The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1773048865 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid field-overflowing     memcpy() In preparation for FORTIFY_SOURCE performing compile-time and run-time field bounds checking for     memcpy(), memmove(), and memset(), avoid intentionally writing across neighboring fields. Use flexible     arrays instead of zero-element arrays (which look like they are always overflowing) and split the cross-     field memcpy() into two halves that can be appropriately bounds-checked by the compiler. We were doing:
    #define ETH_HLEN 14 #define VLAN_HLEN 4 ... #define MLX5E_XDP_MIN_INLINE (ETH_HLEN + VLAN_HLEN) ... struct     mlx5e_tx_wqe *wqe = mlx5_wq_cyc_get_wqe(wq, pi); ... struct mlx5_wqe_eth_seg *eseg = &wqe->eth; struct     mlx5_wqe_data_seg *dseg = wqe->data; ... memcpy(eseg->inline_hdr.start, xdptxd->data,     MLX5E_XDP_MIN_INLINE); target is wqe->eth.inline_hdr.start (which the compiler sees as being 2 bytes in     size), but copying 18, intending to write across start (really vlan_tci, 2 bytes). The remaining 16 bytes     get written into wqe->data[0], covering byte_count (4 bytes), lkey (4 bytes), and addr (8 bytes). struct     mlx5e_tx_wqe { struct mlx5_wqe_ctrl_seg ctrl; /* 0 16 */ struct mlx5_wqe_eth_seg eth; /* 16 16 */ struct     mlx5_wqe_data_seg data[]; /* 32 0 */ /* size: 32, cachelines: 1, members: 3 */ /* last cacheline: 32 bytes
    */ }; struct mlx5_wqe_eth_seg { u8 swp_outer_l4_offset; /* 0 1 */ u8 swp_outer_l3_offset; /* 1 1 */ u8     swp_inner_l4_offset; /* 2 1 */ u8 swp_inner_l3_offset; /* 3 1 */ u8 cs_flags; /* 4 1 */ u8 swp_flags; /* 5     1 */ __be16 mss; /* 6 2 */ __be32 flow_table_metadata; /* 8 4 */ union { struct { __be16 sz; /* 12 2 */ u8     start[2]; /* 14 2 */ } inline_hdr; /* 12 4 */ struct { __be16 type; /* 12 2 */ __be16 vlan_tci; /* 14 2 */     } insert; /* 12 4 */ __be32 trailer; /* 12 4 */ }; /* 12 4 */ /* size: 16, cachelines: 1, members: 9 */ /*     last cacheline: 16 bytes */ }; struct mlx5_wqe_data_seg { __be32 byte_count; /* 0 4 */ __be32 lkey; /* 4 4
    */ __be64 addr; /* 8 8 */ /* size: 16, cachelines: 1, members: 3 */ /* last cacheline: 16 bytes */ }; So,     split the memcpy() so the compiler can reason about the buffer sizes. pahole shows no size nor member     offset changes to struct mlx5e_tx_wqe nor struct mlx5e_umr_wqe. objdump -d shows no meaningful object     code changes (i.e. only source line number induced differences and optimizations). (CVE-2022-48744)

  - In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix the behavior of READ near     OFFSET_MAX Dan Aloni reports: > Due to commit 8cfb9015280d (NFS: Always provide aligned buffers to > the     RPC read layers) on the client, a read of 0xfff is aligned up > to server rsize of 0x1000. > > As a     result, in a test where the server has a file of size > 0x7fffffffffffffff, and the client tries to read     from the offset > 0x7ffffffffffff000, the read causes loff_t overflow in the server > and it returns an     NFS code of EINVAL to the client. The client as > a result indefinitely retries the request. The Linux NFS     client does not handle NFS?ERR_INVAL, even though all NFS specifications permit servers to return that     status code for a READ. Instead of NFS?ERR_INVAL, have out-of-range READ requests succeed and return a     short result. Set the EOF flag in the result to prevent the client from retrying the READ request. This     behavior appears to be consistent with Solaris NFS servers. Note that NFSv3 and NFSv4 use u64 offset     values on the wire. These must be converted to loff_t internally before use -- an implicit type cast is     not adequate for this purpose. Otherwise VFS checks against sb->s_maxbytes do not work properly.
    (CVE-2022-48827)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free     This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following     trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref *kref) Bluetooth: chan     0000000023c4974d Bluetooth: parent 00000000ae861c08     ================================================================== BUG: KASAN: use-after-free in
    __mutex_waiter_is_first kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free in
    __mutex_lock_common kernel/locking/mutex.c:671 [inline] BUG: KASAN: use-after-free in
    __mutex_lock+0x278/0x400 kernel/locking/mutex.c:729 Read of size 8 at addr ffff888006a49b08 by task     kworker/u3:2/389 (CVE-2022-50386)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix use-after-free bug     in smp_execute_task_sg() When executing SMP task failed, the smp_execute_task_sg() calls del_timer() to     delete slow_task->timer. However, if the timer handler sas_task_internal_timedout() is running, the     del_timer() in smp_execute_task_sg() will not stop it and a UAF will happen. The process is shown below:
    (thread 1) | (thread 2) smp_execute_task_sg() | sas_task_internal_timedout() ... | del_timer() | ... | ...
    sas_free_task(task) | kfree(task->slow_task) //FREE| | task->slow_task->... //USE Fix by calling     del_timer_sync() in smp_execute_task_sg(), which makes sure the timer handler have finished before the     task->slow_task is deallocated. (CVE-2022-50422)

  - In the Linux kernel, the following vulnerability has been resolved: kernfs: fix use-after-free in
    __kernfs_remove Syzkaller managed to trigger concurrent calls to kernfs_remove_by_name_ns() for the same     file resulting in a KASAN detected use-after-free. The race occurs when the root node is freed during     kernfs_drain(). To prevent this acquire an additional reference for the root of the tree that is removed     before calling __kernfs_remove(). Found by syzkaller with the following reproducer (slab_nomerge is     required): syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x100000, 0x0, 0x0, 0x0, 0x0) r0 =     openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0) close(r0)     pipe2(&(0x7f0000000140)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x800) mount$9p_fd(0x0,     &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x408, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d,     r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@mmap}, {@loose}, {@loose}, {@mmap}],     [{@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@fsmagic={'fsmagic', 0x3d, 0x10001}}, {@dont_hash}]}}) Sample     report: ================================================================== BUG: KASAN: use-after-free in     kernfs_type include/linux/kernfs.h:335 [inline] BUG: KASAN: use-after-free in kernfs_leftmost_descendant     fs/kernfs/dir.c:1261 [inline] BUG: KASAN: use-after-free in __kernfs_remove.part.0+0x843/0x960     fs/kernfs/dir.c:1369 Read of size 2 at addr ffff8880088807f0 by task syz-executor.2/857 CPU: 0 PID: 857     Comm: syz-executor.2 Not tainted 6.0.0-rc3-00363-g7726d4c3e60b #5 Hardware name: QEMU Standard PC (i440FX     + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline]     dump_stack_lvl+0x6e/0x91 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline]     print_report.cold+0x5e/0x5e5 mm/kasan/report.c:433 kasan_report+0xa3/0x130 mm/kasan/report.c:495     kernfs_type include/linux/kernfs.h:335 [inline] kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline]
    __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369 __kernfs_remove fs/kernfs/dir.c:1356 [inline]     kernfs_remove_by_name_ns+0x108/0x190 fs/kernfs/dir.c:1589 sysfs_slab_add+0x133/0x1e0 mm/slub.c:5943
    __kmem_cache_create+0x3e0/0x550 mm/slub.c:4899 create_cache mm/slab_common.c:229 [inline]     kmem_cache_create_usercopy+0x167/0x2a0 mm/slab_common.c:335 p9_client_create+0xd4d/0x1190     net/9p/client.c:993 v9fs_session_init+0x1e6/0x13c0 fs/9p/v9fs.c:408 v9fs_mount+0xb9/0xbd0     fs/9p/vfs_super.c:126 legacy_get_tree+0xf1/0x200 fs/fs_context.c:610 vfs_get_tree+0x85/0x2e0     fs/super.c:1530 do_new_mount fs/namespace.c:3040 [inline] path_mount+0x675/0x1d00 fs/namespace.c:3370     do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount     fs/namespace.c:3568 [inline] __x64_sys_mount+0x282/0x300 fs/namespace.c:3568 do_syscall_x64     arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80     entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f725f983aed Code: 02 b8 ff ff ff ff c3 66 0f 1f 44     00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0     ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f725f0f7028 EFLAGS: 00000246     ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f725faa3f80 RCX: 00007f725f983aed RDX:
    00000000200000c0 RSI: 0000000020000040 RDI: 0000000000000000 RBP: 00007f725f9f419c R08: 0000000020000280     R09: 0000000000000000 R10: 0000000000000408 R11: 0000000000000246 R12: 0000000000000000 R13:
    0000000000000006 R14: 00007f725faa3f80 R15: 00007f725f0d7000 </TASK> Allocated by task 855:
    kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline]     set_alloc_info mm/kasan/common.c:437 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:470     kasan_slab_alloc include/linux/kasan.h:224 [inline] slab_post_alloc_hook mm/slab.h:7 ---truncated---     (CVE-2022-50432)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1765463110 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: KVM: Reject attempts to consume or     refresh inactive gfn_to_pfn_cache Reject kvm_gpc_check() and kvm_gpc_refresh() if the cache is inactive.
    Not checking the active flag during refresh is particularly egregious, as KVM can end up with a valid,     inactive cache, which can lead to a variety of use-after-free bugs, e.g. consuming a NULL kernel pointer     or missing an mmu_notifier invalidation due to the cache not being on the list of gfns to invalidate.
    Note, active needs to be set if and only if the cache is on the list of caches, i.e. is reachable via     mmu_notifier events. If a relevant mmu_notifier event occurs while the cache is active but not on the     list, KVM will not acquire the cache's lock and so will not serailize the mmu_notifier event with active     users and/or kvm_gpc_refresh(). A race between KVM_XEN_ATTR_TYPE_SHARED_INFO and KVM_XEN_HVM_EVTCHN_SEND     can be exploited to trigger the bug. 1. Deactivate shinfo cache: kvm_xen_hvm_set_attr case     KVM_XEN_ATTR_TYPE_SHARED_INFO kvm_gpc_deactivate kvm_gpc_unmap gpc->valid = false gpc->khva = NULL     gpc->active = false Result: active = false, valid = false 2. Cause cache refresh: kvm_arch_vm_ioctl case     KVM_XEN_HVM_EVTCHN_SEND kvm_xen_hvm_evtchn_send kvm_xen_set_evtchn kvm_xen_set_evtchn_fast kvm_gpc_check     return -EWOULDBLOCK because !gpc->valid kvm_xen_set_evtchn_fast return -EWOULDBLOCK kvm_gpc_refresh     hva_to_pfn_retry gpc->valid = true gpc->khva = not NULL Result: active = false, valid = true 3. Race ioctl     KVM_XEN_HVM_EVTCHN_SEND against ioctl KVM_XEN_ATTR_TYPE_SHARED_INFO: kvm_arch_vm_ioctl case     KVM_XEN_HVM_EVTCHN_SEND kvm_xen_hvm_evtchn_send kvm_xen_set_evtchn kvm_xen_set_evtchn_fast read_lock     gpc->lock kvm_xen_hvm_set_attr case KVM_XEN_ATTR_TYPE_SHARED_INFO mutex_lock kvm->lock     kvm_xen_shared_info_init kvm_gpc_activate gpc->khva = NULL kvm_gpc_check [ Check passes because gpc->valid     is still true, even though gpc->khva is already NULL. ] shinfo = gpc->khva pending_bits =     shinfo->evtchn_pending CRASH: test_and_set_bit(..., pending_bits) (CVE-2022-49882)

  - In the Linux kernel, the following vulnerability has been resolved: coresight: Clear the connection field     properly coresight devices track their connections (output connections) and hold a reference to the     fwnode. When a device goes away, we walk through the devices on the coresight bus and make sure that the     references are dropped. This happens both ways: a) For all output connections from the device, drop the     reference to the target device via coresight_release_platform_data() b) Iterate over all the devices on     the coresight bus and drop the reference to fwnode if *this* device is the target of the output     connection, via coresight_remove_conns()->coresight_remove_match(). However, the coresight_remove_match()     doesn't clear the fwnode field, after dropping the reference, this causes use-after-free and additional     refcount drops on the fwnode. e.g., if we have two devices, A and B, with a connection, A -> B. If we     remove B first, B would clear the reference on B, from A via coresight_remove_match(). But when A is     removed, it still has a connection with fwnode still pointing to B. Thus it tries to drops the reference     in coresight_release_platform_data(), raising the bells like : [ 91.990153] ------------[ cut here     ]------------ [ 91.990163] refcount_t: addition on 0; use-after-free. [ 91.990212] WARNING: CPU: 0 PID:
    461 at lib/refcount.c:25 refcount_warn_saturate+0xa0/0x144 [ 91.990260] Modules linked in:
    coresight_funnel coresight_replicator coresight_etm4x(-) crct10dif_ce coresight ip_tables x_tables ipv6     [last unloaded: coresight_cpu_debug] [ 91.990398] CPU: 0 PID: 461 Comm: rmmod Tainted: G W T 5.19.0-rc2+     #53 [ 91.990418] Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS     EDK II Feb 1 2019 [ 91.990434] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [     91.990454] pc : refcount_warn_saturate+0xa0/0x144 [ 91.990476] lr : refcount_warn_saturate+0xa0/0x144 [     91.990496] sp : ffff80000c843640 [ 91.990509] x29: ffff80000c843640 x28: ffff800009957c28 x27:
    ffff80000c8439a8 [ 91.990560] x26: ffff00097eff1990 x25: ffff8000092b6ad8 x24: ffff00097eff19a8 [     91.990610] x23: ffff80000c8439a8 x22: 0000000000000000 x21: ffff80000c8439c2 [ 91.990659] x20:
    0000000000000000 x19: ffff00097eff1a10 x18: ffff80000ab99c40 [ 91.990708] x17: 0000000000000000 x16:
    0000000000000000 x15: ffff80000abf6fa0 [ 91.990756] x14: 000000000000001d x13: 0a2e656572662d72 x12:
    657466612d657375 [ 91.990805] x11: 203b30206e6f206e x10: 6f69746964646120 x9 : ffff8000081aba28 [     91.990854] x8 : 206e6f206e6f6974 x7 : 69646461203a745f x6 : 746e756f63666572 [ 91.990903] x5 :
    ffff00097648ec58 x4 : 0000000000000000 x3 : 0000000000000027 [ 91.990952] x2 : 0000000000000000 x1 :
    0000000000000000 x0 : ffff00080260ba00 [ 91.991000] Call trace: [ 91.991012]     refcount_warn_saturate+0xa0/0x144 [ 91.991034] kobject_get+0xac/0xb0 [ 91.991055] of_node_get+0x2c/0x40 [     91.991076] of_fwnode_get+0x40/0x60 [ 91.991094] fwnode_handle_get+0x3c/0x60 [ 91.991116]     fwnode_get_nth_parent+0xf4/0x110 [ 91.991137] fwnode_full_name_string+0x48/0xc0 [ 91.991158]     device_node_string+0x41c/0x530 [ 91.991178] pointer+0x320/0x3ec [ 91.991198] vsnprintf+0x23c/0x750 [     91.991217] vprintk_store+0x104/0x4b0 [ 91.991238] vprintk_emit+0x8c/0x360 [ 91.991257]     vprintk_default+0x44/0x50 [ 91.991276] vprintk+0xcc/0xf0 [ 91.991295] _printk+0x68/0x90 [ 91.991315]     of_node_release+0x13c/0x14c [ 91.991334] kobject_put+0x98/0x114 [ 91.991354] of_node_put+0x24/0x34 [     91.991372] of_fwnode_put+0x40/0x5c [ 91.991390] fwnode_handle_put+0x38/0x50 [ 91.991411]     coresight_release_platform_data+0x74/0xb0 [coresight] [ 91.991472] coresight_unregister+0x64/0xcc     [coresight] [ 91.991525] etm4_remove_dev+0x64/0x78 [coresight_etm4x] [ 91.991563]     etm4_remove_amba+0x1c/0x2c [coresight_etm4x] [ 91.991598] amba_remove+0x3c/0x19c ---truncated---     (CVE-2022-50214)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential stack-     out-of-bounds in brcmf_c_preinit_dcmds() This patch fixes a stack-out-of-bounds read in brcmfmac that     occurs when 'buf' that is not null-terminated is passed as an argument of strsep() in     brcmf_c_preinit_dcmds(). This buffer is filled with a firmware version string by memcpy() in     brcmf_fil_iovar_data_get(). The patch ensures buf is null-terminated. Found by a modified version of     syzkaller. [ 47.569679][ T1897] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43236b for chip     BCM43236/3 [ 47.582839][ T1897] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device     may have limited channels available [ 47.601565][ T1897]     ================================================================== [ 47.602574][ T1897] BUG: KASAN: stack-     out-of-bounds in strsep+0x1b2/0x1f0 [ 47.603447][ T1897] Read of size 1 at addr ffffc90001f6f000 by task     kworker/0:2/1897 [ 47.604336][ T1897] [ 47.604621][ T1897] CPU: 0 PID: 1897 Comm: kworker/0:2 Tainted: G O     5.14.0+ #131 [ 47.605617][ T1897] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS     rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 47.606907][ T1897] Workqueue: usb_hub_wq     hub_event [ 47.607453][ T1897] Call Trace: [ 47.607801][ T1897] dump_stack_lvl+0x8e/0xd1 [ 47.608295][     T1897] print_address_description.constprop.0.cold+0xf/0x334 [ 47.609009][ T1897] ? strsep+0x1b2/0x1f0 [     47.609434][ T1897] ? strsep+0x1b2/0x1f0 [ 47.609863][ T1897] kasan_report.cold+0x83/0xdf [ 47.610366][     T1897] ? strsep+0x1b2/0x1f0 [ 47.610882][ T1897] strsep+0x1b2/0x1f0 [ 47.611300][ T1897] ?     brcmf_fil_iovar_data_get+0x3a/0xf0 [ 47.611883][ T1897] brcmf_c_preinit_dcmds+0x995/0xc40 [ 47.612434][     T1897] ? brcmf_c_set_joinpref_default+0x100/0x100 [ 47.613078][ T1897] ?     rcu_read_lock_sched_held+0xa1/0xd0 [ 47.613662][ T1897] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 47.614208][     T1897] ? lock_acquire+0x19d/0x4e0 [ 47.614704][ T1897] ? find_held_lock+0x2d/0x110 [ 47.615236][ T1897] ?     brcmf_usb_deq+0x1a7/0x260 [ 47.615741][ T1897] ? brcmf_usb_rx_fill_all+0x5a/0xf0 [ 47.616288][ T1897]     brcmf_attach+0x246/0xd40 [ 47.616758][ T1897] ? wiphy_new_nm+0x1703/0x1dd0 [ 47.617280][ T1897] ?     kmemdup+0x43/0x50 [ 47.617720][ T1897] brcmf_usb_probe+0x12de/0x1690 [ 47.618244][ T1897] ?     brcmf_usbdev_qinit.constprop.0+0x470/0x470 [ 47.618901][ T1897] usb_probe_interface+0x2aa/0x760 [     47.619429][ T1897] ? usb_probe_device+0x250/0x250 [ 47.619950][ T1897] really_probe+0x205/0xb70 [     47.620435][ T1897] ? driver_allows_async_probing+0x130/0x130 [ 47.621048][ T1897]
    __driver_probe_device+0x311/0x4b0 [ 47.621595][ T1897] ? driver_allows_async_probing+0x130/0x130 [     47.622209][ T1897] driver_probe_device+0x4e/0x150 [ 47.622739][ T1897] __device_attach_driver+0x1cc/0x2a0     [ 47.623287][ T1897] bus_for_each_drv+0x156/0x1d0 [ 47.623796][ T1897] ? bus_rescan_devices+0x30/0x30 [     47.624309][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 47.624907][ T1897] ?     trace_hardirqs_on+0x46/0x160 [ 47.625437][ T1897] __device_attach+0x23f/0x3a0 [ 47.625924][ T1897] ?     device_bind_driver+0xd0/0xd0 [ 47.626433][ T1897] ? kobject_uevent_env+0x287/0x14b0 [ 47.627057][ T1897]     bus_probe_device+0x1da/0x290 [ 47.627557][ T1897] device_add+0xb7b/0x1eb0 [ 47.628027][ T1897] ?     wait_for_completion+0x290/0x290 [ 47.628593][ T1897] ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0 [     47.629249][ T1897] usb_set_configuration+0xf59/0x16f0 [ 47.629829][ T1897]     usb_generic_driver_probe+0x82/0xa0 [ 47.630385][ T1897] usb_probe_device+0xbb/0x250 [ 47.630927][ T1897] ?     usb_suspend+0x590/0x590 [ 47.631397][ T1897] really_probe+0x205/0xb70 [ 47.631855][ T1897] ?     driver_allows_async_probing+0x130/0x130 [ 47.632469][ T1897] __driver_probe_device+0x311/0x4b0 [     47.633002][ ---truncated--- (CVE-2022-50258)

  - In the Linux kernel, the following vulnerability has been resolved: netlink: prevent potential spectre v1     gadgets Most netlink attributes are parsed and validated from __nla_validate_parse() or validate_nla() u16     type = nla_type(nla); if (type == 0 || type > maxtype) { /* error or continue */ } @type is then used as     an array index and can be used as a Spectre v1 gadget. array_index_nospec() can be used to prevent leaking     content of kernel memory to malicious users. This should take care of vast majority of netlink uses, but     an audit is needed to take care of others where validation is not yet centralized in core netlink     functions. (CVE-2023-53000)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Bad drive in topology     results kernel crash When the SAS Transport Layer support is enabled and a device exposed to the OS by the     driver fails INQUIRY commands, the driver frees up the memory allocated for an internal HBA port data     structure. However, in some places, the reference to the freed memory is not cleared. When the firmware     sends the Device Info change event for the same device again, the freed memory is accessed and that leads     to memory corruption and OS crash. (CVE-2023-53037)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053286 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    dm-bufio: don't schedule in atomic context

    A BUG was reported as below when CONFIG_DEBUG_ATOMIC_SLEEP and     try_verify_in_tasklet are enabled.
    [  129.444685][  T934] BUG: sleeping function called from invalid context at drivers/md/dm-bufio.c:2421     [  129.444723][  T934] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 934, name: kworker/1:4     [  129.444740][  T934] preempt_count: 201, expected: 0     [  129.444756][  T934] RCU nest depth: 0, expected: 0     [  129.444781][  T934] Preemption disabled at:
    [  129.444789][  T934] [<ffffffd816231900>] shrink_work+0x21c/0x248     [  129.445167][  T934] kernel BUG at kernel/sched/walt/walt_debug.c:16!     [  129.445183][  T934] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP     [  129.445204][  T934] Skip md ftrace buffer dump for: 0x1609e0     [  129.447348][  T934] CPU: 1 PID: 934 Comm: kworker/1:4 Tainted: G        W  OE     6.6.56-android15-8-o-g6f82312b30b9-debug #1 1400000003000000474e5500b3187743670464e8     [  129.447362][  T934] Hardware name: Qualcomm Technologies, Inc. Parrot QRD, Alpha-M (DT)     [  129.447373][  T934] Workqueue: dm_bufio_cache shrink_work     [  129.447394][  T934] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)     [  129.447406][  T934] pc : android_rvh_schedule_bug+0x0/0x8 [sched_walt_debug]     [  129.447435][  T934] lr : __traceiter_android_rvh_schedule_bug+0x44/0x6c     [  129.447451][  T934] sp : ffffffc0843dbc90     [  129.447459][  T934] x29: ffffffc0843dbc90 x28: ffffffffffffffff x27: 0000000000000c8b     [  129.447479][  T934] x26: 0000000000000040 x25: ffffff804b3d6260 x24: ffffffd816232b68     [  129.447497][  T934] x23: ffffff805171c5b4 x22: 0000000000000000 x21: ffffffd816231900     [  129.447517][  T934] x20: ffffff80306ba898 x19: 0000000000000000 x18: ffffffc084159030     [  129.447535][  T934] x17: 00000000d2b5dd1f x16: 00000000d2b5dd1f x15: ffffffd816720358     [  129.447554][  T934] x14: 0000000000000004 x13: ffffff89ef978000 x12: 0000000000000003     [  129.447572][  T934] x11: ffffffd817a823c4 x10: 0000000000000202 x9 : 7e779c5735de9400     [  129.447591][  T934] x8 : ffffffd81560d004 x7 : 205b5d3938373434 x6 : ffffffd8167397c8     [  129.447610][  T934] x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffffffc0843db9e0     [  129.447629][  T934] x2 : 0000000000002f15 x1 : 0000000000000000 x0 : 0000000000000000     [  129.447647][  T934] Call trace:
    [  129.447655][  T934]  android_rvh_schedule_bug+0x0/0x8 [sched_walt_debug     1400000003000000474e550080cce8a8a78606b6]     [  129.447681][  T934]  __might_resched+0x190/0x1a8     [  129.447694][  T934]  shrink_work+0x180/0x248     [  129.447706][  T934]  process_one_work+0x260/0x624     [  129.447718][  T934]  worker_thread+0x28c/0x454     [  129.447729][  T934]  kthread+0x118/0x158     [  129.447742][  T934]  ret_from_fork+0x10/0x20     [  129.447761][  T934] Code: ???????? ???????? ???????? d2b5dd1f (d4210000)     [  129.447772][  T934] ---[ end trace 0000000000000000 ]---

    dm_bufio_lock will call spin_lock_bh when try_verify_in_tasklet     is enabled, and __scan will be called in atomic context.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02000-1 advisory.

    The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
    - CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
    - CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
    - CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN     (bsc#1234154).
    - CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
    - CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
    - CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
    - CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
    - CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
    - CVE-2025-21919: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (bsc#1240593).
    - CVE-2025-22021: netfilter: socket: Lookup orig tuple for IPv6 SNAT (bsc#1241282).
    - CVE-2025-22030: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (bsc#1241376).
    - CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
    - CVE-2025-22057: net: decrease cached dst counters in dst_release (bsc#1241533).
    - CVE-2025-22063: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (bsc#1241351).
    - CVE-2025-22070: fs/9p: fix NULL pointer dereference on mkdir (bsc#1241305).
    - CVE-2025-22103: net: fix NULL pointer dereference in l3mdev_l3_rcv (bsc#1241448).
    - CVE-2025-23140: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error     (bsc#1242763).
    - CVE-2025-23150: ext4: fix off-by-one error in do_split (bsc#1242513).
    - CVE-2025-23160: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW     initialization (bsc#1242507).
    - CVE-2025-37748: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (bsc#1242523).
    - CVE-2025-37749: net: ppp: Add bound checking for skb data on ppp_sync_txmung (bsc#1242859).
    - CVE-2025-37750: smb: client: fix UAF in decryption with multichannel (bsc#1242510).
    - CVE-2025-37755: net: libwx: handle page_pool_dev_alloc_pages error (bsc#1242506).
    - CVE-2025-37773: virtiofs: add filesystem context source name check (bsc#1242502).
    - CVE-2025-37780: isofs: Prevent the use of too small fid (bsc#1242786).
    - CVE-2025-37787: net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered     (bsc#1242585).
    - CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
    - CVE-2025-37790: net: mctp: Set SOCK_RCU_FREE (bsc#1242509).
    - CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
    - CVE-2025-37803: udmabuf: fix a buf size overflow issue during udmabuf creation (bsc#1242852).
    - CVE-2025-37804: io_uring: always do atomic put from iowq (bsc#1242854).
    - CVE-2025-37809: usb: typec: class: Unlocked on error in typec_register_partner() (bsc#1242856).
    - CVE-2025-37820: xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (bsc#1242866).
    - CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
    - CVE-2025-37824: tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (bsc#1242867).
    - CVE-2025-37829: cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (bsc#1242875).
    - CVE-2025-37830: cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (bsc#1242860).
    - CVE-2025-37831: cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (bsc#1242861).
    - CVE-2025-37833: net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (bsc#1242868).
    - CVE-2025-37842: spi: fsl-qspi: Fix double cleanup in probe error path (bsc#1242951).
    - CVE-2025-37870: drm/amd/display: prevent hang on link training fail (bsc#1243056).
    - CVE-2025-37879: 9p/net: fix improper handling of bogus negative read/write replies (bsc#1243077).
    - CVE-2025-37886: pds_core: make wait_context part of q_info (bsc#1242944).
    - CVE-2025-37887: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (bsc#1242962).
    - CVE-2025-37949: xenbus: Use kref to track req lifetime (bsc#1243541).
    - CVE-2025-37954: smb: client: Avoid race in open_cached_dir with lease breaks (bsc#1243664).
    - CVE-2025-37957: KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (bsc#1243513).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-37960: memblock: Accept allocated memory before use in memblock_double_array() (bsc#1243519).
    - CVE-2025-37974: s390/pci: Fix missing check for zpci_create_device() error return (bsc#1243547).
    - CVE-2025-38152: remoteproc: core: Clear table_sz when rproc_shutdown (bsc#1241627).
    - CVE-2025-38637: net_sched: skbprio: Remove overly strict queue assertions (bsc#1241657).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 25.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7649-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - PA-RISC architecture;

    - PowerPC architecture;

    - S390 architecture;

    - x86 architecture;

    - Compute Acceleration Framework;

    - Ublk userspace block driver;

    - Bluetooth drivers;

    - ARM SCMI message protocol;

    - GPU drivers;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - Multiple devices driver;

    - Network drivers;

    - PCI subsystem;

    - PTP clock framework;

    - SPI subsystem;

    - BTRFS file system;

    - SMB network file system;

    - eXpress Data Path;

    - Universal MIDI packet (UMP) support module;

    - Tracing infrastructure;

    - Memory management;

    - IPv4 networking;

    - IPv6 networking;

    - Network traffic control;

    - AMD SoC Alsa drivers;

    - SoC Audio generic drivers; (CVE-2025-37898, CVE-2025-37990, CVE-2025-37974, CVE-2025-37991,     CVE-2025-37894, CVE-2025-37906, CVE-2025-37896, CVE-2025-37909, CVE-2025-37923, CVE-2025-37899,     CVE-2025-37901, CVE-2025-37914, CVE-2025-38216, CVE-2025-37931, CVE-2025-37928, CVE-2025-37916,     CVE-2025-37908, CVE-2025-37915, CVE-2025-37917, CVE-2025-37921, CVE-2025-37903, CVE-2025-37922,     CVE-2025-37895, CVE-2025-37936, CVE-2025-37933, CVE-2025-37891, CVE-2025-37926, CVE-2025-37912,     CVE-2025-37920, CVE-2025-37924, CVE-2025-37927, CVE-2025-37946, CVE-2025-37907, CVE-2025-37930,     CVE-2025-37911, CVE-2025-37905, CVE-2025-37900, CVE-2025-37929, CVE-2025-37910, CVE-2025-37913,     CVE-2025-37935, CVE-2025-37919, CVE-2025-37918, CVE-2025-37897, CVE-2025-37904, CVE-2025-37934)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20530 advisory.

    - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38137447]     {CVE-2025-38089}
    - Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
    - x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38172252]     {CVE-2024-36350} {CVE-2024-36357}
    - Add normal counters (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
    - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38172252]     {CVE-2024-36350} {CVE-2024-36357}
    - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38172252]     {CVE-2024-36350} {CVE-2024-36357}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02307-1 advisory.

    The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-52888: media: mediatek: vcodec: Only free buffer VA that is not NULL (bsc#1228557).
    - CVE-2024-49568: net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg     (bsc#1235728).
    - CVE-2024-57982: xfrm: state: fix out-of-bounds read during lookup (bsc#1237913).
    - CVE-2024-57995: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev()     (bsc#1237895).
    - CVE-2024-58053: rxrpc: Fix handling of received connection abort (bsc#1238982).
    - CVE-2025-21720: xfrm: delete intermediate secpath entry in packet offload mode (bsc#1238859).
    - CVE-2025-21868: kABI workaround for adding an header (bsc#1240180).
    - CVE-2025-21898: ftrace: Avoid potential division by zero in function_stat_show() (bsc#1240610).
    - CVE-2025-21899: tracing: Fix bad hist from corrupting named_triggers list (bsc#1240577).
    - CVE-2025-21920: vlan: enforce underlying device type (bsc#1240686).
    - CVE-2025-21938: mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr (bsc#1240723).
    - CVE-2025-21959: netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()     (bsc#1240814).
    - CVE-2025-21997: xsk: fix an integer overflow in xp_create_and_assign_umem() (bsc#1240823).
    - CVE-2025-22035: tracing: Fix use-after-free in print_graph_function_flags during tracer switching     (bsc#1241544).
    - CVE-2025-22111: kABI fix for net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF (bsc#1241572).
    - CVE-2025-22113: ext4: define ext4_journal_destroy wrapper (bsc#1241617).
    - CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
    - CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
    - CVE-2025-37743: wifi: ath12k: Avoid memory leak while enabling statistics (bsc#1242163).
    - CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
    - CVE-2025-37756: net: tls: explicitly disallow disconnect (bsc#1242515).
    - CVE-2025-37757: tipc: fix memory leak in tipc_link_xmit (bsc#1242521).
    - CVE-2025-37786: net: dsa: free routing table on probe failure (bsc#1242725).
    - CVE-2025-37800: driver core: fix potential NULL pointer dereference in dev_uevent() (bsc#1242849).
    - CVE-2025-37801: spi: spi-imx: Add check for spi_imx_setupxfer() (bsc#1242850).
    - CVE-2025-37811: usb: chipidea: ci_hdrc_imx: fix usbmisc handling (bsc#1242907).
    - CVE-2025-37837: iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (bsc#1242952).
    - CVE-2025-37844: cifs: avoid NULL pointer dereference in dbg call (bsc#1242946).
    - CVE-2025-37859: page_pool: avoid infinite loop to schedule delayed worker (bsc#1243051).
    - CVE-2025-37862: HID: pidff: Fix null pointer dereference in pidff_find_fields (bsc#1242982).
    - CVE-2025-37865: net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported     (bsc#1242954).
    - CVE-2025-37874: net: ngbe: fix memory leak in ngbe_probe() error path (bsc#1242940).
    - CVE-2025-37884: bpf: Fix deadlock between rcu_tasks_trace and event_mutex (bsc#1243060).
    - CVE-2025-37909: net: lan743x: Fix memleak issue when GSO enabled (bsc#1243467).
    - CVE-2025-37917: net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (bsc#1243475).
    - CVE-2025-37921: vxlan: vnifilter: Fix unlocked deletion of default FDB entry (bsc#1243480).
    - CVE-2025-37923: tracing: Fix oob write in trace_seq_to_buffer() (bsc#1243551).
    - CVE-2025-37927: iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (bsc#1243620).
    - CVE-2025-37933: octeon_ep: Fix host hang issue during device reboot (bsc#1243628).
    - CVE-2025-37936: perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value (bsc#1243537).
    - CVE-2025-37938: tracing: Verify event formats that have '%*p..' (bsc#1243544).
    - CVE-2025-37945: net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY     (bsc#1243538).
    - CVE-2025-37954: smb: client: Avoid race in open_cached_dir with lease breaks (bsc#1243664).
    - CVE-2025-37961: ipvs: fix uninit-value for saddr in do_output_route4 (bsc#1243523).
    - CVE-2025-37967: usb: typec: ucsi: displayport: Fix deadlock (bsc#1243572).
    - CVE-2025-37968: iio: light: opt3001: fix deadlock due to concurrent flag access (bsc#1243571).
    - CVE-2025-37987: pds_core: Prevent possible adminq overflow/stuck condition (bsc#1243542).
    - CVE-2025-37992: net_sched: Flush gso_skb list too during ->change() (bsc#1243698).
    - CVE-2025-37995: module: ensure that kobject_put() is safe for module type kobjects (bsc#1243827).
    - CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
    - CVE-2025-37998: openvswitch: Fix unsafe attribute parsing in output_userspace() (bsc#1243836).
    - CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
    - CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
    - CVE-2025-38011: drm/amdgpu: csa unmap use uninterruptible lock (bsc#1244729).
    - CVE-2025-38018: net/tls: fix kernel panic when alloc_page failed (bsc#1244999).
    - CVE-2025-38053: idpf: fix null-ptr-deref in idpf_features_check (bsc#1244746).
    - CVE-2025-38055: perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq (bsc#1244747).
    - CVE-2025-38057: espintcp: fix skb leaks (bsc#1244862).
    - CVE-2025-38060: bpf: abort verification if env->cur_state->loop_entry != NULL (bsc#1245155).
    - CVE-2025-38072: libnvdimm/labels: Fix divide error in nd_label_data_init() (bsc#1244743).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02334-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-47212: net/mlx5: Update error handler for UCTX and UMEM (bsc#1222709).
    - CVE-2021-47455: ptp: Fix possible memory leak in ptp_clock_register() (bsc#1225254).
    - CVE-2021-47527: serial: core: fix transmit-buffer reset and memleak (bsc#1227768).
    - CVE-2022-21546: scsi: target: Fix WRITE_SAME No Data Buffer crash (bsc#1242243).
    - CVE-2022-49154: KVM: SVM: fix panic on out-of-bounds guest IRQ (bsc#1238167).
    - CVE-2022-49622: netfilter: nf_tables: fix crash when nf_trace is enabled (bsc#1239042).
    - CVE-2022-49731: ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (bsc#1239071).
    - CVE-2022-49764: kABI: workaround 'bpf: Prevent bpf program recursion for raw tracepoint probes' changes     (bsc#1242301).
    - CVE-2022-49780: scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()     (bsc#1242262).
    - CVE-2022-49814: kcm: close race conditions on sk_receive_queue (bsc#1242498).
    - CVE-2022-49879: ext4: fix BUG_ON() when directory entry has invalid rec_len (bsc#1242733).
    - CVE-2022-49881: wifi: cfg80211: fix memory leak in query_regdb_file() (bsc#1242481).
    - CVE-2022-49917: ipvs: fix WARNING in ip_vs_app_net_cleanup() (bsc#1242406).
    - CVE-2022-49921: net: sched: Fix use after free in red_enqueue() (bsc#1242359).
    - CVE-2022-50055: iavf: Fix adminq error handling (bsc#1245039).
    - CVE-2022-50087: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (bsc#1245119).
    - CVE-2022-50134: RDMA/hfi1: fix potential memory leak in setup_base_ctxt() (bsc#1244802).
    - CVE-2022-50200: selinux: Add boundary check in put_entry() (bsc#1245149).
    - CVE-2023-52500: Fixed information leaking when processing OPC_INB_SET_CONTROLLER_CONFIG command     (bsc#1220883).
    - CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
    - CVE-2023-53020: l2tp: fix lockdep splat (bsc#1240224).
    - CVE-2023-53090: drm/amdkfd: Fix an illegal memory access (bsc#1242753).
    - CVE-2023-53091: ext4: update s_journal_inum if it changes after journal replay (bsc#1242767).
    - CVE-2023-53133: bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()     (bsc#1242423).
    - CVE-2024-26586: mlxsw: spectrum_acl_tcam: Fix stack corruption (bsc#1220243).
    - CVE-2024-26825: nfc: nci: free rx_data_reassembly skb on NCI device cleanup (bsc#1223065).
    - CVE-2024-26872: RDMA/srpt: Do not register event handler until srpt device is fully setup (bsc#1223115).
    - CVE-2024-26875: media: pvrusb2: fix uaf in pvr2_context_set_notify (bsc#1223118).
    - CVE-2024-35790: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device     attribute group (bsc#1224712).
    - CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info     (bsc#1224726).
    - CVE-2024-38588: ftrace: Fix possible use-after-free issue in ftrace_location() (bsc#1226837).
    - CVE-2024-57982: xfrm: state: fix out-of-bounds read during lookup (bsc#1237913).
    - CVE-2025-21898: ftrace: Avoid potential division by zero in function_stat_show() (bsc#1240610).
    - CVE-2025-21920: vlan: enforce underlying device type (bsc#1240686).
    - CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1240799).
    - CVE-2025-22035: tracing: Fix use-after-free in print_graph_function_flags during tracer switching     (bsc#1241544).
    - CVE-2025-23149: tpm: do not start chip while suspended (bsc#1242758).
    - CVE-2025-37756: net: tls: explicitly disallow disconnect (bsc#1242515).
    - CVE-2025-37757: tipc: fix memory leak in tipc_link_xmit (bsc#1242521).
    - CVE-2025-37781: i2c: cros-ec-tunnel: defer probe if parent EC is not present (bsc#1242575).
    - CVE-2025-37800: driver core: fix potential NULL pointer dereference in dev_uevent() (bsc#1242849).
    - CVE-2025-37810: usb: dwc3: gadget: check that event count does not exceed event buffer length     (bsc#1242906).
    - CVE-2025-37836: PCI: Fix reference leak in pci_register_host_bridge() (bsc#1242957).
    - CVE-2025-37844: cifs: avoid NULL pointer dereference in dbg call (bsc#1242946).
    - CVE-2025-37862: HID: pidff: Fix null pointer dereference in pidff_find_fields (bsc#1242982).
    - CVE-2025-37892: mtd: inftlcore: Add error check for inftl_read_oob() (bsc#1243536).
    - CVE-2025-37911: bnxt_en: Fix out-of-bound memcpy() during ethtool -w (bsc#1243469).
    - CVE-2025-37923: tracing: Fix oob write in trace_seq_to_buffer() (bsc#1243551).
    - CVE-2025-37927: iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (bsc#1243620).
    - CVE-2025-37928: dm-bufio: do not schedule in atomic context (bsc#1243621).
    - CVE-2025-37961: ipvs: fix uninit-value for saddr in do_output_route4 (bsc#1243523).
    - CVE-2025-37980: block: fix resource leak in blk_register_queue() error path (bsc#1243522).
    - CVE-2025-37982: wifi: wl1251: fix memory leak in wl1251_tx_work (bsc#1243524).
    - CVE-2025-37992: net_sched: Flush gso_skb list too during ->change() (bsc#1243698).
    - CVE-2025-37995: module: ensure that kobject_put() is safe for module type kobjects (bsc#1243827).
    - CVE-2025-37998: openvswitch: Fix unsafe attribute parsing in output_userspace() (bsc#1243836).
    - CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
    - CVE-2025-38004: can: bcm: add locking for bcm_op runtime updates (bsc#1244274).
    - CVE-2025-38023: nfs: handle failure of nfs_get_lock_context in unlock path (bsc#1245004).
    - CVE-2025-38024: RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (bsc#1245025).
    - CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write()     (bsc#1245440).
    - CVE-2025-38072: libnvdimm/labels: Fix divide error in nd_label_data_init() (bsc#1244743).
    - CVE-2025-38078: ALSA: pcm: Fix race of buffer access at PCM OSS layer (bsc#1244737).
    - CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
361020	CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1773048865)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	high
236949	Photon OS 5.0: Linux PHSA-2025-5.0-0521	Nessus	PhotonOS Local Security Checks	2025/5/19	2026/7/22	high
352030	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1765463110)	Nessus	Alma Linux Local Security Checks	2026/9/30	2026/10/1	high
343200	Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053286)	Nessus	Unity Linux Local Security Checks	2026/9/6	2026/9/6	high
333653	Photon OS 5.0: Linux PHSA-2025-5.0-91-0521	Nessus	PhotonOS Local Security Checks	2026/8/10	2026/8/10	high
240762	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:02000-1)	Nessus	SuSE Local Security Checks	2025/6/27	2025/9/24	medium
242280	Ubuntu 25.04 : Linux kernel vulnerabilities (USN-7649-1)	Nessus	Ubuntu Local Security Checks	2025/7/17	2025/7/17	medium
252244	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20530)	Nessus	Oracle Linux Local Security Checks	2025/8/19	2026/2/9	medium
242099	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2025:02307-1)	Nessus	SuSE Local Security Checks	2025/7/15	2026/9/29	high
242218	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2025:02334-1)	Nessus	SuSE Local Security Checks	2025/7/17	2026/6/26	critical

检测

插件搜索

high

high

high

high

high

medium

medium

medium

high

critical