In the Linux kernel, the following vulnerability has been resolved: vfio/pci: fix memory leak during D3hot to D0 transition If 'vfio_pci_core_device::needs_pm_restore' is set (PCI device does not have No_Soft_Reset bit set in its PMCSR config register), then the current PCI state will be saved locally in 'vfio_pci_core_device::pm_save' during D0->D3hot transition and same will be restored back during D3hot->D0 transition. For saving the PCI state locally, pci_store_saved_state() is being used and the pci_load_and_free_saved_state() will free the allocated memory. But for reset related IOCTLs, vfio driver calls PCI reset-related API's which will internally change the PCI power state back to D0. So, when the guest resumes, then it will get the current state as D0 and it will skip the call to vfio_pci_set_power_state() for changing the power state to D0 explicitly. In this case, the memory pointed by 'pm_save' will never be freed. In a malicious sequence, the state changing to D3hot followed by VFIO_DEVICE_RESET/VFIO_DEVICE_PCI_HOT_RESET can be run in a loop and it can cause an OOM situation. This patch frees the earlier allocated memory first before overwriting 'pm_save' to prevent the mentioned memory leak.

The version of kernel installed on the remote host is prior to 5.10.237-230.949. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-094 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/gt: Cleanup partial engine discovery failures (CVE-2022-48893)

    In the Linux kernel, the following vulnerability has been resolved:

    ice: arfs: fix use-after-free when freeing @rx_cpu_rmap (CVE-2022-49063)

    In the Linux kernel, the following vulnerability has been resolved:

    kernel/resource: fix kfree() of bootmem memory again (CVE-2022-49190)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/pci: fix memory leak during D3hot to D0 transition (CVE-2022-49219)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix UAF in cifs_demultiplex_thread() (CVE-2023-52572)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (CVE-2023-52621)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (CVE-2023-52752)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix potential deadlock when releasing mids (CVE-2023-52757)

    A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue. (CVE-2024-24855)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (CVE-2024-26686)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix potential UAF in cifs_debug_files_proc_show() (CVE-2024-26928)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix potential UAF in cifs_stats_proc_show() (CVE-2024-35867)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-iocost: do not WARN if iocg was already offlined (CVE-2024-36908)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme: avoid double free special payload (CVE-2024-41073)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix UAF in async decryption (CVE-2024-50047)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache: fix flushing uninitialized delayed_work on cache_ctr error (CVE-2024-50280)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: avoid holding freeze_mutex during mmap operation (CVE-2025-21853)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (CVE-2025-21927)

    In the Linux kernel, the following vulnerability has been resolved:

    media: streamzap: fix race between device disconnection and urb callback (CVE-2025-22027)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: detect and prevent references to a freed transport in sendmsg (CVE-2025-23142)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix NULL pointer in can_accept_new_subflow (CVE-2025-23145)

    In the Linux kernel, the following vulnerability has been resolved:

    i3c: Add NULL pointer check in i3c_master_queue_ibi() (CVE-2025-23147)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix off-by-one error in do_split (CVE-2025-23150)

    In the Linux kernel, the following vulnerability has been resolved:

    net: vlan: don't propagate flags on open (CVE-2025-23163)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: ignore xattrs past end (CVE-2025-37738)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tls: explicitly disallow disconnect (CVE-2025-37756)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix memory leak in tipc_link_xmit (CVE-2025-37757)

    In the Linux kernel, the following vulnerability has been resolved:

    virtiofs: add filesystem context source name check (CVE-2025-37773)

    In the Linux kernel, the following vulnerability has been resolved:

    isofs: Prevent the use of too small fid (CVE-2025-37780)

    In the Linux kernel, the following vulnerability has been resolved:

    cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (CVE-2025-37788)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix nested key length validation in the set() action (CVE-2025-37789)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: null - Use spin lock instead of mutex (CVE-2025-37808)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CVE-2025-37823)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (CVE-2025-37824)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: Fix reference leak in pci_register_host_bridge() (CVE-2025-37836)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: remove wrong sb->s_sequence check (CVE-2025-37839)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: avoid NULL pointer dereference in dbg call (CVE-2025-37844)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: st: Fix array overflow in st_setup() (CVE-2025-37857)

    In the Linux kernel, the following vulnerability has been resolved:

    page_pool: avoid infinite loop to schedule delayed worker (CVE-2025-37859)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: pidff: Fix null pointer dereference in pidff_find_fields (CVE-2025-37862)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/core: Silence oversized kvmalloc() warning (CVE-2025-37867)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: decrease sc_count directly if fail to queue dl_recall (CVE-2025-37871)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Reset IRTE to host control if *new* route isn't postable (CVE-2025-37885)

    In the Linux kernel, the following vulnerability has been resolved:

    mtd: inftlcore: Add error check for inftl_read_oob() (CVE-2025-37892)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Add cond_resched() to ftrace_graph_set_hash() (CVE-2025-37940)

    In the Linux kernel, the following vulnerability has been resolved:

    net: phy: leds: fix memory leak (CVE-2025-37989)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4178 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4178-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     May 25, 2025                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux     Version        : 5.10.237-1     CVE ID         : CVE-2021-47247 CVE-2021-47489 CVE-2022-48893 CVE-2022-49046                      CVE-2022-49190 CVE-2022-49219 CVE-2022-49309 CVE-2022-49546                      CVE-2022-49728 CVE-2023-52572 CVE-2023-52621 CVE-2023-52752                      CVE-2023-52757 CVE-2023-53034 CVE-2024-26686 CVE-2024-26928                      CVE-2024-26982 CVE-2024-35867 CVE-2024-35943 CVE-2024-36908                      CVE-2024-38611 CVE-2024-39494 CVE-2024-41073 CVE-2024-42322                      CVE-2024-44938 CVE-2024-46753 CVE-2024-46812 CVE-2024-46816                      CVE-2024-46821 CVE-2024-47726 CVE-2024-47730 CVE-2024-49960                      CVE-2024-50047 CVE-2024-50154 CVE-2024-50280 CVE-2024-53144                      CVE-2024-54458 CVE-2024-56599 CVE-2024-56608 CVE-2024-56658                      CVE-2024-56664 CVE-2024-57834 CVE-2024-57973 CVE-2024-57977                      CVE-2024-57979 CVE-2024-57980 CVE-2024-57981 CVE-2024-57986                      CVE-2024-58001 CVE-2024-58002 CVE-2024-58005 CVE-2024-58007                      CVE-2024-58010 CVE-2024-58014 CVE-2024-58016 CVE-2024-58017                      CVE-2024-58020 CVE-2024-58051 CVE-2024-58052 CVE-2024-58055                      CVE-2024-58058 CVE-2024-58063 CVE-2024-58069 CVE-2024-58071                      CVE-2024-58072 CVE-2024-58083 CVE-2024-58085 CVE-2024-58090                      CVE-2025-21647 CVE-2025-21700 CVE-2025-21702 CVE-2025-21704                      CVE-2025-21708 CVE-2025-21711 CVE-2025-21715 CVE-2025-21718                      CVE-2025-21719 CVE-2025-21721 CVE-2025-21722 CVE-2025-21726                      CVE-2025-21727 CVE-2025-21728 CVE-2025-21731 CVE-2025-21735                      CVE-2025-21736 CVE-2025-21744 CVE-2025-21745 CVE-2025-21749                      CVE-2025-21753 CVE-2025-21756 CVE-2025-21760 CVE-2025-21761                      CVE-2025-21762 CVE-2025-21763 CVE-2025-21764 CVE-2025-21765                      CVE-2025-21767 CVE-2025-21772 CVE-2025-21776 CVE-2025-21779                      CVE-2025-21781 CVE-2025-21782 CVE-2025-21785 CVE-2025-21787                      CVE-2025-21791 CVE-2025-21795 CVE-2025-21796 CVE-2025-21799                      CVE-2025-21802 CVE-2025-21804 CVE-2025-21806 CVE-2025-21811                      CVE-2025-21814 CVE-2025-21823 CVE-2025-21826 CVE-2025-21835                      CVE-2025-21844 CVE-2025-21846 CVE-2025-21848 CVE-2025-21853                      CVE-2025-21858 CVE-2025-21859 CVE-2025-21862 CVE-2025-21871                      CVE-2025-21872 CVE-2025-21875 CVE-2025-21877 CVE-2025-21878                      CVE-2025-21898 CVE-2025-21904 CVE-2025-21905 CVE-2025-21909                      CVE-2025-21910 CVE-2025-21914 CVE-2025-21916 CVE-2025-21917                      CVE-2025-21920 CVE-2025-21922 CVE-2025-21925 CVE-2025-21926                      CVE-2025-21928 CVE-2025-21934 CVE-2025-21935 CVE-2025-21941                      CVE-2025-21943 CVE-2025-21948 CVE-2025-21956 CVE-2025-21957                      CVE-2025-21959 CVE-2025-21968 CVE-2025-21971 CVE-2025-21975                      CVE-2025-21981 CVE-2025-21991 CVE-2025-21992 CVE-2025-21993                      CVE-2025-21996 CVE-2025-21999 CVE-2025-22004 CVE-2025-22005                      CVE-2025-22007 CVE-2025-22008 CVE-2025-22010 CVE-2025-22014                      CVE-2025-22018 CVE-2025-22020 CVE-2025-22021 CVE-2025-22025                      CVE-2025-22027 CVE-2025-22035 CVE-2025-22044 CVE-2025-22045                      CVE-2025-22054 CVE-2025-22055 CVE-2025-22056 CVE-2025-22063                      CVE-2025-22075 CVE-2025-22079 CVE-2025-22086 CVE-2025-23136                      CVE-2025-23138 CVE-2025-23140 CVE-2025-23142 CVE-2025-23144                      CVE-2025-23145 CVE-2025-23146 CVE-2025-23147 CVE-2025-23148                      CVE-2025-23150 CVE-2025-23156 CVE-2025-23157 CVE-2025-23158                      CVE-2025-23159 CVE-2025-23163 CVE-2025-37738 CVE-2025-37739                      CVE-2025-37740 CVE-2025-37741 CVE-2025-37749 CVE-2025-37756                      CVE-2025-37757 CVE-2025-37765 CVE-2025-37766 CVE-2025-37768                      CVE-2025-37770 CVE-2025-37773 CVE-2025-37780 CVE-2025-37781                      CVE-2025-37782 CVE-2025-37785 CVE-2025-37788 CVE-2025-37789                      CVE-2025-37792 CVE-2025-37794 CVE-2025-37796 CVE-2025-37797                      CVE-2025-37803 CVE-2025-37808 CVE-2025-37810 CVE-2025-37812                      CVE-2025-37817 CVE-2025-37823 CVE-2025-37824 CVE-2025-37829                      CVE-2025-37836 CVE-2025-37838 CVE-2025-37839 CVE-2025-37840                      CVE-2025-37841 CVE-2025-37844 CVE-2025-37850 CVE-2025-37851                      CVE-2025-37857 CVE-2025-37858 CVE-2025-37859 CVE-2025-37862                      CVE-2025-37867 CVE-2025-37871 CVE-2025-37881 CVE-2025-37885                      CVE-2025-38637 CVE-2025-39728 CVE-2025-39735

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 11 bullseye, these problems have been fixed in version     5.10.237-1.  This additionally includes many more bug fixes from     stable updates 5.10.235-5.10.237.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1241-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
    - CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync     (bsc#1239095).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - vfio/pci: fix memory leak during D3hot to D0 transition If 'vfio_pci_core_device::needs_pm_restore' is set     (PCI device does not have No_Soft_Reset bit set in its PMCSR config register), then the current PCI state     will be saved locally in 'vfio_pci_core_device::pm_save' during D0->D3hot transition and same will be     restored back during D3hot->D0 transition. For saving the PCI state locally, pci_store_saved_state() is     being used and the pci_load_and_free_saved_state() will free the allocated memory. But for reset related     IOCTLs, vfio driver calls PCI reset-related API's which will internally change the PCI power state back to     D0. So, when the guest resumes, then it will get the current state as D0 and it will skip the call to     vfio_pci_set_power_state() for changing the power state to D0 explicitly. In this case, the memory pointed     by 'pm_save' will never be freed. In a malicious sequence, the state changing to D3hot followed by     VFIO_DEVICE_RESET/VFIO_DEVICE_PCI_HOT_RESET can be run in a loop and it can cause an OOM situation. This     patch frees the earlier allocated memory first before overwriting 'pm_save' to prevent the mentioned     memory leak. (CVE-2022-49219)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
238028	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2025-094 (ALASKERNEL-5.10-2025-094)	Nessus	Amazon Linux Local Security Checks	high
237278	Alibaba Cloud Linux 3 : 0075: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2025:0075)	Nessus	Alibaba Cloud Linux Local Security Checks	critical
237255	Debian dla-4178 : ata-modules-5.10.0-34-armmp-di - security update	Nessus	Debian Local Security Checks	high
236993	Photon OS 4.0: Linux PHSA-2025-4.0-0801	Nessus	PhotonOS Local Security Checks	high
234407	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1241-1)	Nessus	SuSE Local Security Checks	high
225553	Linux Distros Unpatched Vulnerability : CVE-2022-49219	Nessus	Misc.	medium

Detections

Analytics

CVE-2022-49219

medium

Tenable Plugins

high

critical

high

high

high

medium