The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03600-1 advisory.

    The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
    - CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
    - CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
    - CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
    - CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
    - CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
    - CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
    - CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
    - CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
    - CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
    - CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in     rproc_attach() (bsc#1247136).
    - CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
    - CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
    - CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
    - CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
    - CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
    - CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
    - CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
    - CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
    - CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
    - CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
    - CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
    - CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
    - CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port     (bsc#1248378).
    - CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
    - CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
    - CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
    - CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
    - CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
    - CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
    - CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
    - CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
    - CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data     (bsc#1248647).
    - CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
    - CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
    - CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
    - CVE-2025-38705: drm/amd/pm: fix null pointer access (bsc#1249334).
    - CVE-2025-38709: loop: Avoid updating block size under exclusive owner (bsc#1249199).
    - CVE-2025-38721: netfilter: ctnetlink: fix refcount leak on table dump (bsc#1249176).
    - CVE-2025-38722: habanalabs: fix UAF in export_dmabuf() (bsc#1249163).
    - CVE-2025-38730: io_uring/net: commit partial buffers on retry (bsc#1249172).
    - CVE-2025-38732: netfilter: nf_reject: do not leak dst refcount for loopback packets (bsc#1249262).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
    - CVE-2025-39677: net/sched: Fix backlog accounting in qdisc_dequeue_internal (bsc#1249300).
    - CVE-2025-39678: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL (bsc#1249290).
    - CVE-2025-39681: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (bsc#1249303).
    - CVE-2025-39682: tls: fix handling of zero-length records on the rx_list (bsc#1249284).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39705: drm/amd/display: fix a Null pointer dereference vulnerability (bsc#1249295).
    - CVE-2025-39718: vsock/virtio: Validate length in packet header before skb_put() (bsc#1249305).
    - CVE-2025-39738: btrfs: do not allow relocation of partially dropped subvolumes (bsc#1249540).
    - CVE-2025-39744: rcu: Fix rcu_read_unlock() deadloop due to IRQ work (bsc#1249494).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39749: rcu: Protect ->defer_qs_iw_pending from data race (bsc#1249533).
    - CVE-2025-39754: mm/smaps: fix race between smaps_hugetlb_range and migration (bsc#1249524).
    - CVE-2025-39764: netfilter: ctnetlink: remove refcounting in expectation dumpers (bsc#1249513).
    - CVE-2025-39766: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (bsc#1249510).
    - CVE-2025-39770: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (bsc#1249508).
    - CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
    - CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
    - CVE-2025-39787: soc: qcom: mdt_loader: Deal with zero e_shentsize (bsc#1249545).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39825: smb: client: fix race with concurrent opens in rename(2) (bsc#1250179).
    - CVE-2025-39832: net/mlx5: Fix lockdep assertion on sync reset unload event (bsc#1249901).
    - CVE-2025-39835: xfs: do not propagate ENODATA disk errors into xattr code (bsc#1250025).
    - CVE-2025-39838: cifs: prevent NULL pointer dereference in UTF16 conversion (bsc#1250365).
    - CVE-2025-39842: ocfs2: prevent release journal inode after journal shutdown (bsc#1250267).
    - CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
    - CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
    - CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
    - CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
    - CVE-2025-39857: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (bsc#1250251).
    - CVE-2025-39865: tee: fix NULL pointer dereference in tee_shm_put (bsc#1250294).
    - CVE-2025-39885: ocfs2: fix recursive semaphore deadlock in fiemap call (bsc#1250407).
    - CVE-2025-40300: x86/vmscape: Warn when STIBP is disabled with SMT (bsc#1247483).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03628-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
    - CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
    - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
    - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
    - CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
    - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
    - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
    - CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
    - CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
    - CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245498).
    - CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
    - CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
    - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
    - CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
    - CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime     (bsc#1247288).
    - CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree     (bsc#1248255).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
    - CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
    - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
    - CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
    - CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
    - CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005596 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix uninitialized array access for some pathnames

    For filenames that begin with . and are between 2 and 5 characters long,     UDF charset conversion code would read uninitialized memory in the     output buffer. The only practical impact is that the name may be prepended a     unification hash when it is not actually needed but still it is good     to fix this.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()(CVE-2023-53521)

    binfmt_misc: fix shift-out-of-bounds in check_special_flags(CVE-2022-50497)

    scsi: lpfc: Fix buffer free/clear order in deferred receive path(CVE-2025-39841)

    mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory(CVE-2025-39883)

    md: Replace snprintf with scnprintf(CVE-2022-50299)

    drivers: serial: jsm: fix some leaks in probe(CVE-2022-50312)

    udf: Do not bother merging very long extents(CVE-2023-53506)

    fbdev: fix potential buffer overflow in do_register_framebuffer()(CVE-2025-38702)

    mm/slub: avoid accessing metadata when pointer is invalid in object_err()(CVE-2025-39902)

    xhci: Remove device endpoints from bandwidth list when freeing the device(CVE-2022-50470)

    HID: multitouch: Correct devm device reference for hidinput input_dev name(CVE-2023-53454)

    ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed(CVE-2023-53481)

    thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash(CVE-2022-50494)

    md: fix a crash in mempool_free(CVE-2022-50381)

    scsi: ses: Fix possible desc_ptr out-of-bounds accesses(CVE-2023-53675)

    scsi: target: target_core_configfs: Add length check to avoid buffer overflow(CVE-2025-39998)

    fs: dlm: fix invalid derefence of sb_lvbptr(CVE-2022-50516)

    NFS: Fix a race when updating an existing write(CVE-2025-39697)

    mmc: vub300: fix return value check of mmc_add_host()(CVE-2022-50251)

    tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak(CVE-2022-50389)

    scsi: qla4xxx: Add length check when parsing nlattrs(CVE-2023-53456)

    ext4: avoid deadlock in fs reclaim with page writeback(CVE-2023-53149)

    kobject: Add sanity check for kset-kobj.ktype in kset_register()(CVE-2023-53480)

    scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()(CVE-2023-53676)

    udf: Fix uninitialized array access for some pathnames(CVE-2023-53165)

    ext4: avoid crash when inline data creation follows DIO write(CVE-2022-50435)

    cifs: Fix warning and UAF when destroy the MR list(CVE-2023-53427)

    scsi: qla2xxx: Pointer may be dereferenced(CVE-2023-53150)

    fs: writeback: fix use-after-free in __mark_inode_dirty()(CVE-2025-39866)

    blk-mq: use quiesced elevator switch when reinitializing queues(CVE-2022-50552)

    mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()(CVE-2023-53623)

    ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS(CVE-2022-50315)

    pnode: terminate at peers of source(CVE-2022-50280)

    tracing: Fix race issue between cpu buffer write and swap(CVE-2023-53368)

    igb: Fix igb_down hung on surprise removal(CVE-2023-53148)

    udf: Do not update file length for failed writes to inline files(CVE-2023-53295)

    usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()(CVE-2022-50544)

    cacheinfo: Fix shared_cpu_map to handle shared caches at different levels(CVE-2023-53254)

    net/tunnel: wait until all sk_user_data reader finish before releasing the sock(CVE-2022-50405)

    mtd: Fix device name leak when register device failed in add_mtd_device()(CVE-2022-50566)

    ext4: add bounds checking in get_max_inline_xattr_value_size()(CVE-2023-53285)

    drm/mipi-dsi: Detach devices when removing the host(CVE-2022-50489)

    ipv6: Fix out-of-bounds access in ipv6_find_tlv()(CVE-2023-53705)

    md/raid10: check slab-out-of-bounds in md_bitmap_get_counter(CVE-2023-53357)

    scsi: qla2xxx: Wait for io return on terminate rport(CVE-2023-53322)

    PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free(CVE-2023-53446)

    sctp: check send stream number after wait_for_sndbuf(CVE-2023-53296)

    rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails(CVE-2023-53307)

    md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request(CVE-2023-53380)

    ubi: ensure that VID header offset + VID header size = alloc, size(CVE-2023-53265)

    icmp6: Fix null-ptr-deref of ip6_null_entry-rt6i_idev in icmp6_dev().(CVE-2023-53343)

    calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().(CVE-2025-38181)

    ftrace: Also allocate and copy hash for reading of filter files(CVE-2025-39689)

    firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region(CVE-2023-52989)

    sched/fair: Don't balance task to its current running CPU(CVE-2023-53215)

    dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path(CVE-2023-53604)

    qede: confirm skb is allocated before using(CVE-2022-49084)

    sctp: linearize cloned gso packets in sctp_rcv(CVE-2025-38718)

    af_unix: Fix data-races around user-unix_inflight.(CVE-2023-53204)

    scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue(CVE-2023-53280)

    md/raid10: fix leak of 'r10bio-remaining' for recovery(CVE-2023-53299)

    recordmcount: Fix memory leaks in the uwrite function(CVE-2023-53318)

    cifs: fix oops during encryption(CVE-2022-50341)

    nfsd: call op_release, even when op_func returns an error(CVE-2023-53241)

    uio_hv_generic: Let userspace take care of interrupt mask(CVE-2025-40048)

    posix-timers: Ensure timer ID search-loop limit is valid(CVE-2023-53728)

    tipc: fix a null-ptr-deref in tipc_topsrv_accept(CVE-2022-50555)

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer(CVE-2023-53395)

    x86/MCE: Always save CS register on AMD Zen IF Poison errors(CVE-2023-53438)

    xfrm: fix slab-use-after-free in decode_session6(CVE-2023-53500)

    posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()(CVE-2025-38352)

    i40e: add validation for ring_len param(CVE-2025-39973)

    firewire: net: fix use after free in fwnet_finish_incoming_packet()(CVE-2023-53432)

    NFSD: Protect against send buffer overflow in NFSv2 READ(CVE-2022-50410)

    drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()(CVE-2022-50402)

    net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode(CVE-2023-53733)

    crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg(CVE-2025-39964)

    udf: Detect system inodes linked into directory hierarchy(CVE-2023-53695)

    skbuff: Account for tail adjustment during pull operations(CVE-2022-50365)

    mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING(CVE-2022-50430)

    skbuff: skb_segment, Call zero copy functions before using skbuff frags(CVE-2023-53354)

    tracing/histograms: Add histograms to hist_vars if they have referenced variables(CVE-2023-53560)

    net: fix skb leak in __skb_tstamp_tx()(CVE-2023-53716)

    media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()(CVE-2023-53220)

    serial: arc_uart: fix of_iomap leak in `arc_serial_probe`(CVE-2023-53719)

    fs: udf: fix OOB read in lengthAllocDescs handling(CVE-2025-40044)

    ipvs: Defer ip_vs_ftp unregister during netns cleanup(CVE-2025-40018)

    scsi: target: iscsi: Fix a race condition between login_work and the login thread(CVE-2022-50350)

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare(CVE-2025-39817)

    igb: Do not free q_vector unless new one was allocated(CVE-2022-50252)

    iommu/vt-d: Clean up si_domain in the init_dmars() error path(CVE-2022-50482)

    VMCI: check context-notify_page after call to get_user_pages_fast() to avoid GPF(CVE-2023-53259)

    ext4: fix WARNING in mb_find_extent(CVE-2023-53317)

    ip_vti: fix potential slab-use-after-free in decode_session6(CVE-2023-53559)

    netfilter: conntrack: Avoid nf_ct_helper_hash uses after free(CVE-2023-53619)

    Input: MT - limit max slots(CVE-2024-45008)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.128-80.144. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-026 advisory.

    Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2022-40982)

    A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss     of confidentiality. (CVE-2023-20588)

    The fix for XSA-423 added logic to Linux'es netback driver to deal witha frontend splitting a packet in a     way such that not all of the headerswould come in one piece.  Unfortunately the logic introduced     theredidn't account for the extreme case of the entire packet being splitinto as many pieces as permitted     by the protocol, yet still beingsmaller than the area that's specially dealt with to keep all     (possible)headers together.  Such an unusual packet would therefore trigger abuffer overrun in the driver.
    (CVE-2023-34319)

    A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)

    A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of     XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data     to userspace. (CVE-2023-3773)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the     chain's owner rule can also release the objects in certain circumstances.

    We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8. (CVE-2023-3777)

    A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing     of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local     privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an     information disclosure. (CVE-2023-39194)

    A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    On an error when building a nftables rule, deactivating immediate expressions in     nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used.

    We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2. (CVE-2023-4015)

    A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in     the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to     incorrect handling of the existing filter, leading to a kernel information leak issue. (CVE-2023-4128)

    netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID (CVE-2023-4147)

    A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to     bypass network filters and gain unauthorized access to some resources. The original patches fixing     CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits -     a096ccca6e50 (tun: tun_chr_open(): correctly initialize socket uid), - 66b2c338adce (tap: tap_open():
    correctly initialize socket uid), pass inode->i_uid to sock_init_data_uid() as the last parameter and     that turns out to not be accurate. (CVE-2023-4194)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to     achieve local privilege escalation.

    When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into     the new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8. (CVE-2023-4206)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation.

    When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the     new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec. (CVE-2023-4207)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation.

    When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the     new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81. (CVE-2023-4208)

    A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation     of the file name reconstruction function, which is responsible for reading file name entries from a     directory index and merging file name parts belonging to one file into a single long file name. Since the     file name characters are copied into a stack variable, a local privileged attacker could use this flaw to     overflow the kernel stack. (CVE-2023-4273)

    A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux     Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which     can result in a memory leak. (CVE-2023-4569)

    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.

    The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without     locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that     is being released by garbage collection, resulting in use-after-free.

    We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: add NULL check in xfrm_update_ae_params (CVE-2023-53147)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix uninitialized array access for some pathnames (CVE-2023-53165)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fix possible memory leak if device_add() fails (CVE-2023-53174)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: exit gracefully if reloc roots don't match (CVE-2023-53183)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: Fix nexthop hash size (CVE-2023-53192)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix warning in cifs_smb3_do_mount() (CVE-2023-53230)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (CVE-2023-53245)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Return the firmware result upon destroying QP/RQ (CVE-2023-53286)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/client: Fix memory leak in drm_client_modeset_probe (CVE-2023-53288)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: fix overlap expiration walk (CVE-2023-53304)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (CVE-2023-53311)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Enhance sanity check while generating attr_list (CVE-2023-53328)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix BUG_ON condition in btrfs_cancel_balance (CVE-2023-53339)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6mr: Fix skb_under_panic in ip6mr_cache_report() (CVE-2023-53365)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dcb: choose correct policy to parse DCB_ATTR_BCN (CVE-2023-53369)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (CVE-2023-53469)

    In the Linux kernel, the following vulnerability has been resolved:

    powerpc/rtas_flash: allow user copy to flash block cache objects (CVE-2023-53487)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix slab-use-after-free in decode_session6 (CVE-2023-53500)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-mmio: don't break lifecycle of vm_dev (CVE-2023-53515)

    In the Linux kernel, the following vulnerability has been resolved:

    ip_vti: fix potential slab-use-after-free in decode_session6 (CVE-2023-53559)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, cpumap: Make sure kthread is running before map update returns (CVE-2023-53577)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Release folio lock on fscache read hit. (CVE-2023-53593)

    In the Linux kernel, the following vulnerability has been resolved:

    tunnels: fix kasan splat when generating ipv4 pmtu error (CVE-2023-53600)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: reject invalid reloc tree root keys with stack dump (CVE-2023-53618)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, cpumap: Handle skb as well when clean up ptr_ring (CVE-2023-53660)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: fix refcount underflow in error path (CVE-2023-53698)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Do not swap cpu_buffer during resize process (CVE-2023-53718)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_vti: fix slab-use-after-free in decode_session6 (CVE-2023-53821)

    In the Linux kernel, the following vulnerability has been resolved:

    dccp: fix data-race around dp->dccps_mss_cache (CVE-2023-53839)

    In the Linux kernel, the following vulnerability has been resolved:

    usb-storage: alauda: Fix uninit-value in alauda_check_media() (CVE-2023-53847)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix warning when putting transaction with qgroups enabled after abort (CVE-2023-53865)

    In the Linux kernel, the following vulnerability has been resolved:

    net: do not allow gso_size to be set to GSO_BY_FRAGS (CVE-2023-54051)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/client: Fix memory leak in drm_client_target_cloned (CVE-2023-54091)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: Protect reconfiguration of sb read-write from racing writes (CVE-2023-54099)

    In the Linux kernel, the following vulnerability has been resolved:

    net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() (CVE-2023-54155)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: Fix linking a duplicate key to a keyring's assoc_array (CVE-2023-54170)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Disable preemption in bpf_event_output (CVE-2023-54173)

    In the Linux kernel, the following vulnerability has been resolved:

    quota: fix warning in dqgrab() (CVE-2023-54177)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree (CVE-2023-54194)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix warning in trace_buffered_event_disable() (CVE-2023-54211)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: Fix oops for port->pm on uart_change_pm() (CVE-2023-54220)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX. (CVE-2023-54251)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/ttm: Don't leak a resource on eviction error (CVE-2023-54254)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix potential oops in cifs_oplock_break (CVE-2023-54258)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: zoned: fix memory leak after finding block group with super blocks (CVE-2023-54297)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
278702	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:03600-1)	Nessus	SuSE Local Security Checks	2025/12/15	2026/1/6	high
270857	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:03628-1)	Nessus	SuSE Local Security Checks	2025/10/21	2025/10/21	high
300344	Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005596)	Nessus	Unity Linux Local Security Checks	2026/3/3	2026/3/3	medium
284758	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2026-1029)	Nessus	Huawei Local Security Checks	2026/1/15	2026/2/12	high
297598	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1212)	Nessus	Huawei Local Security Checks	2026/2/2	2026/2/4	high
180566	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-039 (ALASKERNEL-5.10-2023-039)	Nessus	Amazon Linux Local Security Checks	2023/9/6	2026/2/11	high
180567	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-026 (ALASKERNEL-5.15-2023-026)	Nessus	Amazon Linux Local Security Checks	2023/9/6	2026/2/11	high

检测

插件搜索

high

high

medium

high

high

high

high