In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use after free in hci_send_acl This fixes the following trace caused by receiving HCI_EV_DISCONN_PHY_LINK_COMPLETE which does call hci_conn_del without first checking if conn->type is in fact AMP_LINK and in case it is do properly cleanup upper layers with hci_disconn_cfm: ================================================================== BUG: KASAN: use-after-free in hci_send_acl+0xaba/0xc50 Read of size 8 at addr ffff88800e404818 by task bluetoothd/142 CPU: 0 PID: 142 Comm: bluetoothd Not tainted 5.17.0-rc5-00006-gda4022eeac1a #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x45/0x59 print_address_description.constprop.0+0x1f/0x150 kasan_report.cold+0x7f/0x11b hci_send_acl+0xaba/0xc50 l2cap_do_send+0x23f/0x3d0 l2cap_chan_send+0xc06/0x2cc0 l2cap_sock_sendmsg+0x201/0x2b0 sock_sendmsg+0xdc/0x110 sock_write_iter+0x20f/0x370 do_iter_readv_writev+0x343/0x690 do_iter_write+0x132/0x640 vfs_writev+0x198/0x570 do_writev+0x202/0x280 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RSP: 002b:00007ffce8a099b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 14 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 RDX: 0000000000000001 RSI: 00007ffce8a099e0 RDI: 0000000000000015 RAX: ffffffffffffffda RBX: 00007ffce8a099e0 RCX: 00007f788fc3cf77 R10: 00007ffce8af7080 R11: 0000000000000246 R12: 000055e4ccf75580 RBP: 0000000000000015 R08: 0000000000000002 R09: 0000000000000001 </TASK> R13: 000055e4ccf754a0 R14: 000055e4ccf75cd0 R15: 000055e4ccf4a6b0 Allocated by task 45: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 hci_chan_create+0x9a/0x2f0 l2cap_conn_add.part.0+0x1a/0xdc0 l2cap_connect_cfm+0x236/0x1000 le_conn_complete_evt+0x15a7/0x1db0 hci_le_conn_complete_evt+0x226/0x2c0 hci_le_meta_evt+0x247/0x450 hci_event_packet+0x61b/0xe90 hci_rx_work+0x4d5/0xc50 process_one_work+0x8fb/0x15a0 worker_thread+0x576/0x1240 kthread+0x29d/0x340 ret_from_fork+0x1f/0x30 Freed by task 45: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_set_free_info+0x20/0x30 __kasan_slab_free+0xfb/0x130 kfree+0xac/0x350 hci_conn_cleanup+0x101/0x6a0 hci_conn_del+0x27e/0x6c0 hci_disconn_phylink_complete_evt+0xe0/0x120 hci_event_packet+0x812/0xe90 hci_rx_work+0x4d5/0xc50 process_one_work+0x8fb/0x15a0 worker_thread+0x576/0x1240 kthread+0x29d/0x340 ret_from_fork+0x1f/0x30 The buggy address belongs to the object at ffff88800c0f0500 The buggy address is located 24 bytes inside of which belongs to the cache kmalloc-128 of size 128 The buggy address belongs to the page: 128-byte region [ffff88800c0f0500, ffff88800c0f0580) flags: 0x100000000000200(slab|node=0|zone=1) page:00000000fe45cd86 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xc0f0 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 raw: 0100000000000200 ffffea00003a2c80 dead000000000004 ffff8880078418c0 page dumped because: kasan: bad access detected ffff88800c0f0400: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc Memory state around the buggy address: >ffff88800c0f0500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88800c0f0480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88800c0f0580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ---truncated---

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:10669 advisory.

    * kernel: Bluetooth: Fix use after free in hci_send_acl (CVE-2022-49111)
      * kernel: Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CVE-2022-49136)
      * kernel: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CVE-2022-49846)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:10670 advisory.

    * kernel: Bluetooth: Fix use after free in hci_send_acl (CVE-2022-49111)
      * kernel: Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CVE-2022-49136)
      * kernel: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CVE-2022-49846)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-10669 advisory.

    - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113]     {CVE-2022-49846}
    - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111}
    - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468]     {CVE-2022-49136}
    - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136}
    - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468]     {CVE-2022-49136}
    - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136}
    - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468]     {CVE-2022-49136}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10670 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Bluetooth: Fix use after free in hci_send_acl (CVE-2022-49111)

    * kernel: Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CVE-2022-49136)

    * kernel: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CVE-2022-49846)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10669 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Bluetooth: Fix use after free in hci_send_acl (CVE-2022-49111)

    * kernel: Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CVE-2022-49136)

    * kernel: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CVE-2022-49846)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10673 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Bluetooth: Fix use after free in hci_send_acl (CVE-2022-49111)

    * kernel: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CVE-2022-49846)

    * kernel: net: atlantic: fix aq_vec index out of range error (CVE-2022-50066)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10211 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: um: Fix out-of-bounds read in LDT setup (CVE-2022-49395)

    * kernel: Bluetooth: Fix use after free in hci_send_acl (CVE-2022-49111)

    * kernel: ndisc: use RCU protection in ndisc_alloc_skb() (CVE-2025-21764)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10193 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * Kernel: use-after-free in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c (CVE-2023-1652)

    * kernel: dlm: fix plock invalid read (CVE-2022-49407)

    * kernel: blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx (CVE-2022-49377)

    * kernel: Bluetooth: Fix use after free in hci_send_acl (CVE-2022-49111)

    * kernel: scsi: libfc: Fix use after free in fc_exch_abts_resp() (CVE-2022-49114)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10179 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: um: Fix out-of-bounds read in LDT setup (CVE-2022-49395)

    * kernel: Bluetooth: Fix use after free in hci_send_acl (CVE-2022-49111)

    * kernel: scsi: libfc: Fix use after free in fc_exch_abts_resp() (CVE-2022-49114)

    * kernel: dm ioctl: prevent potential spectre v1 gadget (CVE-2022-49122)

    * kernel: mt76: fix use-after-free by removing a non-RCU wcid pointer (CVE-2022-49328)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10174 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * Kernel: use-after-free in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c (CVE-2023-1652)

    * kernel: dlm: fix plock invalid read (CVE-2022-49407)

    * kernel: blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx (CVE-2022-49377)

    * kernel: Bluetooth: Fix use after free in hci_send_acl (CVE-2022-49111)

    * kernel: scsi: libfc: Fix use after free in fc_exch_abts_resp() (CVE-2022-49114)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10005 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Bluetooth: Fix use after free in hci_send_acl (CVE-2022-49111)

    * kernel: scsi: libfc: Fix use after free in fc_exch_abts_resp() (CVE-2022-49114)

    * kernel: dm ioctl: prevent potential spectre v1 gadget (CVE-2022-49122)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01600-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-47659: drm/plane: Move range check for format_count earlier (bsc#1237839).
    - CVE-2022-49044: dm integrity: fix memory corruption when tag_size is less than digest size     (bsc#1237840).
    - CVE-2022-49055: drm/amdkfd: Check for potential null return of kmalloc_array() (bsc#1237868).
    - CVE-2022-49060: net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() (bsc#1237845).
    - CVE-2022-49086: net: openvswitch: fix leak of nested actions (bsc#1238037).
    - CVE-2022-49111: Bluetooth: Fix use after free in hci_send_acl (bsc#1237984).
    - CVE-2022-49118: scsi: hisi_sas: Free irq vectors in order for v3 HW (bsc#1237979).
    - CVE-2022-49121: scsi: pm8001: Fix tag leaks on error (bsc#1237926).
    - CVE-2022-49137: drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj (bsc#1238155).
    - CVE-2022-49175: PM: core: keep irq flags in device_pm_check_callbacks() (bsc#1238099).
    - CVE-2022-49176: bfq: fix use-after-free in bfq_dispatch_request (bsc#1238097).
    - CVE-2022-49179: block, bfq: do not move oom_bfqq (bsc#1238092).
    - CVE-2022-49188: remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region (bsc#1238138).
    - CVE-2022-49197: af_netlink: Fix shift out of bounds in group mask calculation (bsc#1238455).
    - CVE-2022-49205: bpf, sockmap: Fix double uncharge the mem of sk_msg (bsc#1238335).
    - CVE-2022-49232: drm/amd/display: Fix a NULL pointer dereference in     amdgpu_dm_connector_add_common_modes() (bsc#1238139).
    - CVE-2022-49290: mac80211: fix potential double free on mesh join (bsc#1238156).
    - CVE-2022-49305: drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() (bsc#1238645).
    - CVE-2022-49325: tcp: add accessors to read/set tp->snd_cwnd (bsc#1238398).
    - CVE-2022-49335: drm/amdgpu/cs: make commands with 0 chunks illegal behaviour (bsc#1238377).
    - CVE-2022-49351: net: altera: Fix refcount leak in altera_tse_mdio_create (bsc#1237939).
    - CVE-2022-49385: driver: base: fix UAF when driver_attach failed (bsc#1237951).
    - CVE-2022-49390: macsec: fix UAF bug for real_dev (bsc#1238233).
    - CVE-2022-49411: bfq: Make sure bfqg for which we are queueing requests is online (bsc#1238307).
    - CVE-2022-49442: drivers/base/node.c: fix compaction sysfs file leak (bsc#1238243).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49478: media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init (bsc#1238000).
    - CVE-2022-49489: drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm     runtime resume (bsc#1238244).
    - CVE-2022-49504: scsi: lpfc: Inhibit aborts if external loopback plug is inserted (bsc#1238835).
    - CVE-2022-49521: scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() (bsc#1238938).
    - CVE-2022-49525: media: cx25821: Fix the warning when removing the module (bsc#1238022).
    - CVE-2022-49534: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT (bsc#1238893).
    - CVE-2022-49535: scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI     (bsc#1238937).
    - CVE-2022-49536: scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock (bsc#1238838).
    - CVE-2022-49537: scsi: lpfc: Fix call trace observed during I/O with CMF enabled (bsc#1238930).
    - CVE-2022-49542: scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg() (bsc#1238722).
    - CVE-2022-49561: netfilter: conntrack: re-fetch conntrack after insertion (bsc#1238537).
    - CVE-2022-49590: igmp: Fix data-races around sysctl_igmp_llm_reports (bsc#1238844).
    - CVE-2022-49658: bpf, selftests: Add verifier test case for imm=0,umin=0,umax=1 scalar (bsc#1238803).
    - CVE-2022-49668: PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events (bsc#1237957).
    - CVE-2022-49693: drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf (bsc#1237954).
    - CVE-2022-49725: i40e: Fix call trace in setup_tx_descriptors (bsc#1238016).
    - CVE-2022-49728: kABI workaround for changeing the variable length type to size_t (bsc#1239111).
    - CVE-2022-49730: scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted (bsc#1239070).
    - CVE-2022-49749: i2c: designware: use casting of u64 in clock multiplication to avoid overflow     (bsc#1240243).
    - CVE-2022-49753: dmaengine: Fix double increment of client_count in dma_chan_get() (bsc#1240250).
    - CVE-2023-53023: net: nfc: Fix use-after-free in local_cleanup() (bsc#1240309).
    - CVE-2023-53032: netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function     (bsc#1240270).
    - CVE-2024-49994: block: fix integer overflow in BLKSECDISCARD (bsc#1237757).
    - CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
    - CVE-2024-50272: filemap: Fix bounds checking in filemap_read() (bsc#1233461 bsc#1234209).
    - CVE-2024-52559: drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit() (bsc#1238507).
    - CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
    - CVE-2024-56590: skbuff: introduce skb_pull_data (bsc#1235038).
    - CVE-2024-56641: net/smc: initialize close_work early to avoid warning (bsc#1235526).
    - CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
    - CVE-2024-57980: media: uvcvideo: Fix double free in error path (bsc#1237911).
    - CVE-2024-57981: usb: xhci: Fix NULL pointer dereference on certain command aborts (bsc#1237912).
    - CVE-2024-58005: tpm: Change to kvalloc() in eventlog/acpi.c (bsc#1237873).
    - CVE-2024-58009: Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc (bsc#1238760).
    - CVE-2024-58017: printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX (bsc#1237950     bsc#1239112).
    - CVE-2024-58063: wifi: rtlwifi: fix memory leaks and invalid access at probe error path (bsc#1238984).
    - CVE-2024-58093: PCI/ASPM: Fix link state exit during switch upstream function removal (bsc#1241347).
    - CVE-2025-21635: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy (bsc#1236111).
    - CVE-2025-21735: NFC: nci: Add bounds checking in nci_hci_create_pipe() (bsc#1238497).
    - CVE-2025-21750: wifi: brcmfmac: Check the return value of of_property_read_string_index() (bsc#1238905).
    - CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
    - CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21779: KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel     (bsc#1238768).
    - CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
    - CVE-2025-21862: drop_monitor: fix incorrect initialization order (bsc#1239474).
    - CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
    - CVE-2025-21909: wifi: nl80211: reject cooked mode if it is set along with other flags (bsc#1240590).
    - CVE-2025-21910: wifi: cfg80211: regulatory: improve invalid hints checking (bsc#1240583).
    - CVE-2025-21926: net: gso: fix ownership in __udp_gso_segment (bsc#1240712).
    - CVE-2025-21927: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (bsc#1240714).
    - CVE-2025-21931: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio (bsc#1240709).
    - CVE-2025-21941: drm/amd/display: Fix null check for pipe_ctx->plane_state in (bsc#1240701).
    - CVE-2025-21948: HID: appleir: Fix potential NULL dereference at raw event handle (bsc#1240703).
    - CVE-2025-21956: drm/amd/display: Assign normalized_pix_clk when color depth = 14 (bsc#1240739).
    - CVE-2025-21957: scsi: qla1280: Fix kernel oops when debug level > 2 (bsc#1240742).
    - CVE-2025-21963: cifs: Fix integer overflow while processing acdirmax mount option (bsc#1240717).
    - CVE-2025-21964: cifs: Fix integer overflow while processing acregmax mount option (bsc#1240740).
    - CVE-2025-21976: fbdev: hyperv_fb: Allow graceful removal of framebuffer (bsc#1241145).
    - CVE-2025-22004: net: atm: fix use after free in lec_send() (bsc#1240835).
    - CVE-2025-22008: regulator: check that dummy regulator has been probed before using it (bsc#1240942).
    - CVE-2025-22010: RDMA/hns: Fix soft lockup during bt pages loop (bsc#1240943).
    - CVE-2025-22018: atm: Fix NULL pointer dereference (bsc#1241266).
    - CVE-2025-22053: net: ibmveth: make veth_pool_store stop hanging (bsc#1241373).
    - CVE-2025-22055: net: fix geneve_opt length integer overflow (bsc#1241371).
    - CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
    - CVE-2025-22086: RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (bsc#1241458).
    - CVE-2025-23131: dlm: prevent NPD when writing a positive value to event_done (bsc#1241601).
    - CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01633-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-49111: Bluetooth: Fix use after free in hci_send_acl (bsc#1237984).
    - CVE-2025-21726: padata: avoid UAF for reorder_work (bsc#1238865).
    - CVE-2025-21785: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (bsc#1238747).
    - CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1238512).
    - CVE-2025-22004: net: atm: fix use after free in lec_send() (bsc#1240835).
    - CVE-2025-22020: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (bsc#1241280).
    - CVE-2025-22055: net: fix geneve_opt length integer overflow (bsc#1241371).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1263-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-47248: udp: fix race between close() and udp_abort() (bsc#1224867).
    - CVE-2022-49051: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup (bsc#1237903).
    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49275: can: m_can: m_can_tx_handler(): fix use after free of skb (bsc#1238719).
    - CVE-2022-49413: bfq: Update cgroup information before merging bio (bsc#1238710).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238729).
    - CVE-2022-49563: crypto: qat - add param check for RSA (bsc#1238787).
    - CVE-2022-49564: crypto: qat - add param check for DH (bsc#1238789).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-56642: tipc: Fix use-after-free of kernel socket in cleanup_bearer() (bsc#1235433).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1241-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
    - CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync     (bsc#1239095).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1027-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
    - CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
    - CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use after free in     hci_send_acl This fixes the following trace caused by receiving HCI_EV_DISCONN_PHY_LINK_COMPLETE which     does call hci_conn_del without first checking if conn->type is in fact AMP_LINK and in case it is do     properly cleanup upper layers with hci_disconn_cfm:
    ================================================================== BUG: KASAN: use-after-free in     hci_send_acl+0xaba/0xc50 Read of size 8 at addr ffff88800e404818 by task bluetoothd/142 CPU: 0 PID: 142     Comm: bluetoothd Not tainted 5.17.0-rc5-00006-gda4022eeac1a #7 Hardware name: QEMU Standard PC (i440FX +     PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK>     dump_stack_lvl+0x45/0x59 print_address_description.constprop.0+0x1f/0x150 kasan_report.cold+0x7f/0x11b     hci_send_acl+0xaba/0xc50 l2cap_do_send+0x23f/0x3d0 l2cap_chan_send+0xc06/0x2cc0     l2cap_sock_sendmsg+0x201/0x2b0 sock_sendmsg+0xdc/0x110 sock_write_iter+0x20f/0x370     do_iter_readv_writev+0x343/0x690 do_iter_write+0x132/0x640 vfs_writev+0x198/0x570 do_writev+0x202/0x280     do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RSP: 002b:00007ffce8a099b8 EFLAGS:
    00000246 ORIG_RAX: 0000000000000014 Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f     1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 14 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89     54 24 1c 48 89 74 24 10 RDX: 0000000000000001 RSI: 00007ffce8a099e0 RDI: 0000000000000015 RAX:
    ffffffffffffffda RBX: 00007ffce8a099e0 RCX: 00007f788fc3cf77 R10: 00007ffce8af7080 R11: 0000000000000246     R12: 000055e4ccf75580 RBP: 0000000000000015 R08: 0000000000000002 R09: 0000000000000001 </TASK> R13:
    000055e4ccf754a0 R14: 000055e4ccf75cd0 R15: 000055e4ccf4a6b0 Allocated by task 45:
    kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 hci_chan_create+0x9a/0x2f0     l2cap_conn_add.part.0+0x1a/0xdc0 l2cap_connect_cfm+0x236/0x1000 le_conn_complete_evt+0x15a7/0x1db0     hci_le_conn_complete_evt+0x226/0x2c0 hci_le_meta_evt+0x247/0x450 hci_event_packet+0x61b/0xe90     hci_rx_work+0x4d5/0xc50 process_one_work+0x8fb/0x15a0 worker_thread+0x576/0x1240 kthread+0x29d/0x340     ret_from_fork+0x1f/0x30 Freed by task 45: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30     kasan_set_free_info+0x20/0x30 __kasan_slab_free+0xfb/0x130 kfree+0xac/0x350 hci_conn_cleanup+0x101/0x6a0     hci_conn_del+0x27e/0x6c0 hci_disconn_phylink_complete_evt+0xe0/0x120 hci_event_packet+0x812/0xe90     hci_rx_work+0x4d5/0xc50 process_one_work+0x8fb/0x15a0 worker_thread+0x576/0x1240 kthread+0x29d/0x340     ret_from_fork+0x1f/0x30 The buggy address belongs to the object at ffff88800c0f0500 The buggy address is     located 24 bytes inside of which belongs to the cache kmalloc-128 of size 128 The buggy address belongs to     the page: 128-byte region [ffff88800c0f0500, ffff88800c0f0580) flags:
    0x100000000000200(slab|node=0|zone=1) page:00000000fe45cd86 refcount:1 mapcount:0 mapping:0000000000000000     index:0x0 pfn:0xc0f0 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 raw:
    0100000000000200 ffffea00003a2c80 dead000000000004 ffff8880078418c0 page dumped because: kasan: bad access     detected ffff88800c0f0400: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc Memory state around the buggy     address: >ffff88800c0f0500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88800c0f0480: fc fc fc fc     fc fc fc fc fc fc fc fc fc fc fc fc ffff88800c0f0580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    ---truncated--- (CVE-2022-49111)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 4.14.276-211.499. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2569 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl (CVE-2021-47634)

    A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

    A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

    A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where     virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-     free and create a situation where it may be possible to escalate privileges on the system. (CVE-2022-2977)

    A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in     progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to     crash the system or leak internal kernel information. (CVE-2022-41858)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: tcmu: Fix possible page UAF (CVE-2022-49053)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: potential buffer overflow in handling symlinks (CVE-2022-49058)

    In the Linux kernel, the following vulnerability has been resolved:

    veth: Ensure eth header is in skb's linear part (CVE-2022-49066)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix qgroup reserve overflow the qgroup limit (CVE-2022-49075)

    In the Linux kernel, the following vulnerability has been resolved:

    mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) (CVE-2022-49077)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/mempolicy: fix mpol_new leak in shared_policy_replace (CVE-2022-49080)

    In the Linux kernel, the following vulnerability has been resolved:

    drbd: Fix five use after free bugs in get_initial_state (CVE-2022-49085)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio_console: eliminate anonymous module_init & module_exit (CVE-2022-49100)

    In the Linux kernel, the following vulnerability has been resolved:

    Bluetooth: Fix use after free in hci_send_acl (CVE-2022-49111)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libfc: Fix use after free in fc_exch_abts_resp() (CVE-2022-49114)

    In the Linux kernel, the following vulnerability has been resolved:

    dm ioctl: prevent potential spectre v1 gadget (CVE-2022-49122)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: CPPC: Avoid out of bounds access when parsing _CPC data (CVE-2022-49145)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() (CVE-2022-49155)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs: add sanity check on allocation size (CVE-2022-49166)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't BUG if someone dirty pages without asking ext4 first (CVE-2022-49171)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: core: keep irq flags in device_pm_check_callbacks() (CVE-2022-49175)

    In the Linux kernel, the following vulnerability has been resolved:

    af_netlink: Fix shift out of bounds in group mask calculation (CVE-2022-49197)

    In the Linux kernel, the following vulnerability has been resolved:

    power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init (CVE-2022-49224)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: prevent underflow in nfssvc_decode_writeargs() (CVE-2022-49280)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: fix reference counting for struct tpm_chip (CVE-2022-49287)

    A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the     Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from     suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of     the CPU similar to the speculative execution behavior kind of attacks. (CVE-2023-1637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
241971	AlmaLinux 8 : kernel (ALSA-2025:10669)	Nessus	Alma Linux Local Security Checks	high
241970	AlmaLinux 8 : kernel-rt (ALSA-2025:10670)	Nessus	Alma Linux Local Security Checks	high
241687	Oracle Linux 8 : kernel (ELSA-2025-10669)	Nessus	Oracle Linux Local Security Checks	high
241616	RHEL 8 : kernel-rt (RHSA-2025:10670)	Nessus	Red Hat Local Security Checks	high
241613	RHEL 8 : kernel (RHSA-2025:10669)	Nessus	Red Hat Local Security Checks	high
241601	RHEL 8 : kernel (RHSA-2025:10673)	Nessus	Red Hat Local Security Checks	high
241203	RHEL 8 : kernel (RHSA-2025:10211)	Nessus	Red Hat Local Security Checks	high
241185	RHEL 9 : kernel-rt (RHSA-2025:10193)	Nessus	Red Hat Local Security Checks	high
241180	RHEL 8 : kernel (RHSA-2025:10179)	Nessus	Red Hat Local Security Checks	high
241147	RHEL 9 : kernel (RHSA-2025:10174)	Nessus	Red Hat Local Security Checks	high
241022	RHEL 8 : kernel (RHSA-2025:10005)	Nessus	Red Hat Local Security Checks	high
237099	SUSE SLES12 Security Update : kernel (SUSE-SU-2025:01600-1)	Nessus	SuSE Local Security Checks	high
237095	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:01633-1)	Nessus	SuSE Local Security Checks	high
234484	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1263-1)	Nessus	SuSE Local Security Checks	high
234407	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1241-1)	Nessus	SuSE Local Security Checks	high
233410	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1027-1)	Nessus	SuSE Local Security Checks	high
225413	Linux Distros Unpatched Vulnerability : CVE-2022-49111	Nessus	Misc.	high
200382	Amazon Linux 2 : kernel (ALAS-2024-2569)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2022-49111

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high