In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: Fix lockup on kernel exec fault The powerpc kernel is not prepared to handle exec faults from kernel. Especially, the function is_exec_fault() will return 'false' when an exec fault is taken by kernel, because the check is based on reading current->thread.regs->trap which contains the trap from user. For instance, when provoking a LKDTM EXEC_USERSPACE test, current->thread.regs->trap is set to SYSCALL trap (0xc00), and the fault taken by the kernel is not seen as an exec fault by set_access_flags_filter(). Commit d7df2443cd5f ("powerpc/mm: Fix spurious segfaults on radix with autonuma") made it clear and handled it properly. But later on commit d3ca587404b3 ("powerpc/mm: Fix reporting of kernel execute faults") removed that handling, introducing test based on error_code. And here is the problem, because on the 603 all upper bits of SRR1 get cleared when the TLB instruction miss handler bails out to ISI. Until commit cbd7e6ca0210 ("powerpc/fault: Avoid heavy search_exception_tables() verification"), an exec fault from kernel at a userspace address was indirectly caught by the lack of entry for that address in the exception tables. But after that commit the kernel mainly relies on KUAP or on core mm handling to catch wrong user accesses. Here the access is not wrong, so mm handles it. It is a minor fault because PAGE_EXEC is not set, set_access_flags_filter() should set PAGE_EXEC and voila. But as is_exec_fault() returns false as explained in the beginning, set_access_flags_filter() bails out without setting PAGE_EXEC flag, which leads to a forever minor exec fault. As the kernel is not prepared to handle such exec faults, the thing to do is to fire in bad_kernel_fault() for any exec fault taken by the kernel, as it was prior to commit d3ca587404b3.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989308 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    powerpc/mm: Fix lockup on kernel exec fault

    The powerpc kernel is not prepared to handle exec faults from kernel.
    Especially, the function is_exec_fault() will return 'false' when an     exec fault is taken by kernel, because the check is based on reading     current->thread.regs->trap which contains the trap from user.

    For instance, when provoking a LKDTM EXEC_USERSPACE test,     current->thread.regs->trap is set to SYSCALL trap (0xc00), and     the fault taken by the kernel is not seen as an exec fault by     set_access_flags_filter().

    Commit d7df2443cd5f (powerpc/mm: Fix spurious segfaults on radix     with autonuma) made it clear and handled it properly. But later on     commit d3ca587404b3 (powerpc/mm: Fix reporting of kernel execute     faults) removed that handling, introducing test based on error_code.
    And here is the problem, because on the 603 all upper bits of SRR1     get cleared when the TLB instruction miss handler bails out to ISI.

    Until commit cbd7e6ca0210 (powerpc/fault: Avoid heavy     search_exception_tables() verification), an exec fault from kernel     at a userspace address was indirectly caught by the lack of entry for     that address in the exception tables. But after that commit the     kernel mainly relies on KUAP or on core mm handling to catch wrong     user accesses. Here the access is not wrong, so mm handles it.
    It is a minor fault because PAGE_EXEC is not set,     set_access_flags_filter() should set PAGE_EXEC and voila.
    But as is_exec_fault() returns false as explained in the beginning,     set_access_flags_filter() bails out without setting PAGE_EXEC flag,     which leads to a forever minor exec fault.

    As the kernel is not prepared to handle such exec faults, the thing to     do is to fire in bad_kernel_fault() for any exec fault taken by the     kernel, as it was prior to commit d3ca587404b3.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987135 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    powerpc/mm: Fix lockup on kernel exec fault

    The powerpc kernel is not prepared to handle exec faults from kernel.
    Especially, the function is_exec_fault() will return 'false' when an     exec fault is taken by kernel, because the check is based on reading     current->thread.regs->trap which contains the trap from user.

    For instance, when provoking a LKDTM EXEC_USERSPACE test,     current->thread.regs->trap is set to SYSCALL trap (0xc00), and     the fault taken by the kernel is not seen as an exec fault by     set_access_flags_filter().

    Commit d7df2443cd5f (powerpc/mm: Fix spurious segfaults on radix     with autonuma) made it clear and handled it properly. But later on     commit d3ca587404b3 (powerpc/mm: Fix reporting of kernel execute     faults) removed that handling, introducing test based on error_code.
    And here is the problem, because on the 603 all upper bits of SRR1     get cleared when the TLB instruction miss handler bails out to ISI.

    Until commit cbd7e6ca0210 (powerpc/fault: Avoid heavy     search_exception_tables() verification), an exec fault from kernel     at a userspace address was indirectly caught by the lack of entry for     that address in the exception tables. But after that commit the     kernel mainly relies on KUAP or on core mm handling to catch wrong     user accesses. Here the access is not wrong, so mm handles it.
    It is a minor fault because PAGE_EXEC is not set,     set_access_flags_filter() should set PAGE_EXEC and voila.
    But as is_exec_fault() returns false as explained in the beginning,     set_access_flags_filter() bails out without setting PAGE_EXEC flag,     which leads to a forever minor exec fault.

    As the kernel is not prepared to handle such exec faults, the thing to     do is to fire in bad_kernel_fault() for any exec fault taken by the     kernel, as it was prior to commit d3ca587404b3.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - powerpc/mm: Fix lockup on kernel exec fault The powerpc kernel is not prepared to handle exec faults from     kernel. Especially, the function is_exec_fault() will return 'false' when an exec fault is taken by     kernel, because the check is based on reading current->thread.regs->trap which contains the trap from     user. For instance, when provoking a LKDTM EXEC_USERSPACE test, current->thread.regs->trap is set to     SYSCALL trap (0xc00), and the fault taken by the kernel is not seen as an exec fault by     set_access_flags_filter(). Commit d7df2443cd5f (powerpc/mm: Fix spurious segfaults on radix with     autonuma) made it clear and handled it properly. But later on commit d3ca587404b3 (powerpc/mm: Fix     reporting of kernel execute faults) removed that handling, introducing test based on error_code. And here     is the problem, because on the 603 all upper bits of SRR1 get cleared when the TLB instruction miss     handler bails out to ISI. Until commit cbd7e6ca0210 (powerpc/fault: Avoid heavy search_exception_tables()     verification), an exec fault from kernel at a userspace address was indirectly caught by the lack of     entry for that address in the exception tables. But after that commit the kernel mainly relies on KUAP or     on core mm handling to catch wrong user accesses. Here the access is not wrong, so mm handles it. It is a     minor fault because PAGE_EXEC is not set, set_access_flags_filter() should set PAGE_EXEC and voila. But as     is_exec_fault() returns false as explained in the beginning, set_access_flags_filter() bails out without     setting PAGE_EXEC flag, which leads to a forever minor exec fault. As the kernel is not prepared to handle     such exec faults, the thing to do is to fire in bad_kernel_fault() for any exec fault taken by the kernel,     as it was prior to commit d3ca587404b3. (CVE-2021-47350)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2183-1 advisory.

    The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
    - CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
    - CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
    - CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve     local privilege escalation (bsc#1215420).
    - CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve     local privilege escalation (bsc#1215420).
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
    - CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
    - CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
    - CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
    - CVE-2022-48673: kABI workarounds for struct smc_link (bsc#1223934).
    - CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
    - CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
    - CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
    - CVE-2021-47261: Fix initializing CQ fragments buffer (bsc#1224954)
    - CVE-2021-47254: Fix use-after-free in gfs2_glock_shrink_scan (bsc#1224888).
    - CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
    - CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2185-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
    - CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
    - CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
    - CVE-2022-48673: kABI workarounds for struct smc_link (bsc#1223934).
    - CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
    - CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
    - CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
    - CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
    - CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
    - CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
    - CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
    - CVE-2021-47261: Fix initializing CQ fragments buffer (bsc#1224954)
    - CVE-2021-47254: Fix use-after-free in gfs2_glock_shrink_scan (bsc#1224888).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
    - CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve     local privilege escalation (bsc#1215420).
    - CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve     local privilege escalation (bsc#1215420).
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
    - CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
273335	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989308)	Nessus	Unity Linux Local Security Checks	medium
268030	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987135)	Nessus	Unity Linux Local Security Checks	medium
229794	Linux Distros Unpatched Vulnerability : CVE-2021-47350	Nessus	Misc.	medium
200932	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:2183-1)	Nessus	SuSE Local Security Checks	critical
200930	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:2185-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2021-47350

medium

Tenable Plugins

medium

medium

medium

critical

critical