Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control bits. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0777.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002354 advisory.

    Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel     memory by not enabling memory and I/O decoding control bits.  NOTE: this vulnerability exists because of     an incomplete fix for CVE-2015-0777.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001986 advisory.

    Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel     memory by not enabling memory and I/O decoding control bits.  NOTE: this vulnerability exists because of     an incomplete fix for CVE-2015-0777.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000918 advisory.

    Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel     memory by not enabling memory and I/O decoding control bits.  NOTE: this vulnerability exists because of     an incomplete fix for CVE-2015-0777.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel     memory by not enabling memory and I/O decoding control bits. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2015-0777. (CVE-2015-8553)

Note that Nessus relies on the presence of the package as reported by the vendor.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2015-8553     Jan Beulich discovered that CVE-2015-2150 was not     completely addressed. If a PCI physical function is     passed through to a Xen guest, the guest is able to     access its memory and I/O regions before enabling     decoding of those regions. This could result in a     denial-of-service (unexpected NMI) on the host.

  The fix for this is incompatible with qemu versions before 2.5.

  - CVE-2017-18509     Denis Andzakovic reported a missing type check in the     IPv4 multicast routing implementation. A user with the     CAP_NET_ADMIN capability (in any user namespace) could     use this for denial-of-service (memory corruption or     crash) or possibly for privilege escalation.

  - CVE-2018-5995     ADLab of VenusTech discovered that the kernel logged the     virtual addresses assigned to per-CPU data, which could     make it easier to exploit other vulnerabilities.

  - CVE-2018-20836     chenxiang reported a race condition in libsas, the     kernel subsystem supporting Serial Attached SCSI (SAS)     devices, which could lead to a use-after-free. It is not     clear how this might be exploited.

  - CVE-2018-20856     Xiao Jin reported a potential double-free in the block     subsystem, in case an error occurs while initialising     the I/O scheduler for a block device. It is not clear     how this might be exploited.

  - CVE-2019-1125     It was discovered that most x86 processors could     speculatively skip a conditional SWAPGS instruction used     when entering the kernel from user mode, and/or could     speculatively execute it when it should be skipped. This     is a subtype of Spectre variant 1, which could allow     local users to obtain sensitive information from the     kernel or other processes. It has been mitigated by     using memory barriers to limit speculative execution.
    Systems using an i386 kernel are not affected as the     kernel does not use SWAPGS.

  - CVE-2019-3882     It was found that the vfio implementation did not limit     the number of DMA mappings to device memory. A local     user granted ownership of a vfio device could use this     to cause a denial of service (out-of-memory condition).

  - CVE-2019-3900     It was discovered that vhost drivers did not properly     control the amount of work done to service requests from     guest VMs. A malicious guest could use this to cause a     denial-of-service (unbounded CPU usage) on the host.

  - CVE-2019-10207     The syzkaller tool found a potential null dereference in     various drivers for UART-attached Bluetooth adapters. A     local user with access to a pty device or other suitable     tty device could use this for denial-of-service     (BUG/oops).

  - CVE-2019-10638     Amit Klein and Benny Pinkas discovered that the     generation of IP packet IDs used a weak hash function,     'jhash'. This could enable tracking individual computers     as they communicate with different remote servers and     from different networks. The 'siphash' function is now     used instead.

  - CVE-2019-10639     Amit Klein and Benny Pinkas discovered that the     generation of IP packet IDs used a weak hash function     that incorporated a kernel virtual address. This hash     function is no longer used for IP IDs, although it is     still used for other purposes in the network stack.

  - CVE-2019-13631     It was discovered that the gtco driver for USB input     tablets could overrun a stack buffer with constant data     while parsing the device's descriptor. A physically     present user with a specially constructed USB device     could use this to cause a denial-of-service (BUG/oops),     or possibly for privilege escalation.

  - CVE-2019-13648     Praveen Pandey reported that on PowerPC (ppc64el)     systems without Transactional Memory (TM), the kernel     would still attempt to restore TM state passed to the     sigreturn() system call. A local user could use this for     denial-of-service (oops).

  - CVE-2019-14283     The syzkaller tool found a missing bounds check in the     floppy disk driver. A local user with access to a floppy     disk device, with a disk present, could use this to read     kernel memory beyond the I/O buffer, possibly obtaining     sensitive information.

  - CVE-2019-14284     The syzkaller tool found a potential division-by-zero in     the floppy disk driver. A local user with access to a     floppy disk device could use this for denial-of-service     (oops).

  - CVE-2019-15239     Denis Andzakovic reported a possible use-after-free in     the TCP sockets implementation. A local user could use     this for denial-of-service (memory corruption or crash)     or possibly for privilege escalation.

  - (CVE ID not yet assigned)

    The netfilter conntrack subsystem used kernel addresses     as user-visible IDs, which could make it easier to     exploit other security vulnerabilities.

  - XSA-300

    Julien Grall reported that Linux does not limit the     amount of memory which a domain will attempt to balloon     out, nor limits the amount of 'foreign / grant map'     memory which any individual guest can consume, leading     to denial of service conditions (for host or guests).

ID	Name	Product	Family	Severity
287697	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002354)	Nessus	Unity Linux Local Security Checks	medium
286492	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001986)	Nessus	Unity Linux Local Security Checks	medium
283746	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000918)	Nessus	Unity Linux Local Security Checks	medium
219038	Linux Distros Unpatched Vulnerability : CVE-2015-8553	Nessus	Misc.	medium
127867	Debian DSA-4497-1 : linux - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-8553

medium

Tenable Plugins

medium

medium

medium

medium

high