In the Linux kernel, the following vulnerability has been resolved: x86/kexec: fix memory leak of elf header buffer This is reported by kmemleak detector: unreferenced object 0xffffc900002a9000 (size 4096): comm "kexec", pid 14950, jiffies 4295110793 (age 373.951s) hex dump (first 32 bytes): 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 .ELF............ 04 00 3e 00 01 00 00 00 00 00 00 00 00 00 00 00 ..>............. backtrace: [<0000000016a8ef9f>] __vmalloc_node_range+0x101/0x170 [<000000002b66b6c0>] __vmalloc_node+0xb4/0x160 [<00000000ad40107d>] crash_prepare_elf64_headers+0x8e/0xcd0 [<0000000019afff23>] crash_load_segments+0x260/0x470 [<0000000019ebe95c>] bzImage64_load+0x814/0xad0 [<0000000093e16b05>] arch_kexec_kernel_image_load+0x1be/0x2a0 [<000000009ef2fc88>] kimage_file_alloc_init+0x2ec/0x5a0 [<0000000038f5a97a>] __do_sys_kexec_file_load+0x28d/0x530 [<0000000087c19992>] do_syscall_64+0x3b/0x90 [<0000000066e063a4>] entry_SYSCALL_64_after_hwframe+0x44/0xae In crash_prepare_elf64_headers(), a buffer is allocated via vmalloc() to store elf headers. While it's not freed back to system correctly when kdump kernel is reloaded or unloaded. Then memory leak is caused. Fix it by introducing x86 specific function arch_kimage_file_post_load_cleanup(), and freeing the buffer there. And also remove the incorrect elf header buffer freeing code. Before calling arch specific kexec_file loading function, the image instance has been initialized. So 'image->elf_headers' must be NULL. It doesn't make sense to free the elf header buffer in the place. Three different people have reported three bugs about the memory leak on x86_64 inside Redhat.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    ovl: Use 'buf' flexible array for memcpy() destination(CVE-2022-49743)

    cifs: fix potential memory leaks in session setup(CVE-2023-53008)

    bnxt: Do not read past the end of test names(CVE-2023-53010)

    uprobes: Reject the shared zeropage in uprobe_write_opcode().(CVE-2025-21881)

    ftrace: Avoid potential division by zero in function_stat_show().(CVE-2025-21898)

    igb: Fix potential invalid memory access in igb_init_module().(CVE-2024-52332)

    bpf: Skip invalid kfunc call in backtrack_insn(CVE-2023-52928)

    HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove().(CVE-2025-21928)

    efi: Don't map the entire mokvar table to determine its size(CVE-2025-21872)

    mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize().(CVE-2025-21861)

    net_sched: sch_sfq: don't allow 1 packet limit(CVE-2024-57996)

    scsi: hisi_sas: Add cond_resched() for no forced preemption model(CVE-2024-56589)

    ipmr: do not call mr_mfc_uses_dev() for unres entries(CVE-2025-21719)

    dm thin: make get_first_thin use rcu-safe list first function(CVE-2025-21664)

    ipvlan: ensure network headers are in skb linear part(CVE-2025-21891)

    net/mlx5: handle errors in mlx5_chains_create_table().(CVE-2025-21975)

    ppp: Fix KMSAN uninit-value warning with bpf(CVE-2025-21922)

    udp: Deal with race between UDP socket address change and rehash(CVE-2024-57974)

    net: let net.core.dev_weight always be non-zero(CVE-2025-21806)

    RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers(CVE-2025-21885)

    tracing: Fix bad hist from corrupting named_triggers list(CVE-2025-21899)

    ipv6: use RCU protection in ip6_default_advmss().(CVE-2025-21765)

    x86/kexec: fix memory leak of elf header buffer(CVE-2022-49546)

    regulator: check that dummy regulator has been probed before using it(CVE-2025-22008)

    iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic().(CVE-2025-21993)

    ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().(CVE-2025-22005)

    drm/drm_vma_manager: Add drm_vma_node_allow_once().(CVE-2023-53001)

    ext4: avoid journaling sb update on error if journal is destroying(CVE-2025-22113)

    ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all().(CVE-2025-22121)

    nfsd: don't ignore the return code of svc_proc_register().(CVE-2025-22026)

    ipv4: Fix data-races around sysctl_fib_multipath_hash_policy.(CVE-2022-49579)

    thermal: int340x: Add NULL check for adev(CVE-2025-23136)

    dlm: prevent NPD when writing a positive value to event_done(CVE-2025-23131)

    ext4: fix OOB read when checking dotdot dir(CVE-2025-37785)

    mmc: core: use sysfs_emit() instead of sprintf().(CVE-2022-49267)

    wifi: brcmfmac: Check the return value of of_property_read_string_index().(CVE-2025-21750)

    media: streamzap: fix race between device disconnection and urb callback(CVE-2025-22027)

    hrtimers: Handle CPU state correctly on hotplug(CVE-2024-57951)

    x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range().(CVE-2025-22090)

    clk: samsung: Fix UBSAN panic in samsung_clk_init().(CVE-2025-39728)

    netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets.(CVE-2025-22063)

    bpf: Fix kmemleak warning for percpu hashmap(CVE-2025-37807)

    xfrm: state: fix out-of-bounds read during lookup(CVE-2024-57982)

    ext4: fix off-by-one error in do_split(CVE-2025-23150)

    net_sched: sch_sfq: move the limit validation(CVE-2025-37752)

    cpufreq: governor: Use kobject release() method to free dbs_data(CVE-2022-49513)

    hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio(CVE-2025-21931)

    netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree().(CVE-2025-21959)

    ice: Fix memory corruption in VF driver(CVE-2022-49722)

    PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1(CVE-2025-21831)

    usb: cdc-acm: Check control transfer buffer size before access(CVE-2025-21704)

    ipv6: mcast: add RCU protection to mld_newpack().(CVE-2025-21758)

    vlan: enforce underlying device type(CVE-2025-21920)

    fbdev: hyperv_fb: Allow graceful removal of framebuffer(CVE-2025-21976)

    dm array: fix releasing a faulty array block twice in dm_array_cursor_end(CVE-2024-57929)

    ipv4: use RCU protection in __ip_rt_update_pmtu().(CVE-2025-21766)

    ice: fix memory leak in aRFS after reset(CVE-2025-21981)

    nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu().(CVE-2025-21927)

    net_sched: Prevent creation of classes with TC_H_ROOT(CVE-2025-21971)

    net: sched: Disallow replacing of child qdisc from one parent to another(CVE-2025-21702)

    net: gso: fix ownership in __udp_gso_segment(CVE-2025-21926)

    usbnet: gl620a: fix endpoint checking in genelink_bind().(CVE-2025-21877)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    usbnet: gl620a: fix endpoint checking in genelink_bind().(CVE-2025-21877)

    ASoC: soc-compress: prevent the potentially use of null pointer(CVE-2021-47650)

    net: gso: fix ownership in __udp_gso_segment(CVE-2025-21926)

    exec: Force single empty string when argv is empty(CVE-2022-49264)

    IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition(CVE-2022-49089)

    netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits(CVE-2023-53033)

    erspan: do not assume transport header is always set(CVE-2022-49691)

    tipc: check attribute length for bearer name(CVE-2022-49374)

    qede: confirm skb is allocated before using(CVE-2022-49084)

    nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu().(CVE-2025-21927)

    ice: fix memory leak in aRFS after reset(CVE-2025-21981)

    arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall(CVE-2022-49520)

    NFSD: prevent underflow in nfssvc_decode_writeargs().(CVE-2022-49280)

    tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd(CVE-2022-49330)

    net: sched: Disallow replacing of child qdisc from one parent to another(CVE-2025-21702)

    net: ipv4: fix route with nexthop object delete warning(CVE-2022-49092)

    x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL(CVE-2023-52993)

    firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region(CVE-2023-52989)

    netfilter: nf_tables: don't skip expired elements during walk(CVE-2023-52924)

    net: openvswitch: fix leak of nested actions(CVE-2022-49086)

    drm/nouveau: prime: fix refcount underflow(CVE-2024-43867)

    net_sched: Prevent creation of classes with TC_H_ROOT(CVE-2025-21971)

    netfilter: nf_tables: memleak flow rule from commit path(CVE-2022-49358)

    rcu-tasks: Fix race in schedule and flush work(CVE-2022-49540)

    netfilter: use get_random_u32 instead of prandom(CVE-2022-49698)

    fbdev: hyperv_fb: Allow graceful removal of framebuffer(CVE-2025-21976)

    nvme-pci: add missing condition check for existence of mapped data(CVE-2024-42276)

    cifs: Fix oops due to uncleared server-smbd_conn in reconnect(CVE-2023-53006)

    ipv6: mcast: add RCU protection to mld_newpack().(CVE-2025-21758)

    ftrace: Clean up hash direct_functions on register failures(CVE-2022-49402)

    clocksource: hyper-v: unexport __init-annotated hv_init_clocksource().(CVE-2022-49726)

    usb: cdc-acm: Check control transfer buffer size before access(CVE-2025-21704)

    PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1(CVE-2025-21831)

    ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero(CVE-2022-49584)

    gpio: Restrict usage of GPIO chip irq members before initialization(CVE-2022-49072)

    i40e: Fix call trace in setup_tx_descriptors(CVE-2022-49725)

    RDMA/hfi1: Fix potential integer multiplication overflow errors(CVE-2022-49404)

    ice: Fix memory corruption in VF driver(CVE-2022-49722)

    ipv4: prevent potential spectre v1 gadget in fib_metrics_match().(CVE-2023-52996)

    ACPI: CPPC: Avoid out of bounds access when parsing _CPC data(CVE-2022-49145)

    KVM: SVM: fix panic on out-of-bounds guest IRQ(CVE-2022-49154)

    ipv4: prevent potential spectre v1 gadget in ip_metrics_convert().(CVE-2023-52997)

    net: fix NULL pointer in skb_segment_list(CVE-2023-52991)

    dlm: fix plock invalid read(CVE-2022-49407)

    netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree().(CVE-2025-21959)

    tee: optee: Fix supplicant wait loop(CVE-2025-21871)

    dm raid: fix accesses beyond end of raid member array(CVE-2022-49674)

    ipv4: use RCU protection in __ip_rt_update_pmtu().(CVE-2025-21766)

    dm array: fix releasing a faulty array block twice in dm_array_cursor_end(CVE-2024-57929)

    netlink: prevent potential spectre v1 gadgets(CVE-2023-53000)

    net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices(CVE-2023-52984)

    net: xfrm: unexport __init-annotated xfrm4_protocol_init().(CVE-2022-49345)

    tunnels: do not assume mac header is set in skb_tunnel_check_pmtu().(CVE-2022-49663)

    cpufreq: governor: Use kobject release() method to free dbs_data(CVE-2022-49513)

    brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path(CVE-2022-49263)

    HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections(CVE-2024-57986)

    ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up(CVE-2025-21887)

    xsk: Fix race at socket teardown(CVE-2022-49215)

    acct: perform last write from workqueue(CVE-2025-21846)

    nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags(CVE-2022-49492)

    drop_monitor: fix incorrect initialization order(CVE-2025-21862)

    udp: Fix a data-race around sysctl_udp_l3mdev_accept.(CVE-2022-49577)

    ip: Fix data-races around sysctl_ip_prot_sock.(CVE-2022-49578)

    ipv4: Fix data-races around sysctl_fib_multipath_hash_policy.(CVE-2022-49579)

    ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh.(CVE-2022-49580)

    tcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout.(CVE-2022-49585)

    drm/drm_vma_manager: Add drm_vma_node_allow_once().(CVE-2023-53001)

    x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes(CVE-2025-21991)

    ipv6: Fix signed integer overflow in __ip6_append_data(CVE-2022-49728)

    ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().(CVE-2025-22005)

    exec: don't WARN for racy path_noexec check(CVE-2024-50010)

    iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic().(CVE-2025-21993)

    RDMA/hns: Fix soft lockup during bt pages loop(CVE-2025-22010)

    tracing: Fix use-after-free in print_graph_function_flags during tracer switching(CVE-2025-22035)

    regulator: check that dummy regulator has been probed before using it(CVE-2025-22008)

    smb: client: Add check for next_buffer in receive_encrypted_standard().(CVE-2025-21844)

    vlan: enforce underlying device type(CVE-2025-21920)

    tcp: Fix data-races around sysctl_tcp_mtu_probing.(CVE-2022-49598)

    mm/swapfile: add cond_resched() in get_swap_pages().(CVE-2023-52932)

    proc: fix UAF in proc_get_inode().(CVE-2025-21999)

    driver core: Fix wait_for_device_probe()  deferred_probe_timeout interaction(CVE-2022-49379)

    NFSD: prevent integer overflow on 32 bit systems(CVE-2022-49279)

    x86/kexec: fix memory leak of elf header buffer(CVE-2022-49546)

    PM: core: keep irq flags in device_pm_check_callbacks().(CVE-2022-49175)

    KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak(CVE-2022-49556)

    tracing: Fix bad hist from corrupting named_triggers list(CVE-2025-21899)

    drivers/base/node.c: fix compaction sysfs file leak(CVE-2022-49442)

    hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio(CVE-2025-21931)

    s390/cpum_sf: Handle CPU hotplug remove during sampling(CVE-2024-57849)

    bpf, sockmap: Fix double uncharge the mem of sk_msg(CVE-2022-49205)

    perf/x86/amd: fix potential integer overflow on shift of a int(CVE-2022-49748)

    firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle(CVE-2022-49370)

    driver core: fix deadlock in __device_attach(CVE-2022-49371)

    RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers(CVE-2025-21885)

    RDMA/core: Fix ib block iterator counter overflow(CVE-2023-53026)

    net: let net.core.dev_weight always be non-zero(CVE-2025-21806)

    irqchip/gic-v3: Fix GICR_CTLR.RWP polling(CVE-2022-49074)

    x86/speculation: Fill RSB on vmexit for IBRS(CVE-2022-49611)

    netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.(CVE-2023-53032)

    arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY(CVE-2024-39488)

    udp: Deal with race between UDP socket address change and rehash(CVE-2024-57974)

    net: mdio: validate parameter addr in mdiobus_get_phy().(CVE-2023-53019)

    ppp: Fix KMSAN uninit-value warning with bpf(CVE-2025-21922)

    KVM: x86: Use __try_cmpxchg_user() to update guest PTE A/D bits(CVE-2022-49562)

    NFS: Avoid writeback threads getting stuck in mempool_alloc().(CVE-2022-49097)

    virtio_net: fix xdp_rxq_info bug after suspend/resume(CVE-2022-49687)

    LSM: general protection fault in legacy_parse_param(CVE-2022-49180)

    net/mlx5: handle errors in mlx5_chains_create_table().(CVE-2025-21975)

    net: mdio: unexport __init-annotated mdio_bus_init().(CVE-2022-49350)

    be2net: Fix buffer overflow in be_get_module_eeprom(CVE-2022-49581)

    l2tp: close all race conditions in l2tp_tunnel_register().(CVE-2023-53020)

    ipvlan: ensure network headers are in skb linear part(CVE-2025-21891)

    serial: 8250: Fix PM usage_count for console handover(CVE-2022-49613)

    scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress(CVE-2023-52975)

    NFSD: Fix the behavior of READ near OFFSET_MAX(CVE-2022-48827)

    af_netlink: Fix shift out of bounds in group mask calculation(CVE-2022-49197)

    dm thin: make get_first_thin use rcu-safe list first function(CVE-2025-21664)

    netfilter: conntrack: re-fetch conntrack after insertion(CVE-2022-49561)

    mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath().(CVE-2023-52939)

    tick/nohz: unexport __init-annotated tick_nohz_full_setup().(CVE-2022-49675)

    ipv6: use RCU protection in ip6_default_advmss().(CVE-2025-21765)

    virtio_console: eliminate anonymous module_init  module_exit(CVE-2022-49100)

    net: tun: unlink NAPI from device on destruction(CVE-2022-49672)

    Drivers: hv: vmbus: Fix potential crash on module unload(CVE-2022-49098)

    net/tls: fix slab-out-of-bounds bug in decrypt_internal(CVE-2022-49094)

    keys: Fix UAF in key_put().(CVE-2025-21893)

    bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener(CVE-2023-52986)

    RDMA/hfi1: Prevent panic when SDMA is disabled(CVE-2022-49429)

    xhci: Handle TD clearing for multiple streams case(CVE-2024-40927)

    ipmr: do not call mr_mfc_uses_dev() for unres entries(CVE-2025-21719)

    scsi: hisi_sas: Add cond_resched() for no forced preemption model(CVE-2024-56589)

    veth: Ensure eth header is in skb's linear part(CVE-2022-49066)

    tracing: Fix potential double free in create_var_ref().(CVE-2022-49410)

    dmaengine: Fix double increment of client_count in dma_chan_get().(CVE-2022-49753)

    scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress(CVE-2023-52974)

    net_sched: sch_sfq: don't allow 1 packet limit(CVE-2024-57996)

    vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF(CVE-2023-52973)

    dm mirror log: round up region bitmap size to BITS_PER_LONG(CVE-2022-49710)

    x86/xen: don't do PV iret hypercall through hypercall page(CVE-2024-53241)

    bpf, sockmap: Fix more uncharged while msg has more_data(CVE-2022-49204)

    mm/khugepaged: fix -anon_vma race(CVE-2023-52935)

    dm integrity: fix memory corruption when tag_size is less than digest size(CVE-2022-49044)

    scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp().(CVE-2022-49521)

    bpf: Fix request_sock leak in sk lookup helpers(CVE-2022-49697)

    mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize().(CVE-2025-21861)

    efi: Don't map the entire mokvar table to determine its size(CVE-2025-21872)

    net: asix: add proper error handling of usb read errors(CVE-2022-49226)

    HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove().(CVE-2025-21928)

    bpf: Skip task with pid=1 in send_signal_common().(CVE-2023-52992)

    bpf: Skip invalid kfunc call in backtrack_insn(CVE-2023-52928)

    bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation(CVE-2023-53024)

    igb: Fix potential invalid memory access in igb_init_module().(CVE-2024-52332)

    ftrace: Avoid potential division by zero in function_stat_show().(CVE-2025-21898)

    efi: fix potential NULL deref in efi_mem_reserve_persistent(CVE-2023-52976)

    uprobes: Reject the shared zeropage in uprobe_write_opcode().(CVE-2025-21881)

    bnxt: Do not read past the end of test names(CVE-2023-53010)

    trace_events_hist: add check for return value of 'create_hist_field'(CVE-2023-53005)

    tracing: Make sure trace_printk() can output as soon as it can be used(CVE-2023-53007)

    Squashfs: fix handling and sanity checking of xattr_ids count(CVE-2023-52933)

    tcp: Fix a data-race around sysctl_tcp_probe_threshold.(CVE-2022-49595)

    tcp: Fix data-races around sysctl_tcp_min_snd_mss.(CVE-2022-49596)

    tcp: Fix data-races around sysctl_tcp_base_mss.(CVE-2022-49597)

    tcp: Fix data-races around sysctl_tcp_l3mdev_accept.(CVE-2022-49599)

    hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING(CVE-2025-21816)

    RDMA/hfi1: Prevent use of lock before it is initialized(CVE-2022-49433)

    cifs: fix potential memory leaks in session setup(CVE-2023-53008)

    ovl: Use 'buf' flexible array for memcpy() destination(CVE-2022-49743)

    openvswitch: fix lockup on tx to unregistering netdev with carrier(CVE-2025-21681)

    net: hns3: add vlan list lock to protect vlan list(CVE-2022-49182)

    driver: base: fix UAF when driver_attach failed(CVE-2022-49385)

    ubi: ubi_create_volume: Fix use-after-free when volume creation failed(CVE-2022-49388)

    rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read(CVE-2024-58069)

    lz4: fix LZ4_decompress_safe_partial read out of bound(CVE-2022-49078)

    um: Fix out-of-bounds read in LDT setup(CVE-2022-49395)

    KVM: Explicitly verify target vCPU is online in kvm_get_vcpu().(CVE-2024-58083)

    ipv6: mcast: extend RCU protection in igmp6_send().(CVE-2025-21759)

    vsock: Keep the binding until socket destruction(CVE-2025-21756)

    pps: Fix a use-after-free(CVE-2024-57979)

    padata: fix UAF in padata_reorder(CVE-2025-21727)

    netfilter: nf_tables: avoid skb access on nf_stolen(CVE-2022-49622)

    srcu: Tighten cleanup_srcu_struct() GP checks(CVE-2022-49651)

    openvswitch: use RCU protection in ovs_vport_cmd_fill_info().(CVE-2025-21761)

    cgroup: Use separate src/dst nodes when preloading css_sets for migration(CVE-2022-49647)

    ice: arfs: fix use-after-free when freeing @rx_cpu_rmap(CVE-2022-49063)

    macsec: fix UAF bug for real_dev(CVE-2022-49390)

    ndisc: extend RCU protection in ndisc_send_skb().(CVE-2025-21760)

    nfsd: release svc_expkey(CVE-2024-53216)

    nfsd: make sure exp active before svc_export_show(CVE-2024-56558)

    net: sched: Disallow replacing of child qdisc from one parent to another(CVE-2025-21700)

    neighbour: use RCU protection in __neigh_notify().(CVE-2025-21763)

    nfsd: clear acl_access/acl_default after releasing them(CVE-2025-21796)

    ndisc: use RCU protection in ndisc_alloc_skb().(CVE-2025-21764)

    arp: use RCU protection in arp_xmit().(CVE-2025-21762)

    iommu/arm-smmu-v3: check return value after calling platform_get_resource().(CVE-2022-49319)

    memcg: fix soft lockup in the OOM process(CVE-2024-57977)

    rdma/cxgb4: Prevent potential integer overflow on 32bit(CVE-2024-57973)

    scsi: hisi_sas: Free irq vectors in order for v3 HW(CVE-2022-49118)

    drm/plane: Move range check for format_count earlier(CVE-2021-47659)

    USB: hub: Ignore non-compliant devices with too many configs or interfaces(CVE-2025-21776)

    bpf: avoid holding freeze_mutex during mmap operation(CVE-2025-21853)

    linux/dim: Fix divide by 0 in RDMA DIM(CVE-2022-49670)

    HID: multitouch: Add NULL check in mt_input_configured(CVE-2024-58020)

    nfp: bpf: Add check for nfp_app_ctrl_msg_alloc().(CVE-2025-21848)

    KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel(CVE-2025-21779)

    usb: xhci: Fix NULL pointer dereference on certain command aborts(CVE-2024-57981)

    ceph: fix memory leak in ceph_readdir when note_last_dentry returns error(CVE-2022-49107)

    NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify().(CVE-2022-49103)

    io_uring: fix memory leak of uid in files registration(CVE-2022-49144)

    hwrng: cavium - fix NULL but dereferenced coccicheck error(CVE-2022-49177)

    mlxsw: spectrum: Guard against invalid local ports(CVE-2022-49134)

    iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe().(CVE-2022-49323)

    drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes(CVE-2022-49532)

    scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair().(CVE-2022-49155)

    NFSv4: Don't hold the layoutget locks across multiple RPC calls(CVE-2022-49316)

    kernel/resource: fix kfree() of bootmem memory again(CVE-2022-49190)

    vrf: use RCU protection in l3mdev_l3_out().(CVE-2025-21791)

    tcp: Fix a data-race around sysctl_tcp_ecn_fallback.(CVE-2022-49630)

    i2c: dev: check return value when calling dev_set_name().(CVE-2022-49046)

    list: fix a data-race around ep-rdllist(CVE-2022-49443)

    perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()(CVE-2022-49607)

    drm/amd/display: Fix memory leak(CVE-2022-49135)

    media: uvcvideo: Fix double free in error path(CVE-2024-57980)

    io_uring: prevent opcode speculation(CVE-2025-21863)

    geneve: Fix use-after-free in geneve_find_dev().(CVE-2025-21858)

    arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array(CVE-2025-21785)

    scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock(CVE-2022-49536)

    KVM: VMX: Prevent RSB underflow before vmenter(CVE-2022-49610)

    tpm: Change to kvalloc() in eventlog/acpi.c(CVE-2024-58005)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    net: gso: fix ownership in __udp_gso_segment(CVE-2025-21926)

    usbnet: gl620a: fix endpoint checking in genelink_bind().(CVE-2025-21877)

    net_sched: Prevent creation of classes with TC_H_ROOT(CVE-2025-21971)

    fbdev: hyperv_fb: Allow graceful removal of framebuffer(CVE-2025-21976)

    drm/nouveau: prime: fix refcount underflow(CVE-2024-43867)

    nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu().(CVE-2025-21927)

    nvme-pci: add missing condition check for existence of mapped data(CVE-2024-42276)

    ipv6: mcast: add RCU protection to mld_newpack().(CVE-2025-21758)

    vlan: enforce underlying device type(CVE-2025-21920)

    usb: cdc-acm: Check control transfer buffer size before access(CVE-2025-21704)

    PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1(CVE-2025-21831)

    net: sched: Disallow replacing of child qdisc from one parent to another(CVE-2025-21702)

    netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree().(CVE-2025-21959)

    ipv4: use RCU protection in __ip_rt_update_pmtu().(CVE-2025-21766)

    dm array: fix releasing a faulty array block twice in dm_array_cursor_end(CVE-2024-57929)

    hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio(CVE-2025-21931)

    cpufreq: governor: Use kobject release() method to free dbs_data(CVE-2022-49513)

    HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections(CVE-2024-57986)

    ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up(CVE-2025-21887)

    xsk: Fix race at socket teardown(CVE-2022-49215)

    acct: perform last write from workqueue(CVE-2025-21846)

    drop_monitor: fix incorrect initialization order(CVE-2025-21862)

    memcg: fix soft lockup in the OOM process(CVE-2024-57977)

    rdma/cxgb4: Prevent potential integer overflow on 32bit(CVE-2024-57973)

    iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic().(CVE-2025-21993)

    x86/kexec: fix memory leak of elf header buffer(CVE-2022-49546)

    proc: fix UAF in proc_get_inode().(CVE-2025-21999)

    tracing: Fix bad hist from corrupting named_triggers list(CVE-2025-21899)

    RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers(CVE-2025-21885)

    net: let net.core.dev_weight always be non-zero(CVE-2025-21806)

    udp: Deal with race between UDP socket address change and rehash(CVE-2024-57974)

    NFSD: Fix the behavior of READ near OFFSET_MAX(CVE-2022-48827)

    dm thin: make get_first_thin use rcu-safe list first function(CVE-2025-21664)

    ipv6: use RCU protection in ip6_default_advmss().(CVE-2025-21765)

    xhci: Handle TD clearing for multiple streams case(CVE-2024-40927)

    ipmr: do not call mr_mfc_uses_dev() for unres entries(CVE-2025-21719)

    scsi: hisi_sas: Add cond_resched() for no forced preemption model(CVE-2024-56589)

    net_sched: sch_sfq: don't allow 1 packet limit(CVE-2024-57996)

    mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize().(CVE-2025-21861)

    efi: Don't map the entire mokvar table to determine its size(CVE-2025-21872)

    net: asix: add proper error handling of usb read errors(CVE-2022-49226)

    HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove().(CVE-2025-21928)

    igb: Fix potential invalid memory access in igb_init_module().(CVE-2024-52332)

    ftrace: Avoid potential division by zero in function_stat_show().(CVE-2025-21898)

    uprobes: Reject the shared zeropage in uprobe_write_opcode().(CVE-2025-21881)

    bnxt: Do not read past the end of test names(CVE-2023-53010)

    hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING(CVE-2025-21816)

    cifs: fix potential memory leaks in session setup(CVE-2023-53008)

    ovl: Use 'buf' flexible array for memcpy() destination(CVE-2022-49743)

    openvswitch: fix lockup on tx to unregistering netdev with carrier(CVE-2025-21681)

    rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read(CVE-2024-58069)

    KVM: Explicitly verify target vCPU is online in kvm_get_vcpu().(CVE-2024-58083)

    ipv6: mcast: extend RCU protection in igmp6_send().(CVE-2025-21759)

    vsock: Keep the binding until socket destruction(CVE-2025-21756)

    pps: Fix a use-after-free(CVE-2024-57979)

    padata: fix UAF in padata_reorder(CVE-2025-21727)

    netfilter: nf_tables: avoid skb access on nf_stolen(CVE-2022-49622)

    srcu: Tighten cleanup_srcu_struct() GP checks(CVE-2022-49651)

    openvswitch: use RCU protection in ovs_vport_cmd_fill_info().(CVE-2025-21761)

    cgroup: Use separate src/dst nodes when preloading css_sets for migration(CVE-2022-49647)

    ice: arfs: fix use-after-free when freeing @rx_cpu_rmap(CVE-2022-49063)

    macsec: fix UAF bug for real_dev(CVE-2022-49390)

    ndisc: extend RCU protection in ndisc_send_skb().(CVE-2025-21760)

    nfsd: release svc_expkey(CVE-2024-53216)

    nfsd: make sure exp active before svc_export_show(CVE-2024-56558)

    net: sched: Disallow replacing of child qdisc from one parent to another(CVE-2025-21700)

    neighbour: use RCU protection in __neigh_notify().(CVE-2025-21763)

    nfsd: clear acl_access/acl_default after releasing them(CVE-2025-21796)

    ndisc: use RCU protection in ndisc_alloc_skb().(CVE-2025-21764)

    arp: use RCU protection in arp_xmit().(CVE-2025-21762)

    USB: hub: Ignore non-compliant devices with too many configs or interfaces(CVE-2025-21776)

    bpf: avoid holding freeze_mutex during mmap operation(CVE-2025-21853)

    nfp: bpf: Add check for nfp_app_ctrl_msg_alloc().(CVE-2025-21848)

    KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel(CVE-2025-21779)

    usb: xhci: Fix NULL pointer dereference on certain command aborts(CVE-2024-57981)

    mlxsw: spectrum: Guard against invalid local ports(CVE-2022-49134)

    icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr.(CVE-2022-49632)

    kernel/resource: fix kfree() of bootmem memory again(CVE-2022-49190)

    vrf: use RCU protection in l3mdev_l3_out().(CVE-2025-21791)

    tcp: Fix a data-race around sysctl_tcp_ecn_fallback.(CVE-2022-49630)

    printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX(CVE-2024-58017)

    i2c: dev: check return value when calling dev_set_name().(CVE-2022-49046)

    list: fix a data-race around ep-rdllist(CVE-2022-49443)

    drm/amd/display: Fix memory leak(CVE-2022-49135)

    media: uvcvideo: Fix double free in error path(CVE-2024-57980)

    io_uring: prevent opcode speculation(CVE-2025-21863)

    geneve: Fix use-after-free in geneve_find_dev().(CVE-2025-21858)

    arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array(CVE-2025-21785)

    scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock(CVE-2022-49536)

    KVM: VMX: Prevent RSB underflow before vmenter(CVE-2022-49610)

    tpm: Change to kvalloc() in eventlog/acpi.c(CVE-2024-58005)

    media: uvcvideo: Remove dangling pointers(CVE-2024-58002)

    padata: avoid UAF for reorder_work(CVE-2025-21726)

    ptp: Ensure info-enable callback is always set(CVE-2025-21814)

    bpf: Send signals asynchronously if !preemptible(CVE-2025-21728)

    scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI(CVE-2022-49535)

    crypto: qat - add param check for RSA(CVE-2022-49563)

    nbd: don't allow reconnect after disconnect(CVE-2025-21731)

    media: cx24116: prevent overflows on SNR calculus(CVE-2024-50290)

    crypto: qat - add param check for DH(CVE-2022-49564)

    net: usb: rtl8150: enable basic endpoint checking(CVE-2025-21708)

    scsi: qla2xxx: Fix crash during module load unload test(CVE-2022-49160)

    sctp: sysctl: rto_min/max: avoid using current-nsproxy(CVE-2025-21639)

    crypto: qat - fix memory leak in RSA(CVE-2022-49566)

    scsi: storvsc: Ratelimit warning logs to prevent VM denial of service(CVE-2025-21690)

    USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb().(CVE-2025-21689)

    ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init().(CVE-2024-53680)

    vsock/virtio: discard packets if the transport changes(CVE-2025-21669)

    vsock: prevent null-ptr-deref in vsock_*[has_data|has_space](CVE-2025-21666)

    eth: bnxt: always recalculate features after XDP clearing, fix null-deref(CVE-2025-21682)

    sched/deadline: Fix warning in migrate_enable for boosted tasks(CVE-2024-56583)

    vfio/platform: check the bounds of read/write syscalls(CVE-2025-21687)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4178 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4178-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     May 25, 2025                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux     Version        : 5.10.237-1     CVE ID         : CVE-2021-47247 CVE-2021-47489 CVE-2022-48893 CVE-2022-49046                      CVE-2022-49190 CVE-2022-49219 CVE-2022-49309 CVE-2022-49546                      CVE-2022-49728 CVE-2023-52572 CVE-2023-52621 CVE-2023-52752                      CVE-2023-52757 CVE-2023-53034 CVE-2024-26686 CVE-2024-26928                      CVE-2024-26982 CVE-2024-35867 CVE-2024-35943 CVE-2024-36908                      CVE-2024-38611 CVE-2024-39494 CVE-2024-41073 CVE-2024-42322                      CVE-2024-44938 CVE-2024-46753 CVE-2024-46812 CVE-2024-46816                      CVE-2024-46821 CVE-2024-47726 CVE-2024-47730 CVE-2024-49960                      CVE-2024-50047 CVE-2024-50154 CVE-2024-50280 CVE-2024-53144                      CVE-2024-54458 CVE-2024-56599 CVE-2024-56608 CVE-2024-56658                      CVE-2024-56664 CVE-2024-57834 CVE-2024-57973 CVE-2024-57977                      CVE-2024-57979 CVE-2024-57980 CVE-2024-57981 CVE-2024-57986                      CVE-2024-58001 CVE-2024-58002 CVE-2024-58005 CVE-2024-58007                      CVE-2024-58010 CVE-2024-58014 CVE-2024-58016 CVE-2024-58017                      CVE-2024-58020 CVE-2024-58051 CVE-2024-58052 CVE-2024-58055                      CVE-2024-58058 CVE-2024-58063 CVE-2024-58069 CVE-2024-58071                      CVE-2024-58072 CVE-2024-58083 CVE-2024-58085 CVE-2024-58090                      CVE-2025-21647 CVE-2025-21700 CVE-2025-21702 CVE-2025-21704                      CVE-2025-21708 CVE-2025-21711 CVE-2025-21715 CVE-2025-21718                      CVE-2025-21719 CVE-2025-21721 CVE-2025-21722 CVE-2025-21726                      CVE-2025-21727 CVE-2025-21728 CVE-2025-21731 CVE-2025-21735                      CVE-2025-21736 CVE-2025-21744 CVE-2025-21745 CVE-2025-21749                      CVE-2025-21753 CVE-2025-21756 CVE-2025-21760 CVE-2025-21761                      CVE-2025-21762 CVE-2025-21763 CVE-2025-21764 CVE-2025-21765                      CVE-2025-21767 CVE-2025-21772 CVE-2025-21776 CVE-2025-21779                      CVE-2025-21781 CVE-2025-21782 CVE-2025-21785 CVE-2025-21787                      CVE-2025-21791 CVE-2025-21795 CVE-2025-21796 CVE-2025-21799                      CVE-2025-21802 CVE-2025-21804 CVE-2025-21806 CVE-2025-21811                      CVE-2025-21814 CVE-2025-21823 CVE-2025-21826 CVE-2025-21835                      CVE-2025-21844 CVE-2025-21846 CVE-2025-21848 CVE-2025-21853                      CVE-2025-21858 CVE-2025-21859 CVE-2025-21862 CVE-2025-21871                      CVE-2025-21872 CVE-2025-21875 CVE-2025-21877 CVE-2025-21878                      CVE-2025-21898 CVE-2025-21904 CVE-2025-21905 CVE-2025-21909                      CVE-2025-21910 CVE-2025-21914 CVE-2025-21916 CVE-2025-21917                      CVE-2025-21920 CVE-2025-21922 CVE-2025-21925 CVE-2025-21926                      CVE-2025-21928 CVE-2025-21934 CVE-2025-21935 CVE-2025-21941                      CVE-2025-21943 CVE-2025-21948 CVE-2025-21956 CVE-2025-21957                      CVE-2025-21959 CVE-2025-21968 CVE-2025-21971 CVE-2025-21975                      CVE-2025-21981 CVE-2025-21991 CVE-2025-21992 CVE-2025-21993                      CVE-2025-21996 CVE-2025-21999 CVE-2025-22004 CVE-2025-22005                      CVE-2025-22007 CVE-2025-22008 CVE-2025-22010 CVE-2025-22014                      CVE-2025-22018 CVE-2025-22020 CVE-2025-22021 CVE-2025-22025                      CVE-2025-22027 CVE-2025-22035 CVE-2025-22044 CVE-2025-22045                      CVE-2025-22054 CVE-2025-22055 CVE-2025-22056 CVE-2025-22063                      CVE-2025-22075 CVE-2025-22079 CVE-2025-22086 CVE-2025-23136                      CVE-2025-23138 CVE-2025-23140 CVE-2025-23142 CVE-2025-23144                      CVE-2025-23145 CVE-2025-23146 CVE-2025-23147 CVE-2025-23148                      CVE-2025-23150 CVE-2025-23156 CVE-2025-23157 CVE-2025-23158                      CVE-2025-23159 CVE-2025-23163 CVE-2025-37738 CVE-2025-37739                      CVE-2025-37740 CVE-2025-37741 CVE-2025-37749 CVE-2025-37756                      CVE-2025-37757 CVE-2025-37765 CVE-2025-37766 CVE-2025-37768                      CVE-2025-37770 CVE-2025-37773 CVE-2025-37780 CVE-2025-37781                      CVE-2025-37782 CVE-2025-37785 CVE-2025-37788 CVE-2025-37789                      CVE-2025-37792 CVE-2025-37794 CVE-2025-37796 CVE-2025-37797                      CVE-2025-37803 CVE-2025-37808 CVE-2025-37810 CVE-2025-37812                      CVE-2025-37817 CVE-2025-37823 CVE-2025-37824 CVE-2025-37829                      CVE-2025-37836 CVE-2025-37838 CVE-2025-37839 CVE-2025-37840                      CVE-2025-37841 CVE-2025-37844 CVE-2025-37850 CVE-2025-37851                      CVE-2025-37857 CVE-2025-37858 CVE-2025-37859 CVE-2025-37862                      CVE-2025-37867 CVE-2025-37871 CVE-2025-37881 CVE-2025-37885                      CVE-2025-38637 CVE-2025-39728 CVE-2025-39735

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 11 bullseye, these problems have been fixed in version     5.10.237-1.  This additionally includes many more bug fixes from     stable updates 5.10.235-5.10.237.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The version of kernel installed on the remote host is prior to 5.10.236-227.928. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-090 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix use-after-free of encap entry in neigh update handler (CVE-2021-47247)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: dev: check return value when calling dev_set_name() (CVE-2022-49046)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-throttle: Set BIO_THROTTLED when bio has been throttled (CVE-2022-49465)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/kexec: fix memory leak of elf header buffer (CVE-2022-49546)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix signed integer overflow in __ip6_append_data (CVE-2022-49728)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress (CVE-2023-52975)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: handle errors from btrfs_dec_ref() properly (CVE-2024-46753)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: call the security_mmap_file() LSM hook in remap_file_pages() (CVE-2024-47745)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix race between element replace and close() (CVE-2024-56664)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI/ASPM: Fix link state exit during switch upstream function removal (CVE-2024-58093)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel (CVE-2025-21779)

    In the Linux kernel, the following vulnerability has been resolved:

    ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (CVE-2025-21887)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() (CVE-2025-21959)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: Prevent creation of classes with TC_H_ROOT (CVE-2025-21971)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: handle errors in mlx5_chains_create_table() (CVE-2025-21975)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CVE-2025-21991)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: ignore non-functional sensor in HP 5MP Camera (CVE-2025-21992)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (CVE-2025-21996)

    In the Linux kernel, the following vulnerability has been resolved:

    proc: fix UAF in proc_get_inode() (CVE-2025-21999)

    In the Linux kernel, the following vulnerability has been resolved:

    net: atm: fix use after free in lec_send() (CVE-2025-22004)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (CVE-2025-22005)

    In the Linux kernel, the following vulnerability has been resolved:

    regulator: check that dummy regulator has been probed before using it (CVE-2025-22008)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: socket: Lookup orig tuple for IPv6 SNAT (CVE-2025-22021)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: put dl_stid if fail to queue dl_recall (CVE-2025-22025)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix use-after-free in print_graph_function_flags during tracer switching (CVE-2025-22035)

    In the Linux kernel, the following vulnerability has been resolved:

    acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (CVE-2025-22044)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (CVE-2025-22045)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix geneve_opt length integer overflow (CVE-2025-22055)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_tunnel: fix geneve_opt type confusion addition (CVE-2025-22056)

    In the Linux kernel, the following vulnerability has been resolved:

    netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063)

    In the Linux kernel, the following vulnerability has been resolved:

    rtnetlink: Allocate vfinfo size for VF GUIDs when supported (CVE-2025-22075)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (CVE-2025-22086)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal: int340x: Add NULL check for adev (CVE-2025-23136)

    In the Linux kernel, the following vulnerability has been resolved:

    watch_queue: fix pipe accounting mismatch (CVE-2025-23138)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix OOB read when checking dotdot dir (CVE-2025-37785)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: skbprio: Remove overly strict queue assertions (CVE-2025-38637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1293-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
    - CVE-2021-47645: media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com     (bsc#1237767).
    - CVE-2021-47648: gpu: host1x: Fix a memory leak in 'host1x_remove()' (bsc#1237725).
    - CVE-2022-49046: i2c: dev: check return value when calling dev_set_name() (bsc#1237842).
    - CVE-2022-49051: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup (bsc#1237903).
    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49059: nfc: nci: add flush_workqueue to prevent uaf (bsc#1238007).
    - CVE-2022-49074: irqchip/gic-v3: Fix GICR_CTLR.RWP polling (bsc#1237728).
    - CVE-2022-49075: btrfs: fix qgroup reserve overflow the qgroup limit (bsc#1237733).
    - CVE-2022-49084: qede: confirm skb is allocated before using (bsc#1237751).
    - CVE-2022-49107: ceph: fix memory leak in ceph_readdir when note_last_dentry returns error (bsc#1237973).
    - CVE-2022-49109: ceph: fix inode reference leakage in ceph_get_snapdir() (bsc#1237836).
    - CVE-2022-49119: scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req() (bsc#1237925).
    - CVE-2022-49120: scsi: pm8001: Fix task leak in pm8001_send_abort_all() (bsc#1237969).
    - CVE-2022-49209: bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full (bsc#1238252).
    - CVE-2022-49220: dax: make sure inodes are flushed before destroy cache (bsc#1237936).
    - CVE-2022-49275: can: m_can: m_can_tx_handler(): fix use after free of skb (bsc#1238719).
    - CVE-2022-49286: tpm: use try_get_ops() in tpm-space.c (bsc#1238647).
    - CVE-2022-49292: ALSA: oss: Fix PCM OSS buffer allocation overflow (bsc#1238625).
    - CVE-2022-49308: extcon: Modify extcon device to be created after driver data is set (bsc#1238654).
    - CVE-2022-49331: nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling (bsc#1237813).
    - CVE-2022-49344: af_unix: Fix a data-race in unix_dgram_peer_wake_me() (bsc#1237988).
    - CVE-2022-49367: net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register (bsc#1238447).
    - CVE-2022-49370: firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (bsc#1238467).
    - CVE-2022-49372: tcp: tcp_rtx_synack() can be called from process context (bsc#1238251).
    - CVE-2022-49388: ubi: ubi_create_volume: Fix use-after-free when volume creation failed (bsc#1237934).
    - CVE-2022-49395: um: Fix out-of-bounds read in LDT setup (bsc#1237953).
    - CVE-2022-49397: phy: qcom-qmp: fix struct clk leak on probe errors (bsc#1237823).
    - CVE-2022-49404: RDMA/hfi1: Fix potential integer multiplication overflow errors (bsc#1238430).
    - CVE-2022-49416: wifi: mac80211: fix use-after-free in chanctx code (bsc#1238293).
    - CVE-2022-49433: RDMA/hfi1: Prevent use of lock before it is initialized (bsc#1238268).
    - CVE-2022-49472: net: phy: micrel: Allow probing without .driver_data (bsc#1238951).
    - CVE-2022-49488: drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock (bsc#1238600).
    - CVE-2022-49495: drm/msm/hdmi: check return value after calling platform_get_resource_byname()     (bsc#1237932).
    - CVE-2022-49497: net: remove two BUG() from skb_checksum_help() (bsc#1238946).
    - CVE-2022-49505: NFC: NULL out the dev->rfkill to prevent UAF (bsc#1238615).
    - CVE-2022-49516: ice: always check VF VSI pointer values (bsc#1238953).
    - CVE-2022-49519: ath10k: skip ath10k_halt during suspend for driver state RESTARTING (bsc#1238943).
    - CVE-2022-49524: media: pci: cx23885: Fix the error handling in cx23885_initdev() (bsc#1238949).
    - CVE-2022-49530: drm/amd/pm: fix double free in si_parse_power_table() (bsc#1238944).
    - CVE-2022-49538: ALSA: jack: Fix mutex call in snd_jack_report() (bsc#1238843).
    - CVE-2022-49544: ipw2x00: Fix potential NULL dereference in libipw_xmit() (bsc#1238721).
    - CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238729).
    - CVE-2022-49546: x86/kexec: Fix double-free of elf header buffer (bsc#1238750).
    - CVE-2022-49563: crypto: qat - add param check for RSA (bsc#1238787).
    - CVE-2022-49564: crypto: qat - add param check for DH (bsc#1238789).
    - CVE-2022-49578: ip: Fix data-races around sysctl_ip_prot_sock. (bsc#1238794).
    - CVE-2022-49581: be2net: Fix buffer overflow in be_get_module_eeprom (bsc#1238540).
    - CVE-2022-49589: kABI: protect mr_ifc_count change (bsc#1238598).
    - CVE-2022-49605: igc: Reinstate IGC_REMOVED logic and implement it properly (bsc#1238433).
    - CVE-2022-49607: perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()     (bsc#1238817).
    - CVE-2022-49610: KVM: VMX: Prevent RSB underflow before vmenter (bsc#1238952).
    - CVE-2022-49619: net: sfp: fix memory leak in sfp_probe() (bsc#1239003).
    - CVE-2022-49620: net: tipc: fix possible refcount leak in tipc_sk_create() (bsc#1239002).
    - CVE-2022-49640: sysctl: Fix data races in proc_douintvec_minmax() (bsc#1237782).
    - CVE-2022-49641: sysctl: Fix data races in proc_douintvec() (bsc#1237831).
    - CVE-2022-49667: net: bonding: fix use-after-free after 802.3ad slave unbind (bsc#1238282).
    - CVE-2022-49672: net: tun: unlink NAPI from device on destruction (bsc#1238816).
    - CVE-2022-49711: bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove() (bsc#1238416).
    - CVE-2022-49727: ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg (bsc#1239059).
    - CVE-2022-49740: wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads     (bsc#1240233).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2023-52997: ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() (bsc#1240303).
    - CVE-2023-53010: bnxt: Do not read past the end of test names (bsc#1240290).
    - CVE-2023-53019: net: mdio: validate parameter addr in mdiobus_get_phy() (bsc#1240286).
    - CVE-2024-35910: kABI fix for tcp: properly terminate timers for kernel sockets (bsc#1224489).
    - CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
    - CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226785).
    - CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
    - CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg     (bsc#1235733).
    - CVE-2024-49935: ACPI: PAD: fix crash in exit_round_robin() (bsc#1232370).
    - CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
    - CVE-2024-50269: usb: musb: sunxi: Fix accessing an released usb phy (bsc#1233458).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
    - CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
    - CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
    - CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
    - CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
    - CVE-2024-57973: rdma/cxgb4: Prevent potential integer overflow on 32bit (bsc#1238531).
    - CVE-2024-57979: kABI workaround for pps changes (bsc#1238521).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2024-58052: drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table     (bsc#1238986).
    - CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970)
    - CVE-2024-58072: wifi: rtlwifi: remove unused check_buddy_priv (bsc#1238964).
    - CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
    - CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
    - CVE-2025-21708: net: usb: rtl8150: enable basic endpoint checking (bsc#1239087).
    - CVE-2025-21744: wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() (bsc#1238903).
    - CVE-2025-21759: ipv6: mcast: extend RCU protection in igmp6_send() (bsc#1238738).
    - CVE-2025-21760: ndisc: extend RCU protection in ndisc_send_skb() (bsc#1238763).
    - CVE-2025-21762: arp: use RCU protection in arp_xmit() (bsc#1238780).
    - CVE-2025-21763: neighbour: use RCU protection in __neigh_notify() (bsc#1237897).
    - CVE-2025-21765: ipv6: use RCU protection in ip6_default_advmss() (bsc#1237906).
    - CVE-2025-21766: ipv4: use RCU protection in __ip_rt_update_pmtu() (bsc#1238754).
    - CVE-2025-21776: USB: hub: Ignore non-compliant devices with too many configs or interfaces     (bsc#1238909).
    - CVE-2025-21782: orangefs: fix a oob in orangefs_debug_write (bsc#1239117).
    - CVE-2025-21785: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (bsc#1238747).
    - CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1238512).
    - CVE-2025-21796: nfsd: clear acl_access/acl_default after releasing them (bsc#1238716).
    - CVE-2025-21802: net: hns3: fix oops when unload drivers paralleling (bsc#1238751).
    - CVE-2025-21821: fbdev: omap: use threaded IRQ for LCD DMA (bsc#1239174).
    - CVE-2025-21831: PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 (bsc#1239039).
    - CVE-2025-21846: acct: perform last write from workqueue (bsc#1239508).
    - CVE-2025-21848: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() (bsc#1239479).
    - CVE-2025-21865: gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl() (bsc#1239481).
    - CVE-2025-21871: tee: optee: Fix supplicant wait loop (bsc#1240183).
    - CVE-2025-21877: usbnet: gl620a: fix endpoint checking in genelink_bind() (bsc#1240172).
    - CVE-2025-21891: ipvlan: ensure network headers are in skb linear part (bsc#1240186).
    - CVE-2025-21916: usb: atm: cxacru: fix a flaw in existing endpoint checks (bsc#1240582).
    - CVE-2025-21922: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639).
    - CVE-2025-21934: rapidio: fix an API misues when rio_add_net() fails (bsc#1240708).
    - CVE-2025-21935: rapidio: add check for rio_add_net() in rio_scan_alloc_net() (bsc#1240700).
    - CVE-2025-21969: Bluetooth: L2CAP: Fix build errors in some archs (bsc#1240784).
    - CVE-2025-21993: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (bsc#1240797).
    - CVE-2025-21996: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (bsc#1240801).
    - CVE-2025-22007: Bluetooth: Fix error code in chan_alloc_skb_cb() (bsc#1240582).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1263-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-47248: udp: fix race between close() and udp_abort() (bsc#1224867).
    - CVE-2022-49051: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup (bsc#1237903).
    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49275: can: m_can: m_can_tx_handler(): fix use after free of skb (bsc#1238719).
    - CVE-2022-49413: bfq: Update cgroup information before merging bio (bsc#1238710).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238729).
    - CVE-2022-49563: crypto: qat - add param check for RSA (bsc#1238787).
    - CVE-2022-49564: crypto: qat - add param check for DH (bsc#1238789).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-56642: tipc: Fix use-after-free of kernel socket in cleanup_bearer() (bsc#1235433).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1241-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
    - CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync     (bsc#1239095).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1027-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
    - CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
    - CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - x86/kexec: fix memory leak of elf header buffer This is reported by kmemleak detector: unreferenced object     0xffffc900002a9000 (size 4096): comm kexec, pid 14950, jiffies 4295110793 (age 373.951s) hex dump (first     32 bytes): 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 .ELF............ 04 00 3e 00 01 00 00 00 00 00     00 00 00 00 00 00 ..>............. backtrace: [<0000000016a8ef9f>] __vmalloc_node_range+0x101/0x170     [<000000002b66b6c0>] __vmalloc_node+0xb4/0x160 [<00000000ad40107d>] crash_prepare_elf64_headers+0x8e/0xcd0     [<0000000019afff23>] crash_load_segments+0x260/0x470 [<0000000019ebe95c>] bzImage64_load+0x814/0xad0     [<0000000093e16b05>] arch_kexec_kernel_image_load+0x1be/0x2a0 [<000000009ef2fc88>]     kimage_file_alloc_init+0x2ec/0x5a0 [<0000000038f5a97a>] __do_sys_kexec_file_load+0x28d/0x530     [<0000000087c19992>] do_syscall_64+0x3b/0x90 [<0000000066e063a4>] entry_SYSCALL_64_after_hwframe+0x44/0xae     In crash_prepare_elf64_headers(), a buffer is allocated via vmalloc() to store elf headers. While it's not     freed back to system correctly when kdump kernel is reloaded or unloaded. Then memory leak is caused. Fix     it by introducing x86 specific function arch_kimage_file_post_load_cleanup(), and freeing the buffer     there. And also remove the incorrect elf header buffer freeing code. Before calling arch specific     kexec_file loading function, the image instance has been initialized. So 'image->elf_headers' must be     NULL. It doesn't make sense to free the elf header buffer in the place. Three different people have     reported three bugs about the memory leak on x86_64 inside Redhat. (CVE-2022-49546)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.15.50-23.125. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2022-002 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    drm/plane: Move range check for format_count earlier (CVE-2021-47659)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()' (CVE-2021-47660)

    A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

    With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

    A NULL pointer dereference flaw was found in the Linux kernel's KVM module, which can lead to a denial of     service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal     instruction in guest in the Intel CPU. (CVE-2022-1852)

    A use-after-free vulnerability was found in the Linux kernel's Netfilter subsystem in     net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege     escalation issue. (CVE-2022-1966)

    A use-after-free flaw was found in the Linux kernel in log_replay in fs/ntfs3/fslog.c in the NTFS journal.
    This flaw allows a local attacker to crash the system and leads to a kernel information leak problem.
    (CVE-2022-1973)

    A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an     attacker to trigger a buffer overflow via nft_set_desc_concat_parse() , causing a denial of service and     possibly to run code. (CVE-2022-2078)

    A flaw was found in hw. Incomplete cleanup of multi-core shared buffers for some Intel(r) Processors may     allow an authenticated user to enable information disclosure via local access. (CVE-2022-21123)

    A flaw was found in hw. Incomplete cleanup of microarchitectural fill buffers on some Intel(r) Processors     may allow an authenticated user to enable information disclosure via local access. (CVE-2022-21125)

    A flaw was found in hw. Incomplete cleanup in specific special register write operations for some     Intel Processors may allow an authenticated user to enable information disclosure via local access.
    (CVE-2022-21166)

    net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

    An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer     overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point     registers. (CVE-2022-32981)

    rpmsg_virtio_add_ctrl_dev in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a     double free. (CVE-2022-34494)

    rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free.
    (CVE-2022-34495)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: call genl_unregister_family() first in nbd_cleanup() (CVE-2022-49295)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: fix io hung while disconnecting device (CVE-2022-49297)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: fix race between nbd_alloc_config() and module removal (CVE-2022-49300)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4: Don't hold the layoutget locks across multiple RPC calls (CVE-2022-49316)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/arm-smmu-v3: check return value after calling platform_get_resource() (CVE-2022-49319)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix sleeping function called from invalid context on RT kernel (CVE-2022-49322)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() (CVE-2022-49323)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: add accessors to read/set tp->snd_cwnd (CVE-2022-49325)

    In the Linux kernel, the following vulnerability has been resolved:

    bcache: avoid journal no-space deadlock by reserving 1 journal bucket (CVE-2022-49327)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd (CVE-2022-49330)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: unexport __init-annotated seg6_hmac_init() (CVE-2022-49339)

    In the Linux kernel, the following vulnerability has been resolved:

    ip_gre: test csum_start instead of transport header (CVE-2022-49340)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, arm64: Clear prog->jited_len along prog->jited (CVE-2022-49341)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid cycles in directory h-tree (CVE-2022-49343)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix a data-race in unix_dgram_peer_wake_me(). (CVE-2022-49344)

    In the Linux kernel, the following vulnerability has been resolved:

    net: xfrm: unexport __init-annotated xfrm4_protocol_init() (CVE-2022-49345)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug_on in ext4_writepages (CVE-2022-49347)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state (CVE-2022-49348)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix use-after-free in ext4_rename_dir_prepare (CVE-2022-49349)

    In the Linux kernel, the following vulnerability has been resolved:

    net: mdio: unexport __init-annotated mdio_bus_init() (CVE-2022-49350)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix warning in ext4_handle_inode_extension (CVE-2022-49352)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: memleak flow rule from commit path (CVE-2022-49358)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (CVE-2022-49370)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: fix deadlock in __device_attach (CVE-2022-49371)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: tcp_rtx_synack() can be called from process context (CVE-2022-49372)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: check attribute length for bearer name (CVE-2022-49374)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: sd: Fix potential NULL pointer dereference (CVE-2022-49376)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx (CVE-2022-49377)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: Fix wait_for_device_probe() & deferred_probe_timeout interaction (CVE-2022-49379)

    In the Linux kernel, the following vulnerability has been resolved:

    md: fix double free of io_acct_set bioset (CVE-2022-49384)

    In the Linux kernel, the following vulnerability has been resolved:

    driver: base: fix UAF when driver_attach failed (CVE-2022-49385)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: usbip: fix a refcount leak in stub_probe() (CVE-2022-49389)

    In the Linux kernel, the following vulnerability has been resolved:

    md: Don't set mddev private to NULL in raid0 pers->free (CVE-2022-49400)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Clean up hash direct_functions on register failures (CVE-2022-49402)

    In the Linux kernel, the following vulnerability has been resolved:

    dlm: fix plock invalid read (CVE-2022-49407)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug_on in __es_tree_search (CVE-2022-49409)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix potential double free in create_var_ref() (CVE-2022-49410)

    In the Linux kernel, the following vulnerability has been resolved:

    bfq: Make sure bfqg for which we are queueing requests is online (CVE-2022-49411)

    In the Linux kernel, the following vulnerability has been resolved:

    bfq: Avoid merging queues with different parents (CVE-2022-49412)

    In the Linux kernel, the following vulnerability has been resolved:

    bfq: Update cgroup information before merging bio (CVE-2022-49413)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix race condition between ext4_write and ext4_convert_inline_data (CVE-2022-49414)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/arm-smmu-v3-sva: Fix mm use-after-free (CVE-2022-49426)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() (CVE-2022-49434)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: fix deadlock caused by calling printk() under tty_port->lock (CVE-2022-49441)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers/base/node.c: fix compaction sysfs file leak (CVE-2022-49442)

    In the Linux kernel, the following vulnerability has been resolved:

    list: fix a data-race around ep->rdllist (CVE-2022-49443)

    In the Linux kernel, the following vulnerability has been resolved:

    nvdimm: Fix firmware activation deadlock scenarios (CVE-2022-49446)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix listen() setting the bar too high for the prealloc rings (CVE-2022-49450)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal/core: Fix memory leak in __thermal_cooling_device_register() (CVE-2022-49468)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags (CVE-2022-49492)

    In the Linux kernel, the following vulnerability has been resolved:

    net: remove two BUG() from skb_checksum_help() (CVE-2022-49497)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: elan: Fix potential double free in elan_input_configured (CVE-2022-49508)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall (CVE-2022-49520)

    In the Linux kernel, the following vulnerability has been resolved:

    md/bitmap: don't set sb values if can't pass sanity check (CVE-2022-49526)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu-tasks: Fix race in schedule and flush work (CVE-2022-49540)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix potential double free during failed mount (CVE-2022-49541)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/kexec: fix memory leak of elf header buffer (CVE-2022-49546)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix potential array overflow in bpf_trampoline_get_progs() (CVE-2022-49548)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails (CVE-2022-49549)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: validate BOOT sectors_per_clusters (CVE-2022-49553)

    In the Linux kernel, the following vulnerability has been resolved:

    zsmalloc: fix races between asynchronous zspage free and page migration (CVE-2022-49554)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak (CVE-2022-49556)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: double hook unregistration in netns path (CVE-2022-49558)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Drop WARNs that assert a triple fault never escapes from L2 (CVE-2022-49559)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: check if cluster num is valid (CVE-2022-49560)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: re-fetch conntrack after insertion (CVE-2022-49561)

    In the Linux kernel, the following vulnerability has been resolved:

    zonefs: fix zonefs_iomap_begin() for reads (CVE-2022-49706)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add reserved GDT blocks check (CVE-2022-49707)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug_on ext4_mb_use_inode_pa (CVE-2022-49708)

    In the Linux kernel, the following vulnerability has been resolved:

    cfi: Fix __cfi_slowpath_diag RCU usage with cpuidle (CVE-2022-49709)

    In the Linux kernel, the following vulnerability has been resolved:

    dm mirror log: round up region bitmap size to BITS_PER_LONG (CVE-2022-49710)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions (CVE-2022-49715)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions (CVE-2022-49716)

    In the Linux kernel, the following vulnerability has been resolved:

    block: Fix handling of offline queues in blk_mq_alloc_request_hctx() (CVE-2022-49720)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: ftrace: consistently handle PLTs. (CVE-2022-49721)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/reset: Fix error_state_read ptr + offset use (CVE-2022-49723)

    In the Linux kernel, the following vulnerability has been resolved:

    clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() (CVE-2022-49726)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (CVE-2022-49731)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
265114	EulerOS Virtualization 2.13.1 : kernel (EulerOS-SA-2025-2168)	Nessus	Huawei Local Security Checks	high
265107	EulerOS Virtualization 2.13.0 : kernel (EulerOS-SA-2025-2169)	Nessus	Huawei Local Security Checks	high
242467	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2025-1826)	Nessus	Huawei Local Security Checks	high
242443	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2025-1827)	Nessus	Huawei Local Security Checks	high
241018	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-1704)	Nessus	Huawei Local Security Checks	high
241015	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-1689)	Nessus	Huawei Local Security Checks	high
238410	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2025-1662)	Nessus	Huawei Local Security Checks	high
238408	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2025-1661)	Nessus	Huawei Local Security Checks	high
237255	Debian dla-4178 : ata-modules-5.10.0-34-armmp-di - security update	Nessus	Debian Local Security Checks	high
235149	Photon OS 4.0: Linux PHSA-2025-4.0-0790	Nessus	PhotonOS Local Security Checks	high
234958	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2025-090)	Nessus	Amazon Linux Local Security Checks	high
234545	SUSE SLES12 Security Update : kernel (SUSE-SU-2025:1293-1)	Nessus	SuSE Local Security Checks	high
234484	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1263-1)	Nessus	SuSE Local Security Checks	high
234407	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1241-1)	Nessus	SuSE Local Security Checks	high
233410	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1027-1)	Nessus	SuSE Local Security Checks	high
227153	Linux Distros Unpatched Vulnerability : CVE-2022-49546	Nessus	Misc.	medium
163372	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2022-002 (ALASKERNEL-5.15-2022-002)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2022-49546

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high