The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - io_uring/rsrc: validate buffer count with offset for cloning syzbot reports that it can trigger a     WARN_ON() for kmalloc() attempt that's too big: WARNING: CPU: 0 PID: 6488 at mm/slub.c:5024
    __kvmalloc_node_noprof+0x520/0x640 mm/slub.c:5024 Modules linked in: CPU: 0 UID: 0 PID: 6488 Comm: syz-     executor312 Not tainted 6.15.0-rc7-syzkaller-gd7fa1af5b33e #0 PREEMPT Hardware name: Google Google Compute     Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS     BTYPE=--) pc : __kvmalloc_node_noprof+0x520/0x640 mm/slub.c:5024 lr : __do_kmalloc_node mm/slub.c:-1     [inline] lr : __kvmalloc_node_noprof+0x3b4/0x640 mm/slub.c:5012 sp : ffff80009cfd7a90 x29:
    ffff80009cfd7ac0 x28: ffff0000dd52a120 x27: 0000000000412dc0 x26: 0000000000000178 x25: ffff7000139faf70     x24: 0000000000000000 x23: ffff800082f4cea8 x22: 00000000ffffffff x21: 000000010cd004a8 x20:
    ffff0000d75816c0 x19: ffff0000dd52a000 x18: 00000000ffffffff x17: ffff800092f39000 x16: ffff80008adbe9e4     x15: 0000000000000005 x14: 1ffff000139faf1c x13: 0000000000000000 x12: 0000000000000000 x11:
    ffff7000139faf21 x10: 0000000000000003 x9 : ffff80008f27b938 x8 : 0000000000000002 x7 : 0000000000000000     x6 : 0000000000000000 x5 : 00000000ffffffff x4 : 0000000000400dc0 x3 : 0000000200000000 x2 :
    000000010cd004a8 x1 : ffff80008b3ebc40 x0 : 0000000000000001 Call trace:
    __kvmalloc_node_noprof+0x520/0x640 mm/slub.c:5024 (P) kvmalloc_array_node_noprof include/linux/slab.h:1065     [inline] io_rsrc_data_alloc io_uring/rsrc.c:206 [inline] io_clone_buffers io_uring/rsrc.c:1178 [inline]     io_register_clone_buffers+0x484/0xa14 io_uring/rsrc.c:1287 __io_uring_register io_uring/register.c:815     [inline] __do_sys_io_uring_register io_uring/register.c:926 [inline] __se_sys_io_uring_register     io_uring/register.c:903 [inline] __arm64_sys_io_uring_register+0x42c/0xea8 io_uring/register.c:903
    __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8     arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132     do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry-     common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync+0x198/0x19c     arch/arm64/kernel/entry.S:600 which is due to offset + buffer_count being too large. The registration code     checks only the total count of buffers, but given that the indexing is an array, it should also check     offset + count. That can't exceed IORING_MAX_REG_BUFFERS either, as there's no way to reach buffers beyond     that limit. There's no issue with registrering a table this large, outside of the fact that it's pointless     to register buffers that cannot be reached, and that it can trigger this kmalloc() warning for attempting     an allocation that is too large. (CVE-2025-38196)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - io_uring/rsrcsyzbot の複製用オフセットでバッファカウントを検証します。大きすぎる kmalloc() 試行に対して WARN_ON() をトリガーできると報告します警告CPU0 PID6488 at mm/slub.c:5024
    __kvmalloc_node_noprof+0x520/0x640 mm/slub.c:5024 モジュールがリンクされています CPU: 0 UID: 0 PID: 6488 通信: syz-executor312 汚染されていません 6.15.0-rc7-syzkaller-gd7fa1af5b33e #0 PREEMPT ハードウェア名: Google Google Compute Engine/Google Compute Engine、BIOS Google 05/07/2025 pstate20400005nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--pc __kvmalloc_node_noprof+0x520/0x640 mm/slub.c:5024 lr __do_kmalloc_node mm/slub.c:-1 [インライン] lr __kvmalloc_node_noprof+0x3b4/0x640 mm/slub.c:5012 sp ffff80009cfd7a90 x29
    ffff80009cfd7ac0 x28: ffff0000dd52a120 x27: 0000000000412dc0 x26: 0000000000000178 x25: ffff7000139faf70 x24: 0000000000000000 x23: ffff800082f4cea8 x22: 00000000ffffffff x21: 000000010cd004a8 x20:
    ffff0000d75816c0 x19: ffff0000dd52a000 x18: 00000000ffffffff x17: ffff800092f39000 x16: ffff80008adbe9e4 x15: 0000000000000005 x14: 1ffff000139faf1c x13: 0000000000000000 x12: 0000000000000000 x11:
    ffff7000139faf21 x10: 0000000000000003 x9 : ffff80008f27b938 x8 : 0000000000000002 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 00000000ffffffff x4 : 0000000000400dc0 x3 : 0000000200000000 x2 :
    000000010cd004a8 x1 : ffff80008b3ebc40 x0 : 0000000000000001 Call trace:
    __kvmalloc_node_noprof+0x520/0x640 mm/slub.c:5024 (P) kvmalloc_array_node_noprof include/linux/slab.h:1065 [インライン] io_rsrc_data_alloc io_uring/rsrc.c:206 [インライン] io_clone_buffers io_uring/rsrc.c:1178 [インライン] io_register_clone_buffers+0x484/0xa14 io_uring/rsrc.c:1287 __io_uring_register io_uring/register.c:815 [inline] __do_sys_io_uring_register io_uring/register.c:926 [inline] __se_sys_io_uring_register io_uring/register.c:903 [inline] io_uring/register.c:903
    __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48 /0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_syncオフセット + buffer_count が大きすぎることが原因の +0x198/0x19c arch/arm64/kernel/entry.S:600 登録コードはバッファの合計数だけをチェックしますが、インデックスが配列である場合、オフセット + カウントもチェックする必要があります。その制限を超えてバッファに到達する方法がないため、IORING_MAX_REG_BUFFERS も超えることはできません。この大きなテーブルを登録しても、到達できないバッファを登録する意味がないことと、大きすぎる割り当てを試行することで kmalloc() 警告を発生させることを除いては、問題はありません。CVE-2025-38196

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - io_uring/rsrc对克隆 syzbot 报告其可触发过大的 kmalloc() 尝试触发 WARN_ON() 的 WARN_ON() 加上偏移计数mm/slub.c:5024 WARNING: CPU: 0 PID: 6488
    __kvmalloc_node_noprof+0x520/0x640 mm/slub.c:5024 模块中链接的模块CPU: 0 UID: 0 PID: 6488 Comm: syz-executor312 未受感染 6.15.0-rc7-syzkaller-gd7fa1af5b33e #0 PREEMPT 硬件名称Google Google Compute Engine/Google 计算引擎，BIOS Google 05/07/2025 pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __kvmalloc_node_noprof+0x520/0x640 mm/slub.c:5024 lr : __do_kmalloc_node mm/slub.c:-1 [内联] lr : __kvmalloc_node_noprof+0x3b4/0x640 mm/slub.c:5012 sp : ffff80009cfd7a90 x29
    ffff80009cfd7ac0 x28: ffff0000dd52a120 x27: 0000000000412dc0 x26: 0000000000000178 x25: ffff7000139faf70 x24: 0000000000000000 x23: ffff800082f4cea8 x22: 00000000ffffffff x21: 000000010cd004a8 x20:
    ffff0000d75816c0 x19: ffff0000dd52a000 x18: 00000000ffffffff x17: ffff800092f39000 x16: ffff80008adbe9e4 x15: 0000000000000005 x14: 1ffff000139faf1c x13: 0000000000000000 x12: 0000000000000000 x11:
    ffff7000139faf21 x10: 0000000000000003 x9 : ffff80008f27b938 x8 : 0000000000000002 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 00000000ffffffff x4 : 0000000000400dc0 x3 : 0000000200000000 x2 :
    000000010cd004a8 x1 : ffff80008b3ebc40 x0 : 0000000000000001 调用跟踪
    __kvmalloc_node_noprof+0x520/0x640 mm/slub.c:5024 (P) kvmalloc_array_node_noprof include/linux/slab.h:1065 [内联] io_rsrc_data_alloc io_uring/rsrc.c:206 [内联] io_clone_buffers io_uring/rsrc.c:1178 [内联] io_register_clone_buffers+0x484/0xa14 io_uring/rsrc.c:1287 __io_uring_register io_uring/register.c:815 [内联] __do_sys_io_uring_register io_uring/register.c:926 [内联] __se_sys_io_uring_register io_uring/register.c:903 [内联] __arm64_sys_io_uring_register.c:903 [内联] __arm64_sys_io_uring_register.c:903 io_uring/register.c:903
    __invoke_syscall arch/arm64/kernel/syscall.c:35 [内联] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48 /0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync +0x198/0x19c arch/arm64/kernel/entry.S:600这是因为 offset + buffer_count 过大所致。注册代码仅检查缓冲区的总数但由于索引为数组因此它还应检查偏移 + 计数。即不能超过 IORING_MAX_REG_BUFFERS因为无法访问超出该限制的缓冲区。注册如此大的表没有问题除了注册无法访问的缓冲区毫无意义之外而且可以因尝试过大的分配而触发此 kmalloc() 警告。 (CVE-2025-38196)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - io_uring/rsrc使用複制的位移驗證緩衝區計數 syzbot 報告其可針對過大的 kmalloc() 嘗試觸發 WARN_ON()警告 CPU: 0 PID: 6488@mm/slub.c:5024
    __kvmalloc_node_noprof+0x520/0x640 mm/slub.c:5024 模組連結於 CPU 0 UID 0 PID 6488 Comm syz-executor312 未受污染的 6.15.0-rc7-syzkaller-gd7fa1af5b33e #0 PREEMPT 硬體名稱 Google Google Compute Engine/Google Compute Engine、BIOS Google 05/07/2025 pstate20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc __kvmalloc_node_noprof+0x520/0x640 mm/slub.c:5024 lr __do_kmalloc_node mm/slub.c:-1 [內嵌] lr __kvmalloc_node_noprof+0x3b4/0x640 mm/slub.c:5012 spffff80009cfd7a90 x29
    ffff80009cfd7ac0 x28: ffff0000dd52a120 x27: 0000000000412dc0 x26: 0000000000000178 x25: ffff7000139faf70 x24: 0000000000000000 x23: ffff800082f4cea8 x22: 00000000ffffffff x21: 000000010cd004a8 x20:
    ffff0000d75816c0 x19: ffff0000dd52a000 x18: 00000000ffffffff x17: ffff800092f39000 x16: ffff80008adbe9e4 x15: 0000000000000005 x14: 1ffff000139faf1c x13: 0000000000000000 x12: 0000000000000000 x11:
    ffff7000139faf21 x10: 0000000000000003 x9 : ffff80008f27b938 x8 : 0000000000000002 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 00000000ffffffff x4 : 0000000000400dc0 x3 : 0000000200000000 x2 :
    000000010cd004a8 x1 ffff80008b3ebc40 x0 0000000000000001 呼叫追踪
    __kvmalloc_node_noprof+0x520/0x640 mm/slub.c:5024 (P) kvmalloc_array_node_noprof include/linux/slab.h:1065 [內嵌] io_rsrc_data_alloc io_uring/rsrc.c:206 [內嵌] io_clone_buffers io_uring/rsrc.c:1178 [內嵌] io_register_clone_buffers+0x484/0xa14 io_uring/rsrc.c:1287 __io_uring_register io_uring/register.c:815 [內嵌] __do_sys_io_uring_register io_uring/register.c:926 [內嵌] __se_sys_io_uring_register io_uring/register.c:903 [內嵌] __arm64_sys_io_uring_register+042/0c_uring/register+0 io_uring/register.c:903
    __invoke_syscall arch/arm64/kernel/syscall.c:35 [內嵌] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48 /0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync +0x198/0x19c arch/arm64/kernel/entry.S:600這是因為 offset + buffer_count 太大所致。註冊程式碼僅檢查緩衝區的總計數但假設索引是一個陣列其也應檢查位移 + 計數。這也不能超過 IORING_MAX_REG_BUFFERS因為超出該限制則無法存取緩衝區。註冊這麼大的表格沒有任何問題但是除了註冊無法存取的緩衝區毫無意義而且可因嘗試太大的配置而觸發此 kmalloc() 警告之外。 (CVE-2025-38196)

請注意，Nessus 依賴供應商報告的套件存在。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
249567	Linux Distros Unpatched Vulnerability : CVE-2025-38196	Nessus	Misc.	2025/8/15	2025/8/15	high
249567	Linux Distros のパッチ未適用の脆弱性: CVE-2025-38196	Nessus	Misc.	2025/8/15	2025/8/15	high
249567	Linux Distros 未修补的漏洞：CVE-2025-38196	Nessus	Misc.	2025/8/15	2025/8/15	high
249567	Linux Distros 未修補的弱點：CVE-2025-38196	Nessus	Misc.	2025/8/15	2025/8/15	high

检测

插件搜索

high

high

high

high