Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - wifimt7601u修正整數反向溢位。修正會導致 ‘mt7601u_rx_skb_from_seg()’ 中的 null 指標解除參照的整數反向溢位。可以操控 URB 封包中的變數「dma_len」進而在「mt7601u_rx_process_seg()」中觸發「seg_len」的整數反向溢位。此反向溢位後續會造成繞過「mt7601u_rx_skb_from_seg()」中的「bad_frame」檢查最終導致指標「p」解除參照這是 null 指標。確認「dma_len」大於「min_seg_len」。此問題由 syzkaller 的修改版本發現。KASAN範圍 [0x0000000000000008-0x000000000000000f] CPU 0 PID 12 通訊 ksoftirqd/0 受污染 GWO 5.14.0+ #139 硬體名稱 QEMU 標準 PC (i440FX + PIIX, 1996)BIOS 版本1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org04/01/2014 RIP: 0010:skb_add_rx_frag+0x143/0x370 程式碼e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 74d 89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00 RSP00cfLA90000cLAGS0000ff ff 00010202 RAXdffffc0000000000 RBX
    ffff888115520dc0 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8 RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010 R10: ffff888111843017 R11:
     R12ffffed1022308602  : 0000000000000000 R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008 FS: 0000000000000000(0000) GS:ffff88811a800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0 DR0
    0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: mt7601u_rx_tasklet+0xc73/0x1270 ? mt7601u_submit_rx_buf.isra.0+0x510/0x510 tasklet_action_common.isra.0+0x79/0x2f0 tasklet_action_common.isra.0+0x206/0x2f0 __do_softirq+0x1b5/0x880 ? tasklet_unlock+0x30/0x30 run_ksoftirqd+0x26/0x50 smpboot_thread_fn+0x34f/0x7d0 smpboot_register_percpu_thread+0x370/0x370 kthread+0x3a1/0x480 set_kthread_struct+0x120/0x120 ret_from_fork+0x1f/0x30 模組連結於88XXau(O) 88x2bu(O) ---[ end trace 57f34f93b4da0f9b ]--- RIP0010:skb_add_rx_frag+0x143/0x370 程式碼e2 07 83 c2 038 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44 89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 48 8b 8 08 a8 01 0f 85 3d 01 00 00 RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8 RBP: 0000000000000000 R08: 0000000000000e09 R09:
     R100000000000000010  : ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000 R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008 FS: 0000000000000000(0000) GS:ffff88811a800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0 0000000080050033 CR2000000004035af40 CR3
    00000001157f2000 CR4: 0000000000750ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 (CVE-2023-53679)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - wifimt7601u修复整数下溢 修复会导致“mt7601u_rx_skb_from_seg()”中空指针取消引用的整数下溢。URB 数据包中的变量“dma_len”可能被操纵从而触发“mt7601u_rx_process_seg()”中“seg_len”的整数下溢。此下溢随后导致绕过“mt7601u_rx_skb_from_seg()”中的“bad_frame”检查最终导致取消引用指针“p”即空指针。确保“dma_len”大于“min_seg_len”。此问题由 syzkaller 的修改版本发现。KASANnull-ptr-deref in 范围 [0x0000000000000008-0x000000000000000f] CPU0 PID12 Comm: ksoftirqd/0 Tainted: GWO 5.14.0+ #139 硬件名称QEMU Standard PC (i440FX + PIIX, 1996)BIOS 相关1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org04/01/2014 RIP0010:skb_add_rx_frag+0x143/0x370 代码e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 48d 74 89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00 RSP: 0018: 0ffc0ffc0ffc0ffc0ffc0 00010202 RAX: dffffc0000000000 RBX
    ffff888115520dc0 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8 RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010 R10: ffff888111843017 R11:
     R12ffffed1022308602  : 0000000000000000 R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008 FS: 0000000000000000(0000) GS:ffff88811a800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0 DR0
    0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: mt7601u_rx_tasklet+0xc73/0x1270 ? mt7601u_submit_rx_buf.isra.0+0x510/0x510 tasklet_action_common.isra.0+0x79/0x2f0 tasklet_action_common.isra.0+0x206/0x2f0 __do_softirq+0x1b5/0x880 tasklet_unlock+0x30/0x30 run_ksoftirqd+0x26/0x50 smpboot_thread_fn+0x34f/0x7d0 smpboot_register_percpu_thread+0x370/0x370 kthread+0x3a1/0x480 ? set_kthread_struct+0x120/0x120 ret_from_fork+0x1f/0x30 模块中链接的 88XXau(O) 88x2bu(O) ---[ end trace 57f34f93b4da0f9b ]--- RIP0010:skb_add_rx_frag+0x143/0x370 Codee2 07 83 cdc 03 382 03 382 03 382 03 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44 89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 cd 01 48 00 08 a8 01 0f 85 3d 01 00 00 RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8 RBP: 0000000000000000 R08: 0000000000000e09 R09:
     R100000000000000010  : ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000 R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008 FS: 0000000000000000(0000) GS:ffff88811a800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0 : 0000000080050033 CR2:000000004035af40 CR3:
    00000001157f2000 CR4: 0000000000750ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 (CVE-2023-53679)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - wifimt7601u整数アンダーフローを修正 「mt7601u_rx_skb_from_seg()」での null ポインターデリファレンスにつながる整数アンダーフローを修正します。URB パケットの変数「dma_len」が操作される可能性があり、これにより「mt7601u_rx_process_seg()」の「seg_len」の整数アンダーフローを発生させる可能性があります。このアンダーフローが続いて、「mt7601u_rx_skb_from_seg()」の「bad_frame」チェックがバイパスされ、最終的にポインター「p」の逆参照につながります。これは null ポインターです。「dma_len」が「min_seg_len」より大きいことを確認。syzkaller の修正バージョンによって見つかりました。KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 12 Comm: ksoftirqd/0 Tainted: GWO 5.14.0+ #139 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel- 1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org04/01/2014 RIP0010:skb_add_rx_frag+0x143/0x370 コードe2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 4c 8d 48d 89 68 08 48 b8 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00 RSP: 0018: ffffc900000000000000000000000000000000000000000000000000000000 00010202 RAXdffffc0000000000 RBX
    ffff888115520dc0 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8 RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010 R10: ffff888111843017 R11:
     R12ffffed1022308602  : 0000000000000000 R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008 FS: 0000000000000000(0000) GS:ffff88811a800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000004035af40 CR3: 00000001157f2000 CR40000000000750ef0 DR0
    0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: mt7601u_rx_tasklet+0xc73/0x1270 ? mt7601u_submit_rx_buf.isra.0+0x510/0x510 ? tasklet_action_common.isra.0+0x79/0x2f0 tasklet_action_common.isra.0+0x206/0x2f0 __do_softirq+0x1b5/0x880 ? tasklet_unlock+0x30/0x30 run_ksoftirqd+0x26/0x50 smpboot_thread_fn+0x34f/0x7d0 ? smpboot_register_percpu_thread+0x370/0x370 kthread+0x3a1/0x480 ? set_kthread_struct+0x120/0x120 ret_from_fork+0x1f/0x30 モジュールのリンク先88XXau(O) 88x2bu(O) ---[ エンドトレース 57f34f93b4da0f9b ]--- RIP 0010:skb_add_rx_frag+0x143/0x370 コード e2 07 83 c2 03 c ca 7c 08 84 c9 0f 86 01 00 00 4c 8d 7d 08 44 89 68 08 48 b8 00 00 00 00 00 00 00 00 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 cd 01 08080440 08 a8 01 0f 85 3d 01 00 00 RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8 RBP: 0000000000000000 R08: 0000000000000e09 R09:
     R100000000000000010  : ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000 R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008 FS: 0000000000000000(0000) GS:ffff88811a800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0 0000000080050033 CR2 000000004035af40 CR3
    00000001157f2000 CR4: 0000000000750ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 (CVE-2023-53679)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

リモートの SUSE Linux SLES15 / SLES_SAP15 ホストには、SUSE-SU-2025:4320-1 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    SUSE Linux Enterprise 15 SP5 カーネルが更新され、多様なセキュリティ問題が修正されました

    以下のセキュリティ問題が修正されました。

    - CVE-2022-50327ACPIprocessoridleacpi_fetch_acpi_dev() の戻り値をチェックしますbsc#1249859。
    - CVE-2022-50334hugetlbfshugetlbfs_parse_param() で null-ptr-deref を修正しますbsc#1249857。
    - CVE-2022-50490bpfhtab_lock_bucket() からユーザー空間にエラーが伝播されますbsc#1251164
    - CVE-2022-50516fsdlmsb_lvbptr の無効な逆参照を修正しますbsc#1251741。
    - CVE-2023-53365ip6mrip6mr_cache_report() の skb_under_panic を修正しますbsc#1249988
    - CVE-2023-53500xfrmdecode_session6 の slab-use-after-free を修正しますbsc#1250816。
    - CVE-2023-53559ip_vtidecode_session6 の潜在的な slab-use-after-free を修正しますbsc#1251052
    - CVE-2023-53574wifirtw88アンロードする際にタイマーを削除し、skb キューを解放しますbsc#1251222。
    - CVE-2023-53619netfilterconntracknf_ct_helper_hash の use-after-free を回避しますbsc#1251743。
    - CVE-2023-53673Bluetoothhci_eventconn を削除する前に切断コールバックを呼び出しますbsc#1251763。
    - CVE-2023-53705ipv6ipv6_find_tlv() の領域外アクセスを修正しますbsc#1252554
    - CVE-2025-37885KVMx86*new* ルートが postable でない場合、IRTE をホストコントロールにリセットしますbsc#1242960。
    - CVE-2025-38084hugetlbVMA を分割する際に一部の PMD を共有しませんbsc#1245498
    - CVE-2025-38085mm/hugetlbhuget_pmd_unshare() と GUP 高速の競合を修正しますbsc#1245499。
    - CVE-2025-38476rplrpl_do_srh_inline() における use-after-free を修正しますbsc#1247317
    - CVE-2025-39742RDMAhfi1find_hw_thread_mask() で発生する可能性のあるゼロ除算を修正しますbsc#1249479。
    - CVE-2025-39797xfrmSPI 処理を重複しますbsc#1249608。
    - CVE-2025-39945cniccnic_delete_task の use-after-free のバグを修正しますbsc#1251230。
    - CVE-2025-39967fbconfbcon_do_set_font での整数オーバーフローを修正しますbsc#1252033。
    - CVE-2025-39968i40eVF フィルターの最大境界検査を追加しますbsc#1252047。
    - CVE-2025-39973i40ering_len パラメーターの検証を追加しますbsc#1252035。
    - CVE-2025-39978octeotx2-pfotx2_tc_add_flow() の潜在的な use-after-free を修正しますbsc#1252069。
    - CVE-2025-39981BluetoothMGMT潜在的な UAF を修正しますbsc#1252060。
    - CVE-2025-40018ipvsnetns クリーンアップ中に ip_vs_ftp unregister を保留しますbsc#1252688。
    - CVE-2025-40044fsudflengthAllocDescs 処理における OOB 読み取りを修正しますbsc#1252785

    以下の非セキュリティ問題は修正されました

    - NFSサーバーの委任リストから取り消された委任を削除しますbsc#1246211。
    - NFSv4FREE_STATEID に委任をクリーンアップさせますbsc#1246211]
    - fbconフォント割り当ての OOB アクセスを修正しますbsc#1252033
    - NFSv4 の kabi 修正FREE_STATEID が委任をクリーンアップできるようにしますbsc#1246211。
    - kernel-subpackage-specモジュールを二重に署名しませんbsc#1251930。
    - mm共有メモリタイプでの不要なページ障害リタイアを回避しますbsc#1251823。
    - nethv_netvscチャネルオープン中のホストからの早期受信イベントの損失を修正しますbsc#1252265。
    - netmanajumbo フレームのページプールに切り替えますbsc#1248754。
    - netmanaRX バッファに対してページプールフラグメントを使用して、メモリ効率を改善しますbsc#1248754。
    - netfilternft_objrefobjref と objrefmap の式を検証しますbsc#1250237。
    - rpm/check-for-config-changesCONFIG_SCHED_PROXY_EXEC も無視しますbsc#1250946

Tenable は、前述の記述ブロックを SUSE セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートの SUSE Linux SLES15 / SLES_SAP15 ホストには、SUSE-SU-2025:4111-1 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    SUSE Linux Enterprise 15 SP4 カーネルが更新され、さまざまなセキュリティの問題が修正されました

    以下のセキュリティ問題が修正されました。

    - CVE-2022-50327ACPIprocessoridleacpi_fetch_acpi_dev() の戻り値をチェックしますbsc#1249859。
    - CVE-2022-50334hugetlbfshugetlbfs_parse_param() で null-ptr-deref を修正しますbsc#1249857。
    - CVE-2022-50490bpfhtab_lock_bucket() からユーザー空間にエラーが伝播されますbsc#1251164
    - CVE-2022-50516fsdlmsb_lvbptr の無効な逆参照を修正しますbsc#1251741。
    - CVE-2023-53365ip6mrip6mr_cache_report() の skb_under_panic を修正しますbsc#1249988
    - CVE-2023-53500xfrmdecode_session6 の slab-use-after-free を修正しますbsc#1250816。
    - CVE-2023-53559ip_vtidecode_session6 の潜在的な slab-use-after-free を修正しますbsc#1251052
    - CVE-2023-53574wifirtw88アンロードする際にタイマーを削除し、skb キューを解放しますbsc#1251222。
    - CVE-2023-53619netfilterconntracknf_ct_helper_hash の use-after-free を回避しますbsc#1251743。
    - CVE-2023-53673Bluetoothhci_eventconn を削除する前に切断コールバックを呼び出しますbsc#1251763。
    - CVE-2023-53705ipv6ipv6_find_tlv() の領域外アクセスを修正しますbsc#1252554
    - CVE-2025-39742RDMAhfi1find_hw_thread_mask() で発生する可能性のあるゼロ除算を修正しますbsc#1249479。
    - CVE-2025-39945cniccnic_delete_task の use-after-free のバグを修正しますbsc#1251230。
    - CVE-2025-39967fbconfbcon_do_set_font での整数オーバーフローを修正しますbsc#1252033。
    - CVE-2025-39968i40eVF フィルターの最大境界検査を追加しますbsc#1252047。
    - CVE-2025-39973i40ering_len パラメーターの検証を追加しますbsc#1252035。
    - CVE-2025-39978octeotx2-pfotx2_tc_add_flow() の潜在的な use-after-free を修正しますbsc#1252069。
    - CVE-2025-40018ipvsnetns クリーンアップ中に ip_vs_ftp unregister を保留しますbsc#1252688。
    - CVE-2025-40044fsudflengthAllocDescs 処理における OOB 読み取りを修正しますbsc#1252785
    - CVE-2025-40088hfsplushfsplus_strcasecmp() の slab-out-of-bounds 読み取りを修正しますbsc#1252904。
    - CVE-2025-40102KVMarm64init 前の vCPU イベントへのアクセスを阻止しますbsc#1252919。

    以下の非セキュリティ問題は修正されました

    - fbconフォント割り当ての OOB アクセスを修正しますbsc#1252033
    - mm共有メモリタイプでの不要なページ障害リタイアを回避しますbsc#1251823。
    - nethv_netvscチャネルオープン中のホストからの早期受信イベントの損失を修正しますbsc#1252265。

Tenable は、前述の記述ブロックを SUSE セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006982 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    wifi: mt7601u: fix an integer underflow

    Fix an integer underflow that leads to a null pointer dereference in     'mt7601u_rx_skb_from_seg()'. The variable 'dma_len' in the URB packet     could be manipulated, which could trigger an integer underflow of     'seg_len' in 'mt7601u_rx_process_seg()'. This underflow subsequently     causes the 'bad_frame' checks in 'mt7601u_rx_skb_from_seg()' to be     bypassed, eventually leading to a dereference of the pointer 'p', which     is a null pointer.

    Ensure that 'dma_len' is greater than 'min_seg_len'.

    Found by a modified version of syzkaller.

    KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]     CPU: 0 PID: 12 Comm: ksoftirqd/0 Tainted: G        W  O      5.14.0+     #139     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS     rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014     RIP: 0010:skb_add_rx_frag+0x143/0x370     Code: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44     89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02     00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00     RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202     RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000     RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8     RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010     R10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000     R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008     FS:  0000000000000000(0000) GS:ffff88811a800000(0000)     knlGS:0000000000000000     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000     DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400     PKRU: 55555554     Call Trace:
     mt7601u_rx_tasklet+0xc73/0x1270      ? mt7601u_submit_rx_buf.isra.0+0x510/0x510      ? tasklet_action_common.isra.0+0x79/0x2f0      tasklet_action_common.isra.0+0x206/0x2f0
     __do_softirq+0x1b5/0x880      ? tasklet_unlock+0x30/0x30      run_ksoftirqd+0x26/0x50      smpboot_thread_fn+0x34f/0x7d0      ? smpboot_register_percpu_thread+0x370/0x370      kthread+0x3a1/0x480      ? set_kthread_struct+0x120/0x120      ret_from_fork+0x1f/0x30     Modules linked in: 88XXau(O) 88x2bu(O)
    ---[ end trace 57f34f93b4da0f9b ]---     RIP: 0010:skb_add_rx_frag+0x143/0x370     Code: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44     89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02     00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00     RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202     RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000     RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8     RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010     R10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000     R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008     FS:  0000000000000000(0000) GS:ffff88811a800000(0000)     knlGS:0000000000000000     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000     DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400     PKRU: 55555554

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4320-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
    - CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (bsc#1249857).
    - CVE-2022-50490: bpf: Propagate error from htab_lock_bucket() to userspace (bsc#1251164).
    - CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
    - CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
    - CVE-2023-53500: xfrm: fix slab-use-after-free in decode_session6 (bsc#1250816).
    - CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
    - CVE-2023-53574: wifi: rtw88: delete timer and free skb queue when unloading (bsc#1251222).
    - CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
    - CVE-2023-53673: Bluetooth: hci_event: call disconnect callback before deleting conn (bsc#1251763).
    - CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-38084: hugetlb: unshare some PMDs when splitting VMAs (bsc#1245498).
    - CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
    - CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
    - CVE-2025-39742: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (bsc#1249479).
    - CVE-2025-39797: xfrm: Duplicate SPI Handling (bsc#1249608).
    - CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
    - CVE-2025-39967: fbcon: fix integer overflow in fbcon_do_set_font (bsc#1252033).
    - CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
    - CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
    - CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).
    - CVE-2025-39981: Bluetooth: MGMT: Fix possible UAFs (bsc#1252060).
    - CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
    - CVE-2025-40044: fs: udf: fix OOB read in lengthAllocDescs handling (bsc#1252785).

    The following non security issues were fixed:

    - NFS: remove revoked delegation from server's delegation list (bsc#1246211).
    - NFSv4: Allow FREE_STATEID to clean up delegations (bsc#1246211).
    - fbcon: Fix OOB access in font allocation (bsc#1252033)
    - kabi fix for NFSv4: Allow FREE_STATEID to clean up delegations (bsc#1246211).
    - kernel-subpackage-spec: Do not doubly-sign modules (bsc#1251930).
    - mm: avoid unnecessary page fault retires on shared memory types (bsc#1251823).
    - net: hv_netvsc: fix loss of early receive events from host during channel open (bsc#1252265).
    - net: mana: Switch to page pool for jumbo frames (bsc#1248754).
    - net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency     (bsc#1248754).
    - netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237).
    - rpm/check-for-config-changes: ignore CONFIG_SCHED_PROXY_EXEC, too (bsc#1250946)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4111-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
    - CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (bsc#1249857).
    - CVE-2022-50490: bpf: Propagate error from htab_lock_bucket() to userspace (bsc#1251164).
    - CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
    - CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
    - CVE-2023-53500: xfrm: fix slab-use-after-free in decode_session6 (bsc#1250816).
    - CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
    - CVE-2023-53574: wifi: rtw88: delete timer and free skb queue when unloading (bsc#1251222).
    - CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
    - CVE-2023-53673: Bluetooth: hci_event: call disconnect callback before deleting conn (bsc#1251763).
    - CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
    - CVE-2025-39742: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (bsc#1249479).
    - CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
    - CVE-2025-39967: fbcon: fix integer overflow in fbcon_do_set_font (bsc#1252033).
    - CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
    - CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
    - CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).
    - CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
    - CVE-2025-40044: fs: udf: fix OOB read in lengthAllocDescs handling (bsc#1252785).
    - CVE-2025-40088: hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (bsc#1252904).
    - CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).

    The following non security issues were fixed:

    - fbcon: Fix OOB access in font allocation (bsc#1252033)
    - mm: avoid unnecessary page fault retires on shared memory types (bsc#1251823).
    - net: hv_netvsc: fix loss of early receive events from host during channel open (bsc#1252265).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011039 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    wifi: mt7601u: fix an integer underflow

    Fix an integer underflow that leads to a null pointer dereference in     'mt7601u_rx_skb_from_seg()'. The variable 'dma_len' in the URB packet     could be manipulated, which could trigger an integer underflow of     'seg_len' in 'mt7601u_rx_process_seg()'. This underflow subsequently     causes the 'bad_frame' checks in 'mt7601u_rx_skb_from_seg()' to be     bypassed, eventually leading to a dereference of the pointer 'p', which     is a null pointer.

    Ensure that 'dma_len' is greater than 'min_seg_len'.

    Found by a modified version of syzkaller.

    KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]     CPU: 0 PID: 12 Comm: ksoftirqd/0 Tainted: G        W  O      5.14.0+     #139     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS     rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014     RIP: 0010:skb_add_rx_frag+0x143/0x370     Code: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44     89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02     00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00     RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202     RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000     RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8     RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010     R10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000     R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008     FS:  0000000000000000(0000) GS:ffff88811a800000(0000)     knlGS:0000000000000000     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000     DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400     PKRU: 55555554     Call Trace:
     mt7601u_rx_tasklet+0xc73/0x1270      ? mt7601u_submit_rx_buf.isra.0+0x510/0x510      ? tasklet_action_common.isra.0+0x79/0x2f0      tasklet_action_common.isra.0+0x206/0x2f0
     __do_softirq+0x1b5/0x880      ? tasklet_unlock+0x30/0x30      run_ksoftirqd+0x26/0x50      smpboot_thread_fn+0x34f/0x7d0      ? smpboot_register_percpu_thread+0x370/0x370      kthread+0x3a1/0x480      ? set_kthread_struct+0x120/0x120      ret_from_fork+0x1f/0x30     Modules linked in: 88XXau(O) 88x2bu(O)
    ---[ end trace 57f34f93b4da0f9b ]---     RIP: 0010:skb_add_rx_frag+0x143/0x370     Code: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44     89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02     00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00     RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202     RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000     RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8     RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010     R10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000     R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008     FS:  0000000000000000(0000) GS:ffff88811a800000(0000)     knlGS:0000000000000000     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000     DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400     PKRU: 55555554

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - wifi: mt7601u: fix an integer underflow Fix an integer underflow that leads to a null pointer dereference     in 'mt7601u_rx_skb_from_seg()'. The variable 'dma_len' in the URB packet could be manipulated, which could     trigger an integer underflow of 'seg_len' in 'mt7601u_rx_process_seg()'. This underflow subsequently     causes the 'bad_frame' checks in 'mt7601u_rx_skb_from_seg()' to be bypassed, eventually leading to a     dereference of the pointer 'p', which is a null pointer. Ensure that 'dma_len' is greater than     'min_seg_len'. Found by a modified version of syzkaller. KASAN: null-ptr-deref in range     [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 12 Comm: ksoftirqd/0 Tainted: G W O 5.14.0+ #139     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org     04/01/2014 RIP: 0010:skb_add_rx_frag+0x143/0x370 Code: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00     4c 8d 7d 08 44 89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 cd 01 00 00     48 8b 45 08 a8 01 0f 85 3d 01 00 00 RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202 RAX: dffffc0000000000 RBX:
    ffff888115520dc0 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8     RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010 R10: ffff888111843017 R11:
    ffffed1022308602 R12: 0000000000000000 R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008     FS: 0000000000000000(0000) GS:ffff88811a800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000     CR0: 0000000080050033 CR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0 DR0:
    0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0     DR7: 0000000000000400 PKRU: 55555554 Call Trace: mt7601u_rx_tasklet+0xc73/0x1270 ?     mt7601u_submit_rx_buf.isra.0+0x510/0x510 ? tasklet_action_common.isra.0+0x79/0x2f0     tasklet_action_common.isra.0+0x206/0x2f0 __do_softirq+0x1b5/0x880 ? tasklet_unlock+0x30/0x30     run_ksoftirqd+0x26/0x50 smpboot_thread_fn+0x34f/0x7d0 ? smpboot_register_percpu_thread+0x370/0x370     kthread+0x3a1/0x480 ? set_kthread_struct+0x120/0x120 ret_from_fork+0x1f/0x30 Modules linked in: 88XXau(O)     88x2bu(O) ---[ end trace 57f34f93b4da0f9b ]--- RIP: 0010:skb_add_rx_frag+0x143/0x370 Code: e2 07 83 c2 03     38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44 89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1     ea 03 <80> 3c 02 00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00 RSP: 0018:ffffc900000cfc90     EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000 RDX: 0000000000000001     RSI: ffff8881118430c0 RDI: ffff8881118430f8 RBP: 0000000000000000 R08: 0000000000000e09 R09:
    0000000000000010 R10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000 R13: 0000000000000e09     R14: 0000000000000010 R15: 0000000000000008 FS: 0000000000000000(0000) GS:ffff88811a800000(0000)     knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000004035af40 CR3:
    00000001157f2000 CR4: 0000000000750ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000     DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 (CVE-2023-53679)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
270145	Linux Distros 未修補的弱點：CVE-2023-53679	Nessus	Misc.	2025/10/13	2026/1/14	medium
270145	Linux Distros 未修补的漏洞：CVE-2023-53679	Nessus	Misc.	2025/10/13	2026/1/14	medium
270145	Linux Distros のパッチ未適用の脆弱性: CVE-2023-53679	Nessus	Misc.	2025/10/13	2026/1/14	medium
280691	SUSE SLES15 セキュリティ更新 : kernel (SUSE-SU-2025:4320-1)	Nessus	SuSE Local Security Checks	2025/12/30	2026/3/6	high
275594	SUSE SLES15 セキュリティ更新 : kernel (SUSE-SU-2025:4111-1)	Nessus	SuSE Local Security Checks	2025/11/18	2025/11/18	high
308204	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-006982)	Nessus	Unity Linux Local Security Checks	2026/4/21	2026/4/21	medium
280691	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:4320-1)	Nessus	SuSE Local Security Checks	2025/12/30	2026/3/6	high
275594	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:4111-1)	Nessus	SuSE Local Security Checks	2025/11/18	2025/11/18	high
308618	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011039)	Nessus	Unity Linux Local Security Checks	2026/4/21	2026/4/21	medium
270145	Linux Distros Unpatched Vulnerability : CVE-2023-53679	Nessus	Misc.	2025/10/13	2026/1/14	medium
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	2021/7/22	2026/3/23	high

检测

插件搜索

medium

medium

medium

high

high

medium

high

high

medium

medium

high