In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix route with nexthop object delete warning FRR folks have hit a kernel warning[1] while deleting routes[2] which is caused by trying to delete a route pointing to a nexthop id without specifying nhid but matching on an interface. That is, a route is found but we hit a warning while matching it. The warning is from fib_info_nh() in include/net/nexthop.h because we run it on a fib_info with nexthop object. The call chain is: inet_rtm_delroute -> fib_table_delete -> fib_nh_match (called with a nexthop fib_info and also with fc_oif set thus calling fib_info_nh on the fib_info and triggering the warning). The fix is to not do any matching in that branch if the fi has a nexthop object because those are managed separately. I.e. we should match when deleting without nh spec and should fail when deleting a nexthop route with old-style nh spec because nexthop objects are managed separately, e.g.: $ ip r show 1.2.3.4/32 1.2.3.4 nhid 12 via 192.168.11.2 dev dummy0 $ ip r del 1.2.3.4/32 $ ip r del 1.2.3.4/32 nhid 12 <both should work> $ ip r del 1.2.3.4/32 dev dummy0 <should fail with ESRCH> [1] [ 523.462226] ------------[ cut here ]------------ [ 523.462230] WARNING: CPU: 14 PID: 22893 at include/net/nexthop.h:468 fib_nh_match+0x210/0x460 [ 523.462236] Modules linked in: dummy rpcsec_gss_krb5 xt_socket nf_socket_ipv4 nf_socket_ipv6 ip6table_raw iptable_raw bpf_preload xt_statistic ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs xt_mark nf_tables xt_nat veth nf_conntrack_netlink nfnetlink xt_addrtype br_netfilter overlay dm_crypt nfsv3 nfs fscache netfs vhost_net vhost vhost_iotlb tap tun xt_CHECKSUM xt_MASQUERADE xt_conntrack 8021q garp mrp ipt_REJECT nf_reject_ipv4 ip6table_mangle ip6table_nat iptable_mangle iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter bridge stp llc rfcomm snd_seq_dummy snd_hrtimer rpcrdma rdma_cm iw_cm ib_cm ib_core ip6table_filter xt_comment ip6_tables vboxnetadp(OE) vboxnetflt(OE) vboxdrv(OE) qrtr bnep binfmt_misc xfs vfat fat squashfs loop nvidia_drm(POE) nvidia_modeset(POE) nvidia_uvm(POE) nvidia(POE) intel_rapl_msr intel_rapl_common snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi btusb btrtl iwlmvm uvcvideo btbcm snd_hda_intel edac_mce_amd [ 523.462274] videobuf2_vmalloc videobuf2_memops btintel snd_intel_dspcfg videobuf2_v4l2 snd_intel_sdw_acpi bluetooth snd_usb_audio snd_hda_codec mac80211 snd_usbmidi_lib joydev snd_hda_core videobuf2_common kvm_amd snd_rawmidi snd_hwdep snd_seq videodev ccp snd_seq_device libarc4 ecdh_generic mc snd_pcm kvm iwlwifi snd_timer drm_kms_helper snd cfg80211 cec soundcore irqbypass rapl wmi_bmof i2c_piix4 rfkill k10temp pcspkr acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc drm zram ip_tables crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel nvme sp5100_tco r8169 nvme_core wmi ipmi_devintf ipmi_msghandler fuse [ 523.462300] CPU: 14 PID: 22893 Comm: ip Tainted: P OE 5.16.18-200.fc35.x86_64 #1 [ 523.462302] Hardware name: Micro-Star International Co., Ltd. MS-7C37/MPG X570 GAMING EDGE WIFI (MS-7C37), BIOS 1.C0 10/29/2020 [ 523.462303] RIP: 0010:fib_nh_match+0x210/0x460 [ 523.462304] Code: 7c 24 20 48 8b b5 90 00 00 00 e8 bb ee f4 ff 48 8b 7c 24 20 41 89 c4 e8 ee eb f4 ff 45 85 e4 0f 85 2e fe ff ff e9 4c ff ff ff <0f> 0b e9 17 ff ff ff 3c 0a 0f 85 61 fe ff ff 48 8b b5 98 00 00 00 [ 523.462306] RSP: 0018:ffffaa53d4d87928 EFLAGS: 00010286 [ 523.462307] RAX: 0000000000000000 RBX: ffffaa53d4d87a90 RCX: ffffaa53d4d87bb0 [ 523.462308] RDX: ffff9e3d2ee6be80 RSI: ffffaa53d4d87a90 RDI: ffffffff920ed380 [ 523.462309] RBP: ffff9e3d2ee6be80 R08: 0000000000000064 R09: 0000000000000000 [ 523.462310] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000031 [ 523.462310] R13: 0000000000000020 R14: 0000000000000000 R15: ffff9e3d331054e0 [ 523.462311] FS: 00007f2455 ---truncated---

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    usbnet: gl620a: fix endpoint checking in genelink_bind().(CVE-2025-21877)

    ASoC: soc-compress: prevent the potentially use of null pointer(CVE-2021-47650)

    net: gso: fix ownership in __udp_gso_segment(CVE-2025-21926)

    exec: Force single empty string when argv is empty(CVE-2022-49264)

    IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition(CVE-2022-49089)

    netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits(CVE-2023-53033)

    erspan: do not assume transport header is always set(CVE-2022-49691)

    tipc: check attribute length for bearer name(CVE-2022-49374)

    qede: confirm skb is allocated before using(CVE-2022-49084)

    nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu().(CVE-2025-21927)

    ice: fix memory leak in aRFS after reset(CVE-2025-21981)

    arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall(CVE-2022-49520)

    NFSD: prevent underflow in nfssvc_decode_writeargs().(CVE-2022-49280)

    tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd(CVE-2022-49330)

    net: sched: Disallow replacing of child qdisc from one parent to another(CVE-2025-21702)

    net: ipv4: fix route with nexthop object delete warning(CVE-2022-49092)

    x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL(CVE-2023-52993)

    firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region(CVE-2023-52989)

    netfilter: nf_tables: don't skip expired elements during walk(CVE-2023-52924)

    net: openvswitch: fix leak of nested actions(CVE-2022-49086)

    drm/nouveau: prime: fix refcount underflow(CVE-2024-43867)

    net_sched: Prevent creation of classes with TC_H_ROOT(CVE-2025-21971)

    netfilter: nf_tables: memleak flow rule from commit path(CVE-2022-49358)

    rcu-tasks: Fix race in schedule and flush work(CVE-2022-49540)

    netfilter: use get_random_u32 instead of prandom(CVE-2022-49698)

    fbdev: hyperv_fb: Allow graceful removal of framebuffer(CVE-2025-21976)

    nvme-pci: add missing condition check for existence of mapped data(CVE-2024-42276)

    cifs: Fix oops due to uncleared server-smbd_conn in reconnect(CVE-2023-53006)

    ipv6: mcast: add RCU protection to mld_newpack().(CVE-2025-21758)

    ftrace: Clean up hash direct_functions on register failures(CVE-2022-49402)

    clocksource: hyper-v: unexport __init-annotated hv_init_clocksource().(CVE-2022-49726)

    usb: cdc-acm: Check control transfer buffer size before access(CVE-2025-21704)

    PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1(CVE-2025-21831)

    ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero(CVE-2022-49584)

    gpio: Restrict usage of GPIO chip irq members before initialization(CVE-2022-49072)

    i40e: Fix call trace in setup_tx_descriptors(CVE-2022-49725)

    RDMA/hfi1: Fix potential integer multiplication overflow errors(CVE-2022-49404)

    ice: Fix memory corruption in VF driver(CVE-2022-49722)

    ipv4: prevent potential spectre v1 gadget in fib_metrics_match().(CVE-2023-52996)

    ACPI: CPPC: Avoid out of bounds access when parsing _CPC data(CVE-2022-49145)

    KVM: SVM: fix panic on out-of-bounds guest IRQ(CVE-2022-49154)

    ipv4: prevent potential spectre v1 gadget in ip_metrics_convert().(CVE-2023-52997)

    net: fix NULL pointer in skb_segment_list(CVE-2023-52991)

    dlm: fix plock invalid read(CVE-2022-49407)

    netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree().(CVE-2025-21959)

    tee: optee: Fix supplicant wait loop(CVE-2025-21871)

    dm raid: fix accesses beyond end of raid member array(CVE-2022-49674)

    ipv4: use RCU protection in __ip_rt_update_pmtu().(CVE-2025-21766)

    dm array: fix releasing a faulty array block twice in dm_array_cursor_end(CVE-2024-57929)

    netlink: prevent potential spectre v1 gadgets(CVE-2023-53000)

    net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices(CVE-2023-52984)

    net: xfrm: unexport __init-annotated xfrm4_protocol_init().(CVE-2022-49345)

    tunnels: do not assume mac header is set in skb_tunnel_check_pmtu().(CVE-2022-49663)

    cpufreq: governor: Use kobject release() method to free dbs_data(CVE-2022-49513)

    brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path(CVE-2022-49263)

    HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections(CVE-2024-57986)

    ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up(CVE-2025-21887)

    xsk: Fix race at socket teardown(CVE-2022-49215)

    acct: perform last write from workqueue(CVE-2025-21846)

    nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags(CVE-2022-49492)

    drop_monitor: fix incorrect initialization order(CVE-2025-21862)

    udp: Fix a data-race around sysctl_udp_l3mdev_accept.(CVE-2022-49577)

    ip: Fix data-races around sysctl_ip_prot_sock.(CVE-2022-49578)

    ipv4: Fix data-races around sysctl_fib_multipath_hash_policy.(CVE-2022-49579)

    ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh.(CVE-2022-49580)

    tcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout.(CVE-2022-49585)

    drm/drm_vma_manager: Add drm_vma_node_allow_once().(CVE-2023-53001)

    x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes(CVE-2025-21991)

    ipv6: Fix signed integer overflow in __ip6_append_data(CVE-2022-49728)

    ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().(CVE-2025-22005)

    exec: don't WARN for racy path_noexec check(CVE-2024-50010)

    iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic().(CVE-2025-21993)

    RDMA/hns: Fix soft lockup during bt pages loop(CVE-2025-22010)

    tracing: Fix use-after-free in print_graph_function_flags during tracer switching(CVE-2025-22035)

    regulator: check that dummy regulator has been probed before using it(CVE-2025-22008)

    smb: client: Add check for next_buffer in receive_encrypted_standard().(CVE-2025-21844)

    vlan: enforce underlying device type(CVE-2025-21920)

    tcp: Fix data-races around sysctl_tcp_mtu_probing.(CVE-2022-49598)

    mm/swapfile: add cond_resched() in get_swap_pages().(CVE-2023-52932)

    proc: fix UAF in proc_get_inode().(CVE-2025-21999)

    driver core: Fix wait_for_device_probe()  deferred_probe_timeout interaction(CVE-2022-49379)

    NFSD: prevent integer overflow on 32 bit systems(CVE-2022-49279)

    x86/kexec: fix memory leak of elf header buffer(CVE-2022-49546)

    PM: core: keep irq flags in device_pm_check_callbacks().(CVE-2022-49175)

    KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak(CVE-2022-49556)

    tracing: Fix bad hist from corrupting named_triggers list(CVE-2025-21899)

    drivers/base/node.c: fix compaction sysfs file leak(CVE-2022-49442)

    hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio(CVE-2025-21931)

    s390/cpum_sf: Handle CPU hotplug remove during sampling(CVE-2024-57849)

    bpf, sockmap: Fix double uncharge the mem of sk_msg(CVE-2022-49205)

    perf/x86/amd: fix potential integer overflow on shift of a int(CVE-2022-49748)

    firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle(CVE-2022-49370)

    driver core: fix deadlock in __device_attach(CVE-2022-49371)

    RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers(CVE-2025-21885)

    RDMA/core: Fix ib block iterator counter overflow(CVE-2023-53026)

    net: let net.core.dev_weight always be non-zero(CVE-2025-21806)

    irqchip/gic-v3: Fix GICR_CTLR.RWP polling(CVE-2022-49074)

    x86/speculation: Fill RSB on vmexit for IBRS(CVE-2022-49611)

    netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.(CVE-2023-53032)

    arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY(CVE-2024-39488)

    udp: Deal with race between UDP socket address change and rehash(CVE-2024-57974)

    net: mdio: validate parameter addr in mdiobus_get_phy().(CVE-2023-53019)

    ppp: Fix KMSAN uninit-value warning with bpf(CVE-2025-21922)

    KVM: x86: Use __try_cmpxchg_user() to update guest PTE A/D bits(CVE-2022-49562)

    NFS: Avoid writeback threads getting stuck in mempool_alloc().(CVE-2022-49097)

    virtio_net: fix xdp_rxq_info bug after suspend/resume(CVE-2022-49687)

    LSM: general protection fault in legacy_parse_param(CVE-2022-49180)

    net/mlx5: handle errors in mlx5_chains_create_table().(CVE-2025-21975)

    net: mdio: unexport __init-annotated mdio_bus_init().(CVE-2022-49350)

    be2net: Fix buffer overflow in be_get_module_eeprom(CVE-2022-49581)

    l2tp: close all race conditions in l2tp_tunnel_register().(CVE-2023-53020)

    ipvlan: ensure network headers are in skb linear part(CVE-2025-21891)

    serial: 8250: Fix PM usage_count for console handover(CVE-2022-49613)

    scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress(CVE-2023-52975)

    NFSD: Fix the behavior of READ near OFFSET_MAX(CVE-2022-48827)

    af_netlink: Fix shift out of bounds in group mask calculation(CVE-2022-49197)

    dm thin: make get_first_thin use rcu-safe list first function(CVE-2025-21664)

    netfilter: conntrack: re-fetch conntrack after insertion(CVE-2022-49561)

    mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath().(CVE-2023-52939)

    tick/nohz: unexport __init-annotated tick_nohz_full_setup().(CVE-2022-49675)

    ipv6: use RCU protection in ip6_default_advmss().(CVE-2025-21765)

    virtio_console: eliminate anonymous module_init  module_exit(CVE-2022-49100)

    net: tun: unlink NAPI from device on destruction(CVE-2022-49672)

    Drivers: hv: vmbus: Fix potential crash on module unload(CVE-2022-49098)

    net/tls: fix slab-out-of-bounds bug in decrypt_internal(CVE-2022-49094)

    keys: Fix UAF in key_put().(CVE-2025-21893)

    bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener(CVE-2023-52986)

    RDMA/hfi1: Prevent panic when SDMA is disabled(CVE-2022-49429)

    xhci: Handle TD clearing for multiple streams case(CVE-2024-40927)

    ipmr: do not call mr_mfc_uses_dev() for unres entries(CVE-2025-21719)

    scsi: hisi_sas: Add cond_resched() for no forced preemption model(CVE-2024-56589)

    veth: Ensure eth header is in skb's linear part(CVE-2022-49066)

    tracing: Fix potential double free in create_var_ref().(CVE-2022-49410)

    dmaengine: Fix double increment of client_count in dma_chan_get().(CVE-2022-49753)

    scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress(CVE-2023-52974)

    net_sched: sch_sfq: don't allow 1 packet limit(CVE-2024-57996)

    vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF(CVE-2023-52973)

    dm mirror log: round up region bitmap size to BITS_PER_LONG(CVE-2022-49710)

    x86/xen: don't do PV iret hypercall through hypercall page(CVE-2024-53241)

    bpf, sockmap: Fix more uncharged while msg has more_data(CVE-2022-49204)

    mm/khugepaged: fix -anon_vma race(CVE-2023-52935)

    dm integrity: fix memory corruption when tag_size is less than digest size(CVE-2022-49044)

    scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp().(CVE-2022-49521)

    bpf: Fix request_sock leak in sk lookup helpers(CVE-2022-49697)

    mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize().(CVE-2025-21861)

    efi: Don't map the entire mokvar table to determine its size(CVE-2025-21872)

    net: asix: add proper error handling of usb read errors(CVE-2022-49226)

    HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove().(CVE-2025-21928)

    bpf: Skip task with pid=1 in send_signal_common().(CVE-2023-52992)

    bpf: Skip invalid kfunc call in backtrack_insn(CVE-2023-52928)

    bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation(CVE-2023-53024)

    igb: Fix potential invalid memory access in igb_init_module().(CVE-2024-52332)

    ftrace: Avoid potential division by zero in function_stat_show().(CVE-2025-21898)

    efi: fix potential NULL deref in efi_mem_reserve_persistent(CVE-2023-52976)

    uprobes: Reject the shared zeropage in uprobe_write_opcode().(CVE-2025-21881)

    bnxt: Do not read past the end of test names(CVE-2023-53010)

    trace_events_hist: add check for return value of 'create_hist_field'(CVE-2023-53005)

    tracing: Make sure trace_printk() can output as soon as it can be used(CVE-2023-53007)

    Squashfs: fix handling and sanity checking of xattr_ids count(CVE-2023-52933)

    tcp: Fix a data-race around sysctl_tcp_probe_threshold.(CVE-2022-49595)

    tcp: Fix data-races around sysctl_tcp_min_snd_mss.(CVE-2022-49596)

    tcp: Fix data-races around sysctl_tcp_base_mss.(CVE-2022-49597)

    tcp: Fix data-races around sysctl_tcp_l3mdev_accept.(CVE-2022-49599)

    hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING(CVE-2025-21816)

    RDMA/hfi1: Prevent use of lock before it is initialized(CVE-2022-49433)

    cifs: fix potential memory leaks in session setup(CVE-2023-53008)

    ovl: Use 'buf' flexible array for memcpy() destination(CVE-2022-49743)

    openvswitch: fix lockup on tx to unregistering netdev with carrier(CVE-2025-21681)

    net: hns3: add vlan list lock to protect vlan list(CVE-2022-49182)

    driver: base: fix UAF when driver_attach failed(CVE-2022-49385)

    ubi: ubi_create_volume: Fix use-after-free when volume creation failed(CVE-2022-49388)

    rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read(CVE-2024-58069)

    lz4: fix LZ4_decompress_safe_partial read out of bound(CVE-2022-49078)

    um: Fix out-of-bounds read in LDT setup(CVE-2022-49395)

    KVM: Explicitly verify target vCPU is online in kvm_get_vcpu().(CVE-2024-58083)

    ipv6: mcast: extend RCU protection in igmp6_send().(CVE-2025-21759)

    vsock: Keep the binding until socket destruction(CVE-2025-21756)

    pps: Fix a use-after-free(CVE-2024-57979)

    padata: fix UAF in padata_reorder(CVE-2025-21727)

    netfilter: nf_tables: avoid skb access on nf_stolen(CVE-2022-49622)

    srcu: Tighten cleanup_srcu_struct() GP checks(CVE-2022-49651)

    openvswitch: use RCU protection in ovs_vport_cmd_fill_info().(CVE-2025-21761)

    cgroup: Use separate src/dst nodes when preloading css_sets for migration(CVE-2022-49647)

    ice: arfs: fix use-after-free when freeing @rx_cpu_rmap(CVE-2022-49063)

    macsec: fix UAF bug for real_dev(CVE-2022-49390)

    ndisc: extend RCU protection in ndisc_send_skb().(CVE-2025-21760)

    nfsd: release svc_expkey(CVE-2024-53216)

    nfsd: make sure exp active before svc_export_show(CVE-2024-56558)

    net: sched: Disallow replacing of child qdisc from one parent to another(CVE-2025-21700)

    neighbour: use RCU protection in __neigh_notify().(CVE-2025-21763)

    nfsd: clear acl_access/acl_default after releasing them(CVE-2025-21796)

    ndisc: use RCU protection in ndisc_alloc_skb().(CVE-2025-21764)

    arp: use RCU protection in arp_xmit().(CVE-2025-21762)

    iommu/arm-smmu-v3: check return value after calling platform_get_resource().(CVE-2022-49319)

    memcg: fix soft lockup in the OOM process(CVE-2024-57977)

    rdma/cxgb4: Prevent potential integer overflow on 32bit(CVE-2024-57973)

    scsi: hisi_sas: Free irq vectors in order for v3 HW(CVE-2022-49118)

    drm/plane: Move range check for format_count earlier(CVE-2021-47659)

    USB: hub: Ignore non-compliant devices with too many configs or interfaces(CVE-2025-21776)

    bpf: avoid holding freeze_mutex during mmap operation(CVE-2025-21853)

    linux/dim: Fix divide by 0 in RDMA DIM(CVE-2022-49670)

    HID: multitouch: Add NULL check in mt_input_configured(CVE-2024-58020)

    nfp: bpf: Add check for nfp_app_ctrl_msg_alloc().(CVE-2025-21848)

    KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel(CVE-2025-21779)

    usb: xhci: Fix NULL pointer dereference on certain command aborts(CVE-2024-57981)

    ceph: fix memory leak in ceph_readdir when note_last_dentry returns error(CVE-2022-49107)

    NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify().(CVE-2022-49103)

    io_uring: fix memory leak of uid in files registration(CVE-2022-49144)

    hwrng: cavium - fix NULL but dereferenced coccicheck error(CVE-2022-49177)

    mlxsw: spectrum: Guard against invalid local ports(CVE-2022-49134)

    iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe().(CVE-2022-49323)

    drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes(CVE-2022-49532)

    scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair().(CVE-2022-49155)

    NFSv4: Don't hold the layoutget locks across multiple RPC calls(CVE-2022-49316)

    kernel/resource: fix kfree() of bootmem memory again(CVE-2022-49190)

    vrf: use RCU protection in l3mdev_l3_out().(CVE-2025-21791)

    tcp: Fix a data-race around sysctl_tcp_ecn_fallback.(CVE-2022-49630)

    i2c: dev: check return value when calling dev_set_name().(CVE-2022-49046)

    list: fix a data-race around ep-rdllist(CVE-2022-49443)

    perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()(CVE-2022-49607)

    drm/amd/display: Fix memory leak(CVE-2022-49135)

    media: uvcvideo: Fix double free in error path(CVE-2024-57980)

    io_uring: prevent opcode speculation(CVE-2025-21863)

    geneve: Fix use-after-free in geneve_find_dev().(CVE-2025-21858)

    arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array(CVE-2025-21785)

    scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock(CVE-2022-49536)

    KVM: VMX: Prevent RSB underflow before vmenter(CVE-2022-49610)

    tpm: Change to kvalloc() in eventlog/acpi.c(CVE-2024-58005)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1241-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
    - CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync     (bsc#1239095).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1027-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
    - CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
    - CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix route with nexthop     object delete warning FRR folks have hit a kernel warning[1] while deleting routes[2] which is caused by     trying to delete a route pointing to a nexthop id without specifying nhid but matching on an interface.
    That is, a route is found but we hit a warning while matching it. The warning is from fib_info_nh() in     include/net/nexthop.h because we run it on a fib_info with nexthop object. The call chain is:
    inet_rtm_delroute -> fib_table_delete -> fib_nh_match (called with a nexthop fib_info and also with fc_oif     set thus calling fib_info_nh on the fib_info and triggering the warning). The fix is to not do any     matching in that branch if the fi has a nexthop object because those are managed separately. I.e. we     should match when deleting without nh spec and should fail when deleting a nexthop route with old-style nh     spec because nexthop objects are managed separately, e.g.: $ ip r show 1.2.3.4/32 1.2.3.4 nhid 12 via     192.168.11.2 dev dummy0 $ ip r del 1.2.3.4/32 $ ip r del 1.2.3.4/32 nhid 12 <both should work> $ ip r del     1.2.3.4/32 dev dummy0 <should fail with ESRCH> [1] [ 523.462226] ------------[ cut here ]------------ [     523.462230] WARNING: CPU: 14 PID: 22893 at include/net/nexthop.h:468 fib_nh_match+0x210/0x460 [     523.462236] Modules linked in: dummy rpcsec_gss_krb5 xt_socket nf_socket_ipv4 nf_socket_ipv6 ip6table_raw     iptable_raw bpf_preload xt_statistic ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs xt_mark nf_tables xt_nat     veth nf_conntrack_netlink nfnetlink xt_addrtype br_netfilter overlay dm_crypt nfsv3 nfs fscache netfs     vhost_net vhost vhost_iotlb tap tun xt_CHECKSUM xt_MASQUERADE xt_conntrack 8021q garp mrp ipt_REJECT     nf_reject_ipv4 ip6table_mangle ip6table_nat iptable_mangle iptable_nat nf_nat nf_conntrack nf_defrag_ipv6     nf_defrag_ipv4 iptable_filter bridge stp llc rfcomm snd_seq_dummy snd_hrtimer rpcrdma rdma_cm iw_cm ib_cm     ib_core ip6table_filter xt_comment ip6_tables vboxnetadp(OE) vboxnetflt(OE) vboxdrv(OE) qrtr bnep     binfmt_misc xfs vfat fat squashfs loop nvidia_drm(POE) nvidia_modeset(POE) nvidia_uvm(POE) nvidia(POE)     intel_rapl_msr intel_rapl_common snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio     snd_hda_codec_hdmi btusb btrtl iwlmvm uvcvideo btbcm snd_hda_intel edac_mce_amd [ 523.462274]     videobuf2_vmalloc videobuf2_memops btintel snd_intel_dspcfg videobuf2_v4l2 snd_intel_sdw_acpi bluetooth     snd_usb_audio snd_hda_codec mac80211 snd_usbmidi_lib joydev snd_hda_core videobuf2_common kvm_amd     snd_rawmidi snd_hwdep snd_seq videodev ccp snd_seq_device libarc4 ecdh_generic mc snd_pcm kvm iwlwifi     snd_timer drm_kms_helper snd cfg80211 cec soundcore irqbypass rapl wmi_bmof i2c_piix4 rfkill k10temp     pcspkr acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc drm zram ip_tables crct10dif_pclmul     crc32_pclmul crc32c_intel ghash_clmulni_intel nvme sp5100_tco r8169 nvme_core wmi ipmi_devintf     ipmi_msghandler fuse [ 523.462300] CPU: 14 PID: 22893 Comm: ip Tainted: P OE 5.16.18-200.fc35.x86_64 #1 [     523.462302] Hardware name: Micro-Star International Co., Ltd. MS-7C37/MPG X570 GAMING EDGE WIFI (MS-7C37),     BIOS 1.C0 10/29/2020 [ 523.462303] RIP: 0010:fib_nh_match+0x210/0x460 [ 523.462304] Code: 7c 24 20 48 8b     b5 90 00 00 00 e8 bb ee f4 ff 48 8b 7c 24 20 41 89 c4 e8 ee eb f4 ff 45 85 e4 0f 85 2e fe ff ff e9 4c ff     ff ff <0f> 0b e9 17 ff ff ff 3c 0a 0f 85 61 fe ff ff 48 8b b5 98 00 00 00 [ 523.462306] RSP:
    0018:ffffaa53d4d87928 EFLAGS: 00010286 [ 523.462307] RAX: 0000000000000000 RBX: ffffaa53d4d87a90 RCX:
    ffffaa53d4d87bb0 [ 523.462308] RDX: ffff9e3d2ee6be80 RSI: ffffaa53d4d87a90 RDI: ffffffff920ed380 [     523.462309] RBP: ffff9e3d2ee6be80 R08: 0000000000000064 R09: 0000000000000000 [ 523.462310] R10:
    0000000000000000 R11: 0000000000000000 R12: 0000000000000031 [ 523.462310] R13: 0000000000000020 R14:
    0000000000000000 R15: ffff9e3d331054e0 [ 523.462311] FS: 00007f2455 ---truncated--- (CVE-2022-49092)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.4.190-107.353. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-076 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl (CVE-2021-47634)

    In the Linux kernel, the following vulnerability has been resolved:

    Revert Revert block, bfq: honor already-setup queue merges (CVE-2021-47646)

    In the Linux kernel, the following vulnerability has been resolved:

    ASoC: soc-compress: prevent the potentially use of null pointer (CVE-2021-47650)

    When the KVM updates the guest's page table entry, it will first use get_user_pages_fast() to pin the     page, and when it fails (e.g. the vma->flags has VM_IO or VM_PFNMAP), it will get corresponding VMA where     the page lies in through find_vma_intersection(), calculate the physical address, and map the page to the     kernel virtual address through memremap(), and finally, write the update.The problem is that when we get     the vma through find_vma_intersection(), only VM_PFNMAP is checked, not both VM_IO and VM_PFNMAP. In the     reproducer below, after the KVM_SET_USER_MEMORY_REGION is completed, we replace the guest's memory mapping     with the kernel-user shared region of io_uring and then perform the KVM_TRANSLATE operation, which finally     triggers the page table entry update. Now, memremap() will return page_offset_base (direct mapping of all     physical memory) + vaddr (the linear address of KVM_TRANSLATE) + vm_pgoff (the offset when io_uring     performs mmap(2)), and use the return value as the base address for CMPXCHG (write 0x21 in this case).
    Since both vaddr and vm_pgoff are controllable by the user-mode process, writing may exceed the previously     mapped guest memory space and trigger exceptions such as UAF. The vulnerability shares similarities with     CVE-2021-22543. (CVE-2022-1158)

    A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

    A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where     virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-     free and create a situation where it may be possible to escalate privileges on the system. (CVE-2022-2977)

    A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in     progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to     crash the system or leak internal kernel information. (CVE-2022-41858)

    In the Linux kernel, the following vulnerability has been resolved:

    swiotlb: fix info leak with DMA_FROM_DEVICE (CVE-2022-48853)

    In the Linux kernel, the following vulnerability has been resolved:

    dm integrity: fix memory corruption when tag_size is less than digest size (CVE-2022-49044)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix panic when forwarding a pkt with no in6 dev (CVE-2022-49048)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: tcmu: Fix possible page UAF (CVE-2022-49053)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: potential buffer overflow in handling symlinks (CVE-2022-49058)

    In the Linux kernel, the following vulnerability has been resolved:

    veth: Ensure eth header is in skb's linear part (CVE-2022-49066)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: sata_dwc_460ex: Fix crash due to OOB write (CVE-2022-49073)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3: Fix GICR_CTLR.RWP polling (CVE-2022-49074)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix qgroup reserve overflow the qgroup limit (CVE-2022-49075)

    In the Linux kernel, the following vulnerability has been resolved:

    mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) (CVE-2022-49077)

    In the Linux kernel, the following vulnerability has been resolved:

    lz4: fix LZ4_decompress_safe_partial read out of bound (CVE-2022-49078)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/mempolicy: fix mpol_new leak in shared_policy_replace (CVE-2022-49080)

    In the Linux kernel, the following vulnerability has been resolved:

    qede: confirm skb is allocated before using (CVE-2022-49084)

    In the Linux kernel, the following vulnerability has been resolved:

    drbd: Fix five use after free bugs in get_initial_state (CVE-2022-49085)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: fix a race in rxrpc_exit_net() (CVE-2022-49087)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: fix route with nexthop object delete warning (CVE-2022-49092)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tls: fix slab-out-of-bounds bug in decrypt_internal (CVE-2022-49094)

    In the Linux kernel, the following vulnerability has been resolved:

    Drivers: hv: vmbus: Fix potential crash on module unload (CVE-2022-49098)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio_console: eliminate anonymous module_init & module_exit (CVE-2022-49100)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libfc: Fix use after free in fc_exch_abts_resp() (CVE-2022-49114)

    In the Linux kernel, the following vulnerability has been resolved:

    dm ioctl: prevent potential spectre v1 gadget (CVE-2022-49122)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: CPPC: Avoid out of bounds access when parsing _CPC data (CVE-2022-49145)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() (CVE-2022-49155)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs: add sanity check on allocation size (CVE-2022-49166)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't BUG if someone dirty pages without asking ext4 first (CVE-2022-49171)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: core: keep irq flags in device_pm_check_callbacks() (CVE-2022-49175)

    In the Linux kernel, the following vulnerability has been resolved:

    bfq: fix use-after-free in bfq_dispatch_request (CVE-2022-49176)

    In the Linux kernel, the following vulnerability has been resolved:

    block, bfq: don't move oom_bfqq (CVE-2022-49179)

    In the Linux kernel, the following vulnerability has been resolved:

    LSM: general protection fault in legacy_parse_param (CVE-2022-49180)

    In the Linux kernel, the following vulnerability has been resolved:

    af_netlink: Fix shift out of bounds in group mask calculation (CVE-2022-49197)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix more uncharged while msg has more_data (CVE-2022-49204)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix double uncharge the mem of sk_msg (CVE-2022-49205)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix memory leak in error flow for subscribe event routine (CVE-2022-49206)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full (CVE-2022-49209)

    In the Linux kernel, the following vulnerability has been resolved:

    dax: make sure inodes are flushed before destroy cache (CVE-2022-49220)

    In the Linux kernel, the following vulnerability has been resolved:

    power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init (CVE-2022-49224)

    In the Linux kernel, the following vulnerability has been resolved:

    block: don't delete queue kobject before its children (CVE-2022-49259)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: prevent integer overflow on 32 bit systems (CVE-2022-49279)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: prevent underflow in nfssvc_decode_writeargs() (CVE-2022-49280)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: fix reference counting for struct tpm_chip (CVE-2022-49287)

    A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the     Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from     suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of     the CPU similar to the speculative execution behavior kind of attacks. (CVE-2023-1637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.112-108.499. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-036 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl (CVE-2021-47634)

    In the Linux kernel, the following vulnerability has been resolved:

    Revert Revert block, bfq: honor already-setup queue merges (CVE-2021-47646)

    In the Linux kernel, the following vulnerability has been resolved:

    ASoC: soc-compress: prevent the potentially use of null pointer (CVE-2021-47650)

    A denial of service (DOS) issue was found in the Linux kernel's smb2_ioctl_query_info function in     the fs/cifs/smb2ops.c Common Internet File System (CIFS) due to an incorrect return from the memdup_user     function. This flaw allows a local, privileged (CAP_SYS_ADMIN) attacker to crash the system.
    (CVE-2022-0168)

    When the KVM updates the guest's page table entry, it will first use get_user_pages_fast() to pin the     page, and when it fails (e.g. the vma->flags has VM_IO or VM_PFNMAP), it will get corresponding VMA where     the page lies in through find_vma_intersection(), calculate the physical address, and map the page to the     kernel virtual address through memremap(), and finally, write the update.The problem is that when we get     the vma through find_vma_intersection(), only VM_PFNMAP is checked, not both VM_IO and VM_PFNMAP. In the     reproducer below, after the KVM_SET_USER_MEMORY_REGION is completed, we replace the guest's memory mapping     with the kernel-user shared region of io_uring and then perform the KVM_TRANSLATE operation, which finally     triggers the page table entry update. Now, memremap() will return page_offset_base (direct mapping of all     physical memory) + vaddr (the linear address of KVM_TRANSLATE) + vm_pgoff (the offset when io_uring     performs mmap(2)), and use the return value as the base address for CMPXCHG (write 0x21 in this case).
    Since both vaddr and vm_pgoff are controllable by the user-mode process, writing may exceed the previously     mapped guest memory space and trigger exceptions such as UAF. The vulnerability shares similarities with     CVE-2021-22543. (CVE-2022-1158)

    A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

    A use-after-free flaw was found in the Linux kernel's io_uring interface subsystem in the way a user     triggers a race condition between timeout flush and removal. This flaw allows a local user to crash or     escalate their privileges on the system. (CVE-2022-29582)

    A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where     virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-     free and create a situation where it may be possible to escalate privileges on the system. (CVE-2022-2977)

    A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in     progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to     crash the system or leak internal kernel information. (CVE-2022-41858)

    In the Linux kernel, the following vulnerability has been resolved:

    swiotlb: fix info leak with DMA_FROM_DEVICE (CVE-2022-48853)

    In the Linux kernel, the following vulnerability has been resolved:

    dm integrity: fix memory corruption when tag_size is less than digest size (CVE-2022-49044)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix panic when forwarding a pkt with no in6 dev (CVE-2022-49048)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: fix unexpected zeroed page mapping with zram swap (CVE-2022-49052)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: tcmu: Fix possible page UAF (CVE-2022-49053)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: potential buffer overflow in handling symlinks (CVE-2022-49058)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Fix the svc_deferred_event trace class (CVE-2022-49065)

    In the Linux kernel, the following vulnerability has been resolved:

    veth: Ensure eth header is in skb's linear part (CVE-2022-49066)

    In the Linux kernel, the following vulnerability has been resolved:

    gpio: Restrict usage of GPIO chip irq members before initialization (CVE-2022-49072)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: sata_dwc_460ex: Fix crash due to OOB write (CVE-2022-49073)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3: Fix GICR_CTLR.RWP polling (CVE-2022-49074)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix qgroup reserve overflow the qgroup limit (CVE-2022-49075)

    In the Linux kernel, the following vulnerability has been resolved:

    mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) (CVE-2022-49077)

    In the Linux kernel, the following vulnerability has been resolved:

    lz4: fix LZ4_decompress_safe_partial read out of bound (CVE-2022-49078)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/mempolicy: fix mpol_new leak in shared_policy_replace (CVE-2022-49080)

    In the Linux kernel, the following vulnerability has been resolved:

    qede: confirm skb is allocated before using (CVE-2022-49084)

    In the Linux kernel, the following vulnerability has been resolved:

    drbd: Fix five use after free bugs in get_initial_state (CVE-2022-49085)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix leak of nested actions (CVE-2022-49086)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: fix a race in rxrpc_exit_net() (CVE-2022-49087)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: fix route with nexthop object delete warning (CVE-2022-49092)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tls: fix slab-out-of-bounds bug in decrypt_internal (CVE-2022-49094)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Avoid writeback threads getting stuck in mempool_alloc() (CVE-2022-49097)

    In the Linux kernel, the following vulnerability has been resolved:

    Drivers: hv: vmbus: Fix potential crash on module unload (CVE-2022-49098)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio_console: eliminate anonymous module_init & module_exit (CVE-2022-49100)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify() (CVE-2022-49103)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix memory leak in ceph_readdir when note_last_dentry returns error (CVE-2022-49107)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libfc: Fix use after free in fc_exch_abts_resp() (CVE-2022-49114)

    In the Linux kernel, the following vulnerability has been resolved:

    dm ioctl: prevent potential spectre v1 gadget (CVE-2022-49122)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring: fix memory leak of uid in files registration (CVE-2022-49144)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: CPPC: Avoid out of bounds access when parsing _CPC data (CVE-2022-49145)

    In the Linux kernel, the following vulnerability has been resolved:

    watch_queue: Free the page array when watch_queue is dismantled (CVE-2022-49148)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix call timer start racing with call destruction (CVE-2022-49149)

    In the Linux kernel, the following vulnerability has been resolved:

    wireguard: socket: free skb in send6 when ipv6 is disabled (CVE-2022-49153)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: fix panic on out-of-bounds guest IRQ (CVE-2022-49154)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() (CVE-2022-49155)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Fix scheduling while atomic (CVE-2022-49156)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't BUG if someone dirty pages without asking ext4 first (CVE-2022-49171)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit (CVE-2022-49174)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: core: keep irq flags in device_pm_check_callbacks() (CVE-2022-49175)

    In the Linux kernel, the following vulnerability has been resolved:

    bfq: fix use-after-free in bfq_dispatch_request (CVE-2022-49176)

    In the Linux kernel, the following vulnerability has been resolved:

    block, bfq: don't move oom_bfqq (CVE-2022-49179)

    In the Linux kernel, the following vulnerability has been resolved:

    LSM: general protection fault in legacy_parse_param (CVE-2022-49180)

    In the Linux kernel, the following vulnerability has been resolved:

    af_netlink: Fix shift out of bounds in group mask calculation (CVE-2022-49197)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix more uncharged while msg has more_data (CVE-2022-49204)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix double uncharge the mem of sk_msg (CVE-2022-49205)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix memory leak in error flow for subscribe event routine (CVE-2022-49206)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full (CVE-2022-49209)

    In the Linux kernel, the following vulnerability has been resolved:

    MIPS: pgalloc: fix memory leak caused by pgd_free() (CVE-2022-49210)

    In the Linux kernel, the following vulnerability has been resolved:

    dax: make sure inodes are flushed before destroy cache (CVE-2022-49220)

    In the Linux kernel, the following vulnerability has been resolved:

    power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init (CVE-2022-49224)

    In the Linux kernel, the following vulnerability has been resolved:

    watch_queue: Actually free the watch (CVE-2022-49256)

    In the Linux kernel, the following vulnerability has been resolved:

    watch_queue: Fix NULL dereference in error cleanup (CVE-2022-49257)

    In the Linux kernel, the following vulnerability has been resolved:

    block: don't delete queue kobject before its children (CVE-2022-49259)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/gem: add missing boundary check in vm_access (CVE-2022-49261)

    In the Linux kernel, the following vulnerability has been resolved:

    exec: Force single empty string when argv is empty (CVE-2022-49264)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: prevent bad output lengths in smb2_ioctl_query_info() (CVE-2022-49271)

    In the Linux kernel, the following vulnerability has been resolved:

    ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock (CVE-2022-49272)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: prevent integer overflow on 32 bit systems (CVE-2022-49279)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: prevent underflow in nfssvc_decode_writeargs() (CVE-2022-49280)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: fix reference counting for struct tpm_chip (CVE-2022-49287)

    A use-after-free flaw was found in the Linux kernel's core dump subsystem. This flaw could allow a local     user to crash the system. (CVE-2023-1249)

    A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the     Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from     suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of     the CPU similar to the speculative execution behavior kind of attacks. (CVE-2023-1637)

    Improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics     drivers for linux before kernel version 6.2.10 may allow an authenticated user to potentially enable     escalation of privilege via local access. (CVE-2023-28410)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
241018	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-1704)	Nessus	Huawei Local Security Checks	high
241015	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-1689)	Nessus	Huawei Local Security Checks	high
234407	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1241-1)	Nessus	SuSE Local Security Checks	high
233410	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1027-1)	Nessus	SuSE Local Security Checks	high
225423	Linux Distros Unpatched Vulnerability : CVE-2022-49092	Nessus	Misc.	high
206247	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-076)	Nessus	Amazon Linux Local Security Checks	high
180564	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-036)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2022-49092

medium

Tenable Plugins

high

high

high

high

high

high

high