022-21546)

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: IPoIB, Block PKEY     interfaces with less rx queues than parent A user is able to configure an arbitrary number of rx queues     when creating an interface via netlink. This doesn't work for child PKEY interfaces because the child     interface uses the parent receive channels. Although the child shares the parent's receive channels, the     number of rx queues is important for the channel_stats array: the parent's rx channel index is used to     access the child's channel_stats. So the array has to be at least as large as the parent's rx queue size     for the counting to work correctly and to prevent out of bound accesses. This patch checks for the     mentioned scenario and returns an error when trying to create the interface. The error is propagated to     the user. (CVE-2022-48883)

  - In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix potential out of bounds     access with invalid rxstatus->rs_keyix The rxstatus->rs_keyix eventually gets passed to test_bit() so we     need to ensure that it is within the bitmap. drivers/net/wireless/ath/ath9k/common.c:46     ath9k_cmn_rx_accept() error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()' (CVE-2022-49503)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992359 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix invalid address access in lookup_rec() when index is 0

    KASAN reported follow problem:

     BUG: KASAN: use-after-free in lookup_rec      Read of size 8 at addr ffff000199270ff0 by task modprobe      CPU: 2 Comm: modprobe      Call trace:
      kasan_report
      __asan_load8       lookup_rec       ftrace_location       arch_check_ftrace_location       check_kprobe_address_safe       register_kprobe

    When checking pg->records[pg->index - 1].ip in lookup_rec(), it can get a     pg which is newly added to ftrace_pages_start in ftrace_process_locs().
    Before the first pg->index++, index is 0 and accessing pg->records[-1].ip     will cause this problem.

    Don't check the ip when pg->index is 0.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    RDMA/core: Silence oversized kvmalloc() warning(CVE-2025-37867)

    igb: revert rtnl_lock() that causes deadlock(CVE-2023-53060)

    bnxt_en: Avoid order-5 memory allocation for TPA data(CVE-2023-53134)

    net_sched: sch_sfq: move the limit validation(CVE-2025-37752)

    ftrace: Add cond_resched() to ftrace_graph_set_hash().(CVE-2025-37940)

    net: annotate races around sk-sk_bound_dev_if(CVE-2022-49420)

    ext4: fix off-by-one error in do_split(CVE-2025-23150)

    jbd2: remove wrong sb-s_sequence check(CVE-2025-37839)

    ext4: update s_journal_inum if it changes after journal replay(CVE-2023-53091)

    udp: Fix memory accounting leak.(CVE-2025-22058)

    netem: Update sch-q.qlen before qdisc_tree_reduce_backlog().(CVE-2025-21703)

    net: fix memory leak in tcp_conn_request().(CVE-2024-57841)

    xfrm: state: fix out-of-bounds read during lookup(CVE-2024-57982)

    Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an     authenticated user to potentially enable denial of service via local access.(CVE-2021-33061)

    udf: Fix a slab-out-of-bounds write bug in udf_find_entry().(CVE-2022-49846)

    nvmet: avoid potential UAF in nvmet_req_complete().(CVE-2023-53116)

    ata: libata-transport: fix error handling in ata_tport_add().(CVE-2022-49825)

    ata: libata-transport: fix double ata_host_put() in ata_tport_add().(CVE-2022-49826)

    bpf: track changes_pkt_data property for global functions(CVE-2024-58098)

    pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map(CVE-2022-49832)

    scsi: core: Fix a procfs host directory removal regression(CVE-2023-53118)

    bpf, verifier: Fix memory leak in array reallocation for stack state(CVE-2022-49878)

    kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case(CVE-2022-49779)

    i2c: piix4: Fix adapter not be removed in piix4_remove().(CVE-2022-49900)

    bpf: Fix kmemleak warning for percpu hashmap(CVE-2025-37807)

    drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker().(CVE-2022-49827)

    RDMA/core: Fix null-ptr-deref in ib_core_cleanup().(CVE-2022-49925)

    net: tun: Fix memory leaks of napi_get_frags(CVE-2022-49871)

    net: sched: Fix use after free in red_enqueue().(CVE-2022-49921)

    bnxt_en: Fix possible crash in bnxt_hwrm_set_coal().(CVE-2022-49869)

    tipc: fix the msg-req tlv len check in tipc_nl_compat_name_table_dump_header(CVE-2022-49862)

    bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb().(CVE-2022-49840)

    net: macvlan: fix memory leaks of macvlan_common_newlink(CVE-2022-49853)

    HID: hyperv: fix possible memory leak in mousevsc_probe().(CVE-2022-49874)

    bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE(CVE-2022-49875)

    ftrace: Fix null pointer dereference in ftrace_add_mod().(CVE-2022-49802)

    tracing: Do not let histogram values have some modifiers(CVE-2023-53093)

    ftrace: Fix invalid address access in lookup_rec() when index is 0(CVE-2023-53075)

    iavf: Fix handling of dummy receive descriptors(CVE-2022-49583)

    ftrace: Fix use-after-free for dynamic ftrace_ops(CVE-2022-49892)

    fscrypt: stop using keyrings subsystem for fscrypt_master_key(CVE-2022-49899)

    bpf: Fix wrong reg type conversion in release_reference().(CVE-2022-49873)

    capabilities: fix potential memleak on error path from vfs_getxattr_alloc().(CVE-2022-49890)

    nfs4: Fix kmemleak when allocate slot failed(CVE-2022-49927)

    scsi: scsi_transport_sas: Fix error handling in sas_phy_add().(CVE-2022-49839)

    ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init().(CVE-2022-49885)

    blk-mq: Fix kmemleak in blk_mq_init_allocated_queue(CVE-2022-49901)

    bpf: Fix memory leaks in __check_func_call(CVE-2022-49837)

    ext4: ignore xattrs past end(CVE-2025-37738)

    ext4: fix another off-by-one fsmap error on 1k block filesystems(CVE-2023-53143)

    ext4: fix WARNING in ext4_update_inline_data(CVE-2023-53100)

    ext4: Fix possible corruption when moving a directory(CVE-2023-53137)

    ext4: zero i_disksize when initializing the bootloader inode(CVE-2023-53101)

    ata: libata-transport: fix error handling in ata_tdev_add().(CVE-2022-49823)

    ext4: fix BUG_ON() when directory entry has invalid rec_len(CVE-2022-49879)

    ext4: fix task hung in ext4_xattr_delete_inode(CVE-2023-53089)

    scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus().(CVE-2022-49780)

    ext4: fix warning in 'ext4_da_release_space'(CVE-2022-49880)

    ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters().(CVE-2022-49889)

    netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets.(CVE-2025-22063)

    clk: samsung: Fix UBSAN panic in samsung_clk_init().(CVE-2025-39728)

    x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range().(CVE-2025-22090)

    misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram().(CVE-2022-49788)

    scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add().(CVE-2023-53124)

    tracing: Fix wild-memory-access in register_synth_event().(CVE-2022-49799)

    hrtimers: Handle CPU state correctly on hotplug(CVE-2024-57951)

    block, bfq: fix uaf for bfqq in bic_set_bfqq().(CVE-2023-52983)

    tcp: Fix data-races around sysctl_tcp_max_reordering.(CVE-2022-49571)

    tcp: Fix data-races around sysctl_tcp_slow_start_after_idle.(CVE-2022-49572)

    tcp: Fix a data-race around sysctl_tcp_early_retrans.(CVE-2022-49573)

    kthread: unpark only parked kthread(CVE-2024-50019)

    media: streamzap: fix race between device disconnection and urb callback(CVE-2025-22027)

    net: openvswitch: fix flow memory leak in ovs_flow_cmd_new(CVE-2023-52977)

    efi: Do not import certificates from UEFI Secure Boot for T2 Macs(CVE-2022-49357)

    Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout(CVE-2022-49474)

    mmc: core: use sysfs_emit() instead of sprintf().(CVE-2022-49267)

    ext4: fix OOB read when checking dotdot dir(CVE-2025-37785)

    tcp: Fix data-races around sysctl_tcp_fastopen.(CVE-2022-49586)

    tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts.(CVE-2022-49575)

    ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg(CVE-2022-49727)

    tcp: Fix a data-race around sysctl_tcp_notsent_lowat.(CVE-2022-49587)

    dlm: prevent NPD when writing a positive value to event_done(CVE-2025-23131)

    thermal: int340x: Add NULL check for adev(CVE-2025-23136)

    nfsd: don't ignore the return code of svc_proc_register().(CVE-2025-22026)

    ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all().(CVE-2025-22121)

    ext4: avoid journaling sb update on error if journal is destroying(CVE-2025-22113)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.311-233.529. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2909 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix invalid address access in lookup_rec() when index is 0 (CVE-2023-53075)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix task hung in ext4_xattr_delete_inode (CVE-2023-53089)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix WARNING in ext4_update_inline_data (CVE-2023-53100)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: zero i_disksize when initializing the bootloader inode (CVE-2023-53101)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tunnels: annotate lockless accesses to dev->needed_headroom (CVE-2023-53109)

    In the Linux kernel, the following vulnerability has been resolved:

    nvmet: avoid potential UAF in nvmet_req_complete() (CVE-2023-53116)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: prevent out-of-bounds array speculation when closing a file descriptor (CVE-2023-53117)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: tcp_make_synack() can be called from process context (CVE-2023-53121)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usb: smsc75xx: Limit packet length to skb->len (CVE-2023-53125)

    In the Linux kernel, the following vulnerability has been resolved:

    ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() (CVE-2023-53141)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix another off-by-one fsmap error on 1k block filesystems (CVE-2023-53143)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02262-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2022-49110: netfilter: conntrack: revisit gc autotuning (bsc#1237981).
    - CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
    - CVE-2022-49767: 9p/trans_fd: always use O_NONBLOCK read/write (bsc#1242493).
    - CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
    - CVE-2022-49858: octeontx2-pf: Fix SQE threshold checking (bsc#1242589).
    - CVE-2023-53058: net/mlx5: E-Switch, Fix an Oops in error handling code (bsc#1242237).
    - CVE-2023-53060: igb: revert rtnl_lock() that causes deadlock (bsc#1242241).
    - CVE-2023-53064: iavf: Fix hang on reboot with ice (bsc#1242222).
    - CVE-2023-53066: qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info (bsc#1242227).
    - CVE-2023-53079: net/mlx5: Fix steering rules cleanup (bsc#1242765).
    - CVE-2023-53114: i40e: Fix kernel crash during reboot when adapter is in recovery mode (bsc#1242398).
    - CVE-2023-53134: bnxt_en: Avoid order-5 memory allocation for TPA data (bsc#1242380)
    - CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
    - CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
    - CVE-2025-21888: RDMA/mlx5: Fix a WARN during dereg_mr for DM type (bsc#1240177).
    - CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
    - CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
    - CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
    - CVE-2025-23138: watch_queue: fix pipe accounting mismatch (bsc#1241648).
    - CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
    - CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).
    - CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1765463110 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: KVM: Reject attempts to consume or     refresh inactive gfn_to_pfn_cache Reject kvm_gpc_check() and kvm_gpc_refresh() if the cache is inactive.
    Not checking the active flag during refresh is particularly egregious, as KVM can end up with a valid,     inactive cache, which can lead to a variety of use-after-free bugs, e.g. consuming a NULL kernel pointer     or missing an mmu_notifier invalidation due to the cache not being on the list of gfns to invalidate.
    Note, active needs to be set if and only if the cache is on the list of caches, i.e. is reachable via     mmu_notifier events. If a relevant mmu_notifier event occurs while the cache is active but not on the     list, KVM will not acquire the cache's lock and so will not serailize the mmu_notifier event with active     users and/or kvm_gpc_refresh(). A race between KVM_XEN_ATTR_TYPE_SHARED_INFO and KVM_XEN_HVM_EVTCHN_SEND     can be exploited to trigger the bug. 1. Deactivate shinfo cache: kvm_xen_hvm_set_attr case     KVM_XEN_ATTR_TYPE_SHARED_INFO kvm_gpc_deactivate kvm_gpc_unmap gpc->valid = false gpc->khva = NULL     gpc->active = false Result: active = false, valid = false 2. Cause cache refresh: kvm_arch_vm_ioctl case     KVM_XEN_HVM_EVTCHN_SEND kvm_xen_hvm_evtchn_send kvm_xen_set_evtchn kvm_xen_set_evtchn_fast kvm_gpc_check     return -EWOULDBLOCK because !gpc->valid kvm_xen_set_evtchn_fast return -EWOULDBLOCK kvm_gpc_refresh     hva_to_pfn_retry gpc->valid = true gpc->khva = not NULL Result: active = false, valid = true 3. Race ioctl     KVM_XEN_HVM_EVTCHN_SEND against ioctl KVM_XEN_ATTR_TYPE_SHARED_INFO: kvm_arch_vm_ioctl case     KVM_XEN_HVM_EVTCHN_SEND kvm_xen_hvm_evtchn_send kvm_xen_set_evtchn kvm_xen_set_evtchn_fast read_lock     gpc->lock kvm_xen_hvm_set_attr case KVM_XEN_ATTR_TYPE_SHARED_INFO mutex_lock kvm->lock     kvm_xen_shared_info_init kvm_gpc_activate gpc->khva = NULL kvm_gpc_check [ Check passes because gpc->valid     is still true, even though gpc->khva is already NULL. ] shinfo = gpc->khva pending_bits =     shinfo->evtchn_pending CRASH: test_and_set_bit(..., pending_bits) (CVE-2022-49882)

  - In the Linux kernel, the following vulnerability has been resolved: coresight: Clear the connection field     properly coresight devices track their connections (output connections) and hold a reference to the     fwnode. When a device goes away, we walk through the devices on the coresight bus and make sure that the     references are dropped. This happens both ways: a) For all output connections from the device, drop the     reference to the target device via coresight_release_platform_data() b) Iterate over all the devices on     the coresight bus and drop the reference to fwnode if *this* device is the target of the output     connection, via coresight_remove_conns()->coresight_remove_match(). However, the coresight_remove_match()     doesn't clear the fwnode field, after dropping the reference, this causes use-after-free and additional     refcount drops on the fwnode. e.g., if we have two devices, A and B, with a connection, A -> B. If we     remove B first, B would clear the reference on B, from A via coresight_remove_match(). But when A is     removed, it still has a connection with fwnode still pointing to B. Thus it tries to drops the reference     in coresight_release_platform_data(), raising the bells like : [ 91.990153] ------------[ cut here     ]------------ [ 91.990163] refcount_t: addition on 0; use-after-free. [ 91.990212] WARNING: CPU: 0 PID:
    461 at lib/refcount.c:25 refcount_warn_saturate+0xa0/0x144 [ 91.990260] Modules linked in:
    coresight_funnel coresight_replicator coresight_etm4x(-) crct10dif_ce coresight ip_tables x_tables ipv6     [last unloaded: coresight_cpu_debug] [ 91.990398] CPU: 0 PID: 461 Comm: rmmod Tainted: G W T 5.19.0-rc2+     #53 [ 91.990418] Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS     EDK II Feb 1 2019 [ 91.990434] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [     91.990454] pc : refcount_warn_saturate+0xa0/0x144 [ 91.990476] lr : refcount_warn_saturate+0xa0/0x144 [     91.990496] sp : ffff80000c843640 [ 91.990509] x29: ffff80000c843640 x28: ffff800009957c28 x27:
    ffff80000c8439a8 [ 91.990560] x26: ffff00097eff1990 x25: ffff8000092b6ad8 x24: ffff00097eff19a8 [     91.990610] x23: ffff80000c8439a8 x22: 0000000000000000 x21: ffff80000c8439c2 [ 91.990659] x20:
    0000000000000000 x19: ffff00097eff1a10 x18: ffff80000ab99c40 [ 91.990708] x17: 0000000000000000 x16:
    0000000000000000 x15: ffff80000abf6fa0 [ 91.990756] x14: 000000000000001d x13: 0a2e656572662d72 x12:
    657466612d657375 [ 91.990805] x11: 203b30206e6f206e x10: 6f69746964646120 x9 : ffff8000081aba28 [     91.990854] x8 : 206e6f206e6f6974 x7 : 69646461203a745f x6 : 746e756f63666572 [ 91.990903] x5 :
    ffff00097648ec58 x4 : 0000000000000000 x3 : 0000000000000027 [ 91.990952] x2 : 0000000000000000 x1 :
    0000000000000000 x0 : ffff00080260ba00 [ 91.991000] Call trace: [ 91.991012]     refcount_warn_saturate+0xa0/0x144 [ 91.991034] kobject_get+0xac/0xb0 [ 91.991055] of_node_get+0x2c/0x40 [     91.991076] of_fwnode_get+0x40/0x60 [ 91.991094] fwnode_handle_get+0x3c/0x60 [ 91.991116]     fwnode_get_nth_parent+0xf4/0x110 [ 91.991137] fwnode_full_name_string+0x48/0xc0 [ 91.991158]     device_node_string+0x41c/0x530 [ 91.991178] pointer+0x320/0x3ec [ 91.991198] vsnprintf+0x23c/0x750 [     91.991217] vprintk_store+0x104/0x4b0 [ 91.991238] vprintk_emit+0x8c/0x360 [ 91.991257]     vprintk_default+0x44/0x50 [ 91.991276] vprintk+0xcc/0xf0 [ 91.991295] _printk+0x68/0x90 [ 91.991315]     of_node_release+0x13c/0x14c [ 91.991334] kobject_put+0x98/0x114 [ 91.991354] of_node_put+0x24/0x34 [     91.991372] of_fwnode_put+0x40/0x5c [ 91.991390] fwnode_handle_put+0x38/0x50 [ 91.991411]     coresight_release_platform_data+0x74/0xb0 [coresight] [ 91.991472] coresight_unregister+0x64/0xcc     [coresight] [ 91.991525] etm4_remove_dev+0x64/0x78 [coresight_etm4x] [ 91.991563]     etm4_remove_amba+0x1c/0x2c [coresight_etm4x] [ 91.991598] amba_remove+0x3c/0x19c ---truncated---     (CVE-2022-50214)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential stack-     out-of-bounds in brcmf_c_preinit_dcmds() This patch fixes a stack-out-of-bounds read in brcmfmac that     occurs when 'buf' that is not null-terminated is passed as an argument of strsep() in     brcmf_c_preinit_dcmds(). This buffer is filled with a firmware version string by memcpy() in     brcmf_fil_iovar_data_get(). The patch ensures buf is null-terminated. Found by a modified version of     syzkaller. [ 47.569679][ T1897] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43236b for chip     BCM43236/3 [ 47.582839][ T1897] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device     may have limited channels available [ 47.601565][ T1897]     ================================================================== [ 47.602574][ T1897] BUG: KASAN: stack-     out-of-bounds in strsep+0x1b2/0x1f0 [ 47.603447][ T1897] Read of size 1 at addr ffffc90001f6f000 by task     kworker/0:2/1897 [ 47.604336][ T1897] [ 47.604621][ T1897] CPU: 0 PID: 1897 Comm: kworker/0:2 Tainted: G O     5.14.0+ #131 [ 47.605617][ T1897] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS     rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 47.606907][ T1897] Workqueue: usb_hub_wq     hub_event [ 47.607453][ T1897] Call Trace: [ 47.607801][ T1897] dump_stack_lvl+0x8e/0xd1 [ 47.608295][     T1897] print_address_description.constprop.0.cold+0xf/0x334 [ 47.609009][ T1897] ? strsep+0x1b2/0x1f0 [     47.609434][ T1897] ? strsep+0x1b2/0x1f0 [ 47.609863][ T1897] kasan_report.cold+0x83/0xdf [ 47.610366][     T1897] ? strsep+0x1b2/0x1f0 [ 47.610882][ T1897] strsep+0x1b2/0x1f0 [ 47.611300][ T1897] ?     brcmf_fil_iovar_data_get+0x3a/0xf0 [ 47.611883][ T1897] brcmf_c_preinit_dcmds+0x995/0xc40 [ 47.612434][     T1897] ? brcmf_c_set_joinpref_default+0x100/0x100 [ 47.613078][ T1897] ?     rcu_read_lock_sched_held+0xa1/0xd0 [ 47.613662][ T1897] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 47.614208][     T1897] ? lock_acquire+0x19d/0x4e0 [ 47.614704][ T1897] ? find_held_lock+0x2d/0x110 [ 47.615236][ T1897] ?     brcmf_usb_deq+0x1a7/0x260 [ 47.615741][ T1897] ? brcmf_usb_rx_fill_all+0x5a/0xf0 [ 47.616288][ T1897]     brcmf_attach+0x246/0xd40 [ 47.616758][ T1897] ? wiphy_new_nm+0x1703/0x1dd0 [ 47.617280][ T1897] ?     kmemdup+0x43/0x50 [ 47.617720][ T1897] brcmf_usb_probe+0x12de/0x1690 [ 47.618244][ T1897] ?     brcmf_usbdev_qinit.constprop.0+0x470/0x470 [ 47.618901][ T1897] usb_probe_interface+0x2aa/0x760 [     47.619429][ T1897] ? usb_probe_device+0x250/0x250 [ 47.619950][ T1897] really_probe+0x205/0xb70 [     47.620435][ T1897] ? driver_allows_async_probing+0x130/0x130 [ 47.621048][ T1897]
    __driver_probe_device+0x311/0x4b0 [ 47.621595][ T1897] ? driver_allows_async_probing+0x130/0x130 [     47.622209][ T1897] driver_probe_device+0x4e/0x150 [ 47.622739][ T1897] __device_attach_driver+0x1cc/0x2a0     [ 47.623287][ T1897] bus_for_each_drv+0x156/0x1d0 [ 47.623796][ T1897] ? bus_rescan_devices+0x30/0x30 [     47.624309][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 47.624907][ T1897] ?     trace_hardirqs_on+0x46/0x160 [ 47.625437][ T1897] __device_attach+0x23f/0x3a0 [ 47.625924][ T1897] ?     device_bind_driver+0xd0/0xd0 [ 47.626433][ T1897] ? kobject_uevent_env+0x287/0x14b0 [ 47.627057][ T1897]     bus_probe_device+0x1da/0x290 [ 47.627557][ T1897] device_add+0xb7b/0x1eb0 [ 47.628027][ T1897] ?     wait_for_completion+0x290/0x290 [ 47.628593][ T1897] ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0 [     47.629249][ T1897] usb_set_configuration+0xf59/0x16f0 [ 47.629829][ T1897]     usb_generic_driver_probe+0x82/0xa0 [ 47.630385][ T1897] usb_probe_device+0xbb/0x250 [ 47.630927][ T1897] ?     usb_suspend+0x590/0x590 [ 47.631397][ T1897] really_probe+0x205/0xb70 [ 47.631855][ T1897] ?     driver_allows_async_probing+0x130/0x130 [ 47.632469][ T1897] __driver_probe_device+0x311/0x4b0 [     47.633002][ ---truncated--- (CVE-2022-50258)

  - In the Linux kernel, the following vulnerability has been resolved: netlink: prevent potential spectre v1     gadgets Most netlink attributes are parsed and validated from __nla_validate_parse() or validate_nla() u16     type = nla_type(nla); if (type == 0 || type > maxtype) { /* error or continue */ } @type is then used as     an array index and can be used as a Spectre v1 gadget. array_index_nospec() can be used to prevent leaking     content of kernel memory to malicious users. This should take care of vast majority of netlink uses, but     an audit is needed to take care of others where validation is not yet centralized in core netlink     functions. (CVE-2023-53000)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Bad drive in topology     results kernel crash When the SAS Transport Layer support is enabled and a device exposed to the OS by the     driver fails INQUIRY commands, the driver frees up the memory allocated for an internal HBA port data     structure. However, in some places, the reference to the freed memory is not cleared. When the firmware     sends the Device Info change event for the same device again, the freed memory is accessed and that leads     to memory corruption and OS crash. (CVE-2023-53037)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.176-157.645. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-059 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: block range must be validated before use in ext4_mb_clear_bb() (CVE-2022-50021)

    In the Linux kernel, the following vulnerability has been resolved:

    block, bfq: fix possible uaf for 'bfqq->bic' (CVE-2022-50488)

    In the Linux kernel, the following vulnerability has been resolved:

    seccomp: Move copy_seccomp() to no failure path. (CVE-2022-50661)

    An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64     lacks consistency checks for CR0 and CR4. (CVE-2023-30456)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix invalid address access in lookup_rec() when index is 0 (CVE-2023-53075)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/shmem-helper: Remove another errant put in error path (CVE-2023-53084)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/active: Fix misuse of non-idle barriers as fence trackers (CVE-2023-53087)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix task hung in ext4_xattr_delete_inode (CVE-2023-53089)

    In the Linux kernel, the following vulnerability has been resolved:

    interconnect: fix mem leak when freeing nodes (CVE-2023-53096)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix WARNING in ext4_update_inline_data (CVE-2023-53100)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: zero i_disksize when initializing the bootloader inode (CVE-2023-53101)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tunnels: annotate lockless accesses to dev->needed_headroom (CVE-2023-53109)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: Fix kernel crash during reboot when adapter is in recovery mode (CVE-2023-53114)

    In the Linux kernel, the following vulnerability has been resolved:

    nvmet: avoid potential UAF in nvmet_req_complete() (CVE-2023-53116)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: prevent out-of-bounds array speculation when closing a file descriptor (CVE-2023-53117)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: tcp_make_synack() can be called from process context (CVE-2023-53121)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() (CVE-2023-53124)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usb: smsc75xx: Limit packet length to skb->len (CVE-2023-53125)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Fix a server shutdown leak (CVE-2023-53131)

    In the Linux kernel, the following vulnerability has been resolved:

    bnxt_en: Avoid order-5 memory allocation for TPA data (CVE-2023-53134)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: Fix possible corruption when moving a directory (CVE-2023-53137)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Remove the /proc/scsi/${proc_name} directory earlier (CVE-2023-53140)

    In the Linux kernel, the following vulnerability has been resolved:

    ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() (CVE-2023-53141)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix another off-by-one fsmap error on 1k block filesystems (CVE-2023-53143)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: efi: Make efi_rt_lock a raw_spinlock (CVE-2023-53216)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: VMX: Fix crash due to uninitialized current_vmcs (CVE-2023-53756)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter (CVE-2023-54057)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01983-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-47670: can: peak_usb: fix use after free bugs (bsc#1241407).
    - CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
    - CVE-2022-49145: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data (bsc#1238162).
    - CVE-2022-49168: btrfs: do not clean up repair bio if submit fails (bsc#1238109).
    - CVE-2022-49190: kernel/resource: fix kfree() of bootmem memory again (bsc#1238130).
    - CVE-2022-49212: mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init (bsc#1238331).
    - CVE-2022-49216: drm/tegra: Fix reference leak in tegra_dsi_ganged_probe (bsc#1238338).
    - CVE-2022-49235: ath9k_htc: fix uninit value bugs (bsc#1238333).
    - CVE-2022-49248: ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction (bsc#1238284).
    - CVE-2022-49253: media: usb: go7007: s2250-board: fix leak in probe() (bsc#1238420).
    - CVE-2022-49320: dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type (bsc#1238394).
    - CVE-2022-49326: rtl818x: Prevent using not initialized queues (bsc#1238646).
    - CVE-2022-49371: driver core: fix deadlock in __device_attach (bsc#1238546).
    - CVE-2022-49382: soc: rockchip: Fix refcount leak in rockchip_grf_init (bsc#1238306).
    - CVE-2022-49396: phy: qcom-qmp: fix reset-controller leak on probe errors (bsc#1238289).
    - CVE-2022-49420: net: annotate races around sk->sk_bound_dev_if (bsc#1238887).
    - CVE-2022-49441: tty: fix deadlock caused by calling printk() under tty_port->lock (bsc#1238263).
    - CVE-2022-49445: pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources()     (bsc#1238019).
    - CVE-2022-49460: PM / devfreq: rk3399_dmc: Disable edev on remove() (bsc#1238892).
    - CVE-2022-49467: drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() (bsc#1238815).
    - CVE-2022-49474: Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout (bsc#1238071).
    - CVE-2022-49491: drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() (bsc#1238539).
    - CVE-2022-49503: ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix     (bsc#1238868).
    - CVE-2022-49592: net: stmmac: fix dma queue left shift overflow issue (bsc#1238311).
    - CVE-2022-49625: sfc: fix kernel panic when creating VF (bsc#1238411).
    - CVE-2022-49635: drm/i915/selftests: fix subtraction overflow bug (bsc#1238806).
    - CVE-2022-49652: dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate (bsc#1238871).
    - CVE-2022-49715: irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions (bsc#1238818).
    - CVE-2022-49728: kABI workaround for changeing the variable length type to size_t (bsc#1239111).
    - CVE-2022-49729: nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred (bsc#1239060).
    - CVE-2022-49751: w1: fix WARNING after calling w1_process() (bsc#1240254).
    - CVE-2022-49761: btrfs: always report error in run_one_delayed_ref() (bsc#1240261).
    - CVE-2022-49772: ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (bsc#1242147).
    - CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
    - CVE-2022-49776: macvlan: enforce a consistent minimal mtu (bsc#1242248).
    - CVE-2022-49787: mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (bsc#1242352).
    - CVE-2022-49788: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (bsc#1242353).
    - CVE-2022-49813: net: ena: Fix error handling in ena_init() (bsc#1242497).
    - CVE-2022-49821: mISDN: fix possible memory leak in mISDN_dsp_element_register() (bsc#1242542).
    - CVE-2022-49826: ata: libata-transport: fix double ata_host_put() in ata_tport_add() (bsc#1242549).
    - CVE-2022-49829: drm/scheduler: fix fence ref counting (bsc#1242691).
    - CVE-2022-49832: pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (bsc#1242154).
    - CVE-2022-49835: ALSA: hda: fix potential memleak in 'add_widget_node' (bsc#1242385).
    - CVE-2022-49840: bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() (bsc#1242447).
    - CVE-2022-49842: ASoC: soc-utils: Remove __exit for snd_soc_util_exit() (bsc#1242484).
    - CVE-2022-49853: net: macvlan: fix memory leaks of macvlan_common_newlink (bsc#1242688).
    - CVE-2022-49861: dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove() (bsc#1242580).
    - CVE-2022-49862: tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header     (bsc#1242755).
    - CVE-2022-49865: ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network (bsc#1242570).
    - CVE-2022-49871: net: tun: call napi_schedule_prep() to ensure we own a napi (bsc#1242558).
    - CVE-2022-49872: net: gso: fix panic on frag_list with mixed head alloc types (bsc#1242594).
    - CVE-2022-49874: HID: hyperv: fix possible memory leak in mousevsc_probe() (bsc#1242478).
    - CVE-2022-49898: btrfs: fix tree mod log mishandling of reallocated nodes (bsc#1242472).
    - CVE-2022-49907: net: mdio: fix undefined behavior in bit shift for __mdiobus_register (bsc#1242450).
    - CVE-2022-49913: btrfs: fix inode list leak during backref walking at find_parent_nodes() (bsc#1242470).
    - CVE-2022-49914: btrfs: fix inode list leak during backref walking at resolve_indirect_refs()     (bsc#1242427).
    - CVE-2022-49922: nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send() (bsc#1242378).
    - CVE-2022-49923: nfc: nxp-nci: Fix potential memory leak in nxp_nci_send() (bsc#1242394).
    - CVE-2022-49924: nfc: fdp: Fix potential memory leak in fdp_nci_send() (bsc#1242426).
    - CVE-2022-49925: RDMA/core: Fix null-ptr-deref in ib_core_cleanup() (bsc#1242371).
    - CVE-2022-49931: IB/hfi1: Correctly move list in sc_disable() (bsc#1242382).
    - CVE-2023-52868: thermal: core: prevent potential string overflow (bsc#1225044).
    - CVE-2023-52975: scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress (bsc#1240322).
    - CVE-2023-52988: ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()     (bsc#1240293).
    - CVE-2023-52989: firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region     (bsc#1240266).
    - CVE-2023-52993: x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL (bsc#1240297).
    - CVE-2023-53039: HID: intel-ish-hid: ipc: Fix potential use-after-free in work function (bsc#1242745).
    - CVE-2023-53045: usb: gadget: u_audio: do not let userspace block driver unbind (bsc#1242756).
    - CVE-2023-53066: qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info (bsc#1242227).
    - CVE-2023-53079: net/mlx5: Fix steering rules cleanup (bsc#1242765).
    - CVE-2023-53080: xsk: Add missing overflow check in xdp_umem_reg (bsc#1242287).
    - CVE-2023-53094: tty: serial: fsl_lpuart: fix race on RX DMA shutdown (bsc#1242288).
    - CVE-2023-53103: bonding: Fix memory leak when changing bond type to Ethernet (bsc#1242408).
    - CVE-2023-53114: i40e: Fix kernel crash during reboot when adapter is in recovery mode (bsc#1242398).
    - CVE-2023-53139: nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties     (bsc#1242361).
    - CVE-2024-26740: Fixed use the backlog for mirred ingress  (bsc#1222563).
    - CVE-2024-27010: net/sched: Fix mirred deadlock on device recursion (bsc#1223720).
    - CVE-2024-45021: memcg_write_event_control(): fix a user-triggerable oops (bsc#1230434).
    - CVE-2024-46751: btrfs: do not BUG_ON() when 0 reference count at btrfs_lookup_extent_info()     (bsc#1230786).
    - CVE-2024-46752: btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info() (bsc#1230794).
    - CVE-2024-50106: nfsd: fix race between laundromat and free_stateid() (bsc#1232882).
    - CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1234887).
    - CVE-2024-56779: nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur (bsc#1235632).
    - CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
    - CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
    - CVE-2025-21704: usb: cdc-acm: Check control transfer buffer size before access (bsc#1237571).
    - CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
    - CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
    - CVE-2025-22021: netfilter: socket: Lookup orig tuple for IPv6 SNAT (bsc#1241282).
    - CVE-2025-22027: media: streamzap: fix race between device disconnection and urb callback (bsc#1241369).
    - CVE-2025-22050: usbnet:fix NPE during rx_complete (bsc#1241441).
    - CVE-2025-22058: udp: Fix memory accounting leak (bsc#1241332).
    - CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
    - CVE-2025-22063: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (bsc#1241351).
    - CVE-2025-22104: ibmvnic: Use kernel helpers for hex dumps (bsc#1241550).
    - CVE-2025-23136: thermal: int340x: Add NULL check for adev (bsc#1241357).
    - CVE-2025-23150: ext4: fix off-by-one error in do_split (bsc#1242513).
    - CVE-2025-23161: PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (bsc#1242792).
    - CVE-2025-37749: net: ppp: Add bound checking for skb data on ppp_sync_txmung (bsc#1242859).
    - CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
    - CVE-2025-37780: isofs: Prevent the use of too small fid (bsc#1242786).
    - CVE-2025-37782: hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (bsc#1242770).
    - CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
    - CVE-2025-37794: wifi: mac80211: Purge vif txq in ieee80211_do_stop() (bsc#1242566).
    - CVE-2025-37796: wifi: at76c50x: fix use after free access in at76_disconnect (bsc#1242727).
    - CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
    - CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
    - CVE-2025-37833: net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (bsc#1242868).
    - CVE-2025-37852: drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create()     (bsc#1243074).
    - CVE-2025-37879: 9p/net: fix improper handling of bogus negative read/write replies (bsc#1243077).
    - CVE-2025-37949: xenbus: Use kref to track req lifetime (bsc#1243541).
    - CVE-2025-37989: net: phy: leds: fix memory leak (bsc#1243511).
    - CVE-2025-38637: net_sched: skbprio: Remove overly strict queue assertions (bsc#1241657).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
173854	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-148)	Nessus	Amazon Linux Local Security Checks	2023/4/4	2026/2/24	high
361173	CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1771078945)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	high
280161	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992359)	Nessus	Unity Linux Local Security Checks	2025/12/30	2025/12/30	high
249192	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-1993)	Nessus	Huawei Local Security Checks	2025/8/13	2025/9/25	high
249320	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-1979)	Nessus	Huawei Local Security Checks	2025/8/14	2025/9/25	high
265114	EulerOS Virtualization 2.13.1 : kernel (EulerOS-SA-2025-2168)	Nessus	Huawei Local Security Checks	2025/9/16	2025/9/16	high
241751	Amazon Linux 2 : kernel (ALAS-2025-2909)	Nessus	Amazon Linux Local Security Checks	2025/7/10	2026/2/24	high
241966	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2025:02262-1)	Nessus	SuSE Local Security Checks	2025/7/11	2026/6/25	high
352030	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1765463110)	Nessus	Alma Linux Local Security Checks	2026/9/30	2026/10/1	high
200362	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2024-059 (ALASKERNEL-5.10-2024-059)	Nessus	Amazon Linux Local Security Checks	2024/6/11	2026/2/9	high
240793	SUSE SLES12 Security Update : kernel (SUSE-SU-2025:01983-1)	Nessus	SuSE Local Security Checks	2025/6/27	2025/12/9	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high