In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Prevent state corruption in __fpu__restore_sig() The non-compacted slowpath uses __copy_from_user() and copies the entire user buffer into the kernel buffer, verbatim. This means that the kernel buffer may now contain entirely invalid state on which XRSTOR will #GP. validate_user_xstate_header() can detect some of that corruption, but that leaves the onus on callers to clear the buffer. Prior to XSAVES support, it was possible just to reinitialize the buffer, completely, but with supervisor states that is not longer possible as the buffer clearing code split got it backwards. Fixing that is possible but not corrupting the state in the first place is more robust. Avoid corruption of the kernel XSAVE buffer by using copy_user_to_xstate() which validates the XSAVE header contents before copying the actual states to the kernel. copy_user_to_xstate() was previously only called for compacted-format kernel buffers, but it works for both compacted and non-compacted forms. Using it for the non-compacted form is slower because of multiple __copy_from_user() operations, but that cost is less important than robust code in an already slow path. [ Changelog polished by Dave Hansen ]

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989287 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    x86/fpu: Prevent state corruption in __fpu__restore_sig()

    The non-compacted slowpath uses __copy_from_user() and copies the entire     user buffer into the kernel buffer, verbatim.  This means that the kernel     buffer may now contain entirely invalid state on which XRSTOR will #GP.
    validate_user_xstate_header() can detect some of that corruption, but that     leaves the onus on callers to clear the buffer.

    Prior to XSAVES support, it was possible just to reinitialize the buffer,     completely, but with supervisor states that is not longer possible as the     buffer clearing code split got it backwards. Fixing that is possible but     not corrupting the state in the first place is more robust.

    Avoid corruption of the kernel XSAVE buffer by using copy_user_to_xstate()     which validates the XSAVE header contents before copying the actual states     to the kernel. copy_user_to_xstate() was previously only called for     compacted-format kernel buffers, but it works for both compacted and     non-compacted forms.

    Using it for the non-compacted form is slower because of multiple
    __copy_from_user() operations, but that cost is less important than robust     code in an already slow path.

    [ Changelog polished by Dave Hansen ]

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986769 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    x86/fpu: Prevent state corruption in __fpu__restore_sig()

    The non-compacted slowpath uses __copy_from_user() and copies the entire     user buffer into the kernel buffer, verbatim.  This means that the kernel     buffer may now contain entirely invalid state on which XRSTOR will #GP.
    validate_user_xstate_header() can detect some of that corruption, but that     leaves the onus on callers to clear the buffer.

    Prior to XSAVES support, it was possible just to reinitialize the buffer,     completely, but with supervisor states that is not longer possible as the     buffer clearing code split got it backwards. Fixing that is possible but     not corrupting the state in the first place is more robust.

    Avoid corruption of the kernel XSAVE buffer by using copy_user_to_xstate()     which validates the XSAVE header contents before copying the actual states     to the kernel. copy_user_to_xstate() was previously only called for     compacted-format kernel buffers, but it works for both compacted and     non-compacted forms.

    Using it for the non-compacted form is slower because of multiple
    __copy_from_user() operations, but that cost is less important than robust     code in an already slow path.

    [ Changelog polished by Dave Hansen ]

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Prevent state corruption in
    __fpu__restore_sig() The non-compacted slowpath uses __copy_from_user() and copies the entire user buffer     into the kernel buffer, verbatim. This means that the kernel buffer may now contain entirely invalid state     on which XRSTOR will #GP. validate_user_xstate_header() can detect some of that corruption, but that     leaves the onus on callers to clear the buffer. Prior to XSAVES support, it was possible just to     reinitialize the buffer, completely, but with supervisor states that is not longer possible as the buffer     clearing code split got it backwards. Fixing that is possible but not corrupting the state in the first     place is more robust. Avoid corruption of the kernel XSAVE buffer by using copy_user_to_xstate() which     validates the XSAVE header contents before copying the actual states to the kernel. copy_user_to_xstate()     was previously only called for compacted-format kernel buffers, but it works for both compacted and non-     compacted forms. Using it for the non-compacted form is slower because of multiple __copy_from_user()     operations, but that cost is less important than robust code in an already slow path. [ Changelog polished     by Dave Hansen ] (CVE-2021-47227)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2185-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
    - CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
    - CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
    - CVE-2022-48673: kABI workarounds for struct smc_link (bsc#1223934).
    - CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
    - CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
    - CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
    - CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
    - CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
    - CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
    - CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
    - CVE-2021-47261: Fix initializing CQ fragments buffer (bsc#1224954)
    - CVE-2021-47254: Fix use-after-free in gfs2_glock_shrink_scan (bsc#1224888).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
    - CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve     local privilege escalation (bsc#1215420).
    - CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve     local privilege escalation (bsc#1215420).
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
    - CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
272875	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989287)	Nessus	Unity Linux Local Security Checks	medium
268079	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986769)	Nessus	Unity Linux Local Security Checks	medium
229818	Linux Distros Unpatched Vulnerability : CVE-2021-47227	Nessus	Misc.	medium
200930	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:2185-1)	Nessus	SuSE Local Security Checks	critical
160459	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2022-002 (ALASKERNEL-5.10-2022-002)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2021-47227

medium

Tenable Plugins

medium

medium

medium

critical

high