In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix listen() setting the bar too high for the prealloc rings AF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump up the sysctl), but whilst the preallocation circular buffers have 32 slots in them, one of them has to be a dead slot because we're using CIRC_CNT(). This means that listen(rxrpc_sock, 32) will cause an oops when the socket is closed because rxrpc_service_prealloc_one() allocated one too many calls and rxrpc_discard_prealloc() won't then be able to get rid of them because it'll think the ring is empty. rxrpc_release_calls_on_socket() then tries to abort them, but oopses because call->peer isn't yet set. Fix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match the ring capacity. BUG: kernel NULL pointer dereference, address: 0000000000000086 ... RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc] Call Trace: <TASK> ? __wake_up_common_lock+0x7a/0x90 ? rxrpc_notify_socket+0x8e/0x140 [rxrpc] ? rxrpc_abort_call+0x4c/0x60 [rxrpc] rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc] rxrpc_release+0xc9/0x1c0 [rxrpc] __sock_release+0x37/0xa0 sock_close+0x11/0x20 __fput+0x89/0x240 task_work_run+0x59/0x90 do_exit+0x319/0xaa0

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989917 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix listen() setting the bar too high for the prealloc rings

    AF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump     up the sysctl), but whilst the preallocation circular buffers have 32 slots     in them, one of them has to be a dead slot because we're using CIRC_CNT().

    This means that listen(rxrpc_sock, 32) will cause an oops when the socket     is closed because rxrpc_service_prealloc_one() allocated one too many calls     and rxrpc_discard_prealloc() won't then be able to get rid of them because     it'll think the ring is empty.  rxrpc_release_calls_on_socket() then tries     to abort them, but oopses because call->peer isn't yet set.

    Fix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match     the ring capacity.

     BUG: kernel NULL pointer dereference, address: 0000000000000086      ...
     RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc]      Call Trace:
      <TASK>       ? __wake_up_common_lock+0x7a/0x90       ? rxrpc_notify_socket+0x8e/0x140 [rxrpc]       ? rxrpc_abort_call+0x4c/0x60 [rxrpc]       rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc]       rxrpc_release+0xc9/0x1c0 [rxrpc]
      __sock_release+0x37/0xa0       sock_close+0x11/0x20
      __fput+0x89/0x240       task_work_run+0x59/0x90       do_exit+0x319/0xaa0

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986919 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix listen() setting the bar too high for the prealloc rings

    AF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump     up the sysctl), but whilst the preallocation circular buffers have 32 slots     in them, one of them has to be a dead slot because we're using CIRC_CNT().

    This means that listen(rxrpc_sock, 32) will cause an oops when the socket     is closed because rxrpc_service_prealloc_one() allocated one too many calls     and rxrpc_discard_prealloc() won't then be able to get rid of them because     it'll think the ring is empty.  rxrpc_release_calls_on_socket() then tries     to abort them, but oopses because call->peer isn't yet set.

    Fix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match     the ring capacity.

     BUG: kernel NULL pointer dereference, address: 0000000000000086      ...
     RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc]      Call Trace:
      <TASK>       ? __wake_up_common_lock+0x7a/0x90       ? rxrpc_notify_socket+0x8e/0x140 [rxrpc]       ? rxrpc_abort_call+0x4c/0x60 [rxrpc]       rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc]       rxrpc_release+0xc9/0x1c0 [rxrpc]
      __sock_release+0x37/0xa0       sock_close+0x11/0x20
      __fput+0x89/0x240       task_work_run+0x59/0x90       do_exit+0x319/0xaa0

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    drm/plane: Move range check for format_count earlier(CVE-2021-47659)

    trace_events_hist: add check for return value of 'create_hist_field'(CVE-2023-53005)

    tracing: Make sure trace_printk() can output as soon as it can be used(CVE-2023-53007)

    bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation(CVE-2023-53024)

    sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket(CVE-2024-53168)

    tracing/histograms: Fix memory leak problem(CVE-2022-49648)

    vrf: use RCU protection in l3mdev_l3_out().(CVE-2025-21791)

    net_sched: sch_sfq: don't allow 1 packet limit(CVE-2024-57996)

    net: sched: Disallow replacing of child qdisc from one parent to another(CVE-2025-21700)

    geneve: Fix use-after-free in geneve_find_dev().(CVE-2025-21858)

    macsec: fix UAF bug for real_dev(CVE-2022-49390)

    net: let net.core.dev_weight always be non-zero(CVE-2025-21806)

    net: mdio: unexport __init-annotated mdio_bus_init().(CVE-2022-49350)

    ip: Fix data-races around sysctl_ip_fwd_update_priority.(CVE-2022-49603)

    mmc: sdio: fix possible resource leaks in some error paths(CVE-2023-52730)

    ipv4: prevent potential spectre v1 gadget in ip_metrics_convert().(CVE-2023-52997)

    net: sched: Disallow replacing of child qdisc from one parent to another(CVE-2025-21702)

    net/sched: act_skbmod: prevent kernel-infoleak(CVE-2024-35893)

    netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.(CVE-2023-53032)

    net: openvswitch: fix leak of nested actions(CVE-2022-49086)

    net: mdio: validate parameter addr in mdiobus_get_phy().(CVE-2023-53019)

    selinux: ignore unknown extended permissions(CVE-2024-57931)

    vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF(CVE-2023-52973)

    driver: base: fix UAF when driver_attach failed(CVE-2022-49385)

    scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put().(CVE-2022-48758)

    rxrpc: Fix listen() setting the bar too high for the prealloc rings(CVE-2022-49450)

    ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl(CVE-2021-47634)

    media: uvcvideo: Fix double free in error path(CVE-2024-57980)

    scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI(CVE-2022-49535)

    dmaengine: Fix double increment of client_count in dma_chan_get().(CVE-2022-49753)

    memcg: fix soft lockup in the OOM process(CVE-2024-57977)

    firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle(CVE-2022-49370)

    dm raid: fix accesses beyond end of raid member array(CVE-2022-49674)

    nfsd: clear acl_access/acl_default after releasing them(CVE-2025-21796)

    Input: MT - limit max slots(CVE-2024-45008)(CVE-2024-45008)

    ubi: ubi_create_volume: Fix use-after-free when volume creation failed(CVE-2022-49388)

    scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair().(CVE-2022-49155)

    NFSD: prevent underflow in nfssvc_decode_writeargs().(CVE-2022-49280)

    dm integrity: fix memory corruption when tag_size is less than digest size(CVE-2022-49044)

    cpufreq: governor: Use kobject release() method to free dbs_data(CVE-2022-49513)

    virtio_console: eliminate anonymous module_init  module_exit(CVE-2022-49100)

    mm/khugepaged: fix -anon_vma race(CVE-2023-52935)

    tty: fix deadlock caused by calling printk() under tty_port-lock(CVE-2022-49441)

    tty: synclink_gt: Fix null-pointer-dereference in slgt_clean().(CVE-2022-49307)

    dyndbg: fix old BUG_ON in control parser(CVE-2024-35947)(CVE-2024-35947)

    ext4: fix OOB read when checking dotdot dir(CVE-2025-37785)

    arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array(CVE-2025-21785)

    net_sched: sch_sfq: move the limit validation(CVE-2025-37752)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    ipv4: Fix a data-race around sysctl_fib_sync_mem.(CVE-2022-49637)

    ima: Fix potential memory leak in ima_init_crypto().(CVE-2022-49627)

    MIPS: pgalloc: fix memory leak caused by pgd_free().(CVE-2022-49210)

    ip: Fix data-races around sysctl_ip_fwd_use_pmtu.(CVE-2022-49604)

    net: tipc: fix possible refcount leak in tipc_sk_create()(CVE-2022-49620)

    bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full(CVE-2022-49209)

    net: remove two BUG() from skb_checksum_help().(CVE-2022-49497)

    usbnet: fix memory leak in error case(CVE-2022-49657)

    ip: Fix a data-race around sysctl_ip_autobind_reuse.(CVE-2022-49600)

    cipso: Fix data-races around sysctl.(CVE-2022-49639)

    nexthop: Fix data-races around nexthop_compat_mode.(CVE-2022-49629)

    tracing/histograms: Fix memory leak problem(CVE-2022-49648)

    SUNRPC: Fix the svc_deferred_event trace class(CVE-2022-49065)

    af_unix: Fix a data-race in unix_dgram_peer_wake_me().(CVE-2022-49344)

    RDMA/cm: Fix memory leak in ib_cm_insert_listen(CVE-2022-49671)

    ip: Fix a data-race around sysctl_fwmark_reflect.(CVE-2022-49602)

    raw: Fix a data-race around sysctl_raw_l3mdev_accept.(CVE-2022-49631)

    icmp: Fix data-races around sysctl.(CVE-2022-49638)

    tty: synclink_gt: Fix null-pointer-dereference in slgt_clean().(CVE-2022-49307)

    tipc: move bc link creation back to tipc_node_create(CVE-2022-49664)

    icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr.(CVE-2022-49632)

    xprtrdma: treat all calls not a bcall when bc_serv is NULL(CVE-2022-49321)

    net: phy: micrel: Allow probing without .driver_data(CVE-2022-49472)

    tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.(CVE-2022-49601)

    ip: Fix data-races around sysctl_ip_fwd_update_priority.(CVE-2022-49603)

    igb: fix a use-after-free issue in igb_clean_tx_ring(CVE-2022-49695)

    rxrpc: Fix listen() setting the bar too high for the prealloc rings(CVE-2022-49450)

    tty: fix deadlock caused by calling printk() under tty_port-lock(CVE-2022-49441)

    media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init(CVE-2022-49478)

    ima: Fix a potential integer overflow in ima_appraise_measurement(CVE-2022-49643)

    scsi: qla2xxx: Fix scheduling while atomic(CVE-2022-49156)

    mm/mempolicy: fix uninit-value in mpol_rebind_policy().(CVE-2022-49567)

    dm raid: fix KASAN warning in raid5_add_disks(CVE-2022-49673)

    padata: avoid UAF for reorder_work(CVE-2025-21726)

    ARM: hisi: Add missing of_node_put after of_find_compatible_node(CVE-2022-49447)

    ptp: Ensure info-enable callback is always set(CVE-2025-21814)

    bpf: Send signals asynchronously if !preemptible(CVE-2025-21728)

    ext4: don't BUG if someone dirty pages without asking ext4 first(CVE-2022-49171)

    ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit(CVE-2022-49174)

    dax: make sure inodes are flushed before destroy cache(CVE-2022-49220)

    ext4: avoid cycles in directory h-tree(CVE-2022-49343)

    ext4: fix bug_on in ext4_writepages(CVE-2022-49347)

    ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state(CVE-2022-49348)

    ext4: fix use-after-free in ext4_rename_dir_prepare(CVE-2022-49349)

    ext4: fix warning in ext4_handle_inode_extension(CVE-2022-49352)

    PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store().(CVE-2022-49434)

    x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails(CVE-2022-49549)

    scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI(CVE-2022-49535)

    crypto: qat - add param check for RSA(CVE-2022-49563)

    dmaengine: idxd: Fix the error handling path in idxd_cdev_register()(CVE-2022-49422)

    RDMA/mlx5: Fix memory leak in error flow for subscribe event routine(CVE-2022-49206)

    bpf, arm64: Clear prog-jited_len along prog-jited(CVE-2022-49341)

    bpf: Fix UAF due to race between btf_try_get_module and load_module(CVE-2022-49236)

    bpf: Fix potential array overflow in bpf_trampoline_get_progs().(CVE-2022-49548)

    bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals(CVE-2022-49658)

    zsmalloc: fix races between asynchronous zspage free and page migration(CVE-2022-49554)

    tpm: fix reference counting for struct tpm_chip(CVE-2022-49287)

    netfilter: nf_tables: initialize registers in nft_do_chain().(CVE-2022-49293)

    dm ioctl: prevent potential spectre v1 gadget(CVE-2022-49122)

    scsi: sd: Fix potential NULL pointer dereference(CVE-2022-49376)

    sysctl: Fix data races in proc_douintvec_minmax().(CVE-2022-49640)

    sysctl: Fix data races in proc_douintvec().(CVE-2022-49641)

    scsi: libfc: Fix use after free in fc_exch_abts_resp().(CVE-2022-49114)

    nbd: don't allow reconnect after disconnect(CVE-2025-21731)

    tpm: use try_get_ops() in tpm-space.c(CVE-2022-49286)

    cifs: potential buffer overflow in handling symlinks(CVE-2022-49058)

    extcon: Modify extcon device to be created after driver data is set(CVE-2022-49308)

    bfq: Update cgroup information before merging bio(CVE-2022-49413)

    cifs: prevent bad output lengths in smb2_ioctl_query_info().(CVE-2022-49271)

    media: cx24116: prevent overflows on SNR calculus(CVE-2024-50290)

    thermal/core: Fix memory leak in __thermal_cooling_device_register().(CVE-2022-49468)

    nbd: call genl_unregister_family() first in nbd_cleanup().(CVE-2022-49295)

    blk-mq: don't touch -tagset in blk_mq_get_sq_hctx(CVE-2022-49377)

    bfq: Make sure bfqg for which we are queueing requests is online(CVE-2022-49411)

    nvdimm: Fix firmware activation deadlock scenarios(CVE-2022-49446)

    nbd: fix io hung while disconnecting device(CVE-2022-49297)

    crypto: qat - add param check for DH(CVE-2022-49564)

    nbd: fix race between nbd_alloc_config() and module removal(CVE-2022-49300)

    net: usb: rtl8150: enable basic endpoint checking(CVE-2025-21708)

    scsi: target: tcmu: Fix possible page UAF(CVE-2022-49053)

    block: don't delete queue kobject before its children(CVE-2022-49259)

    md/bitmap: don't set sb values if can't pass sanity check(CVE-2022-49526)

    mm/slub: add missing TID updates on slab deactivation(CVE-2022-49700)

    block: Fix handling of offline queues in blk_mq_alloc_request_hctx().(CVE-2022-49720)

    ext4: fix race condition between ext4_write and ext4_convert_inline_data(CVE-2022-49414)

    ext4: fix bug_on in __es_tree_search(CVE-2022-49409)

    net: hns3: fix oops when unload drivers paralleling(CVE-2025-21802)

    irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions(CVE-2022-49715)

    mm/mempolicy: fix mpol_new leak in shared_policy_replace(CVE-2022-49080)

    ext4: fix bug_on ext4_mb_use_inode_pa(CVE-2022-49708)

    ext4: add reserved GDT blocks check(CVE-2022-49707)

    irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions(CVE-2022-49716)

    mm: fix unexpected zeroed page mapping with zram swap(CVE-2022-49052)

    scsi: qla2xxx: Fix crash during module load unload test(CVE-2022-49160)

    sctp: sysctl: rto_min/max: avoid using current-nsproxy(CVE-2025-21639)

    crypto: qat - fix memory leak in RSA(CVE-2022-49566)

    net/mlx5: Fix variable not being completed when function returns(CVE-2025-21662)

    scsi: storvsc: Ratelimit warning logs to prevent VM denial of service(CVE-2025-21690)

    vfio/platform: check the bounds of read/write syscalls(CVE-2025-21687)

    USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb().(CVE-2025-21689)

    ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init().(CVE-2024-53680)

    bpf: fix recursive lock when verdict program return SK_PASS(CVE-2024-56694)

    mm: zswap: properly synchronize freeing resources during CPU hotunplug(CVE-2025-21693)

    filemap: avoid truncating 64-bit offset to 32 bits(CVE-2025-21665)

    iomap: avoid avoid truncating 64-bit offset to 32 bits(CVE-2025-21667)

    fs/proc: fix softlockup in __read_vmcore (part 2).(CVE-2025-21694)

    net: hns3: don't auto enable misc vector(CVE-2025-21651)

    netfilter: conntrack: clamp maximum hashtable size to INT_MAX(CVE-2025-21648)

    net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute(CVE-2025-21653)

    netfilter: ipset: Hold module reference while requesting a module(CVE-2024-56637)

    sctp: sysctl: auth_enable: avoid using current-nsproxy(CVE-2025-21638)

    sctp: sysctl: cookie_hmac_alg: avoid using current-nsproxy(CVE-2025-21640)

    af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK(CVE-2024-57901)

    net: sched: fix ordering of qlen adjustment(CVE-2024-53164)

    af_packet: fix vlan_get_tci() vs MSG_PEEK(CVE-2024-57902)

    geneve: do not assume mac header is set in geneve_xmit_skb().(CVE-2024-56636)

    RDMA/rxe: Remove the direct link to net_device(CVE-2024-57795)

    net/ipv6: release expired exception dst cached in socket(CVE-2024-56644)

    NFSD: Prevent NULL dereference in nfsd4_process_cb_update()(CVE-2024-53217)

    iommu/arm-smmu: Defer probe of clients after smmu device bound(CVE-2024-56568)

    net/sctp: Prevent autoclose integer overflow in sctp_association_init().(CVE-2024-57938)

    dlm: fix possible lkb_resource null dereference(CVE-2024-47809)

    vsock/virtio: discard packets if the transport changes(CVE-2025-21669)

    vsock: prevent null-ptr-deref in vsock_*[has_data|has_space](CVE-2025-21666)

    netfilter: nf_tables: adapt set backend to use GC transaction API(CVE-2023-52923)

    RDMA/uverbs: Prevent integer overflow issue(CVE-2024-57890)

    pinmux: Use sequential access to access desc-pinmux data(CVE-2024-47141)

    drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req().(CVE-2024-57798)

    selinux: ignore unknown extended permissions(CVE-2024-57931)

    eth: bnxt: always recalculate features after XDP clearing, fix null-deref(CVE-2025-21682)

    net: restrict SO_REUSEPORT to inet sockets(CVE-2024-57903)

    bpf: Fix bpf_sk_select_reuseport() memory leak(CVE-2025-21683)

    sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket(CVE-2024-53168)

    net: macsec: Fix offload support for NETDEV_UNREGISTER event(CVE-2022-48720)

    netfilter: nf_set_pipapo: fix initial map fill(CVE-2024-57947)

    RDMA/hfi1: Fix use-after-free bug for mm struct(CVE-2022-49076)

    tipc: fix use-after-free Read in tipc_named_reinit(CVE-2022-49696)

    net: bonding: fix use-after-free after 802.3ad slave unbind(CVE-2022-49667)

    usbnet: fix memory leak in error case(CVE-2022-49589)

    sfc: fix use after free when disabling sriov(CVE-2022-49626)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    xsk: Fix race at socket teardown(CVE-2022-49215)

    acct: perform last write from workqueue(CVE-2025-21846)

    nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags(CVE-2022-49492)

    drop_monitor: fix incorrect initialization order(CVE-2025-21862)

    iommu/arm-smmu-v3: check return value after calling platform_get_resource().(CVE-2022-49319)

    ipv4: Fix a data-race around sysctl_fib_sync_mem.(CVE-2022-49637)

    memcg: fix soft lockup in the OOM process(CVE-2024-57977)

    ima: Fix potential memory leak in ima_init_crypto().(CVE-2022-49627)

    rdma/cxgb4: Prevent potential integer overflow on 32bit(CVE-2024-57973)

    tracing: Make sure trace_printk() can output as soon as it can be used(CVE-2023-53007)

    trace_events_hist: add check for return value of 'create_hist_field'(CVE-2023-53005)

    Squashfs: fix handling and sanity checking of xattr_ids count(CVE-2023-52933)

    tcp: Fix a data-race around sysctl_tcp_probe_threshold.(CVE-2022-49595)

    tcp: Fix data-races around sysctl_tcp_min_snd_mss.(CVE-2022-49596)

    tcp: Fix data-races around sysctl_tcp_base_mss.(CVE-2022-49597)

    tcp: Fix data-races around sysctl_tcp_l3mdev_accept.(CVE-2022-49599)

    hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING(CVE-2025-21816)

    RDMA/hfi1: Prevent use of lock before it is initialized(CVE-2022-49433)

    openvswitch: fix lockup on tx to unregistering netdev with carrier(CVE-2025-21681)

    net: hns3: add vlan list lock to protect vlan list(CVE-2022-49182)

    driver: base: fix UAF when driver_attach failed(CVE-2022-49385)

    ubi: ubi_create_volume: Fix use-after-free when volume creation failed(CVE-2022-49388)

    rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read(CVE-2024-58069)

    lz4: fix LZ4_decompress_safe_partial read out of bound(CVE-2022-49078)

    um: Fix out-of-bounds read in LDT setup(CVE-2022-49395)

    KVM: Explicitly verify target vCPU is online in kvm_get_vcpu().(CVE-2024-58083)

    ipv6: mcast: extend RCU protection in igmp6_send().(CVE-2025-21759)

    vsock: Keep the binding until socket destruction(CVE-2025-21756)

    pps: Fix a use-after-free(CVE-2024-57979)

    RDMA/hfi1: Fix use-after-free bug for mm struct(CVE-2022-49076)

    padata: fix UAF in padata_reorder(CVE-2025-21727)

    net: bonding: fix use-after-free after 802.3ad slave unbind(CVE-2022-49667)

    netfilter: nf_tables: avoid skb access on nf_stolen(CVE-2022-49622)

    srcu: Tighten cleanup_srcu_struct() GP checks(CVE-2022-49651)

    openvswitch: use RCU protection in ovs_vport_cmd_fill_info().(CVE-2025-21761)

    cgroup: Use separate src/dst nodes when preloading css_sets for migration(CVE-2022-49647)

    ice: arfs: fix use-after-free when freeing @rx_cpu_rmap(CVE-2022-49063)

    sfc: fix use after free when disabling sriov(CVE-2022-49626)

    macsec: fix UAF bug for real_dev(CVE-2022-49390)

    ndisc: extend RCU protection in ndisc_send_skb().(CVE-2025-21760)

    nfsd: release svc_expkey(CVE-2024-53216)

    nfsd: make sure exp active before svc_export_show(CVE-2024-56558)

    net: sched: Disallow replacing of child qdisc from one parent to another(CVE-2025-21700)

    tipc: fix use-after-free Read in tipc_named_reinit(CVE-2022-49696)

    arp: use RCU protection in arp_xmit().(CVE-2025-21762)

    nfsd: clear acl_access/acl_default after releasing them(CVE-2025-21796)

    ndisc: use RCU protection in ndisc_alloc_skb().(CVE-2025-21764)

    neighbour: use RCU protection in __neigh_notify().(CVE-2025-21763)

    scsi: hisi_sas: Free irq vectors in order for v3 HW(CVE-2022-49118)

    drm/plane: Move range check for format_count earlier(CVE-2021-47659)

    USB: hub: Ignore non-compliant devices with too many configs or interfaces(CVE-2025-21776)

    MIPS: pgalloc: fix memory leak caused by pgd_free().(CVE-2022-49210)

    bpf: avoid holding freeze_mutex during mmap operation(CVE-2025-21853)

    ip: Fix data-races around sysctl_ip_fwd_use_pmtu.(CVE-2022-49604)

    linux/dim: Fix divide by 0 in RDMA DIM(CVE-2022-49670)

    HID: multitouch: Add NULL check in mt_input_configured(CVE-2024-58020)

    nfp: bpf: Add check for nfp_app_ctrl_msg_alloc().(CVE-2025-21848)

    net: tipc: fix possible refcount leak in tipc_sk_create()(CVE-2022-49620)

    bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full(CVE-2022-49209)

    net: remove two BUG() from skb_checksum_help().(CVE-2022-49497)

    usbnet: fix memory leak in error case(CVE-2022-49657)

    usbnet: fix memory leak in error case(CVE-2022-49589)

    ip: Fix a data-race around sysctl_ip_autobind_reuse.(CVE-2022-49600)

    cipso: Fix data-races around sysctl.(CVE-2022-49639)

    KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel(CVE-2025-21779)

    nexthop: Fix data-races around nexthop_compat_mode.(CVE-2022-49629)

    tracing/histograms: Fix memory leak problem(CVE-2022-49648)

    SUNRPC: Fix the svc_deferred_event trace class(CVE-2022-49065)

    af_unix: Fix a data-race in unix_dgram_peer_wake_me().(CVE-2022-49344)

    usb: xhci: Fix NULL pointer dereference on certain command aborts(CVE-2024-57981)

    ceph: fix memory leak in ceph_readdir when note_last_dentry returns error(CVE-2022-49107)

    NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify().(CVE-2022-49103)

    io_uring: fix memory leak of uid in files registration(CVE-2022-49144)

    RDMA/cm: Fix memory leak in ib_cm_insert_listen(CVE-2022-49671)

    ip: Fix a data-race around sysctl_fwmark_reflect.(CVE-2022-49602)

    hwrng: cavium - fix NULL but dereferenced coccicheck error(CVE-2022-49177)

    mlxsw: spectrum: Guard against invalid local ports(CVE-2022-49134)

    raw: Fix a data-race around sysctl_raw_l3mdev_accept.(CVE-2022-49631)

    icmp: Fix data-races around sysctl.(CVE-2022-49638)

    tty: synclink_gt: Fix null-pointer-dereference in slgt_clean().(CVE-2022-49307)

    iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe().(CVE-2022-49323)

    drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes(CVE-2022-49532)

    scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair().(CVE-2022-49155)

    tipc: move bc link creation back to tipc_node_create(CVE-2022-49664)

    NFSv4: Don't hold the layoutget locks across multiple RPC calls(CVE-2022-49316)

    icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr.(CVE-2022-49632)

    xprtrdma: treat all calls not a bcall when bc_serv is NULL(CVE-2022-49321)

    net: phy: micrel: Allow probing without .driver_data(CVE-2022-49472)

    tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.(CVE-2022-49601)

    kernel/resource: fix kfree() of bootmem memory again(CVE-2022-49190)

    vrf: use RCU protection in l3mdev_l3_out().(CVE-2025-21791)

    tcp: Fix a data-race around sysctl_tcp_ecn_fallback.(CVE-2022-49630)

    i2c: dev: check return value when calling dev_set_name().(CVE-2022-49046)

    list: fix a data-race around ep-rdllist(CVE-2022-49443)

    perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()(CVE-2022-49607)

    drm/amd/display: Fix memory leak(CVE-2022-49135)

    ip: Fix data-races around sysctl_ip_fwd_update_priority.(CVE-2022-49603)

    media: uvcvideo: Fix double free in error path(CVE-2024-57980)

    io_uring: prevent opcode speculation(CVE-2025-21863)

    geneve: Fix use-after-free in geneve_find_dev().(CVE-2025-21858)

    arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array(CVE-2025-21785)

    igb: fix a use-after-free issue in igb_clean_tx_ring(CVE-2022-49695)

    rxrpc: Fix listen() setting the bar too high for the prealloc rings(CVE-2022-49450)

    tty: fix deadlock caused by calling printk() under tty_port-lock(CVE-2022-49441)

    media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init(CVE-2022-49478)

    ima: Fix a potential integer overflow in ima_appraise_measurement(CVE-2022-49643)

    scsi: qla2xxx: Fix scheduling while atomic(CVE-2022-49156)

    scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock(CVE-2022-49536)

    mm/mempolicy: fix uninit-value in mpol_rebind_policy().(CVE-2022-49567)

    KVM: VMX: Prevent RSB underflow before vmenter(CVE-2022-49610)

    dm raid: fix KASAN warning in raid5_add_disks(CVE-2022-49673)

    tpm: Change to kvalloc() in eventlog/acpi.c(CVE-2024-58005)

    media: uvcvideo: Remove dangling pointers(CVE-2024-58002)

    padata: avoid UAF for reorder_work(CVE-2025-21726)

    ARM: hisi: Add missing of_node_put after of_find_compatible_node(CVE-2022-49447)

    ptp: Ensure info-enable callback is always set(CVE-2025-21814)

    bpf: Send signals asynchronously if !preemptible(CVE-2025-21728)

    ext4: don't BUG if someone dirty pages without asking ext4 first(CVE-2022-49171)

    ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit(CVE-2022-49174)

    dax: make sure inodes are flushed before destroy cache(CVE-2022-49220)

    ext4: avoid cycles in directory h-tree(CVE-2022-49343)

    ext4: fix bug_on in ext4_writepages(CVE-2022-49347)

    ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state(CVE-2022-49348)

    ext4: fix use-after-free in ext4_rename_dir_prepare(CVE-2022-49349)

    ext4: fix warning in ext4_handle_inode_extension(CVE-2022-49352)

    PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store().(CVE-2022-49434)

    x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails(CVE-2022-49549)

    scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI(CVE-2022-49535)

    crypto: qat - add param check for RSA(CVE-2022-49563)

    dmaengine: idxd: Fix the error handling path in idxd_cdev_register()(CVE-2022-49422)

    RDMA/mlx5: Fix memory leak in error flow for subscribe event routine(CVE-2022-49206)

    bpf, arm64: Clear prog-jited_len along prog-jited(CVE-2022-49341)

    bpf: Fix UAF due to race between btf_try_get_module and load_module(CVE-2022-49236)

    bpf: Fix potential array overflow in bpf_trampoline_get_progs().(CVE-2022-49548)

    bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals(CVE-2022-49658)

    zsmalloc: fix races between asynchronous zspage free and page migration(CVE-2022-49554)

    tpm: fix reference counting for struct tpm_chip(CVE-2022-49287)

    netfilter: nf_tables: initialize registers in nft_do_chain().(CVE-2022-49293)

    dm ioctl: prevent potential spectre v1 gadget(CVE-2022-49122)

    scsi: sd: Fix potential NULL pointer dereference(CVE-2022-49376)

    sysctl: Fix data races in proc_douintvec_minmax().(CVE-2022-49640)

    sysctl: Fix data races in proc_douintvec().(CVE-2022-49641)

    scsi: libfc: Fix use after free in fc_exch_abts_resp().(CVE-2022-49114)

    nbd: don't allow reconnect after disconnect(CVE-2025-21731)

    tpm: use try_get_ops() in tpm-space.c(CVE-2022-49286)

    cifs: potential buffer overflow in handling symlinks(CVE-2022-49058)

    extcon: Modify extcon device to be created after driver data is set(CVE-2022-49308)

    bfq: Update cgroup information before merging bio(CVE-2022-49413)

    cifs: prevent bad output lengths in smb2_ioctl_query_info().(CVE-2022-49271)

    media: cx24116: prevent overflows on SNR calculus(CVE-2024-50290)

    thermal/core: Fix memory leak in __thermal_cooling_device_register().(CVE-2022-49468)

    nbd: call genl_unregister_family() first in nbd_cleanup().(CVE-2022-49295)

    blk-mq: don't touch -tagset in blk_mq_get_sq_hctx(CVE-2022-49377)

    bfq: Make sure bfqg for which we are queueing requests is online(CVE-2022-49411)

    nvdimm: Fix firmware activation deadlock scenarios(CVE-2022-49446)

    crypto: qat - add param check for DH(CVE-2022-49564)

    nbd: fix race between nbd_alloc_config() and module removal(CVE-2022-49300)

    nbd: fix io hung while disconnecting device(CVE-2022-49297)

    net: usb: rtl8150: enable basic endpoint checking(CVE-2025-21708)

    scsi: target: tcmu: Fix possible page UAF(CVE-2022-49053)

    block: don't delete queue kobject before its children(CVE-2022-49259)

    md/bitmap: don't set sb values if can't pass sanity check(CVE-2022-49526)

    mm/slub: add missing TID updates on slab deactivation(CVE-2022-49700)

    block: Fix handling of offline queues in blk_mq_alloc_request_hctx().(CVE-2022-49720)

    ext4: fix race condition between ext4_write and ext4_convert_inline_data(CVE-2022-49414)

    ext4: fix bug_on in __es_tree_search(CVE-2022-49409)

    net: hns3: fix oops when unload drivers paralleling(CVE-2025-21802)

    irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions(CVE-2022-49715)

    mm/mempolicy: fix mpol_new leak in shared_policy_replace(CVE-2022-49080)

    ext4: fix bug_on ext4_mb_use_inode_pa(CVE-2022-49708)

    ext4: add reserved GDT blocks check(CVE-2022-49707)

    irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions(CVE-2022-49716)

    mm: fix unexpected zeroed page mapping with zram swap(CVE-2022-49052)

    scsi: qla2xxx: Fix crash during module load unload test(CVE-2022-49160)

    sctp: sysctl: rto_min/max: avoid using current-nsproxy(CVE-2025-21639)

    crypto: qat - fix memory leak in RSA(CVE-2022-49566)

    net/mlx5: Fix variable not being completed when function returns(CVE-2025-21662)

    scsi: storvsc: Ratelimit warning logs to prevent VM denial of service(CVE-2025-21690)

    vfio/platform: check the bounds of read/write syscalls(CVE-2025-21687)

    USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb().(CVE-2025-21689)

    ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init().(CVE-2024-53680)

    bpf: fix recursive lock when verdict program return SK_PASS(CVE-2024-56694)

    mm: zswap: properly synchronize freeing resources during CPU hotunplug(CVE-2025-21693)

    ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up(CVE-2025-21887)

    net: asix: add proper error handling of usb read errors(CVE-2022-49226)

    mm/khugepaged: fix -anon_vma race(CVE-2023-52935)

    HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections(CVE-2024-57986)

    proc: fix UAF in proc_get_inode().(CVE-2025-21999)

    smb: client: Add check for next_buffer in receive_encrypted_standard().(CVE-2025-21844)

    exec: don't WARN for racy path_noexec check(CVE-2024-50010)

    kthread: unpark only parked kthread(CVE-2024-50019)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    cifs: Fix UAF in cifs_demultiplex_thread().(CVE-2023-52572)

    xsk: fix OOB map writes when deleting elements(CVE-2024-56614)

    net: defer final 'struct net' free in netns dismantle(CVE-2024-56658)

    af_packet: avoid erroring out after sock_init_data() in packet_create().(CVE-2024-56606)

    quota: flush quota_release_work upon quota writeback(CVE-2024-56780)

    mm: hugetlb: independent PMD page table shared count(CVE-2024-57883)

    selinux: ignore unknown extended permissions(CVE-2024-57931)

    netfilter: conntrack: clamp maximum hashtable size to INT_MAX(CVE-2025-21648)

    net: sched: Disallow replacing of child qdisc from one parent to another(CVE-2025-21700)

    net: sched: Disallow replacing of child qdisc from one parent to another(CVE-2025-21702)

    ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl(CVE-2021-47634)

    crypto: qat - add param check for DH(CVE-2022-49564)

    nfsd: clear acl_access/acl_default after releasing them(CVE-2025-21796)

    media: uvcvideo: Fix double free in error path(CVE-2024-57980)

    ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo().(CVE-2022-49731)

    dm raid: fix accesses beyond end of raid member array(CVE-2022-49674)

    scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI(CVE-2022-49535)

    md/bitmap: don't set sb values if can't pass sanity check(CVE-2022-49526)

    drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes(CVE-2022-49532)

    ext4: fix race condition between ext4_write and ext4_convert_inline_data(CVE-2022-49414)

    media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init(CVE-2022-49478)

    dlm: fix plock invalid read(CVE-2022-49407)

    NFSD: prevent underflow in nfssvc_decode_writeargs().(CVE-2022-49280)

    NFSv4: Don't hold the layoutget locks across multiple RPC calls(CVE-2022-49316)

    firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle(CVE-2022-49370)

    ARM: hisi: Add missing of_node_put after of_find_compatible_node(CVE-2022-49447)

    scsi: target: tcmu: Fix possible page UAF(CVE-2022-49053)

    drm/plane: Move range check for format_count earlier(CVE-2021-47659)

    tty: fix deadlock caused by calling printk() under tty_port-lock(CVE-2022-49441)

    bpf, arm64: Clear prog-jited_len along prog-jited(CVE-2022-49341)

    RDMA/hfi1: Fix potential integer multiplication overflow errors(CVE-2022-49404)

    scsi: libfc: Fix use after free in fc_exch_abts_resp().(CVE-2022-49114)

    scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair().(CVE-2022-49155)

    mm: fix unexpected zeroed page mapping with zram swap(CVE-2022-49052)

    net: tipc: fix possible refcount leak in tipc_sk_create()(CVE-2022-49620)

    RDMA/hfi1: Prevent use of lock before it is initialized(CVE-2022-49433)

    memcg: fix soft lockup in the OOM process(CVE-2024-57977)

    block: don't delete queue kobject before its children(CVE-2022-49259)

    exec: Force single empty string when argv is empty(CVE-2022-49264)

    um: Fix out-of-bounds read in LDT setup(CVE-2022-49395)

    cgroup: Use separate src/dst nodes when preloading css_sets for migration(CVE-2022-49647)

    driver: base: fix UAF when driver_attach failed(CVE-2022-49385)

    nbd: don't allow reconnect after disconnect(CVE-2025-21731)

    vrf: use RCU protection in l3mdev_l3_out().(CVE-2025-21791)

    net_sched: sch_sfq: don't allow 1 packet limit(CVE-2024-57996)

    net: let net.core.dev_weight always be non-zero(CVE-2025-21806)

    tty: synclink_gt: Fix null-pointer-dereference in slgt_clean().(CVE-2022-49307)

    virtio_net: fix xdp_rxq_info bug after suspend/resume(CVE-2022-49687)

    be2net: Fix buffer overflow in be_get_module_eeprom(CVE-2022-49581)

    ubi: ubi_create_volume: Fix use-after-free when volume creation failed(CVE-2022-49388)

    ipmr: do not call mr_mfc_uses_dev() for unres entries(CVE-2025-21719)

    ALSA: jack: Access input_dev under mutex(CVE-2022-49538)

    geneve: Fix use-after-free in geneve_find_dev().(CVE-2025-21858)

    rxrpc: Fix listen() setting the bar too high for the prealloc rings(CVE-2022-49450)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix listen() setting the bar     too high for the prealloc rings AF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump     up the sysctl), but whilst the preallocation circular buffers have 32 slots in them, one of them has to be     a dead slot because we're using CIRC_CNT(). This means that listen(rxrpc_sock, 32) will cause an oops when     the socket is closed because rxrpc_service_prealloc_one() allocated one too many calls and     rxrpc_discard_prealloc() won't then be able to get rid of them because it'll think the ring is empty.
    rxrpc_release_calls_on_socket() then tries to abort them, but oopses because call->peer isn't yet set. Fix     this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match the ring capacity. BUG: kernel NULL     pointer dereference, address: 0000000000000086 ... RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc]     Call Trace: <TASK> ? __wake_up_common_lock+0x7a/0x90 ? rxrpc_notify_socket+0x8e/0x140 [rxrpc] ?     rxrpc_abort_call+0x4c/0x60 [rxrpc] rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc]     rxrpc_release+0xc9/0x1c0 [rxrpc] __sock_release+0x37/0xa0 sock_close+0x11/0x20 __fput+0x89/0x240     task_work_run+0x59/0x90 do_exit+0x319/0xaa0 (CVE-2022-49450)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.15.50-23.125. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2022-002 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    drm/plane: Move range check for format_count earlier (CVE-2021-47659)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()' (CVE-2021-47660)

    A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

    With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

    A NULL pointer dereference flaw was found in the Linux kernel's KVM module, which can lead to a denial of     service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal     instruction in guest in the Intel CPU. (CVE-2022-1852)

    A use-after-free vulnerability was found in the Linux kernel's Netfilter subsystem in     net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege     escalation issue. (CVE-2022-1966)

    A use-after-free flaw was found in the Linux kernel in log_replay in fs/ntfs3/fslog.c in the NTFS journal.
    This flaw allows a local attacker to crash the system and leads to a kernel information leak problem.
    (CVE-2022-1973)

    A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an     attacker to trigger a buffer overflow via nft_set_desc_concat_parse() , causing a denial of service and     possibly to run code. (CVE-2022-2078)

    A flaw was found in hw. Incomplete cleanup of multi-core shared buffers for some Intel(r) Processors may     allow an authenticated user to enable information disclosure via local access. (CVE-2022-21123)

    A flaw was found in hw. Incomplete cleanup of microarchitectural fill buffers on some Intel(r) Processors     may allow an authenticated user to enable information disclosure via local access. (CVE-2022-21125)

    A flaw was found in hw. Incomplete cleanup in specific special register write operations for some     Intel Processors may allow an authenticated user to enable information disclosure via local access.
    (CVE-2022-21166)

    net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

    An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer     overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point     registers. (CVE-2022-32981)

    rpmsg_virtio_add_ctrl_dev in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a     double free. (CVE-2022-34494)

    rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free.
    (CVE-2022-34495)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: call genl_unregister_family() first in nbd_cleanup() (CVE-2022-49295)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: fix io hung while disconnecting device (CVE-2022-49297)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: fix race between nbd_alloc_config() and module removal (CVE-2022-49300)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4: Don't hold the layoutget locks across multiple RPC calls (CVE-2022-49316)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/arm-smmu-v3: check return value after calling platform_get_resource() (CVE-2022-49319)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix sleeping function called from invalid context on RT kernel (CVE-2022-49322)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() (CVE-2022-49323)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: add accessors to read/set tp->snd_cwnd (CVE-2022-49325)

    In the Linux kernel, the following vulnerability has been resolved:

    bcache: avoid journal no-space deadlock by reserving 1 journal bucket (CVE-2022-49327)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd (CVE-2022-49330)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: unexport __init-annotated seg6_hmac_init() (CVE-2022-49339)

    In the Linux kernel, the following vulnerability has been resolved:

    ip_gre: test csum_start instead of transport header (CVE-2022-49340)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, arm64: Clear prog->jited_len along prog->jited (CVE-2022-49341)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid cycles in directory h-tree (CVE-2022-49343)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix a data-race in unix_dgram_peer_wake_me(). (CVE-2022-49344)

    In the Linux kernel, the following vulnerability has been resolved:

    net: xfrm: unexport __init-annotated xfrm4_protocol_init() (CVE-2022-49345)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug_on in ext4_writepages (CVE-2022-49347)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state (CVE-2022-49348)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix use-after-free in ext4_rename_dir_prepare (CVE-2022-49349)

    In the Linux kernel, the following vulnerability has been resolved:

    net: mdio: unexport __init-annotated mdio_bus_init() (CVE-2022-49350)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix warning in ext4_handle_inode_extension (CVE-2022-49352)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: memleak flow rule from commit path (CVE-2022-49358)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (CVE-2022-49370)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: fix deadlock in __device_attach (CVE-2022-49371)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: tcp_rtx_synack() can be called from process context (CVE-2022-49372)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: check attribute length for bearer name (CVE-2022-49374)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: sd: Fix potential NULL pointer dereference (CVE-2022-49376)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx (CVE-2022-49377)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: Fix wait_for_device_probe() & deferred_probe_timeout interaction (CVE-2022-49379)

    In the Linux kernel, the following vulnerability has been resolved:

    md: fix double free of io_acct_set bioset (CVE-2022-49384)

    In the Linux kernel, the following vulnerability has been resolved:

    driver: base: fix UAF when driver_attach failed (CVE-2022-49385)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: usbip: fix a refcount leak in stub_probe() (CVE-2022-49389)

    In the Linux kernel, the following vulnerability has been resolved:

    md: Don't set mddev private to NULL in raid0 pers->free (CVE-2022-49400)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Clean up hash direct_functions on register failures (CVE-2022-49402)

    In the Linux kernel, the following vulnerability has been resolved:

    dlm: fix plock invalid read (CVE-2022-49407)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug_on in __es_tree_search (CVE-2022-49409)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix potential double free in create_var_ref() (CVE-2022-49410)

    In the Linux kernel, the following vulnerability has been resolved:

    bfq: Make sure bfqg for which we are queueing requests is online (CVE-2022-49411)

    In the Linux kernel, the following vulnerability has been resolved:

    bfq: Avoid merging queues with different parents (CVE-2022-49412)

    In the Linux kernel, the following vulnerability has been resolved:

    bfq: Update cgroup information before merging bio (CVE-2022-49413)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix race condition between ext4_write and ext4_convert_inline_data (CVE-2022-49414)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/arm-smmu-v3-sva: Fix mm use-after-free (CVE-2022-49426)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() (CVE-2022-49434)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: fix deadlock caused by calling printk() under tty_port->lock (CVE-2022-49441)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers/base/node.c: fix compaction sysfs file leak (CVE-2022-49442)

    In the Linux kernel, the following vulnerability has been resolved:

    list: fix a data-race around ep->rdllist (CVE-2022-49443)

    In the Linux kernel, the following vulnerability has been resolved:

    nvdimm: Fix firmware activation deadlock scenarios (CVE-2022-49446)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix listen() setting the bar too high for the prealloc rings (CVE-2022-49450)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal/core: Fix memory leak in __thermal_cooling_device_register() (CVE-2022-49468)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags (CVE-2022-49492)

    In the Linux kernel, the following vulnerability has been resolved:

    net: remove two BUG() from skb_checksum_help() (CVE-2022-49497)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: elan: Fix potential double free in elan_input_configured (CVE-2022-49508)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall (CVE-2022-49520)

    In the Linux kernel, the following vulnerability has been resolved:

    md/bitmap: don't set sb values if can't pass sanity check (CVE-2022-49526)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu-tasks: Fix race in schedule and flush work (CVE-2022-49540)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix potential double free during failed mount (CVE-2022-49541)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/kexec: fix memory leak of elf header buffer (CVE-2022-49546)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix potential array overflow in bpf_trampoline_get_progs() (CVE-2022-49548)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails (CVE-2022-49549)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: validate BOOT sectors_per_clusters (CVE-2022-49553)

    In the Linux kernel, the following vulnerability has been resolved:

    zsmalloc: fix races between asynchronous zspage free and page migration (CVE-2022-49554)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak (CVE-2022-49556)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: double hook unregistration in netns path (CVE-2022-49558)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Drop WARNs that assert a triple fault never escapes from L2 (CVE-2022-49559)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: check if cluster num is valid (CVE-2022-49560)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: re-fetch conntrack after insertion (CVE-2022-49561)

    In the Linux kernel, the following vulnerability has been resolved:

    zonefs: fix zonefs_iomap_begin() for reads (CVE-2022-49706)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add reserved GDT blocks check (CVE-2022-49707)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug_on ext4_mb_use_inode_pa (CVE-2022-49708)

    In the Linux kernel, the following vulnerability has been resolved:

    cfi: Fix __cfi_slowpath_diag RCU usage with cpuidle (CVE-2022-49709)

    In the Linux kernel, the following vulnerability has been resolved:

    dm mirror log: round up region bitmap size to BITS_PER_LONG (CVE-2022-49710)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions (CVE-2022-49715)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions (CVE-2022-49716)

    In the Linux kernel, the following vulnerability has been resolved:

    block: Fix handling of offline queues in blk_mq_alloc_request_hctx() (CVE-2022-49720)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: ftrace: consistently handle PLTs. (CVE-2022-49721)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/reset: Fix error_state_read ptr + offset use (CVE-2022-49723)

    In the Linux kernel, the following vulnerability has been resolved:

    clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() (CVE-2022-49726)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (CVE-2022-49731)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.201-111.359. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-028 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    drm/plane: Move range check for format_count earlier (CVE-2021-47659)

    Due to the small table perturb size, a memory leak flaw was found in the Linux kernel's TCP source port     generation algorithm in the net/ipv4/tcp.c function. This flaw allows an attacker to leak information and     may cause a denial of service. (CVE-2022-1012)

    A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

    A use-after-free vulnerability was found in the Linux kernel's Netfilter subsystem in     net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege     escalation issue. (CVE-2022-1966)

    A flaw was found in hw. Incomplete cleanup of multi-core shared buffers for some Intel(r) Processors may     allow an authenticated user to enable information disclosure via local access. (CVE-2022-21123)

    A flaw was found in hw. Incomplete cleanup of microarchitectural fill buffers on some Intel(r) Processors     may allow an authenticated user to enable information disclosure via local access. (CVE-2022-21125)

    A flaw was found in hw. Incomplete cleanup in specific special register write operations for some     Intel Processors may allow an authenticated user to enable information disclosure via local access.
    (CVE-2022-21166)

    KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown.
    An attacker with access to a serial port could trigger the debugger so it is important that the debugger     respect the lockdown mode when/if it is triggered. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and     Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H). (CVE-2022-21499)

    net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

    The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used. (CVE-2022-32296)

    An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer     overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point     registers. (CVE-2022-32981)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: fix a possible null pointer dereference (CVE-2022-48710)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix leak of nested actions (CVE-2022-49086)

    In the Linux kernel, the following vulnerability has been resolved:

    exec: Force single empty string when argv is empty (CVE-2022-49264)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: call genl_unregister_family() first in nbd_cleanup() (CVE-2022-49295)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: fix io hung while disconnecting device (CVE-2022-49297)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: fix race between nbd_alloc_config() and module removal (CVE-2022-49300)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() (CVE-2022-49307)

    In the Linux kernel, the following vulnerability has been resolved:

    extcon: Modify extcon device to be created after driver data is set (CVE-2022-49308)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4: Don't hold the layoutget locks across multiple RPC calls (CVE-2022-49316)

    In the Linux kernel, the following vulnerability has been resolved:

    xprtrdma: treat all calls not a bcall when bc_serv is NULL (CVE-2022-49321)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix sleeping function called from invalid context on RT kernel (CVE-2022-49322)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd (CVE-2022-49330)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: unexport __init-annotated seg6_hmac_init() (CVE-2022-49339)

    In the Linux kernel, the following vulnerability has been resolved:

    ip_gre: test csum_start instead of transport header (CVE-2022-49340)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, arm64: Clear prog->jited_len along prog->jited (CVE-2022-49341)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid cycles in directory h-tree (CVE-2022-49343)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix a data-race in unix_dgram_peer_wake_me(). (CVE-2022-49344)

    In the Linux kernel, the following vulnerability has been resolved:

    net: xfrm: unexport __init-annotated xfrm4_protocol_init() (CVE-2022-49345)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug_on in ext4_writepages (CVE-2022-49347)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix use-after-free in ext4_rename_dir_prepare (CVE-2022-49349)

    In the Linux kernel, the following vulnerability has been resolved:

    net: mdio: unexport __init-annotated mdio_bus_init() (CVE-2022-49350)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix warning in ext4_handle_inode_extension (CVE-2022-49352)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: memleak flow rule from commit path (CVE-2022-49358)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (CVE-2022-49370)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: fix deadlock in __device_attach (CVE-2022-49371)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: tcp_rtx_synack() can be called from process context (CVE-2022-49372)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: check attribute length for bearer name (CVE-2022-49374)

    In the Linux kernel, the following vulnerability has been resolved:

    driver: base: fix UAF when driver_attach failed (CVE-2022-49385)

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: ubi_create_volume: Fix use-after-free when volume creation failed (CVE-2022-49388)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: usbip: fix a refcount leak in stub_probe() (CVE-2022-49389)

    In the Linux kernel, the following vulnerability has been resolved:

    dlm: fix plock invalid read (CVE-2022-49407)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix potential double free in create_var_ref() (CVE-2022-49410)

    In the Linux kernel, the following vulnerability has been resolved:

    bfq: Make sure bfqg for which we are queueing requests is online (CVE-2022-49411)

    In the Linux kernel, the following vulnerability has been resolved:

    bfq: Update cgroup information before merging bio (CVE-2022-49413)

    In the Linux kernel, the following vulnerability has been resolved:

    video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup (CVE-2022-49421)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() (CVE-2022-49434)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: fix deadlock caused by calling printk() under tty_port->lock (CVE-2022-49441)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers/base/node.c: fix compaction sysfs file leak (CVE-2022-49442)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix listen() setting the bar too high for the prealloc rings (CVE-2022-49450)

    In the Linux kernel, the following vulnerability has been resolved:

    net: phy: micrel: Allow probing without .driver_data (CVE-2022-49472)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags (CVE-2022-49492)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: elan: Fix potential double free in elan_input_configured (CVE-2022-49508)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall (CVE-2022-49520)

    In the Linux kernel, the following vulnerability has been resolved:

    md/bitmap: don't set sb values if can't pass sanity check (CVE-2022-49526)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes (CVE-2022-49532)

    In the Linux kernel, the following vulnerability has been resolved:

    zsmalloc: fix races between asynchronous zspage free and page migration (CVE-2022-49554)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: re-fetch conntrack after insertion (CVE-2022-49561)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add reserved GDT blocks check (CVE-2022-49707)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug_on ext4_mb_use_inode_pa (CVE-2022-49708)

    In the Linux kernel, the following vulnerability has been resolved:

    dm mirror log: round up region bitmap size to BITS_PER_LONG (CVE-2022-49710)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions (CVE-2022-49715)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions (CVE-2022-49716)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: Fix call trace in setup_tx_descriptors (CVE-2022-49725)

    In the Linux kernel, the following vulnerability has been resolved:

    clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() (CVE-2022-49726)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg (CVE-2022-49727)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (CVE-2022-49731)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.126-117.518. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-015 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    drm/plane: Move range check for format_count earlier (CVE-2021-47659)

    Due to the small table perturb size, a memory leak flaw was found in the Linux kernel's TCP source port     generation algorithm in the net/ipv4/tcp.c function. This flaw allows an attacker to leak information and     may cause a denial of service. (CVE-2022-1012)

    A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

    With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

    A NULL pointer dereference flaw was found in the Linux kernel's KVM module, which can lead to a denial of     service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal     instruction in guest in the Intel CPU. (CVE-2022-1852)

    A use-after-free vulnerability was found in the Linux kernel's Netfilter subsystem in     net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege     escalation issue. (CVE-2022-1966)

    A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an     attacker to trigger a buffer overflow via nft_set_desc_concat_parse() , causing a denial of service and     possibly to run code. (CVE-2022-2078)

    A flaw was found in hw. Incomplete cleanup of multi-core shared buffers for some Intel(r) Processors may     allow an authenticated user to enable information disclosure via local access. (CVE-2022-21123)

    A flaw was found in hw. Incomplete cleanup of microarchitectural fill buffers on some Intel(r) Processors     may allow an authenticated user to enable information disclosure via local access. (CVE-2022-21125)

    A flaw was found in hw. Incomplete cleanup in specific special register write operations for some     Intel Processors may allow an authenticated user to enable information disclosure via local access.
    (CVE-2022-21166)

    KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown.
    An attacker with access to a serial port could trigger the debugger so it is important that the debugger     respect the lockdown mode when/if it is triggered. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and     Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H). (CVE-2022-21499)

    net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

    The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used. (CVE-2022-32296)

    An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer     overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point     registers. (CVE-2022-32981)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: fix a possible null pointer dereference (CVE-2022-48710)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: call genl_unregister_family() first in nbd_cleanup() (CVE-2022-49295)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: fix io hung while disconnecting device (CVE-2022-49297)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: fix race between nbd_alloc_config() and module removal (CVE-2022-49300)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() (CVE-2022-49307)

    In the Linux kernel, the following vulnerability has been resolved:

    extcon: Modify extcon device to be created after driver data is set (CVE-2022-49308)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4: Don't hold the layoutget locks across multiple RPC calls (CVE-2022-49316)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/arm-smmu-v3: check return value after calling platform_get_resource() (CVE-2022-49319)

    In the Linux kernel, the following vulnerability has been resolved:

    xprtrdma: treat all calls not a bcall when bc_serv is NULL (CVE-2022-49321)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix sleeping function called from invalid context on RT kernel (CVE-2022-49322)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() (CVE-2022-49323)

    In the Linux kernel, the following vulnerability has been resolved:

    bcache: avoid journal no-space deadlock by reserving 1 journal bucket (CVE-2022-49327)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd (CVE-2022-49330)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: unexport __init-annotated seg6_hmac_init() (CVE-2022-49339)

    In the Linux kernel, the following vulnerability has been resolved:

    ip_gre: test csum_start instead of transport header (CVE-2022-49340)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, arm64: Clear prog->jited_len along prog->jited (CVE-2022-49341)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid cycles in directory h-tree (CVE-2022-49343)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix a data-race in unix_dgram_peer_wake_me(). (CVE-2022-49344)

    In the Linux kernel, the following vulnerability has been resolved:

    net: xfrm: unexport __init-annotated xfrm4_protocol_init() (CVE-2022-49345)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug_on in ext4_writepages (CVE-2022-49347)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state (CVE-2022-49348)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix use-after-free in ext4_rename_dir_prepare (CVE-2022-49349)

    In the Linux kernel, the following vulnerability has been resolved:

    net: mdio: unexport __init-annotated mdio_bus_init() (CVE-2022-49350)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix warning in ext4_handle_inode_extension (CVE-2022-49352)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: memleak flow rule from commit path (CVE-2022-49358)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (CVE-2022-49370)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: fix deadlock in __device_attach (CVE-2022-49371)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: tcp_rtx_synack() can be called from process context (CVE-2022-49372)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: check attribute length for bearer name (CVE-2022-49374)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: sd: Fix potential NULL pointer dereference (CVE-2022-49376)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: Fix wait_for_device_probe() & deferred_probe_timeout interaction (CVE-2022-49379)

    In the Linux kernel, the following vulnerability has been resolved:

    driver: base: fix UAF when driver_attach failed (CVE-2022-49385)

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: ubi_create_volume: Fix use-after-free when volume creation failed (CVE-2022-49388)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: usbip: fix a refcount leak in stub_probe() (CVE-2022-49389)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Clean up hash direct_functions on register failures (CVE-2022-49402)

    In the Linux kernel, the following vulnerability has been resolved:

    dlm: fix plock invalid read (CVE-2022-49407)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug_on in __es_tree_search (CVE-2022-49409)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix potential double free in create_var_ref() (CVE-2022-49410)

    In the Linux kernel, the following vulnerability has been resolved:

    bfq: Make sure bfqg for which we are queueing requests is online (CVE-2022-49411)

    In the Linux kernel, the following vulnerability has been resolved:

    bfq: Update cgroup information before merging bio (CVE-2022-49413)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() (CVE-2022-49434)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: fix deadlock caused by calling printk() under tty_port->lock (CVE-2022-49441)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers/base/node.c: fix compaction sysfs file leak (CVE-2022-49442)

    In the Linux kernel, the following vulnerability has been resolved:

    nvdimm: Fix firmware activation deadlock scenarios (CVE-2022-49446)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix listen() setting the bar too high for the prealloc rings (CVE-2022-49450)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal/core: Fix memory leak in __thermal_cooling_device_register() (CVE-2022-49468)

    In the Linux kernel, the following vulnerability has been resolved:

    net: phy: micrel: Allow probing without .driver_data (CVE-2022-49472)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags (CVE-2022-49492)

    In the Linux kernel, the following vulnerability has been resolved:

    net: remove two BUG() from skb_checksum_help() (CVE-2022-49497)

    In the Linux kernel, the following vulnerability has been resolved:

    ALSA: pcm: Check for null pointer of pointer substream before dereferencing it (CVE-2022-49498)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: elan: Fix potential double free in elan_input_configured (CVE-2022-49508)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall (CVE-2022-49520)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() (CVE-2022-49521)

    In the Linux kernel, the following vulnerability has been resolved:

    md/bitmap: don't set sb values if can't pass sanity check (CVE-2022-49526)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes (CVE-2022-49532)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu-tasks: Fix race in schedule and flush work (CVE-2022-49540)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix potential array overflow in bpf_trampoline_get_progs() (CVE-2022-49548)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails (CVE-2022-49549)

    In the Linux kernel, the following vulnerability has been resolved:

    zsmalloc: fix races between asynchronous zspage free and page migration (CVE-2022-49554)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak (CVE-2022-49556)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: check if cluster num is valid (CVE-2022-49560)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: re-fetch conntrack after insertion (CVE-2022-49561)

    In the Linux kernel, the following vulnerability has been resolved:

    zonefs: fix zonefs_iomap_begin() for reads (CVE-2022-49706)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add reserved GDT blocks check (CVE-2022-49707)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug_on ext4_mb_use_inode_pa (CVE-2022-49708)

    In the Linux kernel, the following vulnerability has been resolved:

    dm mirror log: round up region bitmap size to BITS_PER_LONG (CVE-2022-49710)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions (CVE-2022-49715)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions (CVE-2022-49716)

    In the Linux kernel, the following vulnerability has been resolved:

    block: Fix handling of offline queues in blk_mq_alloc_request_hctx() (CVE-2022-49720)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: ftrace: consistently handle PLTs. (CVE-2022-49721)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/reset: Fix error_state_read ptr + offset use (CVE-2022-49723)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: Fix call trace in setup_tx_descriptors (CVE-2022-49725)

    In the Linux kernel, the following vulnerability has been resolved:

    clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() (CVE-2022-49726)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg (CVE-2022-49727)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (CVE-2022-49731)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.285-215.501. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1813 advisory.

    A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

    An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c function in     RPCRDMA_HDRLEN_MIN (7) (in rpcrdma_max_call_header_size, rpcrdma_max_reply_header_size). This flaw allows     an attacker with normal user privileges to leak kernel information. (CVE-2022-0812)

    Due to the small table perturb size, a memory leak flaw was found in the Linux kernel's TCP source port     generation algorithm in the net/ipv4/tcp.c function. This flaw allows an attacker to leak information and     may cause a denial of service. (CVE-2022-1012)

    A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

    A use-after-free vulnerability was found in the Linux kernel's Netfilter subsystem in     net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege     escalation issue. (CVE-2022-1966)

    A flaw was found in hw. Incomplete cleanup of multi-core shared buffers for some Intel(r) Processors may     allow an authenticated user to enable information disclosure via local access. (CVE-2022-21123)

    A flaw was found in hw. Incomplete cleanup of microarchitectural fill buffers on some Intel(r) Processors     may allow an authenticated user to enable information disclosure via local access. (CVE-2022-21125)

    A flaw was found in hw. Incomplete cleanup in specific special register write operations for some     Intel Processors may allow an authenticated user to enable information disclosure via local access.
    (CVE-2022-21166)

    net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

    The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used. (CVE-2022-32296)

    An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer     overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point     registers. (CVE-2022-32981)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: fix a possible null pointer dereference (CVE-2022-48710)

    In the Linux kernel, the following vulnerability has been resolved:

    exec: Force single empty string when argv is empty (CVE-2022-49264)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: call genl_unregister_family() first in nbd_cleanup() (CVE-2022-49295)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: fix io hung while disconnecting device (CVE-2022-49297)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: fix race between nbd_alloc_config() and module removal (CVE-2022-49300)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() (CVE-2022-49307)

    In the Linux kernel, the following vulnerability has been resolved:

    extcon: Modify extcon device to be created after driver data is set (CVE-2022-49308)

    In the Linux kernel, the following vulnerability has been resolved:

    xprtrdma: treat all calls not a bcall when bc_serv is NULL (CVE-2022-49321)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix sleeping function called from invalid context on RT kernel (CVE-2022-49322)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd (CVE-2022-49330)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: unexport __init-annotated seg6_hmac_init() (CVE-2022-49339)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid cycles in directory h-tree (CVE-2022-49343)

    In the Linux kernel, the following vulnerability has been resolved:

    net: xfrm: unexport __init-annotated xfrm4_protocol_init() (CVE-2022-49345)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug_on in ext4_writepages (CVE-2022-49347)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix use-after-free in ext4_rename_dir_prepare (CVE-2022-49349)

    In the Linux kernel, the following vulnerability has been resolved:

    net: mdio: unexport __init-annotated mdio_bus_init() (CVE-2022-49350)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (CVE-2022-49370)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: tcp_rtx_synack() can be called from process context (CVE-2022-49372)

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: ubi_create_volume: Fix use-after-free when volume creation failed (CVE-2022-49388)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: usbip: fix a refcount leak in stub_probe() (CVE-2022-49389)

    In the Linux kernel, the following vulnerability has been resolved:

    dlm: fix plock invalid read (CVE-2022-49407)

    In the Linux kernel, the following vulnerability has been resolved:

    video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup (CVE-2022-49421)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() (CVE-2022-49434)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: fix deadlock caused by calling printk() under tty_port->lock (CVE-2022-49441)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers/base/node.c: fix compaction sysfs file leak (CVE-2022-49442)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix listen() setting the bar too high for the prealloc rings (CVE-2022-49450)

    In the Linux kernel, the following vulnerability has been resolved:

    net: phy: micrel: Allow probing without .driver_data (CVE-2022-49472)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags (CVE-2022-49492)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes (CVE-2022-49532)

    In the Linux kernel, the following vulnerability has been resolved:

    zsmalloc: fix races between asynchronous zspage free and page migration (CVE-2022-49554)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: re-fetch conntrack after insertion (CVE-2022-49561)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add reserved GDT blocks check (CVE-2022-49707)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug_on ext4_mb_use_inode_pa (CVE-2022-49708)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: Fix call trace in setup_tx_descriptors (CVE-2022-49725)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg (CVE-2022-49727)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (CVE-2022-49731)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
273049	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989917)	Nessus	Unity Linux Local Security Checks	medium
268280	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986919)	Nessus	Unity Linux Local Security Checks	medium
241806	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2025-1777)	Nessus	Huawei Local Security Checks	high
238226	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-1635)	Nessus	Huawei Local Security Checks	high
238210	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-1618)	Nessus	Huawei Local Security Checks	high
238183	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2025-1590)	Nessus	Huawei Local Security Checks	high
238182	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2025-1589)	Nessus	Huawei Local Security Checks	high
235744	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2025-1520)	Nessus	Huawei Local Security Checks	high
226361	Linux Distros Unpatched Vulnerability : CVE-2022-49450	Nessus	Misc.	medium
163372	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2022-002 (ALASKERNEL-5.15-2022-002)	Nessus	Amazon Linux Local Security Checks	high
163316	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2022-028 (ALASKERNEL-5.4-2022-028)	Nessus	Amazon Linux Local Security Checks	high
163313	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2022-015 (ALASKERNEL-5.10-2022-015)	Nessus	Amazon Linux Local Security Checks	high
163232	Amazon Linux 2 : kernel, --advisory ALAS2-2022-1813 (ALAS-2022-1813)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2022-49450

medium

Tenable Plugins

medium

medium

high

high

high

high

high

high

medium

high

high

high

high