In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() Function ubifs_wbuf_write_nolock() may access buf out of bounds in following process: ubifs_wbuf_write_nolock(): aligned_len = ALIGN(len, 8); // Assume len = 4089, aligned_len = 4096 if (aligned_len <= wbuf->avail) ... // Not satisfy if (wbuf->used) { ubifs_leb_write() // Fill some data in avail wbuf len -= wbuf->avail; // len is still not 8-bytes aligned aligned_len -= wbuf->avail; } n = aligned_len >> c->max_write_shift; if (n) { n <<= c->max_write_shift; err = ubifs_leb_write(c, wbuf->lnum, buf + written, wbuf->offs, n); // n > len, read out of bounds less than 8(n-len) bytes } , which can be catched by KASAN: ========================================================= BUG: KASAN: slab-out-of-bounds in ecc_sw_hamming_calculate+0x1dc/0x7d0 Read of size 4 at addr ffff888105594ff8 by task kworker/u8:4/128 Workqueue: writeback wb_workfn (flush-ubifs_0_0) Call Trace: kasan_report.cold+0x81/0x165 nand_write_page_swecc+0xa9/0x160 ubifs_leb_write+0xf2/0x1b0 [ubifs] ubifs_wbuf_write_nolock+0x421/0x12c0 [ubifs] write_head+0xdc/0x1c0 [ubifs] ubifs_jnl_write_inode+0x627/0x960 [ubifs] wb_workfn+0x8af/0xb80 Function ubifs_wbuf_write_nolock() accepts that parameter 'len' is not 8 bytes aligned, the 'len' represents the true length of buf (which is allocated in 'ubifs_jnl_xxx', eg. ubifs_jnl_write_inode), so ubifs_wbuf_write_nolock() must handle the length read from 'buf' carefully to write leb safely. Fetch a reproducer in [Link].

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2025:1748366748 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix out-of-bound     read in resp_report_tgtpgs() The following issue was observed running syzkaller: BUG: KASAN: slab-out-of-     bounds in memcpy include/linux/string.h:377 [inline] BUG: KASAN: slab-out-of-bounds in     sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 Read of size 2132 at addr ffff8880aea95dc8 by task syz-     executor.0/9815 CPU: 0 PID: 9815 Comm: syz-executor.0 Not tainted 4.19.202-00874-gfc0fe04215a9 #2 Hardware     name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack     lib/dump_stack.c:77 [inline] dump_stack+0xe4/0x14a lib/dump_stack.c:118     print_address_description+0x73/0x280 mm/kasan/report.c:253 kasan_report_error mm/kasan/report.c:352     [inline] kasan_report+0x272/0x370 mm/kasan/report.c:410 memcpy+0x1f/0x50 mm/kasan/kasan.c:302 memcpy     include/linux/string.h:377 [inline] sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831     fill_from_dev_buffer+0x14f/0x340 drivers/scsi/scsi_debug.c:1021 resp_report_tgtpgs+0x5aa/0x770     drivers/scsi/scsi_debug.c:1772 schedule_resp+0x464/0x12f0 drivers/scsi/scsi_debug.c:4429     scsi_debug_queuecommand+0x467/0x1390 drivers/scsi/scsi_debug.c:5835 scsi_dispatch_cmd+0x3fc/0x9b0     drivers/scsi/scsi_lib.c:1896 scsi_request_fn+0x1042/0x1810 drivers/scsi/scsi_lib.c:2034
    __blk_run_queue_uncond block/blk-core.c:464 [inline] __blk_run_queue+0x1a4/0x380 block/blk-core.c:484     blk_execute_rq_nowait+0x1c2/0x2d0 block/blk-exec.c:78 sg_common_write.isra.19+0xd74/0x1dc0     drivers/scsi/sg.c:847 sg_write.part.23+0x6e0/0xd00 drivers/scsi/sg.c:716 sg_write+0x64/0xa0     drivers/scsi/sg.c:622 __vfs_write+0xed/0x690 fs/read_write.c:485 kill_bdev:block_device:00000000e138492c     vfs_write+0x184/0x4c0 fs/read_write.c:549 ksys_write+0x107/0x240 fs/read_write.c:599     do_syscall_64+0xc2/0x560 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe We get     'alen' from command its type is int. If userspace passes a large length we will get a negative 'alen'.
    Switch n, alen, and rlen to u32. (CVE-2021-47219)

  - In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix read out-of-bounds in     ubifs_wbuf_write_nolock() Function ubifs_wbuf_write_nolock() may access buf out of bounds in following     process: ubifs_wbuf_write_nolock(): aligned_len = ALIGN(len, 8); // Assume len = 4089, aligned_len = 4096     if (aligned_len <= wbuf->avail) ... // Not satisfy if (wbuf->used) { ubifs_leb_write() // Fill some data     in avail wbuf len -= wbuf->avail; // len is still not 8-bytes aligned aligned_len -= wbuf->avail; } n =     aligned_len >> c->max_write_shift; if (n) { n <<= c->max_write_shift; err = ubifs_leb_write(c, wbuf->lnum,     buf + written, wbuf->offs, n); // n > len, read out of bounds less than 8(n-len) bytes } , which can be     catched by KASAN: ========================================================= BUG: KASAN: slab-out-of-bounds     in ecc_sw_hamming_calculate+0x1dc/0x7d0 Read of size 4 at addr ffff888105594ff8 by task kworker/u8:4/128     Workqueue: writeback wb_workfn (flush-ubifs_0_0) Call Trace: kasan_report.cold+0x81/0x165     nand_write_page_swecc+0xa9/0x160 ubifs_leb_write+0xf2/0x1b0 [ubifs] ubifs_wbuf_write_nolock+0x421/0x12c0     [ubifs] write_head+0xdc/0x1c0 [ubifs] ubifs_jnl_write_inode+0x627/0x960 [ubifs] wb_workfn+0x8af/0xb80     Function ubifs_wbuf_write_nolock() accepts that parameter 'len' is not 8 bytes aligned, the 'len'     represents the true length of buf (which is allocated in 'ubifs_jnl_xxx', eg. ubifs_jnl_write_inode), so     ubifs_wbuf_write_nolock() must handle the length read from 'buf' carefully to write leb safely. Fetch a     reproducer in [Link]. (CVE-2021-47636)

  - In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix an out-of-bounds     bug in __snd_usb_parse_audio_interface() There may be a bad USB audio device with a USB ID of (0x04fa,     0x4201) and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsing the     interface descriptor for this device. Fix this by checking the number of interfaces. (CVE-2022-48701)

  - In the Linux kernel, the following vulnerability has been resolved: udf: fix uninit-value use in     udf_get_fileshortad Check for overflow when computing alen in udf_current_aext to mitigate later uninit-     value use in udf_get_fileshortad KMSAN bug[1]. After applying the patch reproducer did not trigger any     issue[2]. [1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df [2]     https://syzkaller.appspot.com/x/log.txt?x=10242227980000 (CVE-2024-50143)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: Clear stale interrupts     before resuming device iwl4965 fails upon resume from hibernation on my laptop. The reason seems to be a     stale interrupt which isn't being cleared out before interrupts are enabled. We end up with a race beween     the resume trying to bring things back up, and the restart work (queued form the interrupt handler) trying     to bring things down. Eventually the whole thing blows up. Fix the problem by clearing out any stale     interrupts before interrupts get enabled during resume. Here's a debug log of the indicent: [ 12.042589]     ieee80211 phy0: il_isr ISR inta 0x00000080, enabled 0xaa00008b, fh 0x00000000 [ 12.042625] ieee80211 phy0:
    il4965_irq_tasklet inta 0x00000080, enabled 0x00000000, fh 0x00000000 [ 12.042651] iwl4965 0000:10:00.0:
    RF_KILL bit toggled to enable radio. [ 12.042653] iwl4965 0000:10:00.0: On demand firmware reload [     12.042690] ieee80211 phy0: il4965_irq_tasklet End inta 0x00000000, enabled 0xaa00008b, fh 0x00000000,     flags 0x00000282 [ 12.052207] ieee80211 phy0: il4965_mac_start enter [ 12.052212] ieee80211 phy0:
    il_prep_station Add STA to driver ID 31: ff:ff:ff:ff:ff:ff [ 12.052244] ieee80211 phy0:
    il4965_set_hw_ready hardware ready [ 12.052324] ieee80211 phy0: il_apm_init Init card's basic functions [     12.052348] ieee80211 phy0: il_apm_init L1 Enabled; Disabling L0S [ 12.055727] ieee80211 phy0:
    il4965_load_bsm Begin load bsm [ 12.056140] ieee80211 phy0: il4965_verify_bsm Begin verify bsm [     12.058642] ieee80211 phy0: il4965_verify_bsm BSM bootstrap uCode image OK [ 12.058721] ieee80211 phy0:
    il4965_load_bsm BSM write complete, poll 1 iterations [ 12.058734] ieee80211 phy0: __il4965_up iwl4965 is     coming up [ 12.058737] ieee80211 phy0: il4965_mac_start Start UP work done. [ 12.058757] ieee80211 phy0:
    __il4965_down iwl4965 is going down [ 12.058761] ieee80211 phy0: il_scan_cancel_timeout Scan cancel     timeout [ 12.058762] ieee80211 phy0: il_do_scan_abort Not performing scan to abort [ 12.058765] ieee80211     phy0: il_clear_ucode_stations Clearing ucode stations in driver [ 12.058767] ieee80211 phy0:
    il_clear_ucode_stations No active stations found to be cleared [ 12.058819] ieee80211 phy0: _il_apm_stop     Stop card, put in low power state [ 12.058827] ieee80211 phy0: _il_apm_stop_master stop master [     12.058864] ieee80211 phy0: il4965_clear_free_frames 0 frames on pre-allocated heap on clear. [ 12.058869]     ieee80211 phy0: Hardware restart was requested [ 16.132299] iwl4965 0000:10:00.0: START_ALIVE timeout     after 4000ms. [ 16.132303] ------------[ cut here ]------------ [ 16.132304] Hardware became unavailable     upon resume. This could be a software issue prior to suspend or a hardware issue. [ 16.132338] WARNING:
    CPU: 0 PID: 181 at net/mac80211/util.c:1826 ieee80211_reconfig+0x8f/0x14b0 [mac80211] [ 16.132390] Modules     linked in: ctr ccm sch_fq_codel xt_tcpudp xt_multiport xt_state iptable_filter iptable_nat nf_nat     nf_conntrack nf_defrag_ipv4 ip_tables x_tables binfmt_misc joydev mousedev btusb btrtl btintel btbcm     bluetooth ecdh_generic ecc iTCO_wdt i2c_dev iwl4965 iwlegacy coretemp snd_hda_codec_analog pcspkr psmouse     mac80211 snd_hda_codec_generic libarc4 sdhci_pci cqhci sha256_generic sdhci libsha256 firewire_ohci     snd_hda_intel snd_intel_dspcfg mmc_core snd_hda_codec snd_hwdep firewire_core led_class iosf_mbi     snd_hda_core uhci_hcd lpc_ich crc_itu_t cfg80211 ehci_pci ehci_hcd snd_pcm usbcore mfd_core rfkill     snd_timer snd usb_common soundcore video parport_pc parport intel_agp wmi intel_gtt backlight e1000e     agpgart evdev [ 16.132456] CPU: 0 UID: 0 PID: 181 Comm: kworker/u8:6 Not tainted 6.11.0-cl+ #143 [     16.132460] Hardware name: Hewlett-Packard HP Compaq 6910p/30BE, BIOS 68MCU Ver. F.19 07/06/2010 [     16.132463] Workqueue: async async_run_entry_fn [ 16.132469] RIP: 0010:ieee80211_reconfig+0x8f/0x14b0     [mac80211] [ 16.132501] Code: da 02 00 0 ---truncated--- (CVE-2024-50234)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988791 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()

    Function ubifs_wbuf_write_nolock() may access buf out of bounds in     following process:

    ubifs_wbuf_write_nolock():
      aligned_len = ALIGN(len, 8);   // Assume len = 4089, aligned_len = 4096       if (aligned_len <= wbuf->avail) ... // Not satisfy       if (wbuf->used) {         ubifs_leb_write()  // Fill some data in avail wbuf         len -= wbuf->avail;   // len is still not 8-bytes aligned         aligned_len -= wbuf->avail;
      }       n = aligned_len >> c->max_write_shift;
      if (n) {         n <<= c->max_write_shift;
        err = ubifs_leb_write(c, wbuf->lnum, buf + written,                               wbuf->offs, n);
        // n > len, read out of bounds less than 8(n-len) bytes       }

    , which can be catched by KASAN:
      =========================================================       BUG: KASAN: slab-out-of-bounds in ecc_sw_hamming_calculate+0x1dc/0x7d0       Read of size 4 at addr ffff888105594ff8 by task kworker/u8:4/128       Workqueue: writeback wb_workfn (flush-ubifs_0_0)       Call Trace:
        kasan_report.cold+0x81/0x165         nand_write_page_swecc+0xa9/0x160         ubifs_leb_write+0xf2/0x1b0 [ubifs]         ubifs_wbuf_write_nolock+0x421/0x12c0 [ubifs]         write_head+0xdc/0x1c0 [ubifs]         ubifs_jnl_write_inode+0x627/0x960 [ubifs]         wb_workfn+0x8af/0xb80

    Function ubifs_wbuf_write_nolock() accepts that parameter 'len' is not 8     bytes aligned, the 'len' represents the true length of buf (which is     allocated in 'ubifs_jnl_xxx', eg. ubifs_jnl_write_inode), so     ubifs_wbuf_write_nolock() must handle the length read from 'buf' carefully     to write leb safely.

    Fetch a reproducer in [Link].

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987395 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()

    Function ubifs_wbuf_write_nolock() may access buf out of bounds in     following process:

    ubifs_wbuf_write_nolock():
      aligned_len = ALIGN(len, 8);   // Assume len = 4089, aligned_len = 4096       if (aligned_len <= wbuf->avail) ... // Not satisfy       if (wbuf->used) {         ubifs_leb_write()  // Fill some data in avail wbuf         len -= wbuf->avail;   // len is still not 8-bytes aligned         aligned_len -= wbuf->avail;
      }       n = aligned_len >> c->max_write_shift;
      if (n) {         n <<= c->max_write_shift;
        err = ubifs_leb_write(c, wbuf->lnum, buf + written,                               wbuf->offs, n);
        // n > len, read out of bounds less than 8(n-len) bytes       }

    , which can be catched by KASAN:
      =========================================================       BUG: KASAN: slab-out-of-bounds in ecc_sw_hamming_calculate+0x1dc/0x7d0       Read of size 4 at addr ffff888105594ff8 by task kworker/u8:4/128       Workqueue: writeback wb_workfn (flush-ubifs_0_0)       Call Trace:
        kasan_report.cold+0x81/0x165         nand_write_page_swecc+0xa9/0x160         ubifs_leb_write+0xf2/0x1b0 [ubifs]         ubifs_wbuf_write_nolock+0x421/0x12c0 [ubifs]         write_head+0xdc/0x1c0 [ubifs]         ubifs_jnl_write_inode+0x627/0x960 [ubifs]         wb_workfn+0x8af/0xb80

    Function ubifs_wbuf_write_nolock() accepts that parameter 'len' is not 8     bytes aligned, the 'len' represents the true length of buf (which is     allocated in 'ubifs_jnl_xxx', eg. ubifs_jnl_write_inode), so     ubifs_wbuf_write_nolock() must handle the length read from 'buf' carefully     to write leb safely.

    Fetch a reproducer in [Link].

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1241-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
    - CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync     (bsc#1239095).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1027-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
    - CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
    - CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() Function ubifs_wbuf_write_nolock() may access     buf out of bounds in following process: ubifs_wbuf_write_nolock(): aligned_len = ALIGN(len, 8); // Assume     len = 4089, aligned_len = 4096 if (aligned_len <= wbuf->avail) ... // Not satisfy if (wbuf->used) {     ubifs_leb_write() // Fill some data in avail wbuf len -= wbuf->avail; // len is still not 8-bytes aligned     aligned_len -= wbuf->avail; } n = aligned_len >> c->max_write_shift; if (n) { n <<= c->max_write_shift;
    err = ubifs_leb_write(c, wbuf->lnum, buf + written, wbuf->offs, n); // n > len, read out of bounds less     than 8(n-len) bytes } , which can be catched by KASAN:
    ========================================================= BUG: KASAN: slab-out-of-bounds in     ecc_sw_hamming_calculate+0x1dc/0x7d0 Read of size 4 at addr ffff888105594ff8 by task kworker/u8:4/128     Workqueue: writeback wb_workfn (flush-ubifs_0_0) Call Trace: kasan_report.cold+0x81/0x165     nand_write_page_swecc+0xa9/0x160 ubifs_leb_write+0xf2/0x1b0 [ubifs] ubifs_wbuf_write_nolock+0x421/0x12c0     [ubifs] write_head+0xdc/0x1c0 [ubifs] ubifs_jnl_write_inode+0x627/0x960 [ubifs] wb_workfn+0x8af/0xb80     Function ubifs_wbuf_write_nolock() accepts that parameter 'len' is not 8 bytes aligned, the 'len'     represents the true length of buf (which is allocated in 'ubifs_jnl_xxx', eg. ubifs_jnl_write_inode), so     ubifs_wbuf_write_nolock() must handle the length read from 'buf' carefully to write leb safely. Fetch a     reproducer in [Link]. (CVE-2021-47636)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Type	Severity
353101	CentOS Linux 6 [TuxCare] Security Update: kernel / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2025:1748366748)	Nessus	CentOS Local Security Checks	Local	high
272916	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988791)	Nessus	Unity Linux Local Security Checks	Local	high
268675	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987395)	Nessus	Unity Linux Local Security Checks	Local	high
234407	SUSE SLES15 : Security update for the Linux Kernel (SUSE-SU-2025:1241-1)	Nessus	SuSE Local Security Checks	Local	high
233410	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2025:1027-1)	Nessus	SuSE Local Security Checks	Local	high
229856	Linux Distros Unpatched Vulnerability : CVE-2021-47636	Nessus	Misc.	Local	high
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2021-47636

high

Tenable Plugins

high

high

high

high

high

high

high