In the Linux kernel, the following vulnerability has been resolved: coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer() commit 6f755e85c332 ("coresight: Add helper for inserting synchronization packets") removed trailing '\0' from barrier_pkt array and updated the call sites like etb_update_buffer() to have proper checks for barrier_pkt size before read but missed updating tmc_update_etf_buffer() which still reads barrier_pkt past the array size resulting in KASAN out-of-bounds bug. Fix this by adding a check for barrier_pkt size before accessing like it is done in etb_update_buffer(). BUG: KASAN: global-out-of-bounds in tmc_update_etf_buffer+0x4b8/0x698 Read of size 4 at addr ffffffd05b7d1030 by task perf/2629 Call trace: dump_backtrace+0x0/0x27c show_stack+0x20/0x2c dump_stack+0x11c/0x188 print_address_description+0x3c/0x4a4 __kasan_report+0x140/0x164 kasan_report+0x10/0x18 __asan_report_load4_noabort+0x1c/0x24 tmc_update_etf_buffer+0x4b8/0x698 etm_event_stop+0x248/0x2d8 etm_event_del+0x20/0x2c event_sched_out+0x214/0x6f0 group_sched_out+0xd0/0x270 ctx_sched_out+0x2ec/0x518 __perf_event_task_sched_out+0x4fc/0xe6c __schedule+0x1094/0x16a0 preempt_schedule_irq+0x88/0x170 arm64_preempt_schedule_irq+0xf0/0x18c el1_irq+0xe8/0x180 perf_event_exec+0x4d8/0x56c setup_new_exec+0x204/0x400 load_elf_binary+0x72c/0x18c0 search_binary_handler+0x13c/0x420 load_script+0x500/0x6c4 search_binary_handler+0x13c/0x420 exec_binprm+0x118/0x654 __do_execve_file+0x77c/0xba4 __arm64_compat_sys_execve+0x98/0xac el0_svc_common+0x1f8/0x5e0 el0_svc_compat_handler+0x84/0xb0 el0_svc_compat+0x10/0x50 The buggy address belongs to the variable: barrier_pkt+0x10/0x40 Memory state around the buggy address: ffffffd05b7d0f00: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00 ffffffd05b7d0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffffd05b7d1000: 00 00 00 00 00 00 fa fa fa fa fa fa 00 00 00 03 ^ ffffffd05b7d1080: fa fa fa fa 00 02 fa fa fa fa fa fa 03 fa fa fa ffffffd05b7d1100: fa fa fa fa 00 00 00 00 05 fa fa fa fa fa fa fa ==================================================================

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989239 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()

    commit 6f755e85c332 (coresight: Add helper for inserting synchronization     packets) removed trailing '\0' from barrier_pkt array and updated the     call sites like etb_update_buffer() to have proper checks for barrier_pkt     size before read but missed updating tmc_update_etf_buffer() which still     reads barrier_pkt past the array size resulting in KASAN out-of-bounds     bug. Fix this by adding a check for barrier_pkt size before accessing     like it is done in etb_update_buffer().

     BUG: KASAN: global-out-of-bounds in tmc_update_etf_buffer+0x4b8/0x698      Read of size 4 at addr ffffffd05b7d1030 by task perf/2629

     Call trace:
      dump_backtrace+0x0/0x27c       show_stack+0x20/0x2c       dump_stack+0x11c/0x188       print_address_description+0x3c/0x4a4
      __kasan_report+0x140/0x164       kasan_report+0x10/0x18
      __asan_report_load4_noabort+0x1c/0x24       tmc_update_etf_buffer+0x4b8/0x698       etm_event_stop+0x248/0x2d8       etm_event_del+0x20/0x2c       event_sched_out+0x214/0x6f0       group_sched_out+0xd0/0x270       ctx_sched_out+0x2ec/0x518
      __perf_event_task_sched_out+0x4fc/0xe6c
      __schedule+0x1094/0x16a0       preempt_schedule_irq+0x88/0x170       arm64_preempt_schedule_irq+0xf0/0x18c       el1_irq+0xe8/0x180       perf_event_exec+0x4d8/0x56c       setup_new_exec+0x204/0x400       load_elf_binary+0x72c/0x18c0       search_binary_handler+0x13c/0x420       load_script+0x500/0x6c4       search_binary_handler+0x13c/0x420       exec_binprm+0x118/0x654
      __do_execve_file+0x77c/0xba4
      __arm64_compat_sys_execve+0x98/0xac       el0_svc_common+0x1f8/0x5e0       el0_svc_compat_handler+0x84/0xb0       el0_svc_compat+0x10/0x50

     The buggy address belongs to the variable:
      barrier_pkt+0x10/0x40

     Memory state around the buggy address:
      ffffffd05b7d0f00: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00       ffffffd05b7d0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00      >ffffffd05b7d1000: 00 00 00 00 00 00 fa fa fa fa fa fa 00 00 00 03                                           ^       ffffffd05b7d1080: fa fa fa fa 00 02 fa fa fa fa fa fa 03 fa fa fa       ffffffd05b7d1100: fa fa fa fa 00 00 00 00 05 fa fa fa fa fa fa fa      ==================================================================

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987362 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()

    commit 6f755e85c332 (coresight: Add helper for inserting synchronization     packets) removed trailing '\0' from barrier_pkt array and updated the     call sites like etb_update_buffer() to have proper checks for barrier_pkt     size before read but missed updating tmc_update_etf_buffer() which still     reads barrier_pkt past the array size resulting in KASAN out-of-bounds     bug. Fix this by adding a check for barrier_pkt size before accessing     like it is done in etb_update_buffer().

     BUG: KASAN: global-out-of-bounds in tmc_update_etf_buffer+0x4b8/0x698      Read of size 4 at addr ffffffd05b7d1030 by task perf/2629

     Call trace:
      dump_backtrace+0x0/0x27c       show_stack+0x20/0x2c       dump_stack+0x11c/0x188       print_address_description+0x3c/0x4a4
      __kasan_report+0x140/0x164       kasan_report+0x10/0x18
      __asan_report_load4_noabort+0x1c/0x24       tmc_update_etf_buffer+0x4b8/0x698       etm_event_stop+0x248/0x2d8       etm_event_del+0x20/0x2c       event_sched_out+0x214/0x6f0       group_sched_out+0xd0/0x270       ctx_sched_out+0x2ec/0x518
      __perf_event_task_sched_out+0x4fc/0xe6c
      __schedule+0x1094/0x16a0       preempt_schedule_irq+0x88/0x170       arm64_preempt_schedule_irq+0xf0/0x18c       el1_irq+0xe8/0x180       perf_event_exec+0x4d8/0x56c       setup_new_exec+0x204/0x400       load_elf_binary+0x72c/0x18c0       search_binary_handler+0x13c/0x420       load_script+0x500/0x6c4       search_binary_handler+0x13c/0x420       exec_binprm+0x118/0x654
      __do_execve_file+0x77c/0xba4
      __arm64_compat_sys_execve+0x98/0xac       el0_svc_common+0x1f8/0x5e0       el0_svc_compat_handler+0x84/0xb0       el0_svc_compat+0x10/0x50

     The buggy address belongs to the variable:
      barrier_pkt+0x10/0x40

     Memory state around the buggy address:
      ffffffd05b7d0f00: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00       ffffffd05b7d0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00      >ffffffd05b7d1000: 00 00 00 00 00 00 fa fa fa fa fa fa 00 00 00 03                                           ^       ffffffd05b7d1080: fa fa fa fa 00 02 fa fa fa fa fa fa 03 fa fa fa       ffffffd05b7d1100: fa fa fa fa 00 00 00 00 05 fa fa fa fa fa fa fa      ==================================================================

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: coresight: tmc-etf: Fix global-out-of-     bounds in tmc_update_etf_buffer() commit 6f755e85c332 (coresight: Add helper for inserting     synchronization packets) removed trailing '\0' from barrier_pkt array and updated the call sites like     etb_update_buffer() to have proper checks for barrier_pkt size before read but missed updating     tmc_update_etf_buffer() which still reads barrier_pkt past the array size resulting in KASAN out-of-bounds     bug. Fix this by adding a check for barrier_pkt size before accessing like it is done in     etb_update_buffer(). BUG: KASAN: global-out-of-bounds in tmc_update_etf_buffer+0x4b8/0x698 Read of size 4     at addr ffffffd05b7d1030 by task perf/2629 Call trace: dump_backtrace+0x0/0x27c show_stack+0x20/0x2c     dump_stack+0x11c/0x188 print_address_description+0x3c/0x4a4 __kasan_report+0x140/0x164     kasan_report+0x10/0x18 __asan_report_load4_noabort+0x1c/0x24 tmc_update_etf_buffer+0x4b8/0x698     etm_event_stop+0x248/0x2d8 etm_event_del+0x20/0x2c event_sched_out+0x214/0x6f0 group_sched_out+0xd0/0x270     ctx_sched_out+0x2ec/0x518 __perf_event_task_sched_out+0x4fc/0xe6c __schedule+0x1094/0x16a0     preempt_schedule_irq+0x88/0x170 arm64_preempt_schedule_irq+0xf0/0x18c el1_irq+0xe8/0x180     perf_event_exec+0x4d8/0x56c setup_new_exec+0x204/0x400 load_elf_binary+0x72c/0x18c0     search_binary_handler+0x13c/0x420 load_script+0x500/0x6c4 search_binary_handler+0x13c/0x420     exec_binprm+0x118/0x654 __do_execve_file+0x77c/0xba4 __arm64_compat_sys_execve+0x98/0xac     el0_svc_common+0x1f8/0x5e0 el0_svc_compat_handler+0x84/0xb0 el0_svc_compat+0x10/0x50 The buggy address     belongs to the variable: barrier_pkt+0x10/0x40 Memory state around the buggy address: ffffffd05b7d0f00: fa     fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00 ffffffd05b7d0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00     00 00 >ffffffd05b7d1000: 00 00 00 00 00 00 fa fa fa fa fa fa 00 00 00 03 ^ ffffffd05b7d1080: fa fa fa fa     00 02 fa fa fa fa fa fa 03 fa fa fa ffffffd05b7d1100: fa fa fa fa 00 00 00 00 05 fa fa fa fa fa fa fa     ================================================================== (CVE-2021-47346)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
273820	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989239)	Nessus	Unity Linux Local Security Checks	high
268772	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987362)	Nessus	Unity Linux Local Security Checks	high
224417	Linux Distros Unpatched Vulnerability : CVE-2021-47346	Nessus	Misc.	high

Detections

Analytics

CVE-2021-47346

high

Tenable Plugins

high

high

high