The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006977 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF

    The call to get_user_pages_fast() in vmci_host_setup_notify() can return     NULL context->notify_page causing a GPF. To avoid GPF check if     context->notify_page == NULL and return error if so.

    general protection fault, probably for non-canonical address         0xe0009d1000000060: 0000 [#1] PREEMPT SMP KASAN NOPTI     KASAN: maybe wild-memory-access in range [0x0005088000000300-         0x0005088000000307]     CPU: 2 PID: 26180 Comm: repro_34802241 Not tainted 6.1.0-rc4 #1     Hardware name: Red Hat KVM, BIOS 1.15.0-2.module+el8.6.0 04/01/2014     RIP: 0010:vmci_ctx_check_signal_notify+0x91/0xe0     Call Trace:
     <TASK>      vmci_host_unlocked_ioctl+0x362/0x1f40
     __x64_sys_ioctl+0x1a1/0x230      do_syscall_64+0x3a/0x90      entry_SYSCALL_64_after_hwframe+0x63/0xcd

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.240-238.959. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-101 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null (CVE-2022-50073)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT (CVE-2022-50224)

    In the Linux kernel, the following vulnerability has been resolved:

    VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF (CVE-2023-53259)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: PAD: fix crash in exit_round_robin() (CVE-2024-49935)

    In the Linux kernel, the following vulnerability has been resolved:

    codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CVE-2025-37798)

    In the Linux kernel, the following vulnerability has been resolved:

    sch_htb: make htb_qlen_notify() idempotent (CVE-2025-37932)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: mctrl_gpio: split disable_ms into sync and no_sync APIs (CVE-2025-38040)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio: break and reset virtio devices on device_shutdown() (CVE-2025-38064)

    In the Linux kernel, the following vulnerability has been resolved:

    rseq: Fix segfault on registration when rseq_cs is non-zero (CVE-2025-38067)

    In the Linux kernel, the following vulnerability has been resolved:

    VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (CVE-2025-38102)

    In the Linux kernel, the following vulnerability has been resolved:

    sch_hfsc: make hfsc_qlen_notify() idempotent (CVE-2025-38177)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: sch_sfq: reject invalid perturb period (CVE-2025-38193)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211)

    In the Linux kernel, the following vulnerability has been resolved:

    bcache: fix NULL pointer in cache_set_flush() (CVE-2025-38263)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Always pass notifications when child class becomes empty (CVE-2025-38350)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Refuse to evaluate a method if arguments are missing (CVE-2025-38386)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (CVE-2025-38387)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/gt: Fix timeline left held on VMA alloc error (CVE-2025-38389)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (CVE-2025-38393)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (CVE-2025-38399)

    In the Linux kernel, the following vulnerability has been resolved:

    nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (CVE-2025-38400)

    In the Linux kernel, the following vulnerability has been resolved:

    mtk-sd: Prevent memory corruption from DMA map failure (CVE-2025-38401)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock/vmci: Clear the vmci transport packet properly when initializing it (CVE-2025-38403)

    In the Linux kernel, the following vulnerability has been resolved:

    bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (CVE-2025-38439)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid1: Fix stack memory use after return in raid1_reshape (CVE-2025-38445)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Abort __tc_modify_qdisc if parent class does not exist (CVE-2025-38457)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: Fix transport_* TOCTOU (CVE-2025-38461)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: Fix transport_{g2h,h2g} TOCTOU (CVE-2025-38462)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: Fix use-after-free in tipc_conn_close(). (CVE-2025-38464)

    In the Linux kernel, the following vulnerability has been resolved:

    netlink: Fix wraparounds of sk->sk_rmem_alloc. (CVE-2025-38465)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: Revert to requiring CAP_SYS_ADMIN for uprobes (CVE-2025-38466)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix oops due to non-existence of prealloc backlog struct (CVE-2025-38514)

    In the Linux kernel, the following vulnerability has been resolved:

    pinctrl: qcom: msm: mark certain pins as invalid for interrupts (CVE-2025-38516)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (CVE-2025-38540)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1771239384 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for bfqq in     bfq_exit_icq_bfqq Commit 64dc8c732f5c (block, bfq: fix possible uaf for 'bfqq->bic') will access     'bic->bfqq' in bic_set_bfqq(), however, bfq_exit_icq_bfqq() can free bfqq first, and then call     bic_set_bfqq(), which will cause uaf. Fix the problem by moving bfq_exit_bfqq() behind bic_set_bfqq().
    (CVE-2022-50329)

  - In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix possible uaf for     'bfqq->bic' Our test report a uaf for 'bfqq->bic' in 5.10:
    ================================================================== BUG: KASAN: use-after-free in     bfq_select_queue+0x378/0xa30 CPU: 6 PID: 2318352 Comm: fsstress Kdump: loaded Not tainted     5.10.0-60.18.0.50.h602.kasan.eulerosv2r11.x86_64 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),     BIOS rel-1.12.1-0-ga5cab58-20220320_160524-szxrtosci10000 04/01/2014 Call Trace:
    bfq_select_queue+0x378/0xa30 bfq_dispatch_request+0xe8/0x130 blk_mq_do_dispatch_sched+0x62/0xb0
    __blk_mq_sched_dispatch_requests+0x215/0x2a0 blk_mq_sched_dispatch_requests+0x8f/0xd0
    __blk_mq_run_hw_queue+0x98/0x180 __blk_mq_delay_run_hw_queue+0x22b/0x240 blk_mq_run_hw_queue+0xe3/0x190     blk_mq_sched_insert_requests+0x107/0x200 blk_mq_flush_plug_list+0x26e/0x3c0 blk_finish_plug+0x63/0x90
    __iomap_dio_rw+0x7b5/0x910 iomap_dio_rw+0x36/0x80 ext4_dio_read_iter+0x146/0x190 [ext4]     ext4_file_read_iter+0x1e2/0x230 [ext4] new_sync_read+0x29f/0x400 vfs_read+0x24e/0x2d0 ksys_read+0xd5/0x1b0     do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x61/0xc6 Commit 3bc5e683c67d (bfq: Split shared     queues on move between cgroups) changes that move process to a new cgroup will allocate a new bfqq to     use, however, the old bfqq and new bfqq can point to the same bic: 1) Initial state, two process with io     in the same cgroup. Process 1 Process 2 (BIC1) (BIC2) |  |  | | | | V | V | bfqq1 bfqq2 2) bfqq1 is     merged to bfqq2. Process 1 Process 2 (BIC1) (BIC2) | | \-------------\| V bfqq1 bfqq2(coop) 3) Process 1     exit, then issue new io(denoce IOA) from Process 2. (BIC2) |  | | V | bfqq2(coop) 4) Before IOA is     completed, move Process 2 to another cgroup and issue io. Process 2 (BIC2)  |\--------------\ | V bfqq2     bfqq3 Now that BIC2 points to bfqq3, while bfqq2 and bfqq3 both point to BIC2. If all the requests are     completed, and Process 2 exit, BIC2 will be freed while there is no guarantee that bfqq2 will be freed     before BIC2. Fix the problem by clearing bfqq->bic while bfqq is detached from bic. (CVE-2022-50488)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: Delay the unmapping of     the buffer On WCN3990, we are seeing a rare scenario where copy engine hardware is sending a copy complete     interrupt to the host driver while still processing the buffer that the driver has sent, this is leading     into an SMMU fault triggering kernel panic. This is happening on copy engine channel 3 (CE3) where the     driver normally enqueues WMI commands to the firmware. Upon receiving a copy complete interrupt, host     driver will immediately unmap and frees the buffer presuming that hardware has processed the buffer. In     the issue case, upon receiving copy complete interrupt, host driver will unmap and free the buffer but     since hardware is still accessing the buffer (which in this case got unmapped in parallel), SMMU hardware     will trigger an SMMU fault resulting in a kernel panic. In order to avoid this, as a work around, add a     delay before unmapping the copy engine source DMA buffer. This is conditionally done for WCN3990 and only     for the CE3 channel where issue is seen. Below is the crash signature: wifi smmu error: kernel: [     10.120965] arm-smmu 15000000.iommu: Unhandled context fault: fsr=0x402, iova=0x7fdfd8ac0,     fsynr=0x500003,cbfrsynra=0xc1, cb=6 arm-smmu 15000000.iommu: Unhandled context fault:fsr=0x402,     iova=0x7fe06fdc0, fsynr=0x710003, cbfrsynra=0xc1, cb=6 qcom-q6v5-mss 4080000.remoteproc: fatal error     received: err_qdi.c:1040:EF:wlan_process:0x1:WLAN RT:0x2091: cmnos_thread.c:3998:Asserted in     copy_engine.c:AXI_ERROR_DETECTED:2149 remoteproc remoteproc0: crash detected in 4080000.remoteproc: type     fatal error <3> remoteproc remoteproc0: handling crash #1 in 4080000.remoteproc pc :
    __arm_lpae_unmap+0x500/0x514 lr : __arm_lpae_unmap+0x4bc/0x514 sp : ffffffc011ffb530 x29: ffffffc011ffb590     x28: 0000000000000000 x27: 0000000000000000 x26: 0000000000000004 x25: 0000000000000003 x24:
    ffffffc011ffb890 x23: ffffffa762ef9be0 x22: ffffffa77244ef00 x21: 0000000000000009 x20: 00000007fff7c000     x19: 0000000000000003 x18: 0000000000000000 x17: 0000000000000004 x16: ffffffd7a357d9f0 x15:
    0000000000000000 x14: 00fd5d4fa7ffffff x13: 000000000000000e x12: 0000000000000000 x11: 00000000ffffffff     x10: 00000000fffffe00 x9 : 000000000000017c x8 : 000000000000000c x7 : 0000000000000000 x6 :
    ffffffa762ef9000 x5 : 0000000000000003 x4 : 0000000000000004 x3 : 0000000000001000 x2 : 00000007fff7c000     x1 : ffffffc011ffb890 x0 : 0000000000000000 Call trace: __arm_lpae_unmap+0x500/0x514
    __arm_lpae_unmap+0x4bc/0x514 __arm_lpae_unmap+0x4bc/0x514 arm_lpae_unmap_pages+0x78/0xa4     arm_smmu_unmap_pages+0x78/0x104 __iommu_unmap+0xc8/0x1e4 iommu_unmap_fast+0x38/0x48
    __iommu_dma_unmap+0x84/0x104 iommu_dma_free+0x34/0x50 dma_free_attrs+0xa4/0xd0     ath10k_htt_rx_free+0xc4/0xf4 [ath10k_core] ath10k_core_stop+0x64/0x7c [ath10k_core]     ath10k_halt+0x11c/0x180 [ath10k_core] ath10k_stop+0x54/0x94 [ath10k_core] drv_stop+0x48/0x1c8 [mac80211]     ieee80211_do_open+0x638/0x77c [mac80211] ieee80211_open+0x48/0x5c [mac80211] __dev_open+0xb4/0x174
    __dev_change_flags+0xc4/0x1dc dev_change_flags+0x3c/0x7c devinet_ioctl+0x2b4/0x580 inet_ioctl+0xb0/0x1b4     sock_do_ioctl+0x4c/0x16c compat_ifreq_ioctl+0x1cc/0x35c compat_sock_ioctl+0x110/0x2ac
    __arm64_compat_sys_ioctl+0xf4/0x3e0 el0_svc_common+0xb4/0x17c el0_svc_compat_handler+0x2c/0x58     el0_svc_compat+0x8/0x2c Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.2.0-01387-QCAHLSWMTPLZ-1 (CVE-2022-50700)

  - In the Linux kernel, the following vulnerability has been resolved: tcp: fix a signed-integer-overflow bug     in tcp_add_backlog() The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and in tcp_add_backlog(),     the variable limit is caculated by adding sk_rcvbuf, sk_sndbuf and 64 * 1024, it may exceed the max value     of int and overflow. This patch reduces the limit budget by halving the sndbuf to solve this issue since     ACK packets are much smaller than the payload. (CVE-2022-50865)

  - In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for bfqq in     bic_set_bfqq() After commit 64dc8c732f5c (block, bfq: fix possible uaf for 'bfqq->bic'), bic->bfqq will     be accessed in bic_set_bfqq(), however, in some context bic->bfqq will be freed, and bic_set_bfqq() is     called with the freed bic->bfqq. Fix the problem by always freeing bfqq after bic_set_bfqq().
    (CVE-2023-52983)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1771078945 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: pid: take a reference when     initializing `cad_pid` During boot, kernel_init_freeable() initializes `cad_pid` to the init task's struct     pid. Later on, we may change `cad_pid` via a sysctl, and when this happens proc_do_cad_pid() will     increment the refcount on the new pid via get_pid(), and will decrement the refcount on the old pid via     put_pid(). As we never called get_pid() when we initialized `cad_pid`, we decrement a reference we never     incremented, can therefore free the init task's struct pid early. As there can be dangling references to     the struct pid, we can later encounter a use-after-free (e.g. when delivering signals). This was spotted     when fuzzing v5.13-rc3 with Syzkaller, but seems to have been around since the conversion of `cad_pid` to     struct pid in commit 9ec52099e4b8 ([PATCH] replace cad_pid by a struct pid) from the pre-KASAN stone age     of v2.6.19. Fix this by getting a reference to the init task's struct pid when we assign it to `cad_pid`.
    Full KASAN splat below. ================================================================== BUG: KASAN:
    use-after-free in ns_of_pid include/linux/pid.h:153 [inline] BUG: KASAN: use-after-free in     task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 Read of size 4 at addr ffff23794dda0004 by task syz-     executor.0/273 CPU: 1 PID: 273 Comm: syz-executor.0 Not tainted 5.12.0-00001-g9aef892b2d15 #1 Hardware     name: linux,dummy-virt (DT) Call trace: ns_of_pid include/linux/pid.h:153 [inline]     task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 do_notify_parent+0x308/0xe60 kernel/signal.c:1950     exit_notify kernel/exit.c:682 [inline] do_exit+0x2334/0x2bd0 kernel/exit.c:845 do_group_exit+0x108/0x2c8     kernel/exit.c:922 get_signal+0x4e4/0x2a88 kernel/signal.c:2781 do_signal arch/arm64/kernel/signal.c:882     [inline] do_notify_resume+0x300/0x970 arch/arm64/kernel/signal.c:936 work_pending+0xc/0x2dc Allocated by     task 0: slab_post_alloc_hook+0x50/0x5c0 mm/slab.h:516 slab_alloc_node mm/slub.c:2907 [inline] slab_alloc     mm/slub.c:2915 [inline] kmem_cache_alloc+0x1f4/0x4c0 mm/slub.c:2920 alloc_pid+0xdc/0xc00 kernel/pid.c:180     copy_process+0x2794/0x5e18 kernel/fork.c:2129 kernel_clone+0x194/0x13c8 kernel/fork.c:2500     kernel_thread+0xd4/0x110 kernel/fork.c:2552 rest_init+0x44/0x4a0 init/main.c:687     arch_call_rest_init+0x1c/0x28 start_kernel+0x520/0x554 init/main.c:1064 0x0 Freed by task 270:
    slab_free_hook mm/slub.c:1562 [inline] slab_free_freelist_hook+0x98/0x260 mm/slub.c:1600 slab_free     mm/slub.c:3161 [inline] kmem_cache_free+0x224/0x8e0 mm/slub.c:3177 put_pid.part.4+0xe0/0x1a8     kernel/pid.c:114 put_pid+0x30/0x48 kernel/pid.c:109 proc_do_cad_pid+0x190/0x1b0 kernel/sysctl.c:1401     proc_sys_call_handler+0x338/0x4b0 fs/proc/proc_sysctl.c:591 proc_sys_write+0x34/0x48     fs/proc/proc_sysctl.c:617 call_write_iter include/linux/fs.h:1977 [inline] new_sync_write+0x3ac/0x510     fs/read_write.c:518 vfs_write fs/read_write.c:605 [inline] vfs_write+0x9c4/0x1018 fs/read_write.c:585     ksys_write+0x124/0x240 fs/read_write.c:658 __do_sys_write fs/read_write.c:670 [inline] __se_sys_write     fs/read_write.c:667 [inline] __arm64_sys_write+0x78/0xb0 fs/read_write.c:667 __invoke_syscall     arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall arch/arm64/kernel/syscall.c:49 [inline]     el0_svc_common.constprop.1+0x16c/0x388 arch/arm64/kernel/syscall.c:129 do_el0_svc+0xf8/0x150     arch/arm64/kernel/syscall.c:168 el0_svc+0x28/0x38 arch/arm64/kernel/entry-common.c:416     el0_sync_handler+0x134/0x180 arch/arm64/kernel/entry-common.c:432 el0_sync+0x154/0x180     arch/arm64/kernel/entry.S:701 The buggy address belongs to the object at ffff23794dda0000 which belongs to     the cache pid of size 224 The buggy address is located 4 bytes inside of 224-byte region [ff
    ---truncated--- (CVE-2021-47118)

  - In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Don't generate an interrupt     on bus reset Now that the i2c-i801 driver supports interrupts, setting the KILL bit in a attempt to     recover from a timed out transaction triggers an interrupt. Unfortunately, the interrupt handler     (i801_isr) is not prepared for this situation and will try to process the interrupt as if it was signaling     the end of a successful transaction. In the case of a block transaction, this can result in an out-of-     range memory access. This condition was reproduced several times by syzbot:
    https://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e     https://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e     https://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e     https://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb     https://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a     https://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79 So disable interrupts while trying to reset     the bus. Interrupts will be enabled again for the following transaction. (CVE-2021-47153)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITE_SAME No Data     Buffer crash In newer version of the SBC specs, we have a NDOB bit that indicates there is no data buffer     that gets written out. If this bit is set using commands like sg_write_same --ndob we will crash in     target_core_iblock/file's execute_write_same handlers when we go to access the se_cmd->t_data_sg because     its NULL. This patch adds a check for the NDOB bit in the common WRITE SAME code because we don't support     it. And, it adds a check for zero SG elements in each handler in case the initiator tries to send a normal     WRITE SAME with no data buffer. (CVE-2022-21546)

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: IPoIB, Block PKEY     interfaces with less rx queues than parent A user is able to configure an arbitrary number of rx queues     when creating an interface via netlink. This doesn't work for child PKEY interfaces because the child     interface uses the parent receive channels. Although the child shares the parent's receive channels, the     number of rx queues is important for the channel_stats array: the parent's rx channel index is used to     access the child's channel_stats. So the array has to be at least as large as the parent's rx queue size     for the counting to work correctly and to prevent out of bound accesses. This patch checks for the     mentioned scenario and returns an error when trying to create the interface. The error is propagated to     the user. (CVE-2022-48883)

  - In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix potential out of bounds     access with invalid rxstatus->rs_keyix The rxstatus->rs_keyix eventually gets passed to test_bit() so we     need to ensure that it is within the bitmap. drivers/net/wireless/ath/ath9k/common.c:46     ath9k_cmn_rx_accept() error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()' (CVE-2022-49503)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03628-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
    - CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
    - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
    - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
    - CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
    - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
    - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
    - CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
    - CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
    - CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245498).
    - CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
    - CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
    - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
    - CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
    - CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime     (bsc#1247288).
    - CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree     (bsc#1248255).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
    - CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
    - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
    - CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
    - CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
    - CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()(CVE-2023-53521)

    binfmt_misc: fix shift-out-of-bounds in check_special_flags(CVE-2022-50497)

    scsi: lpfc: Fix buffer free/clear order in deferred receive path(CVE-2025-39841)

    mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory(CVE-2025-39883)

    md: Replace snprintf with scnprintf(CVE-2022-50299)

    drivers: serial: jsm: fix some leaks in probe(CVE-2022-50312)

    udf: Do not bother merging very long extents(CVE-2023-53506)

    fbdev: fix potential buffer overflow in do_register_framebuffer()(CVE-2025-38702)

    mm/slub: avoid accessing metadata when pointer is invalid in object_err()(CVE-2025-39902)

    xhci: Remove device endpoints from bandwidth list when freeing the device(CVE-2022-50470)

    HID: multitouch: Correct devm device reference for hidinput input_dev name(CVE-2023-53454)

    ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed(CVE-2023-53481)

    thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash(CVE-2022-50494)

    md: fix a crash in mempool_free(CVE-2022-50381)

    scsi: ses: Fix possible desc_ptr out-of-bounds accesses(CVE-2023-53675)

    scsi: target: target_core_configfs: Add length check to avoid buffer overflow(CVE-2025-39998)

    fs: dlm: fix invalid derefence of sb_lvbptr(CVE-2022-50516)

    NFS: Fix a race when updating an existing write(CVE-2025-39697)

    mmc: vub300: fix return value check of mmc_add_host()(CVE-2022-50251)

    tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak(CVE-2022-50389)

    scsi: qla4xxx: Add length check when parsing nlattrs(CVE-2023-53456)

    ext4: avoid deadlock in fs reclaim with page writeback(CVE-2023-53149)

    kobject: Add sanity check for kset-kobj.ktype in kset_register()(CVE-2023-53480)

    scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()(CVE-2023-53676)

    udf: Fix uninitialized array access for some pathnames(CVE-2023-53165)

    ext4: avoid crash when inline data creation follows DIO write(CVE-2022-50435)

    cifs: Fix warning and UAF when destroy the MR list(CVE-2023-53427)

    scsi: qla2xxx: Pointer may be dereferenced(CVE-2023-53150)

    fs: writeback: fix use-after-free in __mark_inode_dirty()(CVE-2025-39866)

    blk-mq: use quiesced elevator switch when reinitializing queues(CVE-2022-50552)

    mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()(CVE-2023-53623)

    ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS(CVE-2022-50315)

    pnode: terminate at peers of source(CVE-2022-50280)

    tracing: Fix race issue between cpu buffer write and swap(CVE-2023-53368)

    igb: Fix igb_down hung on surprise removal(CVE-2023-53148)

    udf: Do not update file length for failed writes to inline files(CVE-2023-53295)

    usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()(CVE-2022-50544)

    cacheinfo: Fix shared_cpu_map to handle shared caches at different levels(CVE-2023-53254)

    net/tunnel: wait until all sk_user_data reader finish before releasing the sock(CVE-2022-50405)

    mtd: Fix device name leak when register device failed in add_mtd_device()(CVE-2022-50566)

    ext4: add bounds checking in get_max_inline_xattr_value_size()(CVE-2023-53285)

    drm/mipi-dsi: Detach devices when removing the host(CVE-2022-50489)

    ipv6: Fix out-of-bounds access in ipv6_find_tlv()(CVE-2023-53705)

    md/raid10: check slab-out-of-bounds in md_bitmap_get_counter(CVE-2023-53357)

    scsi: qla2xxx: Wait for io return on terminate rport(CVE-2023-53322)

    PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free(CVE-2023-53446)

    sctp: check send stream number after wait_for_sndbuf(CVE-2023-53296)

    rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails(CVE-2023-53307)

    md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request(CVE-2023-53380)

    ubi: ensure that VID header offset + VID header size = alloc, size(CVE-2023-53265)

    icmp6: Fix null-ptr-deref of ip6_null_entry-rt6i_idev in icmp6_dev().(CVE-2023-53343)

    calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().(CVE-2025-38181)

    ftrace: Also allocate and copy hash for reading of filter files(CVE-2025-39689)

    firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region(CVE-2023-52989)

    sched/fair: Don't balance task to its current running CPU(CVE-2023-53215)

    dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path(CVE-2023-53604)

    qede: confirm skb is allocated before using(CVE-2022-49084)

    sctp: linearize cloned gso packets in sctp_rcv(CVE-2025-38718)

    af_unix: Fix data-races around user-unix_inflight.(CVE-2023-53204)

    scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue(CVE-2023-53280)

    md/raid10: fix leak of 'r10bio-remaining' for recovery(CVE-2023-53299)

    recordmcount: Fix memory leaks in the uwrite function(CVE-2023-53318)

    cifs: fix oops during encryption(CVE-2022-50341)

    nfsd: call op_release, even when op_func returns an error(CVE-2023-53241)

    uio_hv_generic: Let userspace take care of interrupt mask(CVE-2025-40048)

    posix-timers: Ensure timer ID search-loop limit is valid(CVE-2023-53728)

    tipc: fix a null-ptr-deref in tipc_topsrv_accept(CVE-2022-50555)

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer(CVE-2023-53395)

    x86/MCE: Always save CS register on AMD Zen IF Poison errors(CVE-2023-53438)

    xfrm: fix slab-use-after-free in decode_session6(CVE-2023-53500)

    posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()(CVE-2025-38352)

    i40e: add validation for ring_len param(CVE-2025-39973)

    firewire: net: fix use after free in fwnet_finish_incoming_packet()(CVE-2023-53432)

    NFSD: Protect against send buffer overflow in NFSv2 READ(CVE-2022-50410)

    drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()(CVE-2022-50402)

    net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode(CVE-2023-53733)

    crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg(CVE-2025-39964)

    udf: Detect system inodes linked into directory hierarchy(CVE-2023-53695)

    skbuff: Account for tail adjustment during pull operations(CVE-2022-50365)

    mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING(CVE-2022-50430)

    skbuff: skb_segment, Call zero copy functions before using skbuff frags(CVE-2023-53354)

    tracing/histograms: Add histograms to hist_vars if they have referenced variables(CVE-2023-53560)

    net: fix skb leak in __skb_tstamp_tx()(CVE-2023-53716)

    media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()(CVE-2023-53220)

    serial: arc_uart: fix of_iomap leak in `arc_serial_probe`(CVE-2023-53719)

    fs: udf: fix OOB read in lengthAllocDescs handling(CVE-2025-40044)

    ipvs: Defer ip_vs_ftp unregister during netns cleanup(CVE-2025-40018)

    scsi: target: iscsi: Fix a race condition between login_work and the login thread(CVE-2022-50350)

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare(CVE-2025-39817)

    igb: Do not free q_vector unless new one was allocated(CVE-2022-50252)

    iommu/vt-d: Clean up si_domain in the init_dmars() error path(CVE-2022-50482)

    VMCI: check context-notify_page after call to get_user_pages_fast() to avoid GPF(CVE-2023-53259)

    ext4: fix WARNING in mb_find_extent(CVE-2023-53317)

    ip_vti: fix potential slab-use-after-free in decode_session6(CVE-2023-53559)

    netfilter: conntrack: Avoid nf_ct_helper_hash uses after free(CVE-2023-53619)

    Input: MT - limit max slots(CVE-2024-45008)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006770 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF

    The call to get_user_pages_fast() in vmci_host_setup_notify() can return     NULL context->notify_page causing a GPF. To avoid GPF check if     context->notify_page == NULL and return error if so.

    general protection fault, probably for non-canonical address         0xe0009d1000000060: 0000 [#1] PREEMPT SMP KASAN NOPTI     KASAN: maybe wild-memory-access in range [0x0005088000000300-         0x0005088000000307]     CPU: 2 PID: 26180 Comm: repro_34802241 Not tainted 6.1.0-rc4 #1     Hardware name: Red Hat KVM, BIOS 1.15.0-2.module+el8.6.0 04/01/2014     RIP: 0010:vmci_ctx_check_signal_notify+0x91/0xe0     Call Trace:
     <TASK>      vmci_host_unlocked_ioctl+0x362/0x1f40
     __x64_sys_ioctl+0x1a1/0x230      do_syscall_64+0x3a/0x90      entry_SYSCALL_64_after_hwframe+0x63/0xcd

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
308193	Unity Linux 20.1050a Security Update: kernel (UTSA-2026-006977)	Nessus	Unity Linux Local Security Checks	2026/4/21	2026/4/21	high
246925	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2025-101 (ALASKERNEL-5.10-2025-101)	Nessus	Amazon Linux Local Security Checks	2025/8/9	2026/2/26	high
360081	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1771239384)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	high
361173	CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1771078945)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	high
270857	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:03628-1)	Nessus	SuSE Local Security Checks	2025/10/21	2025/10/21	high
252965	Photon OS 4.0: Linux PHSA-2025-4.0-0844	Nessus	PhotonOS Local Security Checks	2025/8/20	2026/11/2	high
284758	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2026-1029)	Nessus	Huawei Local Security Checks	2026/1/15	2026/9/19	high
305483	Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006770)	Nessus	Unity Linux Local Security Checks	2026/4/8	2026/4/8	high

检测

插件搜索

high

high

high

high

high

high

high

high