In the Linux kernel, the following vulnerability has been resolved: mm/slub: actually fix freelist pointer vs redzoning It turns out that SLUB redzoning ("slub_debug=Z") checks from s->object_size rather than from s->inuse (which is normally bumped to make room for the freelist pointer), so a cache created with an object size less than 24 would have the freelist pointer written beyond s->object_size, causing the redzone to be corrupted by the freelist pointer. This was very visible with "slub_debug=ZF": BUG test (Tainted: G B ): Right Redzone overwritten ----------------------------------------------------------------------------- INFO: 0xffff957ead1c05de-0xffff957ead1c05df @offset=1502. First byte 0x1a instead of 0xbb INFO: Slab 0xffffef3950b47000 objects=170 used=170 fp=0x0000000000000000 flags=0x8000000000000200 INFO: Object 0xffff957ead1c05d8 @offset=1496 fp=0xffff957ead1c0620 Redzone (____ptrval____): bb bb bb bb bb bb bb bb ........ Object (____ptrval____): 00 00 00 00 00 f6 f4 a5 ........ Redzone (____ptrval____): 40 1d e8 1a aa @.... Padding (____ptrval____): 00 00 00 00 00 00 00 00 ........ Adjust the offset to stay within s->object_size. (Note that no caches of in this size range are known to exist in the kernel currently.)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989714 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    mm/slub: actually fix freelist pointer vs redzoning

    It turns out that SLUB redzoning (slub_debug=Z) checks from     s->object_size rather than from s->inuse (which is normally bumped to     make room for the freelist pointer), so a cache created with an object     size less than 24 would have the freelist pointer written beyond     s->object_size, causing the redzone to be corrupted by the freelist     pointer.  This was very visible with slub_debug=ZF:

      BUG test (Tainted: G    B            ): Right Redzone overwritten
      -----------------------------------------------------------------------------

      INFO: 0xffff957ead1c05de-0xffff957ead1c05df @offset=1502. First byte 0x1a instead of 0xbb       INFO: Slab 0xffffef3950b47000 objects=170 used=170 fp=0x0000000000000000 flags=0x8000000000000200       INFO: Object 0xffff957ead1c05d8 @offset=1496 fp=0xffff957ead1c0620

      Redzone  (____ptrval____): bb bb bb bb bb bb bb bb               ........
      Object   (____ptrval____): 00 00 00 00 00 f6 f4 a5               ........
      Redzone  (____ptrval____): 40 1d e8 1a aa                        @....
      Padding  (____ptrval____): 00 00 00 00 00 00 00 00               ........

    Adjust the offset to stay within s->object_size.

    (Note that no caches of in this size range are known to exist in the     kernel currently.)

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987014 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    mm/slub: actually fix freelist pointer vs redzoning

    It turns out that SLUB redzoning (slub_debug=Z) checks from     s->object_size rather than from s->inuse (which is normally bumped to     make room for the freelist pointer), so a cache created with an object     size less than 24 would have the freelist pointer written beyond     s->object_size, causing the redzone to be corrupted by the freelist     pointer.  This was very visible with slub_debug=ZF:

      BUG test (Tainted: G    B            ): Right Redzone overwritten
      -----------------------------------------------------------------------------

      INFO: 0xffff957ead1c05de-0xffff957ead1c05df @offset=1502. First byte 0x1a instead of 0xbb       INFO: Slab 0xffffef3950b47000 objects=170 used=170 fp=0x0000000000000000 flags=0x8000000000000200       INFO: Object 0xffff957ead1c05d8 @offset=1496 fp=0xffff957ead1c0620

      Redzone  (____ptrval____): bb bb bb bb bb bb bb bb               ........
      Object   (____ptrval____): 00 00 00 00 00 f6 f4 a5               ........
      Redzone  (____ptrval____): 40 1d e8 1a aa                        @....
      Padding  (____ptrval____): 00 00 00 00 00 00 00 00               ........

    Adjust the offset to stay within s->object_size.

    (Note that no caches of in this size range are known to exist in the     kernel currently.)

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mm/slub: actually fix freelist pointer vs redzoning It turns out that SLUB redzoning (slub_debug=Z)     checks from s->object_size rather than from s->inuse (which is normally bumped to make room for the     freelist pointer), so a cache created with an object size less than 24 would have the freelist pointer     written beyond s->object_size, causing the redzone to be corrupted by the freelist pointer. This was very     visible with slub_debug=ZF: BUG test (Tainted: G B ): Right Redzone overwritten
    ----------------------------------------------------------------------------- INFO:
    0xffff957ead1c05de-0xffff957ead1c05df @offset=1502. First byte 0x1a instead of 0xbb INFO: Slab     0xffffef3950b47000 objects=170 used=170 fp=0x0000000000000000 flags=0x8000000000000200 INFO: Object     0xffff957ead1c05d8 @offset=1496 fp=0xffff957ead1c0620 Redzone (____ptrval____): bb bb bb bb bb bb bb bb     ........ Object (____ptrval____): 00 00 00 00 00 f6 f4 a5 ........ Redzone (____ptrval____): 40 1d e8 1a     aa @.... Padding (____ptrval____): 00 00 00 00 00 00 00 00 ........ Adjust the offset to stay within     s->object_size. (Note that no caches of in this size range are known to exist in the kernel currently.)     (CVE-2021-47221)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2951 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    The following packages have been upgraded to a later upstream version: kernel (4.18.0). (BZ#2122230,     BZ#2122267)

    Security Fix(es):

    * use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)

    * net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)

    * hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)

    * malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)

    * when setting font with malicious data by ioctl PIO_FONT, kernel will write memory out of bounds     (CVE-2021-33656)

    * possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)

    * use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)

    * KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)

    * KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)

    * netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)

    * race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)

    * media: em28xx: initialize refcount before kref_get (CVE-2022-3239)

    * race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)

    * memory leak in ipv6_renew_options() (CVE-2022-3524)

    * data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)

    * data races around sk->sk_prot (CVE-2022-3567)

    * memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)

    * denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)

    * use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)

    * USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)

    * Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)

    * l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)

    * igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)

    * Executable Space Protection Bypass (CVE-2022-25265)

    * Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

    * unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)

    * TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning     (CVE-2022-39189)

    * Report vmalloc UAF in dvb-core/dmxdev (CVE-2022-41218)

    * u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)

    * use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)

    * use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)

    * BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)

    * Denial of service in beacon protection for P2P-device (CVE-2022-42722)

    * memory corruption in usbmon driver (CVE-2022-43750)

    * NULL pointer dereference in traffic control subsystem (CVE-2022-47929)

    * NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)

    * use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)

    * Soft lockup occurred during __page_mapcount (CVE-2023-1582)

    * slab-out-of-bounds read vulnerabilities in cbq_classify (CVE-2023-23454)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
273405	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989714)	Nessus	Unity Linux Local Security Checks	medium
268413	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987014)	Nessus	Unity Linux Local Security Checks	medium
224343	Linux Distros Unpatched Vulnerability : CVE-2021-47221	Nessus	Misc.	medium
175900	RHEL 8 : kernel (RHSA-2023:2951)	Nessus	Red Hat Local Security Checks	high
160459	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2022-002 (ALASKERNEL-5.10-2022-002)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2021-47221

medium

Tenable Plugins

medium

medium

medium

high

high