The futex_wait_requeue_pi function in kernel/futex.c in the Linux kernel before 3.5.1 does not ensure that calls have two different futex addresses, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted FUTEX_WAIT_REQUEUE_PI command.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-490:04 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system.  The     kernel handles the basic functions of the operating system: memory allocation, process allocation, device     input and output, etc.
    Security issues fixed with this release:
    CVE-2012-6647     The futex_wait_requeue_pi function in kernel/futex.c in the Linux kernel before 3.5.1 does not ensure that     calls have two different futex addresses, which allows local users to cause a denial of service (NULL     pointer dereference and system crash) or possibly have unspecified other impact via a crafted     FUTEX_WAIT_REQUEUE_PI command.
    CVE-2013-7339     The rds_ib_laddr_check function in net/rds/ib.c in the Linux kernel before 3.12.8 allows local users to     cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other     impact via a bind system call for an RDS socket on a system that lacks RDS transports.
    CVE-2014-2672     Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux     kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large     amount of network traffic that triggers certain list deletions.
    CVE-2014-2678     The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to     cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other     impact via a bind system call for an RDS socket on a system that lacks RDS transports.
    CVE-2014-2706     Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to     cause a denial of service (system crash) via network traffic that improperly interacts with the     WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c.
    CVE-2014-2851     Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1     allows local users to cause a denial of service (use-after-free and system crash) or possibly gain     privileges via a crafted application that leverages an improperly managed reference counter.
    CVE-2014-3144     The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter     function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length     value is sufficiently large, which allows local users to cause a denial of service (integer underflow and     system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr and
    __skb_get_nlattr_nest functions before the vulnerability was announced.
    CVE-2014-3145     The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in     the Linux kernel through 3.14.3 uses the reverse order in a certain subtraction, which allows local users     to cause a denial of service (over-read and system crash) via crafted BPF instructions. NOTE: the affected     code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced.
    CVE-2014-4699     The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value     for the saved RIP address in the case of a system call that does not use IRET, which allows local users to     leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted     application that makes ptrace and fork system calls.
    CVE-2014-4943     The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain     privileges by leveraging data-structure differences between an l2tp socket and an inet socket.
    Fixed bugs:
    See changelog.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002428 advisory.

    The futex_wait_requeue_pi function in kernel/futex.c in the Linux kernel before 3.5.1 does not ensure that     calls have two different futex addresses, which allows local users to cause a denial of service (NULL     pointer dereference and system crash) or possibly have unspecified other impact via a crafted     FUTEX_WAIT_REQUEUE_PI command.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002532 advisory.

    The futex_wait_requeue_pi function in kernel/futex.c in the Linux kernel before 3.5.1 does not ensure that     calls have two different futex addresses, which allows local users to cause a denial of service (NULL     pointer dereference and system crash) or possibly have unspecified other impact via a crafted     FUTEX_WAIT_REQUEUE_PI command.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000761 advisory.

    The futex_wait_requeue_pi function in kernel/futex.c in the Linux kernel before 3.5.1 does not ensure that     calls have two different futex addresses, which allows local users to cause a denial of service (NULL     pointer dereference and system crash) or possibly have unspecified other impact via a crafted     FUTEX_WAIT_REQUEUE_PI command.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix multiple security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A use-after-free flaw was found in the way the ping_init_sock() function of the Linux kernel handled the group_info reference counter.
A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-2851, Important)

* A NULL pointer dereference flaw was found in the way the futex_wait_requeue_pi() function of the Linux kernel's futex subsystem handled the requeuing of certain Priority Inheritance (PI) futexes. A local, unprivileged user could use this flaw to crash the system.
(CVE-2012-6647, Moderate)

* A NULL pointer dereference flaw was found in the rds_ib_laddr_check() function in the Linux kernel's implementation of Reliable Datagram Sockets (RDS). A local, unprivileged user could use this flaw to crash the system. (CVE-2013-7339, Moderate)

* It was found that a remote attacker could use a race condition flaw in the ath_tx_aggr_sleep() function to crash the system by creating large network traffic on the system's Atheros 9k wireless network adapter. (CVE-2014-2672, Moderate)

* A NULL pointer dereference flaw was found in the rds_iw_laddr_check() function in the Linux kernel's implementation of Reliable Datagram Sockets (RDS). A local, unprivileged user could use this flaw to crash the system. (CVE-2014-2678, Moderate)

* A race condition flaw was found in the way the Linux kernel's mac80211 subsystem implementation handled synchronization between TX and STA wake-up code paths. A remote attacker could use this flaw to crash the system. (CVE-2014-2706, Moderate)

* An out-of-bounds memory access flaw was found in the Netlink Attribute extension of the Berkeley Packet Filter (BPF) interpreter functionality in the Linux kernel's networking implementation. A local, unprivileged user could use this flaw to crash the system or leak kernel memory to user space via a specially crafted socket filter. (CVE-2014-3144, CVE-2014-3145, Moderate)

This update also fixes several bugs and adds one enhancement.
Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add this enhancement. The system must be rebooted for this update to take effect.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3054 advisory.

    - filter: prevent nla extensions to peek beyond the end of the message (Mathias Krause)  [Orabug:
    19315783]  {CVE-2014-3144} {CVE-2014-3145}
    - futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi() (Darren Hart)  [Orabug: 19315318]     {CVE-2012-6647}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0981 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    * A use-after-free flaw was found in the way the ping_init_sock() function     of the Linux kernel handled the group_info reference counter. A local,     unprivileged user could use this flaw to crash the system or, potentially,     escalate their privileges on the system. (CVE-2014-2851, Important)

    * A NULL pointer dereference flaw was found in the way the     futex_wait_requeue_pi() function of the Linux kernel's futex subsystem     handled the requeuing of certain Priority Inheritance (PI) futexes.
    A local, unprivileged user could use this flaw to crash the system.
    (CVE-2012-6647, Moderate)

    * A NULL pointer dereference flaw was found in the rds_ib_laddr_check()     function in the Linux kernel's implementation of Reliable Datagram Sockets     (RDS). A local, unprivileged user could use this flaw to crash the system.
    (CVE-2013-7339, Moderate)

    * It was found that a remote attacker could use a race condition flaw in     the ath_tx_aggr_sleep() function to crash the system by creating large     network traffic on the system's Atheros 9k wireless network adapter.
    (CVE-2014-2672, Moderate)

    * A NULL pointer dereference flaw was found in the rds_iw_laddr_check()     function in the Linux kernel's implementation of Reliable Datagram Sockets     (RDS). A local, unprivileged user could use this flaw to crash the system.
    (CVE-2014-2678, Moderate)

    * A race condition flaw was found in the way the Linux kernel's mac80211     subsystem implementation handled synchronization between TX and STA wake-up     code paths. A remote attacker could use this flaw to crash the system.
    (CVE-2014-2706, Moderate)

    * An out-of-bounds memory access flaw was found in the Netlink Attribute     extension of the Berkeley Packet Filter (BPF) interpreter functionality in     the Linux kernel's networking implementation. A local, unprivileged user     could use this flaw to crash the system or leak kernel memory to user space     via a specially crafted socket filter. (CVE-2014-3144, CVE-2014-3145,     Moderate)

    This update also fixes several bugs and adds one enhancement.
    Documentation for these changes will be available shortly from the     Technical Notes document linked to in the References section.

    All kernel users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues and add this     enhancement. The system must be rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0981 advisory.

    - [netdrv] pppol2tp: fail when socket option level is not SOL_PPPOL2TP [1119461 1119462] {CVE-2014-4943}
    - [kernel] utrace: force IRET path after utrace_finish_vfork() (Oleg Nesterov) [1115932 1115933]     {CVE-2014-4699}
    - [net] filter: prevent nla extensions to peek beyond the end of the message (Jiri Benc) [1096778 1096779]     {CVE-2014-3144 CVE-2014-3145}
    - [net] rds: prevent dereference of a NULL device in rds_iw_laddr_check (Radomir Vrbovsky) [1083276     1083277] {CVE-2014-2678}
    - [kernel] futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi() (Mateusz Guzik) [1097759 1097760]     {CVE-2012-6647}
    - [net] mac80211: crash dues to AP powersave TX vs. wakeup race (Jacob Tanenbaum) [1083531 1083532]     {CVE-2014-2706}
    - [netdrv] ath9k: tid->sched race in ath_tx_aggr_sleep() (Jacob Tanenbaum) [1083249 1083250]     {CVE-2014-2672}
    - [net] ipv4: current group_info should be put after using (Jiri Benc) [1087412 1087414] {CVE-2014-2851}
    - [net] rds: dereference of a NULL device (Jacob Tanenbaum) [1079218 1079219] {CVE-2013-7339}
    - [kernel] futex: Make lookup_pi_state more robust (Jerome Marchand) [1104516 1104517] {CVE-2014-3153}
    - [kernel] futex: Always cleanup owner tid in unlock_pi (Jerome Marchand) [1104516 1104517]     {CVE-2014-3153}
    - [kernel] futex: Validate atomic acquisition in futex_lock_pi_atomic() (Jerome Marchand) [1104516     1104517] {CVE-2014-3153}
    - [kernel] futex: prevent requeue pi on same futex (Jerome Marchand) [1104516 1104517] {CVE-2014-3153}
    - [block] floppy: don't write kernel-only members to FDRAWCMD ioctl output (Denys Vlasenko) [1094308     1094310] {CVE-2014-1738 CVE-2014-1737}
    - [block] floppy: ignore kernel-only members in FDRAWCMD ioctl input (Denys Vlasenko) [1094308 1094310]     {CVE-2014-1738 CVE-2014-1737}
    - [fs] vfs: fix autofs/afs/etc magic mountpoint breakage (Frantisek Hrbata) [1094370 1079347]     {CVE-2014-0203}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
289073	MiracleLinux 4 : kernel-2.6.32-431.23.3.el6 (AXSA:2014-490:04)	Nessus	Miracle Linux Local Security Checks	high
287690	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002428)	Nessus	Unity Linux Local Security Checks	high
287578	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002532)	Nessus	Unity Linux Local Security Checks	high
283751	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000761)	Nessus	Unity Linux Local Security Checks	high
76948	CentOS 6 : kernel (CESA-2014:0981)	Nessus	CentOS Local Security Checks	high
76928	Oracle Linux 5 / 6 : unbreakable enterprise kernel (ELSA-2014-3054)	Nessus	Oracle Linux Local Security Checks	high
76908	RHEL 6 : kernel (RHSA-2014:0981)	Nessus	Red Hat Local Security Checks	medium
76888	Oracle Linux 6 : kernel (ELSA-2014-0981)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2012-6647

high

Tenable Plugins

high

high

high

high

high

high

medium

high