In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: Fix inflight count imbalances and IO hangs on offline iolatency needs to track the number of inflight IOs per cgroup. As this tracking can be expensive, it is disabled when no cgroup has iolatency configured for the device. To ensure that the inflight counters stay balanced, iolatency_set_limit() freezes the request_queue while manipulating the enabled counter, which ensures that no IO is in flight and thus all counters are zero. Unfortunately, iolatency_set_limit() isn't the only place where the enabled counter is manipulated. iolatency_pd_offline() can also dec the counter and trigger disabling. As this disabling happens without freezing the q, this can easily happen while some IOs are in flight and thus leak the counts. This can be easily demonstrated by turning on iolatency on an one empty cgroup while IOs are in flight in other cgroups and then removing the cgroup. Note that iolatency shouldn't have been enabled elsewhere in the system to ensure that removing the cgroup disables iolatency for the whole device. The following keeps flipping on and off iolatency on sda: echo +io > /sys/fs/cgroup/cgroup.subtree_control while true; do mkdir -p /sys/fs/cgroup/test echo '8:0 target=100000' > /sys/fs/cgroup/test/io.latency sleep 1 rmdir /sys/fs/cgroup/test sleep 1 done and there's concurrent fio generating direct rand reads: fio --name test --filename=/dev/sda --direct=1 --rw=randread \ --runtime=600 --time_based --iodepth=256 --numjobs=4 --bs=4k while monitoring with the following drgn script: while True: for css in css_for_each_descendant_pre(prog['blkcg_root'].css.address_of_()): for pos in hlist_for_each(container_of(css, 'struct blkcg', 'css').blkg_list): blkg = container_of(pos, 'struct blkcg_gq', 'blkcg_node') pd = blkg.pd[prog['blkcg_policy_iolatency'].plid] if pd.value_() == 0: continue iolat = container_of(pd, 'struct iolatency_grp', 'pd') inflight = iolat.rq_wait.inflight.counter.value_() if inflight: print(f'inflight={inflight} {disk_name(blkg.q.disk).decode("utf-8")} ' f'{cgroup_path(css.cgroup).decode("utf-8")}') time.sleep(1) The monitoring output looks like the following: inflight=1 sda /user.slice inflight=1 sda /user.slice ... inflight=14 sda /user.slice inflight=13 sda /user.slice inflight=17 sda /user.slice inflight=15 sda /user.slice inflight=18 sda /user.slice inflight=17 sda /user.slice inflight=20 sda /user.slice inflight=19 sda /user.slice <- fio stopped, inflight stuck at 19 inflight=19 sda /user.slice inflight=19 sda /user.slice If a cgroup with stuck inflight ends up getting throttled, the throttled IOs will never get issued as there's no completion event to wake it up leading to an indefinite hang. This patch fixes the bug by unifying enable handling into a work item which is automatically kicked off from iolatency_set_min_lat_nsec() which is called from both iolatency_set_limit() and iolatency_pd_offline() paths. Punting to a work item is necessary as iolatency_pd_offline() is called under spinlocks while freezing a request_queue requires a sleepable context. This also simplifies the code reducing LOC sans the comments and avoids the unnecessary freezes which were happening whenever a cgroup's latency target is newly set or cleared.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990619 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    blk-iolatency: Fix inflight count imbalances and IO hangs on offline

    iolatency needs to track the number of inflight IOs per cgroup. As this     tracking can be expensive, it is disabled when no cgroup has iolatency     configured for the device. To ensure that the inflight counters stay     balanced, iolatency_set_limit() freezes the request_queue while manipulating     the enabled counter, which ensures that no IO is in flight and thus all     counters are zero.

    Unfortunately, iolatency_set_limit() isn't the only place where the enabled     counter is manipulated. iolatency_pd_offline() can also dec the counter and     trigger disabling. As this disabling happens without freezing the q, this     can easily happen while some IOs are in flight and thus leak the counts.

    This can be easily demonstrated by turning on iolatency on an one empty     cgroup while IOs are in flight in other cgroups and then removing the     cgroup. Note that iolatency shouldn't have been enabled elsewhere in the     system to ensure that removing the cgroup disables iolatency for the whole     device.

    The following keeps flipping on and off iolatency on sda:

      echo +io > /sys/fs/cgroup/cgroup.subtree_control       while true; do           mkdir -p /sys/fs/cgroup/test           echo '8:0 target=100000' > /sys/fs/cgroup/test/io.latency           sleep 1           rmdir /sys/fs/cgroup/test           sleep 1       done

    and there's concurrent fio generating direct rand reads:

      fio --name test --filename=/dev/sda --direct=1 --rw=randread \
          --runtime=600 --time_based --iodepth=256 --numjobs=4 --bs=4k

    while monitoring with the following drgn script:

      while True:
        for css in css_for_each_descendant_pre(prog['blkcg_root'].css.address_of_()):
            for pos in hlist_for_each(container_of(css, 'struct blkcg', 'css').blkg_list):
                blkg = container_of(pos, 'struct blkcg_gq', 'blkcg_node')                 pd = blkg.pd[prog['blkcg_policy_iolatency'].plid]                 if pd.value_() == 0:
                    continue                 iolat = container_of(pd, 'struct iolatency_grp', 'pd')                 inflight = iolat.rq_wait.inflight.counter.value_()                 if inflight:
                    print(f'inflight={inflight} {disk_name(blkg.q.disk).decode(utf-8)} '                           f'{cgroup_path(css.cgroup).decode(utf-8)}')         time.sleep(1)

    The monitoring output looks like the following:

      inflight=1 sda /user.slice       inflight=1 sda /user.slice       ...
      inflight=14 sda /user.slice       inflight=13 sda /user.slice       inflight=17 sda /user.slice       inflight=15 sda /user.slice       inflight=18 sda /user.slice       inflight=17 sda /user.slice       inflight=20 sda /user.slice       inflight=19 sda /user.slice <- fio stopped, inflight stuck at 19       inflight=19 sda /user.slice       inflight=19 sda /user.slice

    If a cgroup with stuck inflight ends up getting throttled, the throttled IOs     will never get issued as there's no completion event to wake it up leading     to an indefinite hang.

    This patch fixes the bug by unifying enable handling into a work item which     is automatically kicked off from iolatency_set_min_lat_nsec() which is     called from both iolatency_set_limit() and iolatency_pd_offline() paths.
    Punting to a work item is necessary as iolatency_pd_offline() is called     under spinlocks while freezing a request_queue requires a sleepable context.

    This also simplifies the code reducing LOC sans the comments and avoids the     unnecessary freezes which were happening whenever a cgroup's latency target     is newly set or cleared.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989782 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    blk-iolatency: Fix inflight count imbalances and IO hangs on offline

    iolatency needs to track the number of inflight IOs per cgroup. As this     tracking can be expensive, it is disabled when no cgroup has iolatency     configured for the device. To ensure that the inflight counters stay     balanced, iolatency_set_limit() freezes the request_queue while manipulating     the enabled counter, which ensures that no IO is in flight and thus all     counters are zero.

    Unfortunately, iolatency_set_limit() isn't the only place where the enabled     counter is manipulated. iolatency_pd_offline() can also dec the counter and     trigger disabling. As this disabling happens without freezing the q, this     can easily happen while some IOs are in flight and thus leak the counts.

    This can be easily demonstrated by turning on iolatency on an one empty     cgroup while IOs are in flight in other cgroups and then removing the     cgroup. Note that iolatency shouldn't have been enabled elsewhere in the     system to ensure that removing the cgroup disables iolatency for the whole     device.

    The following keeps flipping on and off iolatency on sda:

      echo +io > /sys/fs/cgroup/cgroup.subtree_control       while true; do           mkdir -p /sys/fs/cgroup/test           echo '8:0 target=100000' > /sys/fs/cgroup/test/io.latency           sleep 1           rmdir /sys/fs/cgroup/test           sleep 1       done

    and there's concurrent fio generating direct rand reads:

      fio --name test --filename=/dev/sda --direct=1 --rw=randread \
          --runtime=600 --time_based --iodepth=256 --numjobs=4 --bs=4k

    while monitoring with the following drgn script:

      while True:
        for css in css_for_each_descendant_pre(prog['blkcg_root'].css.address_of_()):
            for pos in hlist_for_each(container_of(css, 'struct blkcg', 'css').blkg_list):
                blkg = container_of(pos, 'struct blkcg_gq', 'blkcg_node')                 pd = blkg.pd[prog['blkcg_policy_iolatency'].plid]                 if pd.value_() == 0:
                    continue                 iolat = container_of(pd, 'struct iolatency_grp', 'pd')                 inflight = iolat.rq_wait.inflight.counter.value_()                 if inflight:
                    print(f'inflight={inflight} {disk_name(blkg.q.disk).decode(utf-8)} '                           f'{cgroup_path(css.cgroup).decode(utf-8)}')         time.sleep(1)

    The monitoring output looks like the following:

      inflight=1 sda /user.slice       inflight=1 sda /user.slice       ...
      inflight=14 sda /user.slice       inflight=13 sda /user.slice       inflight=17 sda /user.slice       inflight=15 sda /user.slice       inflight=18 sda /user.slice       inflight=17 sda /user.slice       inflight=20 sda /user.slice       inflight=19 sda /user.slice <- fio stopped, inflight stuck at 19       inflight=19 sda /user.slice       inflight=19 sda /user.slice

    If a cgroup with stuck inflight ends up getting throttled, the throttled IOs     will never get issued as there's no completion event to wake it up leading     to an indefinite hang.

    This patch fixes the bug by unifying enable handling into a work item which     is automatically kicked off from iolatency_set_min_lat_nsec() which is     called from both iolatency_set_limit() and iolatency_pd_offline() paths.
    Punting to a work item is necessary as iolatency_pd_offline() is called     under spinlocks while freezing a request_queue requires a sleepable context.

    This also simplifies the code reducing LOC sans the comments and avoids the     unnecessary freezes which were happening whenever a cgroup's latency target     is newly set or cleared.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988773 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    blk-iolatency: Fix inflight count imbalances and IO hangs on offline

    iolatency needs to track the number of inflight IOs per cgroup. As this     tracking can be expensive, it is disabled when no cgroup has iolatency     configured for the device. To ensure that the inflight counters stay     balanced, iolatency_set_limit() freezes the request_queue while manipulating     the enabled counter, which ensures that no IO is in flight and thus all     counters are zero.

    Unfortunately, iolatency_set_limit() isn't the only place where the enabled     counter is manipulated. iolatency_pd_offline() can also dec the counter and     trigger disabling. As this disabling happens without freezing the q, this     can easily happen while some IOs are in flight and thus leak the counts.

    This can be easily demonstrated by turning on iolatency on an one empty     cgroup while IOs are in flight in other cgroups and then removing the     cgroup. Note that iolatency shouldn't have been enabled elsewhere in the     system to ensure that removing the cgroup disables iolatency for the whole     device.

    The following keeps flipping on and off iolatency on sda:

      echo +io > /sys/fs/cgroup/cgroup.subtree_control       while true; do           mkdir -p /sys/fs/cgroup/test           echo '8:0 target=100000' > /sys/fs/cgroup/test/io.latency           sleep 1           rmdir /sys/fs/cgroup/test           sleep 1       done

    and there's concurrent fio generating direct rand reads:

      fio --name test --filename=/dev/sda --direct=1 --rw=randread \
          --runtime=600 --time_based --iodepth=256 --numjobs=4 --bs=4k

    while monitoring with the following drgn script:

      while True:
        for css in css_for_each_descendant_pre(prog['blkcg_root'].css.address_of_()):
            for pos in hlist_for_each(container_of(css, 'struct blkcg', 'css').blkg_list):
                blkg = container_of(pos, 'struct blkcg_gq', 'blkcg_node')                 pd = blkg.pd[prog['blkcg_policy_iolatency'].plid]                 if pd.value_() == 0:
                    continue                 iolat = container_of(pd, 'struct iolatency_grp', 'pd')                 inflight = iolat.rq_wait.inflight.counter.value_()                 if inflight:
                    print(f'inflight={inflight} {disk_name(blkg.q.disk).decode(utf-8)} '                           f'{cgroup_path(css.cgroup).decode(utf-8)}')         time.sleep(1)

    The monitoring output looks like the following:

      inflight=1 sda /user.slice       inflight=1 sda /user.slice       ...
      inflight=14 sda /user.slice       inflight=13 sda /user.slice       inflight=17 sda /user.slice       inflight=15 sda /user.slice       inflight=18 sda /user.slice       inflight=17 sda /user.slice       inflight=20 sda /user.slice       inflight=19 sda /user.slice <- fio stopped, inflight stuck at 19       inflight=19 sda /user.slice       inflight=19 sda /user.slice

    If a cgroup with stuck inflight ends up getting throttled, the throttled IOs     will never get issued as there's no completion event to wake it up leading     to an indefinite hang.

    This patch fixes the bug by unifying enable handling into a work item which     is automatically kicked off from iolatency_set_min_lat_nsec() which is     called from both iolatency_set_limit() and iolatency_pd_offline() paths.
    Punting to a work item is necessary as iolatency_pd_offline() is called     under spinlocks while freezing a request_queue requires a sleepable context.

    This also simplifies the code reducing LOC sans the comments and avoids the     unnecessary freezes which were happening whenever a cgroup's latency target     is newly set or cleared.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1263-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-47248: udp: fix race between close() and udp_abort() (bsc#1224867).
    - CVE-2022-49051: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup (bsc#1237903).
    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49275: can: m_can: m_can_tx_handler(): fix use after free of skb (bsc#1238719).
    - CVE-2022-49413: bfq: Update cgroup information before merging bio (bsc#1238710).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238729).
    - CVE-2022-49563: crypto: qat - add param check for RSA (bsc#1238787).
    - CVE-2022-49564: crypto: qat - add param check for DH (bsc#1238789).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-56642: tipc: Fix use-after-free of kernel socket in cleanup_bearer() (bsc#1235433).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1241-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
    - CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync     (bsc#1239095).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1027-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
    - CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
    - CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: Fix inflight count     imbalances and IO hangs on offline iolatency needs to track the number of inflight IOs per cgroup. As this     tracking can be expensive, it is disabled when no cgroup has iolatency configured for the device. To     ensure that the inflight counters stay balanced, iolatency_set_limit() freezes the request_queue while     manipulating the enabled counter, which ensures that no IO is in flight and thus all counters are zero.
    Unfortunately, iolatency_set_limit() isn't the only place where the enabled counter is manipulated.
    iolatency_pd_offline() can also dec the counter and trigger disabling. As this disabling happens without     freezing the q, this can easily happen while some IOs are in flight and thus leak the counts. This can be     easily demonstrated by turning on iolatency on an one empty cgroup while IOs are in flight in other     cgroups and then removing the cgroup. Note that iolatency shouldn't have been enabled elsewhere in the     system to ensure that removing the cgroup disables iolatency for the whole device. The following keeps     flipping on and off iolatency on sda: echo +io > /sys/fs/cgroup/cgroup.subtree_control while true; do     mkdir -p /sys/fs/cgroup/test echo '8:0 target=100000' > /sys/fs/cgroup/test/io.latency sleep 1 rmdir     /sys/fs/cgroup/test sleep 1 done and there's concurrent fio generating direct rand reads: fio --name test
    --filename=/dev/sda --direct=1 --rw=randread \ --runtime=600 --time_based --iodepth=256 --numjobs=4
    --bs=4k while monitoring with the following drgn script: while True: for css in     css_for_each_descendant_pre(prog['blkcg_root'].css.address_of_()): for pos in     hlist_for_each(container_of(css, 'struct blkcg', 'css').blkg_list): blkg = container_of(pos, 'struct     blkcg_gq', 'blkcg_node') pd = blkg.pd[prog['blkcg_policy_iolatency'].plid] if pd.value_() == 0: continue     iolat = container_of(pd, 'struct iolatency_grp', 'pd') inflight = iolat.rq_wait.inflight.counter.value_()     if inflight: print(f'inflight={inflight} {disk_name(blkg.q.disk).decode(utf-8)} '     f'{cgroup_path(css.cgroup).decode(utf-8)}') time.sleep(1) The monitoring output looks like the     following: inflight=1 sda /user.slice inflight=1 sda /user.slice ... inflight=14 sda /user.slice     inflight=13 sda /user.slice inflight=17 sda /user.slice inflight=15 sda /user.slice inflight=18 sda     /user.slice inflight=17 sda /user.slice inflight=20 sda /user.slice inflight=19 sda /user.slice <- fio     stopped, inflight stuck at 19 inflight=19 sda /user.slice inflight=19 sda /user.slice If a cgroup with     stuck inflight ends up getting throttled, the throttled IOs will never get issued as there's no completion     event to wake it up leading to an indefinite hang. This patch fixes the bug by unifying enable handling     into a work item which is automatically kicked off from iolatency_set_min_lat_nsec() which is called from     both iolatency_set_limit() and iolatency_pd_offline() paths. Punting to a work item is necessary as     iolatency_pd_offline() is called under spinlocks while freezing a request_queue requires a sleepable     context. This also simplifies the code reducing LOC sans the comments and avoids the unnecessary freezes     which were happening whenever a cgroup's latency target is newly set or cleared. (CVE-2022-49394)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8267 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

    * use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

    * smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)

    * NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

    * swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

    * uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)

    * race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

    * use-after-free and memory errors in ext4 when mounting and operating on a corrupted image     (CVE-2022-1184)

    * concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280)

    * kernel info leak issue in pfkey_register (CVE-2022-1353)

    * use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)

    * NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

    * fanotify misuses fd_install() which could lead to use-after-free (CVE-2022-1998)

    * nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)

    * integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

    * slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

    * incomplete clean-up of multi-core shared buffers (aka SBDR) (CVE-2022-21123)

    * incomplete clean-up of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125)

    * incomplete clean-up in specific special register write operations (aka DRPW) (CVE-2022-21166)

    * possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

    * AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816,     CVE-2022-29900)

    * AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)

    * Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

    * double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

    * use after free in SUNRPC subsystem (CVE-2022-28893)

    * use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

    * Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

    * DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

    * nf_tables disallow binding to already bound chain (CVE-2022-39190)

    * nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
274303	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990619)	Nessus	Unity Linux Local Security Checks	medium
273719	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989782)	Nessus	Unity Linux Local Security Checks	medium
273145	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988773)	Nessus	Unity Linux Local Security Checks	medium
234484	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1263-1)	Nessus	SuSE Local Security Checks	high
234407	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1241-1)	Nessus	SuSE Local Security Checks	high
233410	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1027-1)	Nessus	SuSE Local Security Checks	high
225455	Linux Distros Unpatched Vulnerability : CVE-2022-49394	Nessus	Misc.	medium
167620	RHEL 9 : kernel (RHSA-2022:8267)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2022-49394

medium

Tenable Plugins

medium

medium

medium

high

high

high

medium

high