In the Linux kernel, the following vulnerability has been resolved: skbuff: fix coalescing for page_pool fragment recycling Fix a use-after-free when using page_pool with page fragments. We encountered this problem during normal RX in the hns3 driver: (1) Initially we have three descriptors in the RX queue. The first one allocates PAGE1 through page_pool, and the other two allocate one half of PAGE2 each. Page references look like this: RX_BD1 _______ PAGE1 RX_BD2 _______ PAGE2 RX_BD3 _________/ (2) Handle RX on the first descriptor. Allocate SKB1, eventually added to the receive queue by tcp_queue_rcv(). (3) Handle RX on the second descriptor. Allocate SKB2 and pass it to netif_receive_skb(): netif_receive_skb(SKB2) ip_rcv(SKB2) SKB3 = skb_clone(SKB2) SKB2 and SKB3 share a reference to PAGE2 through skb_shinfo()->dataref. The other ref to PAGE2 is still held by RX_BD3: SKB2 ---+- PAGE2 SKB3 __/ / RX_BD3 _________/ (3b) Now while handling TCP, coalesce SKB3 with SKB1: tcp_v4_rcv(SKB3) tcp_try_coalesce(to=SKB1, from=SKB3) // succeeds kfree_skb_partial(SKB3) skb_release_data(SKB3) // drops one dataref SKB1 _____ PAGE1 \____ SKB2 _____ PAGE2 / RX_BD3 _________/ In skb_try_coalesce(), __skb_frag_ref() takes a page reference to PAGE2, where it should instead have increased the page_pool frag reference, pp_frag_count. Without coalescing, when releasing both SKB2 and SKB3, a single reference to PAGE2 would be dropped. Now when releasing SKB1 and SKB2, two references to PAGE2 will be dropped, resulting in underflow. (3c) Drop SKB2: af_packet_rcv(SKB2) consume_skb(SKB2) skb_release_data(SKB2) // drops second dataref page_pool_return_skb_page(PAGE2) // drops one pp_frag_count SKB1 _____ PAGE1 \____ PAGE2 / RX_BD3 _________/ (4) Userspace calls recvmsg() Copies SKB1 and releases it. Since SKB3 was coalesced with SKB1, we release the SKB3 page as well: tcp_eat_recv_skb(SKB1) skb_release_data(SKB1) page_pool_return_skb_page(PAGE1) page_pool_return_skb_page(PAGE2) // drops second pp_frag_count (5) PAGE2 is freed, but the third RX descriptor was still using it! In our case this causes IOMMU faults, but it would silently corrupt memory if the IOMMU was disabled. Change the logic that checks whether pp_recycle SKBs can be coalesced. We still reject differing pp_recycle between 'from' and 'to' SKBs, but in order to avoid the situation described above, we also reject coalescing when both 'from' and 'to' are pp_recycled and 'from' is cloned. The new logic allows coalescing a cloned pp_recycle SKB into a page refcounted one, because in this case the release (4) will drop the right reference, the one taken by skb_try_coalesce().

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013477 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: fix coalescing for page_pool fragment recycling

    Fix a use-after-free when using page_pool with page fragments. We     encountered this problem during normal RX in the hns3 driver:

    (1) Initially we have three descriptors in the RX queue. The first one         allocates PAGE1 through page_pool, and the other two allocate one         half of PAGE2 each. Page references look like this:

                    RX_BD1 _______ PAGE1                     RX_BD2 _______ PAGE2                     RX_BD3 _________/

    (2) Handle RX on the first descriptor. Allocate SKB1, eventually added         to the receive queue by tcp_queue_rcv().

    (3) Handle RX on the second descriptor. Allocate SKB2 and pass it to         netif_receive_skb():

        netif_receive_skb(SKB2)           ip_rcv(SKB2)             SKB3 = skb_clone(SKB2)

        SKB2 and SKB3 share a reference to PAGE2 through         skb_shinfo()->dataref. The other ref to PAGE2 is still held by         RX_BD3:

                          SKB2 ---+- PAGE2                           SKB3 __/   /                     RX_BD3 _________/

     (3b) Now while handling TCP, coalesce SKB3 with SKB1:

          tcp_v4_rcv(SKB3)             tcp_try_coalesce(to=SKB1, from=SKB3)    // succeeds             kfree_skb_partial(SKB3)               skb_release_data(SKB3)                // drops one dataref

                          SKB1 _____ PAGE1                                \____                           SKB2 _____ PAGE2                                      /                     RX_BD3 _________/

        In skb_try_coalesce(), __skb_frag_ref() takes a page reference to         PAGE2, where it should instead have increased the page_pool frag         reference, pp_frag_count. Without coalescing, when releasing both         SKB2 and SKB3, a single reference to PAGE2 would be dropped. Now         when releasing SKB1 and SKB2, two references to PAGE2 will be         dropped, resulting in underflow.

     (3c) Drop SKB2:

          af_packet_rcv(SKB2)             consume_skb(SKB2)               skb_release_data(SKB2)                // drops second dataref                 page_pool_return_skb_page(PAGE2)    // drops one pp_frag_count

                          SKB1 _____ PAGE1                                \____                                      PAGE2                                      /                     RX_BD3 _________/

    (4) Userspace calls recvmsg()         Copies SKB1 and releases it. Since SKB3 was coalesced with SKB1, we         release the SKB3 page as well:

        tcp_eat_recv_skb(SKB1)           skb_release_data(SKB1)             page_pool_return_skb_page(PAGE1)             page_pool_return_skb_page(PAGE2)        // drops second pp_frag_count

    (5) PAGE2 is freed, but the third RX descriptor was still using it!         In our case this causes IOMMU faults, but it would silently corrupt         memory if the IOMMU was disabled.

    Change the logic that checks whether pp_recycle SKBs can be coalesced.
    We still reject differing pp_recycle between 'from' and 'to' SKBs, but     in order to avoid the situation described above, we also reject     coalescing when both 'from' and 'to' are pp_recycled and 'from' is     cloned.

    The new logic allows coalescing a cloned pp_recycle SKB into a page     refcounted one, because in this case the release (4) will drop the right     reference, the one taken by skb_try_coalesce().

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010755 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: fix coalescing for page_pool fragment recycling

    Fix a use-after-free when using page_pool with page fragments. We     encountered this problem during normal RX in the hns3 driver:

    (1) Initially we have three descriptors in the RX queue. The first one         allocates PAGE1 through page_pool, and the other two allocate one         half of PAGE2 each. Page references look like this:

                    RX_BD1 _______ PAGE1                     RX_BD2 _______ PAGE2                     RX_BD3 _________/

    (2) Handle RX on the first descriptor. Allocate SKB1, eventually added         to the receive queue by tcp_queue_rcv().

    (3) Handle RX on the second descriptor. Allocate SKB2 and pass it to         netif_receive_skb():

        netif_receive_skb(SKB2)           ip_rcv(SKB2)             SKB3 = skb_clone(SKB2)

        SKB2 and SKB3 share a reference to PAGE2 through         skb_shinfo()->dataref. The other ref to PAGE2 is still held by         RX_BD3:

                          SKB2 ---+- PAGE2                           SKB3 __/   /                     RX_BD3 _________/

     (3b) Now while handling TCP, coalesce SKB3 with SKB1:

          tcp_v4_rcv(SKB3)             tcp_try_coalesce(to=SKB1, from=SKB3)    // succeeds             kfree_skb_partial(SKB3)               skb_release_data(SKB3)                // drops one dataref

                          SKB1 _____ PAGE1                                \____                           SKB2 _____ PAGE2                                      /                     RX_BD3 _________/

        In skb_try_coalesce(), __skb_frag_ref() takes a page reference to         PAGE2, where it should instead have increased the page_pool frag         reference, pp_frag_count. Without coalescing, when releasing both         SKB2 and SKB3, a single reference to PAGE2 would be dropped. Now         when releasing SKB1 and SKB2, two references to PAGE2 will be         dropped, resulting in underflow.

     (3c) Drop SKB2:

          af_packet_rcv(SKB2)             consume_skb(SKB2)               skb_release_data(SKB2)                // drops second dataref                 page_pool_return_skb_page(PAGE2)    // drops one pp_frag_count

                          SKB1 _____ PAGE1                                \____                                      PAGE2                                      /                     RX_BD3 _________/

    (4) Userspace calls recvmsg()         Copies SKB1 and releases it. Since SKB3 was coalesced with SKB1, we         release the SKB3 page as well:

        tcp_eat_recv_skb(SKB1)           skb_release_data(SKB1)             page_pool_return_skb_page(PAGE1)             page_pool_return_skb_page(PAGE2)        // drops second pp_frag_count

    (5) PAGE2 is freed, but the third RX descriptor was still using it!         In our case this causes IOMMU faults, but it would silently corrupt         memory if the IOMMU was disabled.

    Change the logic that checks whether pp_recycle SKBs can be coalesced.
    We still reject differing pp_recycle between 'from' and 'to' SKBs, but     in order to avoid the situation described above, we also reject     coalescing when both 'from' and 'to' are pp_recycled and 'from' is     cloned.

    The new logic allows coalescing a cloned pp_recycle SKB into a page     refcounted one, because in this case the release (4) will drop the right     reference, the one taken by skb_try_coalesce().

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1241-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
    - CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync     (bsc#1239095).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1027-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
    - CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
    - CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8267 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

    * use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

    * smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)

    * NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

    * swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

    * uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)

    * race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

    * use-after-free and memory errors in ext4 when mounting and operating on a corrupted image     (CVE-2022-1184)

    * concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280)

    * kernel info leak issue in pfkey_register (CVE-2022-1353)

    * use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)

    * NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

    * fanotify misuses fd_install() which could lead to use-after-free (CVE-2022-1998)

    * nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)

    * integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

    * slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

    * incomplete clean-up of multi-core shared buffers (aka SBDR) (CVE-2022-21123)

    * incomplete clean-up of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125)

    * incomplete clean-up in specific special register write operations (aka DRPW) (CVE-2022-21166)

    * possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

    * AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816,     CVE-2022-29900)

    * AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)

    * Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

    * double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

    * use after free in SUNRPC subsystem (CVE-2022-28893)

    * use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

    * Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

    * DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

    * nf_tables disallow binding to already bound chain (CVE-2022-39190)

    * nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
309246	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013477)	Nessus	Unity Linux Local Security Checks	high
308978	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010755)	Nessus	Unity Linux Local Security Checks	high
301628	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1280)	Nessus	Huawei Local Security Checks	high
301595	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1244)	Nessus	Huawei Local Security Checks	high
234407	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1241-1)	Nessus	SuSE Local Security Checks	high
233410	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1027-1)	Nessus	SuSE Local Security Checks	high
167620	RHEL 9 : kernel (RHSA-2022:8267)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2022-49093

high

Tenable Plugins

high

high

high

high

high

high

high