The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993218 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: add NULL check in xfrm_update_ae_params

    Normally, x->replay_esn and x->preplay_esn should be allocated at     xfrm_alloc_replay_state_esn(...) in xfrm_state_construct(...), hence the     xfrm_update_ae_params(...) is okay to update them. However, the current     implementation of xfrm_new_ae(...) allows a malicious user to directly     dereference a NULL pointer and crash the kernel like below.

    BUG: kernel NULL pointer dereference, address: 0000000000000000     PGD 8253067 P4D 8253067 PUD 8e0e067 PMD 0     Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI     CPU: 0 PID: 98 Comm: poc.npd Not tainted 6.4.0-rc7-00072-gdad9774deaf1 #8     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.o4     RIP: 0010:memcpy_orig+0xad/0x140     Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c     RSP: 0018:ffff888008f57658 EFLAGS: 00000202     RAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571     RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000     RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000     R10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818     R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000     FS:  00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0     Call Trace:
     <TASK>      ? __die+0x1f/0x70      ? page_fault_oops+0x1e8/0x500      ? __pfx_is_prefetch.constprop.0+0x10/0x10      ? __pfx_page_fault_oops+0x10/0x10      ? _raw_spin_unlock_irqrestore+0x11/0x40      ? fixup_exception+0x36/0x460      ? _raw_spin_unlock_irqrestore+0x11/0x40      ? exc_page_fault+0x5e/0xc0      ? asm_exc_page_fault+0x26/0x30      ? xfrm_update_ae_params+0xd1/0x260      ? memcpy_orig+0xad/0x140      ? __pfx__raw_spin_lock_bh+0x10/0x10      xfrm_update_ae_params+0xe7/0x260      xfrm_new_ae+0x298/0x4e0      ? __pfx_xfrm_new_ae+0x10/0x10      ? __pfx_xfrm_new_ae+0x10/0x10      xfrm_user_rcv_msg+0x25a/0x410      ? __pfx_xfrm_user_rcv_msg+0x10/0x10      ? __alloc_skb+0xcf/0x210      ? stack_trace_save+0x90/0xd0      ? filter_irq_stacks+0x1c/0x70      ? __stack_depot_save+0x39/0x4e0      ? __kasan_slab_free+0x10a/0x190      ? kmem_cache_free+0x9c/0x340      ? netlink_recvmsg+0x23c/0x660      ? sock_recvmsg+0xeb/0xf0      ? __sys_recvfrom+0x13c/0x1f0      ? __x64_sys_recvfrom+0x71/0x90      ? do_syscall_64+0x3f/0x90      ? entry_SYSCALL_64_after_hwframe+0x72/0xdc      ? copyout+0x3e/0x50      netlink_rcv_skb+0xd6/0x210      ? __pfx_xfrm_user_rcv_msg+0x10/0x10      ? __pfx_netlink_rcv_skb+0x10/0x10      ? __pfx_sock_has_perm+0x10/0x10      ? mutex_lock+0x8d/0xe0      ? __pfx_mutex_lock+0x10/0x10      xfrm_netlink_rcv+0x44/0x50      netlink_unicast+0x36f/0x4c0      ? __pfx_netlink_unicast+0x10/0x10      ? netlink_recvmsg+0x500/0x660      netlink_sendmsg+0x3b7/0x700

    This Null-ptr-deref bug is assigned CVE-2023-3772. And this commit     adds additional NULL check in xfrm_update_ae_params to fix the NPD.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.128-80.144. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-026 advisory.

    Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2022-40982)

    A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss     of confidentiality. (CVE-2023-20588)

    The fix for XSA-423 added logic to Linux'es netback driver to deal witha frontend splitting a packet in a     way such that not all of the headerswould come in one piece.  Unfortunately the logic introduced     theredidn't account for the extreme case of the entire packet being splitinto as many pieces as permitted     by the protocol, yet still beingsmaller than the area that's specially dealt with to keep all     (possible)headers together.  Such an unusual packet would therefore trigger abuffer overrun in the driver.
    (CVE-2023-34319)

    A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)

    A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of     XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data     to userspace. (CVE-2023-3773)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the     chain's owner rule can also release the objects in certain circumstances.

    We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8. (CVE-2023-3777)

    A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing     of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local     privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an     information disclosure. (CVE-2023-39194)

    A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    On an error when building a nftables rule, deactivating immediate expressions in     nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used.

    We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2. (CVE-2023-4015)

    A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in     the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to     incorrect handling of the existing filter, leading to a kernel information leak issue. (CVE-2023-4128)

    netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID (CVE-2023-4147)

    A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to     bypass network filters and gain unauthorized access to some resources. The original patches fixing     CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits -     a096ccca6e50 (tun: tun_chr_open(): correctly initialize socket uid), - 66b2c338adce (tap: tap_open():
    correctly initialize socket uid), pass inode->i_uid to sock_init_data_uid() as the last parameter and     that turns out to not be accurate. (CVE-2023-4194)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to     achieve local privilege escalation.

    When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into     the new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8. (CVE-2023-4206)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation.

    When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the     new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec. (CVE-2023-4207)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation.

    When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the     new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81. (CVE-2023-4208)

    A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation     of the file name reconstruction function, which is responsible for reading file name entries from a     directory index and merging file name parts belonging to one file into a single long file name. Since the     file name characters are copied into a stack variable, a local privileged attacker could use this flaw to     overflow the kernel stack. (CVE-2023-4273)

    A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux     Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which     can result in a memory leak. (CVE-2023-4569)

    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.

    The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without     locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that     is being released by garbage collection, resulting in use-after-free.

    We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: add NULL check in xfrm_update_ae_params (CVE-2023-53147)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix uninitialized array access for some pathnames (CVE-2023-53165)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fix possible memory leak if device_add() fails (CVE-2023-53174)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: exit gracefully if reloc roots don't match (CVE-2023-53183)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: Fix nexthop hash size (CVE-2023-53192)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix warning in cifs_smb3_do_mount() (CVE-2023-53230)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (CVE-2023-53245)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Return the firmware result upon destroying QP/RQ (CVE-2023-53286)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/client: Fix memory leak in drm_client_modeset_probe (CVE-2023-53288)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: fix overlap expiration walk (CVE-2023-53304)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (CVE-2023-53311)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Enhance sanity check while generating attr_list (CVE-2023-53328)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix BUG_ON condition in btrfs_cancel_balance (CVE-2023-53339)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6mr: Fix skb_under_panic in ip6mr_cache_report() (CVE-2023-53365)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dcb: choose correct policy to parse DCB_ATTR_BCN (CVE-2023-53369)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (CVE-2023-53469)

    In the Linux kernel, the following vulnerability has been resolved:

    powerpc/rtas_flash: allow user copy to flash block cache objects (CVE-2023-53487)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix slab-use-after-free in decode_session6 (CVE-2023-53500)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-mmio: don't break lifecycle of vm_dev (CVE-2023-53515)

    In the Linux kernel, the following vulnerability has been resolved:

    ip_vti: fix potential slab-use-after-free in decode_session6 (CVE-2023-53559)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, cpumap: Make sure kthread is running before map update returns (CVE-2023-53577)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Release folio lock on fscache read hit. (CVE-2023-53593)

    In the Linux kernel, the following vulnerability has been resolved:

    tunnels: fix kasan splat when generating ipv4 pmtu error (CVE-2023-53600)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: reject invalid reloc tree root keys with stack dump (CVE-2023-53618)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, cpumap: Handle skb as well when clean up ptr_ring (CVE-2023-53660)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: fix refcount underflow in error path (CVE-2023-53698)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Do not swap cpu_buffer during resize process (CVE-2023-53718)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_vti: fix slab-use-after-free in decode_session6 (CVE-2023-53821)

    In the Linux kernel, the following vulnerability has been resolved:

    dccp: fix data-race around dp->dccps_mss_cache (CVE-2023-53839)

    In the Linux kernel, the following vulnerability has been resolved:

    usb-storage: alauda: Fix uninit-value in alauda_check_media() (CVE-2023-53847)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix warning when putting transaction with qgroups enabled after abort (CVE-2023-53865)

    In the Linux kernel, the following vulnerability has been resolved:

    net: do not allow gso_size to be set to GSO_BY_FRAGS (CVE-2023-54051)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/client: Fix memory leak in drm_client_target_cloned (CVE-2023-54091)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: Protect reconfiguration of sb read-write from racing writes (CVE-2023-54099)

    In the Linux kernel, the following vulnerability has been resolved:

    net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() (CVE-2023-54155)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: Fix linking a duplicate key to a keyring's assoc_array (CVE-2023-54170)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Disable preemption in bpf_event_output (CVE-2023-54173)

    In the Linux kernel, the following vulnerability has been resolved:

    quota: fix warning in dqgrab() (CVE-2023-54177)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree (CVE-2023-54194)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix warning in trace_buffered_event_disable() (CVE-2023-54211)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: Fix oops for port->pm on uart_change_pm() (CVE-2023-54220)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX. (CVE-2023-54251)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/ttm: Don't leak a resource on eviction error (CVE-2023-54254)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix potential oops in cifs_oplock_break (CVE-2023-54258)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: zoned: fix memory leak after finding block group with super blocks (CVE-2023-54297)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
281316	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993218)	Nessus	Unity Linux Local Security Checks	2025/12/31	2025/12/31	medium
180566	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-039 (ALASKERNEL-5.10-2023-039)	Nessus	Amazon Linux Local Security Checks	2023/9/6	2026/2/11	high
297598	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1212)	Nessus	Huawei Local Security Checks	2026/2/2	2026/2/4	high
180567	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-026 (ALASKERNEL-5.15-2023-026)	Nessus	Amazon Linux Local Security Checks	2023/9/6	2026/2/11	high

检测

插件搜索

medium

high

high

high