In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-200688826References: Upstream kernel

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013295 advisory.

    In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to     a race condition. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid     ID: A-200688826References: Upstream kernel

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013387 advisory.

    In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to     a race condition. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid     ID: A-200688826References: Upstream kernel

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414548 advisory.

    In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to     a race condition. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid     ID: A-200688826References: Upstream kernel

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to     a race condition. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid     ID: A-200688826References: Upstream kernel (CVE-2021-39686)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an     authenticated user to potentially enable denial of service via local access. (CVE-2021-33061)

  - When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
    (CVE-2021-33656)

  - In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to     a race condition. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid     ID: A-200688826References: Upstream kernel (CVE-2021-39686)

  - A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the     small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of     service problem. (CVE-2022-1012)

  - A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a     local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device     is detached and reclaim resources early. (CVE-2022-1195)

  - Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency     use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker     could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the     system. (CVE-2022-1652)

  - An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP     pacing can lead to memory/netns leak, which can be used by remote clients. (CVE-2022-1678)

  - A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged     user to gain root privileges. The bug allows to build several exploit primitives such as kernel address     information leak, arbitrary execution, etc. (CVE-2022-1729)

  - A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use     after free both read or write when non synchronized between cleanup routine and firmware download routine.
    (CVE-2022-1734)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by     simulating a nfc device from user-space. (CVE-2022-1975)

  - In various functions of the USB gadget subsystem, there is a possible out of bounds write due to a missing     bounds check. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid     ID: A-213172319References: Upstream kernel (CVE-2022-20009)

  - In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds     read due to improper input validation. This could lead to local information disclosure if a malicious USB     HID device were plugged in, with no additional execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream     kernel (CVE-2022-20132)

  - In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead     to local escalation of privilege when opening and closing inet sockets with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-112551163References: Upstream kernel (CVE-2022-20141)

  - In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead     to local escalation of privilege with System execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream     kernel (CVE-2022-20154)

  - In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer     overflow. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-182388481References: Upstream kernel (CVE-2022-20166)

  - A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. This issue makes it     possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This     flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel     oops condition that results in a denial of service. (CVE-2022-2153)

  - There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that     allow attackers to crash linux kernel without any privileges. (CVE-2022-2318)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

  - The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used. This occurs because of use of Algorithm 4 ('Double-Hash Port Selection Algorithm') of RFC 6056.
    (CVE-2022-32296)

  - An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer     overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point     registers. (CVE-2022-32981)

  - Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree     to keep track of the foreign mappings. Updating of that rbtree is not always done completely with the     related lock held, resulting in a small race window, which can be used by unprivileged guests via PV     devices to cause inconsistencies of the rbtree. These inconsistencies can lead to Denial of Service (DoS)     of dom0, e.g. by causing crashes or the inability to perform further mappings of other guests' memory     pages. (CVE-2022-33744)

  - drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of     a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.
    (CVE-2022-33981)

  - An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init     (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different     vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an     unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data     in net/netfilter/nf_tables_api.c. (CVE-2022-34918)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an     authenticated user to potentially enable denial of service via local access. (CVE-2021-33061)

  - When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
    (CVE-2021-33656)

  - In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to     a race condition. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid     ID: A-200688826References: Upstream kernel (CVE-2021-39686)

  - Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency     use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker     could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the     system. (CVE-2022-1652)

  - An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP     pacing can lead to memory/netns leak, which can be used by remote clients. (CVE-2022-1678)

  - A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged     user to gain root privileges. The bug allows to build several exploit primitives such as kernel address     information leak, arbitrary execution, etc. (CVE-2022-1729)

  - A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use     after free both read or write when non synchronized between cleanup routine and firmware download routine.
    (CVE-2022-1734)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds     read due to improper input validation. This could lead to local information disclosure if a malicious USB     HID device were plugged in, with no additional execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream     kernel (CVE-2022-20132)

  - In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead     to local escalation of privilege when opening and closing inet sockets with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-112551163References: Upstream kernel (CVE-2022-20141)

  - In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead     to local escalation of privilege with System execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream     kernel (CVE-2022-20154)

  - In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer     overflow. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-182388481References: Upstream kernel (CVE-2022-20166)

  - A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. This issue makes it     possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This     flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel     oops condition that results in a denial of service. (CVE-2022-2153)

  - There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that     allow attackers to crash linux kernel without any privileges. (CVE-2022-2318)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

  - The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used. This occurs because of use of Algorithm 4 ('Double-Hash Port Selection Algorithm') of RFC 6056.
    (CVE-2022-32296)

  - Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree     to keep track of the foreign mappings. Updating of that rbtree is not always done completely with the     related lock held, resulting in a small race window, which can be used by unprivileged guests via PV     devices to cause inconsistencies of the rbtree. These inconsistencies can lead to Denial of Service (DoS)     of dom0, e.g. by causing crashes or the inability to perform further mappings of other guests' memory     pages. (CVE-2022-33744)

  - drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of     a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.
    (CVE-2022-33981)

  - An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init     (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different     vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an     unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data     in net/netfilter/nf_tables_api.c. (CVE-2022-34918)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an     authenticated user to potentially enable denial of service via local access.(CVE-2021-33061)

    A use-after-free vulnerability was found in the Linux kernel's Netfilter subsystem in     net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege     escalation issue.(CVE-2022-1966)

    In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to     a race condition. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.(CVE-2021-39686)

    Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency     use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker     could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the     system.(CVE-2022-1652)

    A use-after-free flaw was found in the Linux kernels performance events functionality. A user triggers     a race condition in setting up performance monitoring between the leading PERF_TYPE_TRACEPOINT and sub     PERF_EVENT_HARDWARE plus the PERF_EVENT_SOFTWARE using the perf_event_open() function with these three     types. This flaw allows a local user to crash the system.(CVE-2022-1729)

    With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer     dereference.(CVE-2022-1789)

    A use-after-free vulnerability was found in drivers/block/floppy.c in the floppy driver module in the     Linux kernel between raw_cmd_ioctl and seek_interrupt. This flaw allows an attacker to cause a denial of     service, leading to a leak of internal kernel information.(CVE-2022-1836)

    An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP     pacing can lead to memory/netns leak, which can be used by remote clients.(CVE-2022-1678)

    Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions.(CVE-2022-29581)

    A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use     after free both read or write when non synchronized between cleanup routine and firmware download     routine.(CVE-2022-1734)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to     a race condition. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.(CVE-2021-39686)

    net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free.(CVE-2022-32250)

    A use-after-free vulnerability was found in the Linux kernel's Netfilter subsystem in     net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege     escalation issue.(CVE-2022-1966)

    With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer     dereference.(CVE-2022-1789)

    Due to the small table perturb size, a memory leak flaw was found in the Linux kernels TCP source port     generation algorithm in the net/ipv4/tcp.c function. This flaw allows an attacker to leak information and     may cause a denial of service.(CVE-2022-1012)

    Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency     use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker     could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the     system.(CVE-2022-1652)

    Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions.(CVE-2022-29581)

    A use-after-free vulnerability was found in drivers/block/floppy.c in the floppy driver module in the     Linux kernel between raw_cmd_ioctl and seek_interrupt. This flaw allows an attacker to cause a denial of     service, leading to a leak of internal kernel information.(CVE-2022-1836)

    An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP     pacing can lead to memory/netns leak, which can be used by remote clients.(CVE-2022-1678)

    A use-after-free flaw was found in the Linux kernels performance events functionality. A user triggers     a race condition in setting up performance monitoring between the leading PERF_TYPE_TRACEPOINT and sub     PERF_EVENT_HARDWARE plus the PERF_EVENT_SOFTWARE using the perf_event_open() function with these three     types. This flaw allows a local user to crash the system.(CVE-2022-1729)

    A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use     after free both read or write when non synchronized between cleanup routine and firmware download     routine.(CVE-2022-1734)

    The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.(CVE-2022-30594)

    A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a     local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device     is detached and reclaim resources early.(CVE-2022-1195)

    Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an     authenticated user to potentially enable denial of service via local access.(CVE-2021-33061)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5096 advisory.

    Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation,     denial of service or information leaks. CVE-2020-29374 Jann Horn of Google reported a flaw in Linux's     virtual memory management. A parent and child process initially share all their memory, but when either     writes to a shared page, the page is duplicated and unshared (copy-on-write). However, in case an     operation such as vmsplice() required the kernel to take an additional reference to a shared page, and a     copy-on-write occurs during this operation, the kernel might have accessed the wrong process's memory. For     some programs, this could lead to an information leak or data corruption. This issue was already fixed for     most architectures, but not on MIPS and System z. This update corrects that. CVE-2020-36322,     CVE-2021-28950 The syzbot tool found that the FUSE (filesystem-in-user-space) implementation did not     correctly handle a FUSE server returning invalid attributes for a file. A local user permitted to run a     FUSE server could use this to cause a denial of service (crash). The original fix for this introduced a     different potential denial of service (infinite loop in kernel space), which has also been fixed.
    CVE-2021-3640 Lin Ma discovered a race condiiton in the Bluetooth protocol implementation that can lead to     a use-after-free. A local user could exploit this to cause a denial of service (memory corruption or     crash) or possibly for privilege escalation. CVE-2021-3744, CVE-2021-3764 minihanshen reported bugs in the     ccp driver for AMD Cryptographic Coprocessors that could lead to a resource leak. On systems using this     driver, a local user could exploit this to cause a denial of service. CVE-2021-3752 Likang Luo of NSFOCUS     Security Team discovered a flaw in the Bluetooth L2CAP implementation that can lead to a user-after-free.
    A local user could exploit this to cause a denial of service (memory corruption or crash) or possibly for     privilege escalation. CVE-2021-3760, CVE-2021-4202 Lin Ma discovered race conditions in the NCI (NFC     Controller Interface) driver, which could lead to a use-after-free. A local user could exploit this to     cause a denial of service (memory corruption or crash) or possibly for privilege escalation. This driver     is not enabled in Debian's official kernel configurations. CVE-2021-3772 A flaw was found in the SCTP     protocol implementation, which would allow a networked attacker to break an SCTP association. The attacker     would only need to know or guess the IP addresses and ports for the association. CVE-2021-4002 It was     discovered that hugetlbfs, the virtual filesystem used by applications to allocate huge pages in RAM, did     not flush the CPU's TLB in one case where it was necessary. In some circumstances a local user would be     able to read and write huge pages after they are freed and reallocated to a different process. This could     lead to privilege escalation, denial of service or information leaks. CVE-2021-4083 Jann Horn reported a     race condition in the local (Unix) sockets garbage collector, that can lead to use-after-free. A local     user could exploit this to cause a denial of service (memory corruption or crash) or possibly for     privilege escalation. CVE-2021-4135 A flaw was found in the netdevsim driver which would lead to an     information leak. This driver is not enabled in Debian's official kernel configurations. CVE-2021-4155     Kirill Tkhai discovered a data leak in the way the XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for     a size increase of files with unaligned size. A local attacker can take advantage of this flaw to leak     data on the XFS filesystem. CVE-2021-4203 Jann Horn reported a race condition in the local (Unix) sockets     implementation that can lead to a use-after-free. A local user could exploit this to leak sensitive     information from the kernel. CVE-2021-20317 It was discovered that the timer queue structure could become     corrupt, leading to waiting tasks never being woken up. A local user with certain privileges could exploit     this to cause a denial of service (system hang). CVE-2021-20321 A race condition was discovered in the     overlayfs filesystem driver. A local user with access to an overlayfs mount and to its underlying upper     directory could exploit this for privilege escalation. CVE-2021-20322 An information leak was discovered     in the IPv4 implementation. A remote attacker could exploit this to quickly discover which UDP ports a     system is using, making it easier for them to carry out a DNS poisoning attack against that system.
    CVE-2021-22600 The syzbot tool found a flaw in the packet socket (AF_PACKET) implementation which could     lead to incorrectly freeing memory. A local user with CAP_NET_RAW capability (in any user namespace) could     exploit this for denial of service (memory corruption or crash) or possibly for privilege escalation.
    CVE-2021-28711, CVE-2021-28712, CVE-2021-28713 (XSA-391) Juergen Gross reported that malicious PV backends     can cause a denial of service to guests being serviced by those backends via high frequency events, even     if those backends are running in a less privileged environment. CVE-2021-28714, CVE-2021-28715 (XSA-392)     Juergen Gross discovered that Xen guests can force the Linux netback driver to hog large amounts of kernel     memory, resulting in denial of service. CVE-2021-38300 Piotr Krysiuk discovered a flaw in the classic BPF     (cBPF) JIT compiler for MIPS architectures. A local user could exploit this to excute arbitrary code in     the kernel. This issue is mitigated by setting sysctl net.core.bpf_jit_enable=0, which is the default. It     is *not* mitigated by disabling unprivileged use of eBPF. CVE-2021-39685 Szymon Heidrich discovered a     buffer overflow vulnerability in the USB gadget subsystem, resulting in information disclosure, denial of     service or privilege escalation. CVE-2021-39686 A race condition was discovered in the Android binder     driver, that could lead to incorrect security checks. On systems where the binder driver is loaded, a     local user could exploit this for privilege escalation. CVE-2021-39698 Linus Torvalds reported a flaw in     the file polling implementation, which could lead to a use-after-free. A local user could exploit this for     denial of service (memory corruption or crash) or possibly for privilege escalation. CVE-2021-39713 The     syzbot tool found a race condition in the network scheduling subsystem which could lead to a use-after-     free. A local user could exploit this for denial of service (memory corruption or crash) or possibly for     privilege escalation. CVE-2021-41864 An integer overflow was discovered in the Extended BPF (eBPF)     subsystem. A local user could exploit this for denial of service (memory corruption or crash), or possibly     for privilege escalation. This can be mitigated by setting sysctl kernel.unprivileged_bpf_disabled=1,     which disables eBPF use by unprivileged users. CVE-2021-42739 A heap buffer overflow was discovered in the     firedtv driver for FireWire-connected DVB receivers. A local user with access to a firedtv device could     exploit this for denial of service (memory corruption or crash), or possibly for privilege escalation.
    CVE-2021-43389 The Active Defense Lab of Venustech discovered a flaw in the CMTP subsystem as used by     Bluetooth, which could lead to an out-of-bounds read and object type confusion. A local user with     CAP_NET_ADMIN capability in the initial user namespace could exploit this for denial of service (memory     corruption or crash), or possibly for privilege escalation. CVE-2021-43975 Brendan Dolan-Gavitt reported a     flaw in the hw_atl_utils_fw_rpc_wait() function in the aQuantia AQtion ethernet device driver which can     result in denial of service or the execution of arbitrary code. CVE-2021-43976 Zekun Shen and Brendan     Dolan-Gavitt discovered a flaw in the mwifiex_usb_recv() function of the Marvell WiFi-Ex USB Driver. An     attacker able to connect a crafted USB device can take advantage of this flaw to cause a denial of     service. CVE-2021-44733 A race condition was discovered in the Trusted Execution Environment (TEE)     subsystem for Arm processors, which could lead to a use-after-free. A local user permitted to access a TEE     device could exploit this for denial of service (memory corruption or crash) or possibly for privilege     escalation. CVE-2021-45095 It was discovered that the Phone Network protocol (PhoNet) driver has a     reference count leak in the pep_sock_accept() function. CVE-2021-45469 Wenqing Liu reported an out-of-     bounds memory access in the f2fs implementation if an inode has an invalid last xattr entry. An attacker     able to mount a specially crafted image can take advantage of this flaw for denial of service.
    CVE-2021-45480 A memory leak flaw was discovered in the __rds_conn_create() function in the RDS (Reliable     Datagram Sockets) protocol subsystem. CVE-2022-0001 (INTEL-SA-00598) Researchers at VUSec discovered that     the Branch History Buffer in Intel processors can be exploited to create information side channels with     speculative execution. This issue is similar to Spectre variant 2, but requires additional mitigations on     some processors. This can be exploited to obtain sensitive information from a different security context,     such as from user-space to the kernel, or from a KVM guest to the kernel. CVE-2022-0002 (INTEL-SA-00598)     This is a similar issue to CVE-2022-0001, but covers exploitation within a security context, such as from     JIT-compiled code in a sandbox to hosting code in the same process. This can be partly mitigated by     disabling eBPF for unprivileged users with the sysctl: kernel.unprivileged_bpf_disabled=2. This update     does that by default. CVE-2022-0322 Eiichi Tsukata discovered a flaw in the sctp_make_strreset_req()     function in the SCTP network protocol implementation which can result in denial of service. CVE-2022-0330     Sushma Venkatesh Reddy discovered a missing GPU TLB flush in the i915 driver, resulting in denial of     service or privilege escalation. CVE-2022-0435 Samuel Page and Eric Dumazet reported a stack overflow in     the networking module for the Transparent Inter-Process Communication (TIPC) protocol, resulting in denial     of service or potentially the execution of arbitrary code. CVE-2022-0487 A use-after-free was discovered     in the MOXART SD/MMC Host Controller support driver. This flaw does not impact the Debian binary packages     as CONFIG_MMC_MOXART is not set. CVE-2022-0492 Yiqi Sun and Kevin Wang reported that the cgroup-v1     subsystem does not properly restrict access to the release-agent feature. A local user can take advantage     of this flaw for privilege escalation and bypass of namespace isolation. CVE-2022-0617 butt3rflyh4ck     discovered a NULL pointer dereference in the UDF filesystem. A local user that can mount a specially     crafted UDF image can use this flaw to crash the system. CVE-2022-0644 Hao Sun reported a missing check     for file read permission in the finit_module() and kexec_file_load() system calls. The security impact of     this is unclear, since these system calls are usually only available to the root user. CVE-2022-22942 It     was discovered that wrong file file descriptor handling in the VMware Virtual GPU driver (vmwgfx) could     result in information leak or privilege escalation. CVE-2022-24448 Lyu Tao reported a flaw in the NFS     implementation in the Linux kernel when handling requests to open a directory on a regular file, which     could result in a information leak. CVE-2022-24959 A memory leak was discovered in the     yam_siocdevprivate() function of the YAM driver for AX.25, which could result in denial of service.
    CVE-2022-25258 Szymon Heidrich reported the USB Gadget subsystem lacks certain validation of interface OS     descriptor requests, resulting in memory corruption. CVE-2022-25375 Szymon Heidrich reported that the     RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command, resulting in information leak     from kernel memory. For the oldstable distribution (buster), these problems have been fixed in version     4.19.232-1. This update additionally includes many more bug fixes from stable updates 4.19.209-4.19.232     inclusive. We recommend that you upgrade your linux packages. For the detailed security status of linux     please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
308114	Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013295)	Nessus	Unity Linux Local Security Checks	high
308014	Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013387)	Nessus	Unity Linux Local Security Checks	high
267886	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414548)	Nessus	Unity Linux Local Security Checks	high
224050	Linux Distros Unpatched Vulnerability : CVE-2021-39686	Nessus	Misc.	high
169330	EulerOS Virtualization 2.10.1 : kernel (EulerOS-SA-2022-2891)	Nessus	Huawei Local Security Checks	high
169319	EulerOS Virtualization 2.10.0 : kernel (EulerOS-SA-2022-2873)	Nessus	Huawei Local Security Checks	high
164244	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2022-2257)	Nessus	Huawei Local Security Checks	high
164207	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2022-2244)	Nessus	Huawei Local Security Checks	high
158761	Debian DSA-5096-1 : linux - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2021-39686

high

Tenable Plugins

high

high

high

high

high

high

high

high

high