Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - blk-mq避免双重 ->queue_rq()因为提前超时 David Jeffery 发现一个双重 ->queue_rq() 问题目前为止可在 VM 使用案例中触发原因是 vCPU pthread 或 的长 vmexit 延迟或抢占延迟vCPU pthread 中存在长页面错误则在 ->queue_rq() 期间调用 blk_mq_start_request() 之后在将请求排队到硬件之前块 IO req 可能超时那么超时处理程序可能通过重新排队然后双重 ->queue_rq()会导致内核错误。目前为止驱动程序有责任解决超时与完成之间的争用因此假设驱动程序具有足够的知识理论上此争用问题似乎应在驱动程序中解决。但是这确实是一个常见问题许多驱动程序可能有类似的问题并且即使驱动程序处理争用也可能难以修复所有受影响的驱动程序。因此 David 建议使用此修补程序通过耗尽 in-progress ->queue_rq() 来解决此问题。
    (CVE-2022-50554)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - blk-mq避免雙重 ->queue_rq() 因為提前逾時 David Jeffery 發現一個雙重 ->queue_rq() 問題到目前為止它可以在 VM 使用案例中觸發這是因為 vCPU pthread 的長 vmexit 延遲或先佔延遲所導致 或vCPU pthread 中發生長頁面錯誤然後在將對硬體的要求排入佇列之前但在 ->queue_rq() 期間呼叫 blk_mq_start_request() 之后區塊 IO req 逾時則逾時處置程式可能會透過重新佇列再重複 ->queue_rq() 的方式來處理會造成核心錯誤。目前為止驅動程式有責任解決逾時和完成之間的爭用問題因此理論上應該在驅動程式中解決假設驅動程式有足夠的知識。但這確實是一個常見問題許多驅動程式可能有類似問題而且可能難以修正所有受影響的驅動程式即使驅動程式不容易處理爭用也是如此。因此 David 建議此修補程式透過排出進行中的 ->queue_rq() 來解決此問題。
    (CVE-2022-50554)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - blk-mq早期のタイムアウトのため、二重の ->queue_rq() を回避します。David Jeffery 氏は、二重の ->queue_rq() の問題を 1 つ見つけました。現時点では、長い vmexit 遅延または vCPU pthread またはプリエンプション遅延のために、VM ユースケースでトリガーされる可能性があります。 vCPU pthread の長いページ障害の後、ブロック IO req は、リクエストをハードウェアへキューイングする前にタイムアウトになる可能性がありますが、->queue_rq() 中に blk_mq_start_request() を呼び出した後に、タイムアウトハンドラーがこれを requeue で処理し、続いて double ->queue_rq() で処理する可能性があります。が引き起こされ、カーネルパニックが発生します。これまで、タイムアウトと完了の間の競合をカバーするのはドライバーの責任であるため、ドライバーに十分な知識があるなら、理論上はドライバーで解決されるはずです。しかし、これは非常に一般的な問題の 1 つであり、多くのドライバーに類似の問題がある可能性があり、ドライバーが競合を処理するのは簡単ではないものの、影響を受けるすべてのドライバーを修正するのは困難なことがあります。David は、この問題を解決するために、in-progress ->queue_rq() をドレインすることにより、このパッチを提案しています。
    (CVE-2022-50554)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    net: drop UFO packets in udp_rcv_segment()(CVE-2025-38622)

    A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D     cache, potentially resulting in the leakage of sensitive information across privileged     boundaries.(CVE-2024-36357)

    x86/mce: Work around an erratum on fast string copy instructions(CVE-2022-49124)

    scsi: qla2xxx: Implement ref count for SRB(CVE-2022-49159)

    rcu: Fix rcu_read_unlock() deadloop due to IRQ work(CVE-2025-39744)

    jbd2: prevent softlockup in jbd2_log_do_checkpoint()(CVE-2025-39782)

    drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED(CVE-2022-50390)

    crypto: essiv - Check ssize for decryption and in-place encryption(CVE-2025-40019)

    media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and     w7090p_tuner_read_serpar(CVE-2025-38693)

    rcu: Protect -defer_qs_iw_pending from data race(CVE-2025-39749)

    fbdev: Fix vmalloc out-of-bounds write in fast_imageblit(CVE-2025-38685)

    media: rc: fix races with imon_disconnect()(CVE-2025-39993)

    mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()(CVE-2023-53401)

    scsi: lpfc: Use memcpy() for BIOS version(CVE-2025-38332)

    usb: core: config: Prevent OOB read in SS endpoint companion parsing(CVE-2025-39760)

    scsi: qla2xxx: Fix premature hw access after PCI error(CVE-2022-49157)

    fbcon: fix integer overflow in fbcon_do_set_font(CVE-2025-39967)

    scsi: target: iscsi: Fix a race condition between login_work and the login thread(CVE-2022-50350)

    mm: fix uprobe pte be overwritten when expanding vma(CVE-2025-38207)

    scsi: qla2xxx: Fix crash when I/O abort times out(CVE-2022-50493)

    media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()(CVE-2025-38680)

    scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()(CVE-2023-53530)

    fs/buffer: fix use-after-free when call bh_read() helper(CVE-2025-39691)

    HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras(CVE-2025-38540)

    mmc: rtsx_pci: fix return value check of mmc_add_host()(CVE-2022-50267)

    RDMA/mlx5: Initialize obj_event-obj_sub_list before xa_insert(CVE-2025-38387)

    i40e: fix validation of VF state in get resources(CVE-2025-39969)

    vxlan: Fix NPD when refreshing an FDB entry with a nexthop object(CVE-2025-39851)

    tracing: Limit access to parser-buffer when trace_get_user failed(CVE-2025-39683)

    firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle(CVE-2023-53250)

    perf: arm_spe: Prevent overflow in PERF_IDX2OFF()(CVE-2025-40081)

    ARM: rockchip: fix kernel hang during smp initialization(CVE-2025-39752)

    x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper(CVE-2025-39681)

    i40e: Fix potential invalid access when MAC list is empty(CVE-2025-39853)

    drm/dp_mst: Fix MST sideband message body length check(CVE-2024-56616)

    vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint(CVE-2025-22083)

    bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT(CVE-2025-38439)

    tracing: Fix race condition in kprobe initialization causing NULL pointer dereference(CVE-2025-40042)

    PCI/ASPM: Fix link state exit during switch upstream function removal(CVE-2024-58093)

    ext4: detect invalid INLINE_DATA + EXTENTS flag combination(CVE-2025-40167)

    scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()(CVE-2023-53696)

    qed: Don't collect too many protection override GRC elements(CVE-2025-39949)

    partitions: mac: fix handling of bogus partition table(CVE-2025-21772)

    usb: xhci: Apply the link chain quirk on NEC isoc endpoints(CVE-2025-22022)

    start_kernel: Add __no_stack_protector function attribute(CVE-2023-53491)

    isofs: Prevent the use of too small fid(CVE-2025-37780)

    crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg(CVE-2025-39964)

    acpi: nfit: fix narrowing conversion in acpi_nfit_ctl(CVE-2025-22044)

    KVM: x86: Reset IRTE to host control if *new* route isn't postable(CVE-2025-37885)

    i40e: fix MMIO write access to an invalid page in i40e_clear_hw(CVE-2025-38200)

    net/sched: sch_qfq: Fix null-deref in agg_dequeue(CVE-2025-40083)

    net/sched: sch_qfq: Fix race condition on qfq_aggregate(CVE-2025-38477)

    KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O(CVE-2025-40026)

    fs: udf: fix OOB read in lengthAllocDescs handling(CVE-2025-40044)

    x86/vmscape: Add conditional IBPB mitigation(CVE-2025-40300)

    ppp: fix memory leak in pad_compress_skb(CVE-2025-39847)

    benet: fix BUG when creating VFs(CVE-2025-38569)

    uio_hv_generic: Let userspace take care of interrupt mask(CVE-2025-40048)

    HID: ignore non-functional sensor in HP 5MP Camera(CVE-2025-21992)

    Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or     5th generation Xeon(R) processors may allow an authorized user to potentially enable escalation of     privilege local access(CVE-2024-21823)

    cacheinfo: Fix shared_cpu_map to handle shared caches at different levels(CVE-2023-53254)

    usb: net: sierra: check for no status endpoint(CVE-2025-38474)

    NFSD: Define a proc_layoutcommit for the FlexFiles layout type(CVE-2025-40087)

    vfs: Don't leak disconnected dentries on umount(CVE-2025-40105)

    netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX(CVE-2025-38201)

    firewire: net: fix use after free in fwnet_finish_incoming_packet()(CVE-2023-53432)

    serial: 8250: fix panic due to PSLVERR(CVE-2025-39724)

    HID: core: Harden s32ton() against conversion to 0 bits(CVE-2025-38556)

    tracing: dynevent: Add a missing lockdown check on dynevent(CVE-2025-40021)

    NFS: Fix the setting of capabilities when automounting a new filesystem(CVE-2025-39798)

    RDMA/core: Fix 'KASAN: slab-use-after-free Read in ib_register_device' problem(CVE-2025-38022)

    hv_netvsc: Fix panic during namespace deletion with VF(CVE-2025-38683)

    mm/slub: avoid accessing metadata when pointer is invalid in object_err()(CVE-2025-39902)

    calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().(CVE-2025-38181)

    crypto: rng - Ensure set_ent is always present(CVE-2025-40109)

    ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr(CVE-2025-38701)

    RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()(CVE-2025-39742)

    ice: Fix a null pointer dereference in ice_copy_and_init_pkg()(CVE-2025-38664)

    netfilter: nf_tables: reject duplicate device on updates(CVE-2025-38678)

    ipvs: Defer ip_vs_ftp unregister during netns cleanup(CVE-2025-40018)

    vsock: Do not allow binding to VMADDR_PORT_ANY(CVE-2025-38618)

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare(CVE-2025-39817)

    blk-mq: avoid double -queue_rq() because of early timeout(CVE-2022-50554)

    i40e: add max boundary check for VF filters(CVE-2025-39968)

    net/packet: fix a race in packet_set_ring() and packet_notifier()(CVE-2025-38617)

    xfrm: Duplicate SPI Handling(CVE-2025-39797)

    loop: Avoid updating block size under exclusive owner(CVE-2025-38709)

    scsi: target: Fix WRITE_SAME No Data Buffer crash(CVE-2022-21546)

    ftrace: Fix potential warning in trace_printk_seq during ftrace_dump(CVE-2025-39813)

    cgroup: split cgroup_destroy_wq into 3 workqueues(CVE-2025-39953)

    ext4: fix potential out of bound read in ext4_fc_replay_scan()(CVE-2022-50306)

    padata: Fix pd UAF once and for all(CVE-2025-38584)

    i40e: add validation for ring_len param(CVE-2025-39973)

    mm: fix zswap writeback race condition(CVE-2023-53178)

    bnxt: avoid overflow in bnxt_get_nvram_directory()(CVE-2023-53661)

    tracing: Fix reading strings from synthetic events(CVE-2022-50255)

    trace/fgraph: Fix the warning caused by missing unregister notifier(CVE-2025-39829)

    tee: fix NULL pointer dereference in tee_shm_put(CVE-2025-39865)

    scsi: qla2xxx: Fix warning message due to adisc being flushed(CVE-2022-49158)

    thunderbolt: Do not double dequeue a configuration request(CVE-2025-38174)

    pNFS: Fix uninited ptr deref in block/scsi layout(CVE-2025-38691)

    i40e: fix idx validation in config queues msg(CVE-2025-39971)

    ftrace: Also allocate and copy hash for reading of filter files(CVE-2025-39689)

    net/sched: Restrict conditions for adding duplicating netems to qdisc tree(CVE-2025-38553)

    bpf: Fix oob access in cgroup local storage(CVE-2025-38502)

    vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects(CVE-2025-39850)

    cnic: Fix use-after-free bugs in cnic_delete_task(CVE-2025-39945)

    i40e: fix input validation logic for action_meta(CVE-2025-39970)

    drm/sched: Increment job count before swapping tail spsc queue(CVE-2025-38515)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-021572 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    blk-mq: avoid double ->queue_rq() because of early timeout

    David Jeffery found one double ->queue_rq() issue, so far it can     be triggered in VM use case because of long vmexit latency or preempt     latency of vCPU pthread or long page fault in vCPU pthread, then block     IO req could be timed out before queuing the request to hardware but after     calling blk_mq_start_request() during ->queue_rq(), then timeout handler     may handle it by requeue, then double ->queue_rq() is caused, and kernel     panic.

    So far, it is driver's responsibility to cover the race between timeout     and completion, so it seems supposed to be solved in driver in theory,     given driver has enough knowledge.

    But it is really one common problem, lots of driver could have similar     issue, and could be hard to fix all affected drivers, even it isn't easy     for driver to handle the race. So David suggests this patch by draining     in-progress ->queue_rq() for solving this issue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D     cache, potentially resulting in the leakage of sensitive information across privileged     boundaries.(CVE-2024-36357)

    bpf: Fix oob access in cgroup local storage(CVE-2025-38502)

    vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects(CVE-2025-39850)

    tracing: Fix reading strings from synthetic events(CVE-2022-50255)

    x86/mce: Work around an erratum on fast string copy instructions(CVE-2022-49124)

    serial: 8250: fix panic due to PSLVERR(CVE-2025-39724)

    fbcon: fix integer overflow in fbcon_do_set_font(CVE-2025-39967)

    i40e: add max boundary check for VF filters(CVE-2025-39968)

    scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()(CVE-2023-53530)

    scsi: qla2xxx: Fix premature hw access after PCI error(CVE-2022-49157)

    vxlan: Fix NPD when refreshing an FDB entry with a nexthop object(CVE-2025-39851)

    bpf, cpumap: Make sure kthread is running before map update returns(CVE-2023-53577)

    scsi: qla4xxx: Add length check when parsing nlattrs(CVE-2023-53456)

    bnxt: avoid overflow in bnxt_get_nvram_directory()(CVE-2023-53661)

    scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()(CVE-2023-53521)

    pNFS: Fix uninited ptr deref in block/scsi layout(CVE-2025-38691)

    udf: Fix uninitialized array access for some pathnames(CVE-2023-53165)

    scsi: qla2xxx: Pointer may be dereferenced(CVE-2023-53150)

    firewire: net: fix use after free in fwnet_finish_incoming_packet()(CVE-2023-53432)

    i40e: fix MMIO write access to an invalid page in i40e_clear_hw(CVE-2025-38200)

    RDMA/mlx5: Initialize obj_event-obj_sub_list before xa_insert(CVE-2025-38387)

    usb: net: sierra: check for no status endpoint(CVE-2025-38474)

    hv_netvsc: Fix panic during namespace deletion with VF(CVE-2025-38683)

    ext4: improve error handling from ext4_dirhash()(CVE-2023-53473)

    benet: fix BUG when creating VFs(CVE-2025-38569)

    mm/slub: avoid accessing metadata when pointer is invalid in object_err()(CVE-2025-39902)

    xfrm: Duplicate SPI Handling(CVE-2025-39797)

    i40e: fix validation of VF state in get resources(CVE-2025-39969)

    i40e: fix input validation logic for action_meta(CVE-2025-39970)

    cnic: Fix use-after-free bugs in cnic_delete_task(CVE-2025-39945)

    net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb(CVE-2023-53548)

    bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT(CVE-2025-38439)

    blk-mq: avoid double -queue_rq() because of early timeout(CVE-2022-50554)

    NFSD: Define a proc_layoutcommit for the FlexFiles layout type(CVE-2025-40087)

    tracing: dynevent: Add a missing lockdown check on dynevent(CVE-2025-40021)

    ppp: fix memory leak in pad_compress_skb(CVE-2025-39847)

    i40e: Fix potential invalid access when MAC list is empty(CVE-2025-39853)

    IB/hfi1: Fix possible panic during hotplug remove(CVE-2023-53488)

    vfs: Don't leak disconnected dentries on umount(CVE-2025-40105)

    In kernel/trace/trace_kprobe.c at line 1308, the kprobe_perf_func function attempts to access the call-     perf_events pointer, but due to the race condition, this pointer may not have been properly     initialized.(CVE-2025-40042)

    perf: arm_spe: Prevent overflow in PERF_IDX2OFF()(CVE-2025-40081)

    crypto: essiv - Check ssize for decryption and in-place encryption(CVE-2025-40019)

    loop: Avoid updating block size under exclusive owner(CVE-2025-38709)

    usb: xhci: Apply the link chain quirk on NEC isoc endpoints(CVE-2025-22022)

    nfsd: put dl_stid if fail to queue dl_recall(CVE-2025-22025)

    PCI/ASPM: Fix link state exit during switch upstream function removal(CVE-2024-58093)

    KVM: arm64: Prevent access to vCPU events before init(CVE-2025-40102)

    HID: ignore non-functional sensor in HP 5MP Camera(CVE-2025-21992)

    partitions: mac: fix handling of bogus partition table(CVE-2025-21772)

    fs: udf: fix OOB read in lengthAllocDescs handling(CVE-2025-40044)

    acpi: nfit: fix narrowing conversion in acpi_nfit_ctl(CVE-2025-22044)

    crypto: rng - Ensure set_ent is always present(CVE-2025-40109)

    scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()(CVE-2023-53696)

    drm/hisilicon/hibmc: fix the hibmc loaded failed bug(CVE-2025-39772)

    uio_hv_generic: Let userspace take care of interrupt mask(CVE-2025-40048)

    KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O(CVE-2025-40026)

    ext4: detect invalid INLINE_DATA + EXTENTS flag combination(CVE-2025-40167)

    scsi: ses: Fix possible desc_ptr out-of-bounds accesses(CVE-2023-53675)

    fs: quota: create dedicated workqueue for quota_release_work(CVE-2025-40196)

    crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg(CVE-2025-39964)

    mtd: core: fix possible resource leak in init_mtd()(CVE-2022-50304)

    RDMA/mlx5: Return the firmware result upon destroying QP/RQ(CVE-2023-53286)

    bnxt_en: Fix memory corruption when FW resources change during ifdown(CVE-2025-39810)

    RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()(CVE-2023-53335)

    fs: dlm: fix invalid derefence of sb_lvbptr(CVE-2022-50516)

    scsi: mpt3sas: Fix a memory leak(CVE-2023-53512)

    ext4: fix off-by-one errors in fast-commit block filling(CVE-2022-50428)

    KVM: x86: Reset IRTE to host control if *new* route isn't postable(CVE-2025-37885)

    PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type(CVE-2025-23161)

    scsi: st: Fix array overflow in st_setup()(CVE-2025-37857)

    isofs: Prevent the use of too small fid(CVE-2025-37780)

    md/raid1,raid10: don't ignore IO flags(CVE-2025-22125)

    virtiofs: add filesystem context source name check(CVE-2025-37773)

    vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint(CVE-2025-22083)

    crypto: af_alg - Set merge to zero early in af_alg_sendmsg(CVE-2025-39931)

    modpost: fix off by one in is_executable_section()(CVE-2023-53397)

    scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()(CVE-2025-40115)

    net: bridge: fix soft lockup in br_multicast_query_expired()(CVE-2025-39773)

    arm64: csum: Fix OoB access in IP checksum code for negative lengths(CVE-2023-53726)

    x86/MCE: Always save CS register on AMD Zen IF Poison errors(CVE-2023-53438)

    PCI: Fix reference leak in pci_register_host_bridge()(CVE-2025-37836)

    cacheinfo: Fix shared_cpu_map to handle shared caches at different levels(CVE-2023-53254)

    NFS: Fix the setting of capabilities when automounting a new filesystem(CVE-2025-39798)

    Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or     5th generation Xeon(R) processors may allow an authorized user to potentially enable escalation of     privilege local access(CVE-2024-21823)

    mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory(CVE-2025-39883)

    virtio_net: Fix error unwinding of XDP initialization(CVE-2023-53499)

    RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device(CVE-2023-53393)

    gfs2: No more self recovery(CVE-2025-38659)

    scsi: target: Fix WRITE_SAME No Data Buffer crash(CVE-2022-21546)

    cifs: Fix connections leak when tlink setup failed(CVE-2022-49822)

    cifs: avoid NULL pointer dereference in dbg call(CVE-2025-37844)

    smb3: fix for slab out of bounds on mount to ksmbd(CVE-2025-38728)

    ceph: fix race condition validating r_parent before applying state(CVE-2025-39927)

    cifs: fix small mempool leak in SMB2_negotiate()(CVE-2022-49938)

    NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()(CVE-2025-39730)

    smb: client: fix use-after-free in cifs_oplock_break(CVE-2025-38527)

    scsi: qla2xxx: Fix potential NULL pointer dereference(CVE-2023-53451)

    objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()(CVE-2025-37937)

    scsi: libiscsi: Initialize iscsi_conn-dd_data only if memory is allocated(CVE-2025-38700)

    block: fix resource leak in blk_register_queue() error path(CVE-2025-37980)

    scsi: target: Fix multiple LUN_RESET handling(CVE-2023-53586)

    md/raid1: Fix stack memory use after return in raid1_reshape(CVE-2025-38445)

    blk-mq: fix NULL dereference on q-elevator in blk_mq_elv_switch_none(CVE-2023-53292)

    scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses(CVE-2023-7324)

    nbd: restrict sockets to TCP and UDP(CVE-2025-40080)

    scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()(CVE-2023-53676)

    mm: hugetlb: avoid soft lockup when mprotect to large memory area(CVE-2025-40153)

    fbdev: fix potential buffer overflow in do_register_framebuffer()(CVE-2025-38702)

    net: ena: fix shift-out-of-bounds in exponential backoff(CVE-2023-53272)

    software node: Correct a OOB check in software_node_get_reference_args()(CVE-2025-38342)

    virtio: break and reset virtio devices on device_shutdown()(CVE-2025-38064)

    net/sched: sch_qfq: Fix race condition on qfq_aggregate(CVE-2025-38477)

    netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX(CVE-2025-38201)

    qed: allow sleep in qed_mcp_trace_dump()(CVE-2023-53509)

    vsock: Fix transport_* TOCTOU(CVE-2025-38461)

    ice: Fix a null pointer dereference in ice_copy_and_init_pkg()(CVE-2025-38664)

    tcp_metrics: use dst_dev_net_rcu()(CVE-2025-40075)

    netfilter: nf_tables: reject duplicate device on updates(CVE-2025-38678)

    ipvs: Defer ip_vs_ftp unregister during netns cleanup(CVE-2025-40018)

    net/packet: fix a race in packet_set_ring() and packet_notifier()(CVE-2025-38617)

    xfrm: Zero padding when dumping algos and encap(CVE-2023-53684)

    ipv4: start using dst_dev_rcu()(CVE-2025-40074)

    IB/mad: Don't call to function that might sleep while in atomic context(CVE-2022-50472)

    iavf: Fix reset error handling(CVE-2022-50053)

    RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug(CVE-2025-38024)

    RDMA/bnxt_re: wraparound mbox producer index(CVE-2023-53201)

    net/mlx5e: Check for NOT_READY flag state after locking(CVE-2023-53581)

    i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path(CVE-2025-39911)

    RDMA/rxe: Fix incomplete state save in rxe_requester(CVE-2023-53539)

    net_sched: sch_sfq: reject invalid perturb period(CVE-2025-38193)

    netfilter: conntrack: fix wrong ct-timeout value(CVE-2023-53635)

    net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree(CVE-2025-38468)

    vsock: Fix transport_{g2h,h2g} TOCTOU(CVE-2025-38462)

    media: tuner: xc5000: Fix use-after-free in xc5000_release(CVE-2025-39994)

    mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race(CVE-2025-38085)

    media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()(CVE-2025-38694)

    cifs: prevent NULL pointer dereference in UTF16 conversion(CVE-2025-39838)

    sctp: linearize cloned gso packets in sctp_rcv(CVE-2025-38718)

    mm/vmscan: don't try to reclaim hwpoison folio(CVE-2025-37834)

    tun: Fix memory leak for detached NAPI queue.(CVE-2023-53685)

    iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()(CVE-2023-53476)

    smb: client: fix race with concurrent opens in rename(2)(CVE-2025-39825)

    Squashfs: check return result of sb_min_blocksize(CVE-2025-38415)

    HID: multitouch: Correct devm device reference for hidinput input_dev name(CVE-2023-53454)

    genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie(CVE-2025-38062)

    pinctrl: check the return value of pinmux_ops::get_function_name()(CVE-2025-40030)

    dm-stripe: fix a possible integer overflow(CVE-2025-39940)

    scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write(CVE-2023-53282)

    drm/vmwgfx: Fix a null-ptr access in the cursor snooper(CVE-2025-40110)

    fs: Prevent file descriptor table allocations exceeding INT_MAX(CVE-2025-39756)

    ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()(CVE-2025-40198)

    tty: n_gsm: fix deadlock and link starvation in outgoing data path(CVE-2022-50116)

    sctp: Fix MAC comparison to be constant-time(CVE-2025-40204)

    tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().(CVE-2025-40186)

    scsi: storvsc: Fix handling of virtual Fibre Channel timeouts(CVE-2023-53245)

    media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()(CVE-2025-39713)

    media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove(CVE-2025-39996)

    nubus: Partially revert proc_create_single_data() conversion(CVE-2023-53217)

    scsi: qla2xxx: Fix deletion race condition(CVE-2023-53615)

    Squashfs: fix uninit-value in squashfs_get_parent(CVE-2025-40049)

    RDMA/hns: Fix double destruction of rsv_qp(CVE-2025-38582)

    cifs: parse_dfs_referrals: prevent oob on malformed input(CVE-2025-40099)

    net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an     error(CVE-2025-21924)

    net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer(CVE-2025-39937)

    bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls(CVE-2025-38608)

    ACPI: CPPC: Make rmw_lock a raw_spin_lock(CVE-2024-50249)

    ACPI: video: Fix use-after-free in acpi_video_switch_brightness()(CVE-2025-40211)

    smb: client: Fix refcount leak for cifs_sb_tlink(CVE-2025-40103)

    nfsd: decrease sc_count directly if fail to queue dl_recall(CVE-2025-37871)

    iommu/amd: Avoid stack buffer overflow from kernel cmdline(CVE-2025-38676)

    crypto: hisilicon/qm - set NULL to qm-debug.qm_diff_regs(CVE-2025-40062)

    dma-buf: insert memory barrier before updating num_fences(CVE-2025-38095)

    mm/hugetlb: fix folio is still mapped when deleted(CVE-2025-40006)

    ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered(CVE-2025-39763)

    crypto: hisilicon/qm - request reserved interrupt for virtual function(CVE-2025-40136)

    gfs2: Fix possible data races in gfs2_show_options()(CVE-2023-53622)

    mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list(CVE-2025-39725)

    fs/proc: fix uaf in proc_readdir_de()(CVE-2025-40271)

    powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe()(CVE-2022-50635)

    be2net: pass wrb_params in case of OS2BMC be_insert_vlan_in_pkt() is called with the wrb_params argument     being NULL at be_send_pkt_to_bmc() call site.(CVE-2025-40264)

    fuse: fix livelock in synchronous file put from fuseblk workers(CVE-2025-40220)

    sctp: avoid NULL dereference when chunk data buffer is missing(CVE-2025-40240)

    tipc: Fix use-after-free in tipc_mon_reinit_self().(CVE-2025-40280)

    sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto(CVE-2025-40281)

    scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()(CVE-2025-68229)

    libceph: fix potential use-after-free in have_mon_and_osd_map()(CVE-2025-68285)

    RDMA/core: Fix 'KASAN: slab-use-after-free Read in ib_register_device' problem(CVE-2025-38022)

    usbnet: Fix using smp_processor_id() in preemptible code warnings(CVE-2025-40164)

    scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT(CVE-2022-49534)

    NFSD: fix race between nfsd registration and exports_proc(CVE-2025-38232)

    scsi: target: target_core_configfs: Add length check to avoid buffer overflow(CVE-2025-39998)

    nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()(CVE-2025-38724)

    nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request(CVE-2025-38430)

    HID: core: Harden s32ton() against conversion to 0 bits(CVE-2025-38556)

    iavf: Fix out-of-bounds when setting channels on remove(CVE-2023-53659)

    start_kernel: Add __no_stack_protector function attribute(CVE-2023-53491)

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare(CVE-2025-39817)

    drm/scheduler: fix fence ref counting(CVE-2022-49829)

    scsi: qla2xxx: Wait for io return on terminate rport(CVE-2023-53322)

    scsi: lpfc: Fix buffer free/clear order in deferred receive path(CVE-2025-39841)

    tcp: Clear tcp_sk(sk)-fastopen_rsk in tcp_disconnect().(CVE-2025-39955)

    icmp6: Fix null-ptr-deref of ip6_null_entry-rt6i_idev in icmp6_dev().(CVE-2023-53343)

    cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()(CVE-2025-40194)

    i40e: remove read access to debugfs files(CVE-2025-39901)

    nexthop: Forbid FDB status change while nexthop is in a group(CVE-2025-39980)

    netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed(CVE-2022-50500)

    nfsd: call op_release, even when op_func returns an error(CVE-2023-53241)

    media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID(CVE-2025-40016)

    igb: Fix igb_down hung on surprise removal(CVE-2023-53148)

    __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock(CVE-2025-38058)

    ext4: guard against EA inode refcount underflow in xattr update(CVE-2025-40190)

    ipv6: reject malicious packets in ipv6_gso_segment()(CVE-2025-38572)

    scsi: core: Fix possible memory leak if device_add() fails(CVE-2023-53174)

    md/raid10: fix wrong setting of max_corr_read_errors(CVE-2023-53313)

    lwt: Fix return values of BPF xmit ops(CVE-2023-53338)

    netfilter: ctnetlink: fix refcount leak on table dump(CVE-2025-38721)

    netfilter: ctnetlink: remove refcounting in expectation dumpers(CVE-2025-39764)

    netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm(CVE-2025-39894)

    blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx(CVE-2025-40125)

    cifs: Release folio lock on fscache read hit.(CVE-2023-53593)

    io_uring: wait interruptibly for request completions on exit(CVE-2023-53461)

    net: dlink: handle copy_thresh allocation failure(CVE-2025-40053)

    net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast(CVE-2025-40140)

    i40e: fix idx validation in i40e_validate_queue_map(CVE-2025-39972)

    net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM(CVE-2025-39770)

    ipv6: use RCU in ip6_xmit()(CVE-2025-40135)

    pstore/ram: Check start of empty przs during init(CVE-2023-53331)

    ipv6: use RCU in ip6_output()(CVE-2025-40158)

    net: use dst_dev_rcu() in sk_setup_caps()(CVE-2025-40170)

    KVM: x86: use array_index_nospec with indices that come from guest(CVE-2025-39823)

    vxlan: Annotate FDB data races(CVE-2025-38037)

    drm/vmwgfx: Fix Use-after-free in validation(CVE-2025-40111)

    cifs: fix mid leak during reconnection after timeout threshold(CVE-2023-53597)

    xfs: do not propagate ENODATA disk errors into xattr code(CVE-2025-39835)

    of: check previous kernel's ima-kexec-buffer against memory bounds(CVE-2022-50159)

    Squashfs: reject negative file sizes in squashfs_read_inode()(CVE-2025-40200)

    skmsg: Fix wrong last sg check in sk_msg_recvmsg()(CVE-2022-49973)

    mm/smaps: fix race between smaps_hugetlb_range and migration(CVE-2025-39754)

    Drivers: hv: vmbus: Don't dereference ACPI root object handle(CVE-2023-53647)

    scsi: qla4xxx: Prevent a potential error pointer dereference(CVE-2025-39676)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - blk-mq: avoid double ->queue_rq() because of early timeout David Jeffery found one double ->queue_rq()     issue, so far it can be triggered in VM use case because of long vmexit latency or preempt latency of vCPU     pthread or long page fault in vCPU pthread, then block IO req could be timed out before queuing the     request to hardware but after calling blk_mq_start_request() during ->queue_rq(), then timeout handler may     handle it by requeue, then double ->queue_rq() is caused, and kernel panic. So far, it is driver's     responsibility to cover the race between timeout and completion, so it seems supposed to be solved in     driver in theory, given driver has enough knowledge. But it is really one common problem, lots of driver     could have similar issue, and could be hard to fix all affected drivers, even it isn't easy for driver to     handle the race. So David suggests this patch by draining in-progress ->queue_rq() for solving this issue.
    (CVE-2022-50554)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
270189	Linux Distros 未修补的漏洞：CVE-2022-50554	Nessus	Misc.	2025/10/13	2026/7/25	medium
270189	Linux Distros 未修補的弱點：CVE-2022-50554	Nessus	Misc.	2025/10/13	2026/7/25	medium
270189	Linux Distros のパッチ未適用の脆弱性: CVE-2022-50554	Nessus	Misc.	2025/10/13	2026/7/25	medium
284730	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-1071)	Nessus	Huawei Local Security Checks	2026/1/15	2026/3/4	high
297598	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1212)	Nessus	Huawei Local Security Checks	2026/2/2	2026/2/4	high
315781	Unity Linux 20.1050e Security Update: kernel (UTSA-2026-021572)	Nessus	Unity Linux Local Security Checks	2026/5/20	2026/5/20	medium
284764	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-1091)	Nessus	Huawei Local Security Checks	2026/1/15	2026/3/4	high
302584	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-1610)	Nessus	Huawei Local Security Checks	2026/3/16	2026/3/16	high
302981	EulerOS Virtualization 2.13.1 : kernel (EulerOS-SA-2026-1637)	Nessus	Huawei Local Security Checks	2026/3/18	2026/3/18	high
270189	Linux Distros Unpatched Vulnerability : CVE-2022-50554	Nessus	Misc.	2025/10/13	2026/7/25	medium
302727	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-1582)	Nessus	Huawei Local Security Checks	2026/3/17	2026/3/17	high
297592	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1224)	Nessus	Huawei Local Security Checks	2026/2/2	2026/2/4	high
302971	EulerOS Virtualization 2.13.0 : kernel (EulerOS-SA-2026-1629)	Nessus	Huawei Local Security Checks	2026/3/18	2026/3/18	high
302684	EulerOS Virtualization 2.12.1 : kernel (EulerOS-SA-2026-1433)	Nessus	Huawei Local Security Checks	2026/3/17	2026/3/17	high
302688	EulerOS Virtualization 2.12.0 : kernel (EulerOS-SA-2026-1490)	Nessus	Huawei Local Security Checks	2026/3/17	2026/3/17	high

检测

插件搜索

medium

medium

medium

high

high

medium

high

high

high

medium

high

high

high

high

high