In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() Function ubifs_wbuf_write_nolock() may access buf out of bounds in following process: ubifs_wbuf_write_nolock(): aligned_len = ALIGN(len, 8); // Assume len = 4089, aligned_len = 4096 if (aligned_len <= wbuf->avail) ... // Not satisfy if (wbuf->used) { ubifs_leb_write() // Fill some data in avail wbuf len -= wbuf->avail; // len is still not 8-bytes aligned aligned_len -= wbuf->avail; } n = aligned_len >> c->max_write_shift; if (n) { n <<= c->max_write_shift; err = ubifs_leb_write(c, wbuf->lnum, buf + written, wbuf->offs, n); // n > len, read out of bounds less than 8(n-len) bytes } , which can be catched by KASAN: ========================================================= BUG: KASAN: slab-out-of-bounds in ecc_sw_hamming_calculate+0x1dc/0x7d0 Read of size 4 at addr ffff888105594ff8 by task kworker/u8:4/128 Workqueue: writeback wb_workfn (flush-ubifs_0_0) Call Trace: kasan_report.cold+0x81/0x165 nand_write_page_swecc+0xa9/0x160 ubifs_leb_write+0xf2/0x1b0 [ubifs] ubifs_wbuf_write_nolock+0x421/0x12c0 [ubifs] write_head+0xdc/0x1c0 [ubifs] ubifs_jnl_write_inode+0x627/0x960 [ubifs] wb_workfn+0x8af/0xb80 Function ubifs_wbuf_write_nolock() accepts that parameter 'len' is not 8 bytes aligned, the 'len' represents the true length of buf (which is allocated in 'ubifs_jnl_xxx', eg. ubifs_jnl_write_inode), so ubifs_wbuf_write_nolock() must handle the length read from 'buf' carefully to write leb safely. Fetch a reproducer in [Link].

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988791 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()

    Function ubifs_wbuf_write_nolock() may access buf out of bounds in     following process:

    ubifs_wbuf_write_nolock():
      aligned_len = ALIGN(len, 8);   // Assume len = 4089, aligned_len = 4096       if (aligned_len <= wbuf->avail) ... // Not satisfy       if (wbuf->used) {         ubifs_leb_write()  // Fill some data in avail wbuf         len -= wbuf->avail;   // len is still not 8-bytes aligned         aligned_len -= wbuf->avail;
      }       n = aligned_len >> c->max_write_shift;
      if (n) {         n <<= c->max_write_shift;
        err = ubifs_leb_write(c, wbuf->lnum, buf + written,                               wbuf->offs, n);
        // n > len, read out of bounds less than 8(n-len) bytes       }

    , which can be catched by KASAN:
      =========================================================       BUG: KASAN: slab-out-of-bounds in ecc_sw_hamming_calculate+0x1dc/0x7d0       Read of size 4 at addr ffff888105594ff8 by task kworker/u8:4/128       Workqueue: writeback wb_workfn (flush-ubifs_0_0)       Call Trace:
        kasan_report.cold+0x81/0x165         nand_write_page_swecc+0xa9/0x160         ubifs_leb_write+0xf2/0x1b0 [ubifs]         ubifs_wbuf_write_nolock+0x421/0x12c0 [ubifs]         write_head+0xdc/0x1c0 [ubifs]         ubifs_jnl_write_inode+0x627/0x960 [ubifs]         wb_workfn+0x8af/0xb80

    Function ubifs_wbuf_write_nolock() accepts that parameter 'len' is not 8     bytes aligned, the 'len' represents the true length of buf (which is     allocated in 'ubifs_jnl_xxx', eg. ubifs_jnl_write_inode), so     ubifs_wbuf_write_nolock() must handle the length read from 'buf' carefully     to write leb safely.

    Fetch a reproducer in [Link].

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987395 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()

    Function ubifs_wbuf_write_nolock() may access buf out of bounds in     following process:

    ubifs_wbuf_write_nolock():
      aligned_len = ALIGN(len, 8);   // Assume len = 4089, aligned_len = 4096       if (aligned_len <= wbuf->avail) ... // Not satisfy       if (wbuf->used) {         ubifs_leb_write()  // Fill some data in avail wbuf         len -= wbuf->avail;   // len is still not 8-bytes aligned         aligned_len -= wbuf->avail;
      }       n = aligned_len >> c->max_write_shift;
      if (n) {         n <<= c->max_write_shift;
        err = ubifs_leb_write(c, wbuf->lnum, buf + written,                               wbuf->offs, n);
        // n > len, read out of bounds less than 8(n-len) bytes       }

    , which can be catched by KASAN:
      =========================================================       BUG: KASAN: slab-out-of-bounds in ecc_sw_hamming_calculate+0x1dc/0x7d0       Read of size 4 at addr ffff888105594ff8 by task kworker/u8:4/128       Workqueue: writeback wb_workfn (flush-ubifs_0_0)       Call Trace:
        kasan_report.cold+0x81/0x165         nand_write_page_swecc+0xa9/0x160         ubifs_leb_write+0xf2/0x1b0 [ubifs]         ubifs_wbuf_write_nolock+0x421/0x12c0 [ubifs]         write_head+0xdc/0x1c0 [ubifs]         ubifs_jnl_write_inode+0x627/0x960 [ubifs]         wb_workfn+0x8af/0xb80

    Function ubifs_wbuf_write_nolock() accepts that parameter 'len' is not 8     bytes aligned, the 'len' represents the true length of buf (which is     allocated in 'ubifs_jnl_xxx', eg. ubifs_jnl_write_inode), so     ubifs_wbuf_write_nolock() must handle the length read from 'buf' carefully     to write leb safely.

    Fetch a reproducer in [Link].

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1241-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
    - CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync     (bsc#1239095).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1027-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
    - CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
    - CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() Function ubifs_wbuf_write_nolock() may access     buf out of bounds in following process: ubifs_wbuf_write_nolock(): aligned_len = ALIGN(len, 8); // Assume     len = 4089, aligned_len = 4096 if (aligned_len <= wbuf->avail) ... // Not satisfy if (wbuf->used) {     ubifs_leb_write() // Fill some data in avail wbuf len -= wbuf->avail; // len is still not 8-bytes aligned     aligned_len -= wbuf->avail; } n = aligned_len >> c->max_write_shift; if (n) { n <<= c->max_write_shift;
    err = ubifs_leb_write(c, wbuf->lnum, buf + written, wbuf->offs, n); // n > len, read out of bounds less     than 8(n-len) bytes } , which can be catched by KASAN:
    ========================================================= BUG: KASAN: slab-out-of-bounds in     ecc_sw_hamming_calculate+0x1dc/0x7d0 Read of size 4 at addr ffff888105594ff8 by task kworker/u8:4/128     Workqueue: writeback wb_workfn (flush-ubifs_0_0) Call Trace: kasan_report.cold+0x81/0x165     nand_write_page_swecc+0xa9/0x160 ubifs_leb_write+0xf2/0x1b0 [ubifs] ubifs_wbuf_write_nolock+0x421/0x12c0     [ubifs] write_head+0xdc/0x1c0 [ubifs] ubifs_jnl_write_inode+0x627/0x960 [ubifs] wb_workfn+0x8af/0xb80     Function ubifs_wbuf_write_nolock() accepts that parameter 'len' is not 8 bytes aligned, the 'len'     represents the true length of buf (which is allocated in 'ubifs_jnl_xxx', eg. ubifs_jnl_write_inode), so     ubifs_wbuf_write_nolock() must handle the length read from 'buf' carefully to write leb safely. Fetch a     reproducer in [Link]. (CVE-2021-47636)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
272916	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988791)	Nessus	Unity Linux Local Security Checks	high
268675	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987395)	Nessus	Unity Linux Local Security Checks	high
234407	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1241-1)	Nessus	SuSE Local Security Checks	high
233410	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1027-1)	Nessus	SuSE Local Security Checks	high
229856	Linux Distros Unpatched Vulnerability : CVE-2021-47636	Nessus	Misc.	high

Detections

Analytics

CVE-2021-47636

high

Tenable Plugins

high

high

high

high

high