In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential double free during failed mount RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=2088799

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2025:1750175787 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Disable kvmclock on all CPUs     on shutdown Currenly, we disable kvmclock from machine_shutdown() hook and this only happens for boot CPU.
    We need to disable it for all CPUs to guard against memory corruption e.g. on restore from hibernate.
    Note, writing '0' to kvmclock MSR doesn't clear memory location, it just prevents hypervisor from updating     the location so for the short while after write and while CPU is still alive, the clock remains usable and     correct so we don't need to switch to some other clocksource. (CVE-2021-47110)

  - In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix array-index-out-     of-bounds in pvr2_i2c_core_init Syzbot reported that -1 is used as array index. The problem was in missing     validation check. hdw->unit_number is initialized with -1 and then if init table walk fails this value     remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the     easiest fix for that. hdw->workpoll initialization moved upper to prevent warning in __flush_work.
    (CVE-2022-49478)

  - In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix double free in     si_parse_power_table() In function si_parse_power_table(), array adev->pm.dpm.ps and its member is     allocated. If the allocation of each member fails, the array itself is freed and returned with an error     code. However, the array is later freed again in si_dpm_fini() function which is called when the function     returns an error. This leads to potential double free of the array adev->pm.dpm.ps, as well as leak of its     array members, since the members are not freed in the allocation function and the array is not nulled when     freed. In addition adev->pm.dpm.num_ps, which keeps track of the allocated array member, is not updated     until the member allocation is successfully finished, this could also lead to either use after free, or     uninitialized variable access in si_dpm_fini(). Fix this by postponing the free of the array until     si_dpm_fini() and increment adev->pm.dpm.num_ps everytime the array member is allocated. (CVE-2022-49530)

  - In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential double free during     failed mount RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=2088799 (CVE-2022-49541)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2025:1747688831 advisory.

  - An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input     Validation. This flaw allows a local attacker with a special privilege to crash the system or leak     internal information. (CVE-2021-4204)

  - In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix an out-of-bounds     bug in __snd_usb_parse_audio_interface() There may be a bad USB audio device with a USB ID of (0x04fa,     0x4201) and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsing the     interface descriptor for this device. Fix this by checking the number of interfaces. (CVE-2022-48701)

  - In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential double free during     failed mount RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=2088799 (CVE-2022-49541)

  - In the Linux kernel, the following vulnerability has been resolved: block: Fix handling of offline queues     in blk_mq_alloc_request_hctx() This patch prevents that test nvme/004 triggers the following: UBSAN:
    array-index-out-of-bounds in block/blk-mq.h:135:9 index 512 is out of range for type 'long unsigned int     [512]' Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x49/0x5e dump_stack+0x10/0x12     ubsan_epilogue+0x9/0x3b __ubsan_handle_out_of_bounds.cold+0x44/0x49 blk_mq_alloc_request_hctx+0x304/0x310
    __nvme_submit_sync_cmd+0x70/0x200 [nvme_core] nvmf_connect_io_queue+0x23e/0x2a0 [nvme_fabrics]     nvme_loop_connect_io_queues+0x8d/0xb0 [nvme_loop] nvme_loop_create_ctrl+0x58e/0x7d0 [nvme_loop]     nvmf_create_ctrl+0x1d7/0x4d0 [nvme_fabrics] nvmf_dev_write+0xae/0x111 [nvme_fabrics] vfs_write+0x144/0x560     ksys_write+0xb7/0x140 __x64_sys_write+0x42/0x50 do_syscall_64+0x35/0x80     entry_SYSCALL_64_after_hwframe+0x44/0xae (CVE-2022-49720)

  - In the Linux kernel, the following vulnerability has been resolved: can: bcm: Fix UAF in bcm_proc_show()     BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80 Read of size 8 at addr ffff888155846230 by     task cat/7862 CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230 Hardware name:
    QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK>     dump_stack_lvl+0xd5/0x150 print_report+0xc1/0x5e0 kasan_report+0xba/0xf0 bcm_proc_show+0x969/0xa80     seq_read_iter+0x4f6/0x1260 seq_read+0x165/0x210 proc_reg_read+0x227/0x300 vfs_read+0x1d5/0x8d0     ksys_read+0x11e/0x240 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Allocated by task     7846: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x9e/0xa0     bcm_sendmsg+0x264b/0x44e0 sock_sendmsg+0xda/0x180 ____sys_sendmsg+0x735/0x920 ___sys_sendmsg+0x11d/0x1b0
    __sys_sendmsg+0xfa/0x1d0 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task     7846: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x27/0x40
    ____kasan_slab_free+0x161/0x1c0 slab_free_freelist_hook+0x119/0x220 __kmem_cache_free+0xb4/0x2e0     rcu_core+0x809/0x1bd0 bcm_op is freed before procfs entry be removed in bcm_release(), this lead to     bcm_proc_show() may read the freed bcm_op. (CVE-2023-52922)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:3839 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: ALSA: usb-audio: Fix out of bounds reads when finding clock sources (CVE-2024-53150)

    * kernel: cifs: fix potential double free during failed mount (CVE-2022-49541)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:3838 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ALSA: usb-audio: Fix out of bounds reads when finding clock sources (CVE-2024-53150)

    * kernel: cifs: fix potential double free during failed mount (CVE-2022-49541)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3961 advisory.

    This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the     code of a running kernel.  This patch module is targeted for kernel-5.14.0-70.85.1.el9_0.

    Security Fix(es):

    * kernel: cifs: fix potential double free during failed mount (CVE-2022-49541)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1263-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-47248: udp: fix race between close() and udp_abort() (bsc#1224867).
    - CVE-2022-49051: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup (bsc#1237903).
    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49275: can: m_can: m_can_tx_handler(): fix use after free of skb (bsc#1238719).
    - CVE-2022-49413: bfq: Update cgroup information before merging bio (bsc#1238710).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238729).
    - CVE-2022-49563: crypto: qat - add param check for RSA (bsc#1238787).
    - CVE-2022-49564: crypto: qat - add param check for DH (bsc#1238789).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-56642: tipc: Fix use-after-free of kernel socket in cleanup_bearer() (bsc#1235433).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1241-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
    - CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync     (bsc#1239095).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1027-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
    - CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
    - CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential double free during     failed mount RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=2088799 (CVE-2022-49541)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2458 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)

    * net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)

    * cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)

    * malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)

    * possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)

    * KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)

    * use-after-free in free_pipe_info() could lead to privilege escalation (CVE-2022-1882)

    * KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)

    * netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)

    * race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)

    * out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c (CVE-2022-3435)

    * race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)

    * memory leak in ipv6_renew_options() (CVE-2022-3524)

    * data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)

    * data races around sk->sk_prot (CVE-2022-3567)

    * memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)

    * denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)

    * use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)

    * USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)

    * use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (CVE-2022-3640)

    * Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)

    * mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128)

    * l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)

    * igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)

    * lockdown bypass using IMA (CVE-2022-21505)

    * double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)

    * network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743)

    * unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)

    * TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning     (CVE-2022-39189)

    * u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)

    * use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)

    * use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)

    * BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)

    * Denial of service in beacon protection for P2P-device (CVE-2022-42722)

    * memory corruption in usbmon driver (CVE-2022-43750)

    * NULL pointer dereference in traffic control subsystem (CVE-2022-47929)

    * NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)

    * use-after-free due to race condition in qdisc_graft() (CVE-2023-0590)

    * use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)

    * denial of service in tipc_conn_close (CVE-2023-1382)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7683 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

    * race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference     (CVE-2020-36558)

    * use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

    * memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c     (CVE-2021-30002)

    * smb2_ioctl_query_info NULL Pointer Dereference (CVE-2022-0168)

    * NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

    * swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

    * uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)

    * race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

    * use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)

    * use-after-free and memory errors in ext4 when mounting and operating on a corrupted image     (CVE-2022-1184)

    * NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

    * buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

    * nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)

    * openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

    * use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)

    * net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

    * possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

    * Spectre-BHB (CVE-2022-23960)

    * Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

    * memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)

    * double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

    * use after free in SUNRPC subsystem (CVE-2022-28893)

    * use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

    * DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

    * nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5819 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Small table perturb size in the TCP source port generation algorithm can lead to information     leak (CVE-2022-1012)

    * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-32250)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Softirq hrtimers are being placed on the per-CPU softirq clocks on isolcpus. (BZ#2090484)

    * enable/disable multiqueues repeatedly while ping local host, guest kernel panic (BZ#2093416)

    * Backport kernel audit enhancements and fixes from v5.13-rc1 to v5.16-rc6 (BZ#2095434)

    * blk_update_request: I/O error, dev nvme0n3, during xfs creation (BZ#2100150)

    * SCSI updates for RHEL 8.7 (BZ#2100254)

    * Kernel bug on mm/slub.c:314 (BZ#2102251)

    * Implement new tc action for check_pkt_len (BZ#2102333)

    * too long timeout value with TIME_WAIT status of conntrack entry (BZ#2104002)

    * Connectx6-DX, mlx5 , backport   087032ee7021 (net/mlx5e: TC, Fix ct_clear overwriting ct action     metadata) (BZ#2104012)

    * mlx5: Software steering memory allocation failure, netperf  TCP_CRR with ct(). (BZ#2104013)

    * tcp: request_sock leak in Calico OCP (BZ#2104670)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.50-23.125. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2022-002 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    drm/plane: Move range check for format_count earlier (CVE-2021-47659)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()' (CVE-2021-47660)

    A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

    With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

    A NULL pointer dereference flaw was found in the Linux kernel's KVM module, which can lead to a denial of     service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal     instruction in guest in the Intel CPU. (CVE-2022-1852)

    A use-after-free vulnerability was found in the Linux kernel's Netfilter subsystem in     net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege     escalation issue. (CVE-2022-1966)

    A use-after-free flaw was found in the Linux kernel in log_replay in fs/ntfs3/fslog.c in the NTFS journal.
    This flaw allows a local attacker to crash the system and leads to a kernel information leak problem.
    (CVE-2022-1973)

    A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an     attacker to trigger a buffer overflow via nft_set_desc_concat_parse() , causing a denial of service and     possibly to run code. (CVE-2022-2078)

    A flaw was found in hw. Incomplete cleanup of multi-core shared buffers for some Intel(r) Processors may     allow an authenticated user to enable information disclosure via local access. (CVE-2022-21123)

    A flaw was found in hw. Incomplete cleanup of microarchitectural fill buffers on some Intel(r) Processors     may allow an authenticated user to enable information disclosure via local access. (CVE-2022-21125)

    A flaw was found in hw. Incomplete cleanup in specific special register write operations for some     Intel Processors may allow an authenticated user to enable information disclosure via local access.
    (CVE-2022-21166)

    net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

    An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer     overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point     registers. (CVE-2022-32981)

    rpmsg_virtio_add_ctrl_dev in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a     double free. (CVE-2022-34494)

    rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free.
    (CVE-2022-34495)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: call genl_unregister_family() first in nbd_cleanup() (CVE-2022-49295)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: fix io hung while disconnecting device (CVE-2022-49297)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: fix race between nbd_alloc_config() and module removal (CVE-2022-49300)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4: Don't hold the layoutget locks across multiple RPC calls (CVE-2022-49316)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/arm-smmu-v3: check return value after calling platform_get_resource() (CVE-2022-49319)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix sleeping function called from invalid context on RT kernel (CVE-2022-49322)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() (CVE-2022-49323)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: add accessors to read/set tp->snd_cwnd (CVE-2022-49325)

    In the Linux kernel, the following vulnerability has been resolved:

    bcache: avoid journal no-space deadlock by reserving 1 journal bucket (CVE-2022-49327)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd (CVE-2022-49330)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: unexport __init-annotated seg6_hmac_init() (CVE-2022-49339)

    In the Linux kernel, the following vulnerability has been resolved:

    ip_gre: test csum_start instead of transport header (CVE-2022-49340)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, arm64: Clear prog->jited_len along prog->jited (CVE-2022-49341)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid cycles in directory h-tree (CVE-2022-49343)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix a data-race in unix_dgram_peer_wake_me(). (CVE-2022-49344)

    In the Linux kernel, the following vulnerability has been resolved:

    net: xfrm: unexport __init-annotated xfrm4_protocol_init() (CVE-2022-49345)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug_on in ext4_writepages (CVE-2022-49347)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state (CVE-2022-49348)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix use-after-free in ext4_rename_dir_prepare (CVE-2022-49349)

    In the Linux kernel, the following vulnerability has been resolved:

    net: mdio: unexport __init-annotated mdio_bus_init() (CVE-2022-49350)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix warning in ext4_handle_inode_extension (CVE-2022-49352)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: memleak flow rule from commit path (CVE-2022-49358)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (CVE-2022-49370)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: fix deadlock in __device_attach (CVE-2022-49371)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: tcp_rtx_synack() can be called from process context (CVE-2022-49372)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: check attribute length for bearer name (CVE-2022-49374)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: sd: Fix potential NULL pointer dereference (CVE-2022-49376)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx (CVE-2022-49377)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: Fix wait_for_device_probe() & deferred_probe_timeout interaction (CVE-2022-49379)

    In the Linux kernel, the following vulnerability has been resolved:

    md: fix double free of io_acct_set bioset (CVE-2022-49384)

    In the Linux kernel, the following vulnerability has been resolved:

    driver: base: fix UAF when driver_attach failed (CVE-2022-49385)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: usbip: fix a refcount leak in stub_probe() (CVE-2022-49389)

    In the Linux kernel, the following vulnerability has been resolved:

    md: Don't set mddev private to NULL in raid0 pers->free (CVE-2022-49400)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Clean up hash direct_functions on register failures (CVE-2022-49402)

    In the Linux kernel, the following vulnerability has been resolved:

    dlm: fix plock invalid read (CVE-2022-49407)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug_on in __es_tree_search (CVE-2022-49409)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix potential double free in create_var_ref() (CVE-2022-49410)

    In the Linux kernel, the following vulnerability has been resolved:

    bfq: Make sure bfqg for which we are queueing requests is online (CVE-2022-49411)

    In the Linux kernel, the following vulnerability has been resolved:

    bfq: Avoid merging queues with different parents (CVE-2022-49412)

    In the Linux kernel, the following vulnerability has been resolved:

    bfq: Update cgroup information before merging bio (CVE-2022-49413)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix race condition between ext4_write and ext4_convert_inline_data (CVE-2022-49414)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/arm-smmu-v3-sva: Fix mm use-after-free (CVE-2022-49426)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() (CVE-2022-49434)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: fix deadlock caused by calling printk() under tty_port->lock (CVE-2022-49441)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers/base/node.c: fix compaction sysfs file leak (CVE-2022-49442)

    In the Linux kernel, the following vulnerability has been resolved:

    list: fix a data-race around ep->rdllist (CVE-2022-49443)

    In the Linux kernel, the following vulnerability has been resolved:

    nvdimm: Fix firmware activation deadlock scenarios (CVE-2022-49446)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix listen() setting the bar too high for the prealloc rings (CVE-2022-49450)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal/core: Fix memory leak in __thermal_cooling_device_register() (CVE-2022-49468)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags (CVE-2022-49492)

    In the Linux kernel, the following vulnerability has been resolved:

    net: remove two BUG() from skb_checksum_help() (CVE-2022-49497)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: elan: Fix potential double free in elan_input_configured (CVE-2022-49508)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall (CVE-2022-49520)

    In the Linux kernel, the following vulnerability has been resolved:

    md/bitmap: don't set sb values if can't pass sanity check (CVE-2022-49526)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu-tasks: Fix race in schedule and flush work (CVE-2022-49540)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix potential double free during failed mount (CVE-2022-49541)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/kexec: fix memory leak of elf header buffer (CVE-2022-49546)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix potential array overflow in bpf_trampoline_get_progs() (CVE-2022-49548)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails (CVE-2022-49549)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: validate BOOT sectors_per_clusters (CVE-2022-49553)

    In the Linux kernel, the following vulnerability has been resolved:

    zsmalloc: fix races between asynchronous zspage free and page migration (CVE-2022-49554)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak (CVE-2022-49556)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: double hook unregistration in netns path (CVE-2022-49558)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Drop WARNs that assert a triple fault never escapes from L2 (CVE-2022-49559)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: check if cluster num is valid (CVE-2022-49560)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: re-fetch conntrack after insertion (CVE-2022-49561)

    In the Linux kernel, the following vulnerability has been resolved:

    zonefs: fix zonefs_iomap_begin() for reads (CVE-2022-49706)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add reserved GDT blocks check (CVE-2022-49707)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug_on ext4_mb_use_inode_pa (CVE-2022-49708)

    In the Linux kernel, the following vulnerability has been resolved:

    cfi: Fix __cfi_slowpath_diag RCU usage with cpuidle (CVE-2022-49709)

    In the Linux kernel, the following vulnerability has been resolved:

    dm mirror log: round up region bitmap size to BITS_PER_LONG (CVE-2022-49710)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions (CVE-2022-49715)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions (CVE-2022-49716)

    In the Linux kernel, the following vulnerability has been resolved:

    block: Fix handling of offline queues in blk_mq_alloc_request_hctx() (CVE-2022-49720)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: ftrace: consistently handle PLTs. (CVE-2022-49721)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/reset: Fix error_state_read ptr + offset use (CVE-2022-49723)

    In the Linux kernel, the following vulnerability has been resolved:

    clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() (CVE-2022-49726)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (CVE-2022-49731)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
353180	CentOS Linux 6 [TuxCare] Security Update: kernel / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2025:1750175787)	Nessus	CentOS Local Security Checks	Local	high
351717	CentOS Linux 8.5 [TuxCare] Security Update: kernel-cross-headers / kernel-debug-modules-extra / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2025:1747688831)	Nessus	CentOS Local Security Checks	Local	high
234669	RHEL 9 : kernel-rt (RHSA-2025:3839)	Nessus	Red Hat Local Security Checks	Local	high
234665	RHEL 9 : kernel (RHSA-2025:3838)	Nessus	Red Hat Local Security Checks	Local	high
234660	RHEL 9 : kpatch-patch-5_14_0-70_112_1, kpatch-patch-5_14_0-70_121_1, kpatch-patch-5_14_0-70_124_1, and kpatch-patch-5_14_0-70_85_1 (RHSA-2025:3961)	Nessus	Red Hat Local Security Checks	Local	high
234484	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2025:1263-1)	Nessus	SuSE Local Security Checks	Local	high
234407	SUSE SLES15 : Security update for the Linux Kernel (SUSE-SU-2025:1241-1)	Nessus	SuSE Local Security Checks	Local	high
233410	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2025:1027-1)	Nessus	SuSE Local Security Checks	Local	high
226401	Linux Distros Unpatched Vulnerability : CVE-2022-49541	Nessus	Misc.	Local	high
175477	RHEL 9 : kernel (RHSA-2023:2458)	Nessus	Red Hat Local Security Checks	Local	high
167155	RHEL 8 : kernel (RHSA-2022:7683)	Nessus	Red Hat Local Security Checks	Local	high
163793	RHEL 8 : kernel (RHSA-2022:5819)	Nessus	Red Hat Local Security Checks	Local	high
163372	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2022-002 (ALASKERNEL-5.15-2022-002)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2022-49541

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high