In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Fix memory leak problem This reverts commit 46bbe5c671e06f070428b9be142cc4ee5cedebac. As commit 46bbe5c671e0 ("tracing: fix double free") said, the "double free" problem reported by clang static analyzer is: > In parse_var_defs() if there is a problem allocating > var_defs.expr, the earlier var_defs.name is freed. > This free is duplicated by free_var_defs() which frees > the rest of the list. However, if there is a problem allocating N-th var_defs.expr: + in parse_var_defs(), the freed 'earlier var_defs.name' is actually the N-th var_defs.name; + then in free_var_defs(), the names from 0th to (N-1)-th are freed; IF ALLOCATING PROBLEM HAPPENED HERE!!! -+ \ | 0th 1th (N-1)-th N-th V +-------------+-------------+-----+-------------+----------- var_defs: | name | expr | name | expr | ... | name | expr | name | /// +-------------+-------------+-----+-------------+----------- These two frees don't act on same name, so there was no "double free" problem before. Conversely, after that commit, we get a "memory leak" problem because the above "N-th var_defs.name" is not freed. If enable CONFIG_DEBUG_KMEMLEAK and inject a fault at where the N-th var_defs.expr allocated, then execute on shell like: $ echo 'hist:key=call_site:val=$v1,$v2:v1=bytes_req,v2=bytes_alloc' > \ /sys/kernel/debug/tracing/events/kmem/kmalloc/trigger Then kmemleak reports: unreferenced object 0xffff8fb100ef3518 (size 8): comm "bash", pid 196, jiffies 4295681690 (age 28.538s) hex dump (first 8 bytes): 76 31 00 00 b1 8f ff ff v1...... backtrace: [<0000000038fe4895>] kstrdup+0x2d/0x60 [<00000000c99c049a>] event_hist_trigger_parse+0x206f/0x20e0 [<00000000ae70d2cc>] trigger_process_regex+0xc0/0x110 [<0000000066737a4c>] event_trigger_write+0x75/0xd0 [<000000007341e40c>] vfs_write+0xbb/0x2a0 [<0000000087fde4c2>] ksys_write+0x59/0xd0 [<00000000581e9cdf>] do_syscall_64+0x3a/0x80 [<00000000cf3b065c>] entry_SYSCALL_64_after_hwframe+0x46/0xb0

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986618 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    tracing/histograms: Fix memory leak problem

    This reverts commit 46bbe5c671e06f070428b9be142cc4ee5cedebac.

    As commit 46bbe5c671e0 (tracing: fix double free) said, the     double free problem reported by clang static analyzer is:
      > In parse_var_defs() if there is a problem allocating       > var_defs.expr, the earlier var_defs.name is freed.
      > This free is duplicated by free_var_defs() which frees       > the rest of the list.

    However, if there is a problem allocating N-th var_defs.expr:
      + in parse_var_defs(), the freed 'earlier var_defs.name' is         actually the N-th var_defs.name;
      + then in free_var_defs(), the names from 0th to (N-1)-th are freed;

                            IF ALLOCATING PROBLEM HAPPENED HERE!!! -+                                                                      \                                                                       |               0th           1th                 (N-1)-th      N-th    V               +-------------+-------------+-----+-------------+-----------     var_defs: | name | expr | name | expr | ... | name | expr | name | ///               +-------------+-------------+-----+-------------+-----------

    These two frees don't act on same name, so there was no double free     problem before. Conversely, after that commit, we get a memory leak     problem because the above N-th var_defs.name is not freed.

    If enable CONFIG_DEBUG_KMEMLEAK and inject a fault at where the N-th     var_defs.expr allocated, then execute on shell like:
      $ echo 'hist:key=call_site:val=$v1,$v2:v1=bytes_req,v2=bytes_alloc' > \     /sys/kernel/debug/tracing/events/kmem/kmalloc/trigger

    Then kmemleak reports:
      unreferenced object 0xffff8fb100ef3518 (size 8):
        comm bash, pid 196, jiffies 4295681690 (age 28.538s)         hex dump (first 8 bytes):
          76 31 00 00 b1 8f ff ff                          v1......
        backtrace:
          [<0000000038fe4895>] kstrdup+0x2d/0x60           [<00000000c99c049a>] event_hist_trigger_parse+0x206f/0x20e0           [<00000000ae70d2cc>] trigger_process_regex+0xc0/0x110           [<0000000066737a4c>] event_trigger_write+0x75/0xd0           [<000000007341e40c>] vfs_write+0xbb/0x2a0           [<0000000087fde4c2>] ksys_write+0x59/0xd0           [<00000000581e9cdf>] do_syscall_64+0x3a/0x80           [<00000000cf3b065c>] entry_SYSCALL_64_after_hwframe+0x46/0xb0

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986773 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    tracing/histograms: Fix memory leak problem

    This reverts commit 46bbe5c671e06f070428b9be142cc4ee5cedebac.

    As commit 46bbe5c671e0 (tracing: fix double free) said, the     double free problem reported by clang static analyzer is:
      > In parse_var_defs() if there is a problem allocating       > var_defs.expr, the earlier var_defs.name is freed.
      > This free is duplicated by free_var_defs() which frees       > the rest of the list.

    However, if there is a problem allocating N-th var_defs.expr:
      + in parse_var_defs(), the freed 'earlier var_defs.name' is         actually the N-th var_defs.name;
      + then in free_var_defs(), the names from 0th to (N-1)-th are freed;

                            IF ALLOCATING PROBLEM HAPPENED HERE!!! -+                                                                      \                                                                       |               0th           1th                 (N-1)-th      N-th    V               +-------------+-------------+-----+-------------+-----------     var_defs: | name | expr | name | expr | ... | name | expr | name | ///               +-------------+-------------+-----+-------------+-----------

    These two frees don't act on same name, so there was no double free     problem before. Conversely, after that commit, we get a memory leak     problem because the above N-th var_defs.name is not freed.

    If enable CONFIG_DEBUG_KMEMLEAK and inject a fault at where the N-th     var_defs.expr allocated, then execute on shell like:
      $ echo 'hist:key=call_site:val=$v1,$v2:v1=bytes_req,v2=bytes_alloc' > \     /sys/kernel/debug/tracing/events/kmem/kmalloc/trigger

    Then kmemleak reports:
      unreferenced object 0xffff8fb100ef3518 (size 8):
        comm bash, pid 196, jiffies 4295681690 (age 28.538s)         hex dump (first 8 bytes):
          76 31 00 00 b1 8f ff ff                          v1......
        backtrace:
          [<0000000038fe4895>] kstrdup+0x2d/0x60           [<00000000c99c049a>] event_hist_trigger_parse+0x206f/0x20e0           [<00000000ae70d2cc>] trigger_process_regex+0xc0/0x110           [<0000000066737a4c>] event_trigger_write+0x75/0xd0           [<000000007341e40c>] vfs_write+0xbb/0x2a0           [<0000000087fde4c2>] ksys_write+0x59/0xd0           [<00000000581e9cdf>] do_syscall_64+0x3a/0x80           [<00000000cf3b065c>] entry_SYSCALL_64_after_hwframe+0x46/0xb0

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    drm/plane: Move range check for format_count earlier(CVE-2021-47659)

    trace_events_hist: add check for return value of 'create_hist_field'(CVE-2023-53005)

    tracing: Make sure trace_printk() can output as soon as it can be used(CVE-2023-53007)

    bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation(CVE-2023-53024)

    sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket(CVE-2024-53168)

    tracing/histograms: Fix memory leak problem(CVE-2022-49648)

    vrf: use RCU protection in l3mdev_l3_out().(CVE-2025-21791)

    net_sched: sch_sfq: don't allow 1 packet limit(CVE-2024-57996)

    net: sched: Disallow replacing of child qdisc from one parent to another(CVE-2025-21700)

    geneve: Fix use-after-free in geneve_find_dev().(CVE-2025-21858)

    macsec: fix UAF bug for real_dev(CVE-2022-49390)

    net: let net.core.dev_weight always be non-zero(CVE-2025-21806)

    net: mdio: unexport __init-annotated mdio_bus_init().(CVE-2022-49350)

    ip: Fix data-races around sysctl_ip_fwd_update_priority.(CVE-2022-49603)

    mmc: sdio: fix possible resource leaks in some error paths(CVE-2023-52730)

    ipv4: prevent potential spectre v1 gadget in ip_metrics_convert().(CVE-2023-52997)

    net: sched: Disallow replacing of child qdisc from one parent to another(CVE-2025-21702)

    net/sched: act_skbmod: prevent kernel-infoleak(CVE-2024-35893)

    netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.(CVE-2023-53032)

    net: openvswitch: fix leak of nested actions(CVE-2022-49086)

    net: mdio: validate parameter addr in mdiobus_get_phy().(CVE-2023-53019)

    selinux: ignore unknown extended permissions(CVE-2024-57931)

    vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF(CVE-2023-52973)

    driver: base: fix UAF when driver_attach failed(CVE-2022-49385)

    scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put().(CVE-2022-48758)

    rxrpc: Fix listen() setting the bar too high for the prealloc rings(CVE-2022-49450)

    ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl(CVE-2021-47634)

    media: uvcvideo: Fix double free in error path(CVE-2024-57980)

    scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI(CVE-2022-49535)

    dmaengine: Fix double increment of client_count in dma_chan_get().(CVE-2022-49753)

    memcg: fix soft lockup in the OOM process(CVE-2024-57977)

    firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle(CVE-2022-49370)

    dm raid: fix accesses beyond end of raid member array(CVE-2022-49674)

    nfsd: clear acl_access/acl_default after releasing them(CVE-2025-21796)

    Input: MT - limit max slots(CVE-2024-45008)(CVE-2024-45008)

    ubi: ubi_create_volume: Fix use-after-free when volume creation failed(CVE-2022-49388)

    scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair().(CVE-2022-49155)

    NFSD: prevent underflow in nfssvc_decode_writeargs().(CVE-2022-49280)

    dm integrity: fix memory corruption when tag_size is less than digest size(CVE-2022-49044)

    cpufreq: governor: Use kobject release() method to free dbs_data(CVE-2022-49513)

    virtio_console: eliminate anonymous module_init  module_exit(CVE-2022-49100)

    mm/khugepaged: fix -anon_vma race(CVE-2023-52935)

    tty: fix deadlock caused by calling printk() under tty_port-lock(CVE-2022-49441)

    tty: synclink_gt: Fix null-pointer-dereference in slgt_clean().(CVE-2022-49307)

    dyndbg: fix old BUG_ON in control parser(CVE-2024-35947)(CVE-2024-35947)

    ext4: fix OOB read when checking dotdot dir(CVE-2025-37785)

    arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array(CVE-2025-21785)

    net_sched: sch_sfq: move the limit validation(CVE-2025-37752)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    ipv4: Fix a data-race around sysctl_fib_sync_mem.(CVE-2022-49637)

    ima: Fix potential memory leak in ima_init_crypto().(CVE-2022-49627)

    MIPS: pgalloc: fix memory leak caused by pgd_free().(CVE-2022-49210)

    ip: Fix data-races around sysctl_ip_fwd_use_pmtu.(CVE-2022-49604)

    net: tipc: fix possible refcount leak in tipc_sk_create()(CVE-2022-49620)

    bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full(CVE-2022-49209)

    net: remove two BUG() from skb_checksum_help().(CVE-2022-49497)

    usbnet: fix memory leak in error case(CVE-2022-49657)

    ip: Fix a data-race around sysctl_ip_autobind_reuse.(CVE-2022-49600)

    cipso: Fix data-races around sysctl.(CVE-2022-49639)

    nexthop: Fix data-races around nexthop_compat_mode.(CVE-2022-49629)

    tracing/histograms: Fix memory leak problem(CVE-2022-49648)

    SUNRPC: Fix the svc_deferred_event trace class(CVE-2022-49065)

    af_unix: Fix a data-race in unix_dgram_peer_wake_me().(CVE-2022-49344)

    RDMA/cm: Fix memory leak in ib_cm_insert_listen(CVE-2022-49671)

    ip: Fix a data-race around sysctl_fwmark_reflect.(CVE-2022-49602)

    raw: Fix a data-race around sysctl_raw_l3mdev_accept.(CVE-2022-49631)

    icmp: Fix data-races around sysctl.(CVE-2022-49638)

    tty: synclink_gt: Fix null-pointer-dereference in slgt_clean().(CVE-2022-49307)

    tipc: move bc link creation back to tipc_node_create(CVE-2022-49664)

    icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr.(CVE-2022-49632)

    xprtrdma: treat all calls not a bcall when bc_serv is NULL(CVE-2022-49321)

    net: phy: micrel: Allow probing without .driver_data(CVE-2022-49472)

    tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.(CVE-2022-49601)

    ip: Fix data-races around sysctl_ip_fwd_update_priority.(CVE-2022-49603)

    igb: fix a use-after-free issue in igb_clean_tx_ring(CVE-2022-49695)

    rxrpc: Fix listen() setting the bar too high for the prealloc rings(CVE-2022-49450)

    tty: fix deadlock caused by calling printk() under tty_port-lock(CVE-2022-49441)

    media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init(CVE-2022-49478)

    ima: Fix a potential integer overflow in ima_appraise_measurement(CVE-2022-49643)

    scsi: qla2xxx: Fix scheduling while atomic(CVE-2022-49156)

    mm/mempolicy: fix uninit-value in mpol_rebind_policy().(CVE-2022-49567)

    dm raid: fix KASAN warning in raid5_add_disks(CVE-2022-49673)

    padata: avoid UAF for reorder_work(CVE-2025-21726)

    ARM: hisi: Add missing of_node_put after of_find_compatible_node(CVE-2022-49447)

    ptp: Ensure info-enable callback is always set(CVE-2025-21814)

    bpf: Send signals asynchronously if !preemptible(CVE-2025-21728)

    ext4: don't BUG if someone dirty pages without asking ext4 first(CVE-2022-49171)

    ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit(CVE-2022-49174)

    dax: make sure inodes are flushed before destroy cache(CVE-2022-49220)

    ext4: avoid cycles in directory h-tree(CVE-2022-49343)

    ext4: fix bug_on in ext4_writepages(CVE-2022-49347)

    ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state(CVE-2022-49348)

    ext4: fix use-after-free in ext4_rename_dir_prepare(CVE-2022-49349)

    ext4: fix warning in ext4_handle_inode_extension(CVE-2022-49352)

    PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store().(CVE-2022-49434)

    x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails(CVE-2022-49549)

    scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI(CVE-2022-49535)

    crypto: qat - add param check for RSA(CVE-2022-49563)

    dmaengine: idxd: Fix the error handling path in idxd_cdev_register()(CVE-2022-49422)

    RDMA/mlx5: Fix memory leak in error flow for subscribe event routine(CVE-2022-49206)

    bpf, arm64: Clear prog-jited_len along prog-jited(CVE-2022-49341)

    bpf: Fix UAF due to race between btf_try_get_module and load_module(CVE-2022-49236)

    bpf: Fix potential array overflow in bpf_trampoline_get_progs().(CVE-2022-49548)

    bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals(CVE-2022-49658)

    zsmalloc: fix races between asynchronous zspage free and page migration(CVE-2022-49554)

    tpm: fix reference counting for struct tpm_chip(CVE-2022-49287)

    netfilter: nf_tables: initialize registers in nft_do_chain().(CVE-2022-49293)

    dm ioctl: prevent potential spectre v1 gadget(CVE-2022-49122)

    scsi: sd: Fix potential NULL pointer dereference(CVE-2022-49376)

    sysctl: Fix data races in proc_douintvec_minmax().(CVE-2022-49640)

    sysctl: Fix data races in proc_douintvec().(CVE-2022-49641)

    scsi: libfc: Fix use after free in fc_exch_abts_resp().(CVE-2022-49114)

    nbd: don't allow reconnect after disconnect(CVE-2025-21731)

    tpm: use try_get_ops() in tpm-space.c(CVE-2022-49286)

    cifs: potential buffer overflow in handling symlinks(CVE-2022-49058)

    extcon: Modify extcon device to be created after driver data is set(CVE-2022-49308)

    bfq: Update cgroup information before merging bio(CVE-2022-49413)

    cifs: prevent bad output lengths in smb2_ioctl_query_info().(CVE-2022-49271)

    media: cx24116: prevent overflows on SNR calculus(CVE-2024-50290)

    thermal/core: Fix memory leak in __thermal_cooling_device_register().(CVE-2022-49468)

    nbd: call genl_unregister_family() first in nbd_cleanup().(CVE-2022-49295)

    blk-mq: don't touch -tagset in blk_mq_get_sq_hctx(CVE-2022-49377)

    bfq: Make sure bfqg for which we are queueing requests is online(CVE-2022-49411)

    nvdimm: Fix firmware activation deadlock scenarios(CVE-2022-49446)

    nbd: fix io hung while disconnecting device(CVE-2022-49297)

    crypto: qat - add param check for DH(CVE-2022-49564)

    nbd: fix race between nbd_alloc_config() and module removal(CVE-2022-49300)

    net: usb: rtl8150: enable basic endpoint checking(CVE-2025-21708)

    scsi: target: tcmu: Fix possible page UAF(CVE-2022-49053)

    block: don't delete queue kobject before its children(CVE-2022-49259)

    md/bitmap: don't set sb values if can't pass sanity check(CVE-2022-49526)

    mm/slub: add missing TID updates on slab deactivation(CVE-2022-49700)

    block: Fix handling of offline queues in blk_mq_alloc_request_hctx().(CVE-2022-49720)

    ext4: fix race condition between ext4_write and ext4_convert_inline_data(CVE-2022-49414)

    ext4: fix bug_on in __es_tree_search(CVE-2022-49409)

    net: hns3: fix oops when unload drivers paralleling(CVE-2025-21802)

    irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions(CVE-2022-49715)

    mm/mempolicy: fix mpol_new leak in shared_policy_replace(CVE-2022-49080)

    ext4: fix bug_on ext4_mb_use_inode_pa(CVE-2022-49708)

    ext4: add reserved GDT blocks check(CVE-2022-49707)

    irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions(CVE-2022-49716)

    mm: fix unexpected zeroed page mapping with zram swap(CVE-2022-49052)

    scsi: qla2xxx: Fix crash during module load unload test(CVE-2022-49160)

    sctp: sysctl: rto_min/max: avoid using current-nsproxy(CVE-2025-21639)

    crypto: qat - fix memory leak in RSA(CVE-2022-49566)

    net/mlx5: Fix variable not being completed when function returns(CVE-2025-21662)

    scsi: storvsc: Ratelimit warning logs to prevent VM denial of service(CVE-2025-21690)

    vfio/platform: check the bounds of read/write syscalls(CVE-2025-21687)

    USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb().(CVE-2025-21689)

    ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init().(CVE-2024-53680)

    bpf: fix recursive lock when verdict program return SK_PASS(CVE-2024-56694)

    mm: zswap: properly synchronize freeing resources during CPU hotunplug(CVE-2025-21693)

    filemap: avoid truncating 64-bit offset to 32 bits(CVE-2025-21665)

    iomap: avoid avoid truncating 64-bit offset to 32 bits(CVE-2025-21667)

    fs/proc: fix softlockup in __read_vmcore (part 2).(CVE-2025-21694)

    net: hns3: don't auto enable misc vector(CVE-2025-21651)

    netfilter: conntrack: clamp maximum hashtable size to INT_MAX(CVE-2025-21648)

    net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute(CVE-2025-21653)

    netfilter: ipset: Hold module reference while requesting a module(CVE-2024-56637)

    sctp: sysctl: auth_enable: avoid using current-nsproxy(CVE-2025-21638)

    sctp: sysctl: cookie_hmac_alg: avoid using current-nsproxy(CVE-2025-21640)

    af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK(CVE-2024-57901)

    net: sched: fix ordering of qlen adjustment(CVE-2024-53164)

    af_packet: fix vlan_get_tci() vs MSG_PEEK(CVE-2024-57902)

    geneve: do not assume mac header is set in geneve_xmit_skb().(CVE-2024-56636)

    RDMA/rxe: Remove the direct link to net_device(CVE-2024-57795)

    net/ipv6: release expired exception dst cached in socket(CVE-2024-56644)

    NFSD: Prevent NULL dereference in nfsd4_process_cb_update()(CVE-2024-53217)

    iommu/arm-smmu: Defer probe of clients after smmu device bound(CVE-2024-56568)

    net/sctp: Prevent autoclose integer overflow in sctp_association_init().(CVE-2024-57938)

    dlm: fix possible lkb_resource null dereference(CVE-2024-47809)

    vsock/virtio: discard packets if the transport changes(CVE-2025-21669)

    vsock: prevent null-ptr-deref in vsock_*[has_data|has_space](CVE-2025-21666)

    netfilter: nf_tables: adapt set backend to use GC transaction API(CVE-2023-52923)

    RDMA/uverbs: Prevent integer overflow issue(CVE-2024-57890)

    pinmux: Use sequential access to access desc-pinmux data(CVE-2024-47141)

    drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req().(CVE-2024-57798)

    selinux: ignore unknown extended permissions(CVE-2024-57931)

    eth: bnxt: always recalculate features after XDP clearing, fix null-deref(CVE-2025-21682)

    net: restrict SO_REUSEPORT to inet sockets(CVE-2024-57903)

    bpf: Fix bpf_sk_select_reuseport() memory leak(CVE-2025-21683)

    sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket(CVE-2024-53168)

    net: macsec: Fix offload support for NETDEV_UNREGISTER event(CVE-2022-48720)

    netfilter: nf_set_pipapo: fix initial map fill(CVE-2024-57947)

    RDMA/hfi1: Fix use-after-free bug for mm struct(CVE-2022-49076)

    tipc: fix use-after-free Read in tipc_named_reinit(CVE-2022-49696)

    net: bonding: fix use-after-free after 802.3ad slave unbind(CVE-2022-49667)

    usbnet: fix memory leak in error case(CVE-2022-49589)

    sfc: fix use after free when disabling sriov(CVE-2022-49626)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    xsk: Fix race at socket teardown(CVE-2022-49215)

    acct: perform last write from workqueue(CVE-2025-21846)

    nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags(CVE-2022-49492)

    drop_monitor: fix incorrect initialization order(CVE-2025-21862)

    iommu/arm-smmu-v3: check return value after calling platform_get_resource().(CVE-2022-49319)

    ipv4: Fix a data-race around sysctl_fib_sync_mem.(CVE-2022-49637)

    memcg: fix soft lockup in the OOM process(CVE-2024-57977)

    ima: Fix potential memory leak in ima_init_crypto().(CVE-2022-49627)

    rdma/cxgb4: Prevent potential integer overflow on 32bit(CVE-2024-57973)

    tracing: Make sure trace_printk() can output as soon as it can be used(CVE-2023-53007)

    trace_events_hist: add check for return value of 'create_hist_field'(CVE-2023-53005)

    Squashfs: fix handling and sanity checking of xattr_ids count(CVE-2023-52933)

    tcp: Fix a data-race around sysctl_tcp_probe_threshold.(CVE-2022-49595)

    tcp: Fix data-races around sysctl_tcp_min_snd_mss.(CVE-2022-49596)

    tcp: Fix data-races around sysctl_tcp_base_mss.(CVE-2022-49597)

    tcp: Fix data-races around sysctl_tcp_l3mdev_accept.(CVE-2022-49599)

    hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING(CVE-2025-21816)

    RDMA/hfi1: Prevent use of lock before it is initialized(CVE-2022-49433)

    openvswitch: fix lockup on tx to unregistering netdev with carrier(CVE-2025-21681)

    net: hns3: add vlan list lock to protect vlan list(CVE-2022-49182)

    driver: base: fix UAF when driver_attach failed(CVE-2022-49385)

    ubi: ubi_create_volume: Fix use-after-free when volume creation failed(CVE-2022-49388)

    rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read(CVE-2024-58069)

    lz4: fix LZ4_decompress_safe_partial read out of bound(CVE-2022-49078)

    um: Fix out-of-bounds read in LDT setup(CVE-2022-49395)

    KVM: Explicitly verify target vCPU is online in kvm_get_vcpu().(CVE-2024-58083)

    ipv6: mcast: extend RCU protection in igmp6_send().(CVE-2025-21759)

    vsock: Keep the binding until socket destruction(CVE-2025-21756)

    pps: Fix a use-after-free(CVE-2024-57979)

    RDMA/hfi1: Fix use-after-free bug for mm struct(CVE-2022-49076)

    padata: fix UAF in padata_reorder(CVE-2025-21727)

    net: bonding: fix use-after-free after 802.3ad slave unbind(CVE-2022-49667)

    netfilter: nf_tables: avoid skb access on nf_stolen(CVE-2022-49622)

    srcu: Tighten cleanup_srcu_struct() GP checks(CVE-2022-49651)

    openvswitch: use RCU protection in ovs_vport_cmd_fill_info().(CVE-2025-21761)

    cgroup: Use separate src/dst nodes when preloading css_sets for migration(CVE-2022-49647)

    ice: arfs: fix use-after-free when freeing @rx_cpu_rmap(CVE-2022-49063)

    sfc: fix use after free when disabling sriov(CVE-2022-49626)

    macsec: fix UAF bug for real_dev(CVE-2022-49390)

    ndisc: extend RCU protection in ndisc_send_skb().(CVE-2025-21760)

    nfsd: release svc_expkey(CVE-2024-53216)

    nfsd: make sure exp active before svc_export_show(CVE-2024-56558)

    net: sched: Disallow replacing of child qdisc from one parent to another(CVE-2025-21700)

    tipc: fix use-after-free Read in tipc_named_reinit(CVE-2022-49696)

    arp: use RCU protection in arp_xmit().(CVE-2025-21762)

    nfsd: clear acl_access/acl_default after releasing them(CVE-2025-21796)

    ndisc: use RCU protection in ndisc_alloc_skb().(CVE-2025-21764)

    neighbour: use RCU protection in __neigh_notify().(CVE-2025-21763)

    scsi: hisi_sas: Free irq vectors in order for v3 HW(CVE-2022-49118)

    drm/plane: Move range check for format_count earlier(CVE-2021-47659)

    USB: hub: Ignore non-compliant devices with too many configs or interfaces(CVE-2025-21776)

    MIPS: pgalloc: fix memory leak caused by pgd_free().(CVE-2022-49210)

    bpf: avoid holding freeze_mutex during mmap operation(CVE-2025-21853)

    ip: Fix data-races around sysctl_ip_fwd_use_pmtu.(CVE-2022-49604)

    linux/dim: Fix divide by 0 in RDMA DIM(CVE-2022-49670)

    HID: multitouch: Add NULL check in mt_input_configured(CVE-2024-58020)

    nfp: bpf: Add check for nfp_app_ctrl_msg_alloc().(CVE-2025-21848)

    net: tipc: fix possible refcount leak in tipc_sk_create()(CVE-2022-49620)

    bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full(CVE-2022-49209)

    net: remove two BUG() from skb_checksum_help().(CVE-2022-49497)

    usbnet: fix memory leak in error case(CVE-2022-49657)

    usbnet: fix memory leak in error case(CVE-2022-49589)

    ip: Fix a data-race around sysctl_ip_autobind_reuse.(CVE-2022-49600)

    cipso: Fix data-races around sysctl.(CVE-2022-49639)

    KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel(CVE-2025-21779)

    nexthop: Fix data-races around nexthop_compat_mode.(CVE-2022-49629)

    tracing/histograms: Fix memory leak problem(CVE-2022-49648)

    SUNRPC: Fix the svc_deferred_event trace class(CVE-2022-49065)

    af_unix: Fix a data-race in unix_dgram_peer_wake_me().(CVE-2022-49344)

    usb: xhci: Fix NULL pointer dereference on certain command aborts(CVE-2024-57981)

    ceph: fix memory leak in ceph_readdir when note_last_dentry returns error(CVE-2022-49107)

    NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify().(CVE-2022-49103)

    io_uring: fix memory leak of uid in files registration(CVE-2022-49144)

    RDMA/cm: Fix memory leak in ib_cm_insert_listen(CVE-2022-49671)

    ip: Fix a data-race around sysctl_fwmark_reflect.(CVE-2022-49602)

    hwrng: cavium - fix NULL but dereferenced coccicheck error(CVE-2022-49177)

    mlxsw: spectrum: Guard against invalid local ports(CVE-2022-49134)

    raw: Fix a data-race around sysctl_raw_l3mdev_accept.(CVE-2022-49631)

    icmp: Fix data-races around sysctl.(CVE-2022-49638)

    tty: synclink_gt: Fix null-pointer-dereference in slgt_clean().(CVE-2022-49307)

    iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe().(CVE-2022-49323)

    drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes(CVE-2022-49532)

    scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair().(CVE-2022-49155)

    tipc: move bc link creation back to tipc_node_create(CVE-2022-49664)

    NFSv4: Don't hold the layoutget locks across multiple RPC calls(CVE-2022-49316)

    icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr.(CVE-2022-49632)

    xprtrdma: treat all calls not a bcall when bc_serv is NULL(CVE-2022-49321)

    net: phy: micrel: Allow probing without .driver_data(CVE-2022-49472)

    tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.(CVE-2022-49601)

    kernel/resource: fix kfree() of bootmem memory again(CVE-2022-49190)

    vrf: use RCU protection in l3mdev_l3_out().(CVE-2025-21791)

    tcp: Fix a data-race around sysctl_tcp_ecn_fallback.(CVE-2022-49630)

    i2c: dev: check return value when calling dev_set_name().(CVE-2022-49046)

    list: fix a data-race around ep-rdllist(CVE-2022-49443)

    perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()(CVE-2022-49607)

    drm/amd/display: Fix memory leak(CVE-2022-49135)

    ip: Fix data-races around sysctl_ip_fwd_update_priority.(CVE-2022-49603)

    media: uvcvideo: Fix double free in error path(CVE-2024-57980)

    io_uring: prevent opcode speculation(CVE-2025-21863)

    geneve: Fix use-after-free in geneve_find_dev().(CVE-2025-21858)

    arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array(CVE-2025-21785)

    igb: fix a use-after-free issue in igb_clean_tx_ring(CVE-2022-49695)

    rxrpc: Fix listen() setting the bar too high for the prealloc rings(CVE-2022-49450)

    tty: fix deadlock caused by calling printk() under tty_port-lock(CVE-2022-49441)

    media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init(CVE-2022-49478)

    ima: Fix a potential integer overflow in ima_appraise_measurement(CVE-2022-49643)

    scsi: qla2xxx: Fix scheduling while atomic(CVE-2022-49156)

    scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock(CVE-2022-49536)

    mm/mempolicy: fix uninit-value in mpol_rebind_policy().(CVE-2022-49567)

    KVM: VMX: Prevent RSB underflow before vmenter(CVE-2022-49610)

    dm raid: fix KASAN warning in raid5_add_disks(CVE-2022-49673)

    tpm: Change to kvalloc() in eventlog/acpi.c(CVE-2024-58005)

    media: uvcvideo: Remove dangling pointers(CVE-2024-58002)

    padata: avoid UAF for reorder_work(CVE-2025-21726)

    ARM: hisi: Add missing of_node_put after of_find_compatible_node(CVE-2022-49447)

    ptp: Ensure info-enable callback is always set(CVE-2025-21814)

    bpf: Send signals asynchronously if !preemptible(CVE-2025-21728)

    ext4: don't BUG if someone dirty pages without asking ext4 first(CVE-2022-49171)

    ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit(CVE-2022-49174)

    dax: make sure inodes are flushed before destroy cache(CVE-2022-49220)

    ext4: avoid cycles in directory h-tree(CVE-2022-49343)

    ext4: fix bug_on in ext4_writepages(CVE-2022-49347)

    ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state(CVE-2022-49348)

    ext4: fix use-after-free in ext4_rename_dir_prepare(CVE-2022-49349)

    ext4: fix warning in ext4_handle_inode_extension(CVE-2022-49352)

    PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store().(CVE-2022-49434)

    x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails(CVE-2022-49549)

    scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI(CVE-2022-49535)

    crypto: qat - add param check for RSA(CVE-2022-49563)

    dmaengine: idxd: Fix the error handling path in idxd_cdev_register()(CVE-2022-49422)

    RDMA/mlx5: Fix memory leak in error flow for subscribe event routine(CVE-2022-49206)

    bpf, arm64: Clear prog-jited_len along prog-jited(CVE-2022-49341)

    bpf: Fix UAF due to race between btf_try_get_module and load_module(CVE-2022-49236)

    bpf: Fix potential array overflow in bpf_trampoline_get_progs().(CVE-2022-49548)

    bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals(CVE-2022-49658)

    zsmalloc: fix races between asynchronous zspage free and page migration(CVE-2022-49554)

    tpm: fix reference counting for struct tpm_chip(CVE-2022-49287)

    netfilter: nf_tables: initialize registers in nft_do_chain().(CVE-2022-49293)

    dm ioctl: prevent potential spectre v1 gadget(CVE-2022-49122)

    scsi: sd: Fix potential NULL pointer dereference(CVE-2022-49376)

    sysctl: Fix data races in proc_douintvec_minmax().(CVE-2022-49640)

    sysctl: Fix data races in proc_douintvec().(CVE-2022-49641)

    scsi: libfc: Fix use after free in fc_exch_abts_resp().(CVE-2022-49114)

    nbd: don't allow reconnect after disconnect(CVE-2025-21731)

    tpm: use try_get_ops() in tpm-space.c(CVE-2022-49286)

    cifs: potential buffer overflow in handling symlinks(CVE-2022-49058)

    extcon: Modify extcon device to be created after driver data is set(CVE-2022-49308)

    bfq: Update cgroup information before merging bio(CVE-2022-49413)

    cifs: prevent bad output lengths in smb2_ioctl_query_info().(CVE-2022-49271)

    media: cx24116: prevent overflows on SNR calculus(CVE-2024-50290)

    thermal/core: Fix memory leak in __thermal_cooling_device_register().(CVE-2022-49468)

    nbd: call genl_unregister_family() first in nbd_cleanup().(CVE-2022-49295)

    blk-mq: don't touch -tagset in blk_mq_get_sq_hctx(CVE-2022-49377)

    bfq: Make sure bfqg for which we are queueing requests is online(CVE-2022-49411)

    nvdimm: Fix firmware activation deadlock scenarios(CVE-2022-49446)

    crypto: qat - add param check for DH(CVE-2022-49564)

    nbd: fix race between nbd_alloc_config() and module removal(CVE-2022-49300)

    nbd: fix io hung while disconnecting device(CVE-2022-49297)

    net: usb: rtl8150: enable basic endpoint checking(CVE-2025-21708)

    scsi: target: tcmu: Fix possible page UAF(CVE-2022-49053)

    block: don't delete queue kobject before its children(CVE-2022-49259)

    md/bitmap: don't set sb values if can't pass sanity check(CVE-2022-49526)

    mm/slub: add missing TID updates on slab deactivation(CVE-2022-49700)

    block: Fix handling of offline queues in blk_mq_alloc_request_hctx().(CVE-2022-49720)

    ext4: fix race condition between ext4_write and ext4_convert_inline_data(CVE-2022-49414)

    ext4: fix bug_on in __es_tree_search(CVE-2022-49409)

    net: hns3: fix oops when unload drivers paralleling(CVE-2025-21802)

    irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions(CVE-2022-49715)

    mm/mempolicy: fix mpol_new leak in shared_policy_replace(CVE-2022-49080)

    ext4: fix bug_on ext4_mb_use_inode_pa(CVE-2022-49708)

    ext4: add reserved GDT blocks check(CVE-2022-49707)

    irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions(CVE-2022-49716)

    mm: fix unexpected zeroed page mapping with zram swap(CVE-2022-49052)

    scsi: qla2xxx: Fix crash during module load unload test(CVE-2022-49160)

    sctp: sysctl: rto_min/max: avoid using current-nsproxy(CVE-2025-21639)

    crypto: qat - fix memory leak in RSA(CVE-2022-49566)

    net/mlx5: Fix variable not being completed when function returns(CVE-2025-21662)

    scsi: storvsc: Ratelimit warning logs to prevent VM denial of service(CVE-2025-21690)

    vfio/platform: check the bounds of read/write syscalls(CVE-2025-21687)

    USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb().(CVE-2025-21689)

    ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init().(CVE-2024-53680)

    bpf: fix recursive lock when verdict program return SK_PASS(CVE-2024-56694)

    mm: zswap: properly synchronize freeing resources during CPU hotunplug(CVE-2025-21693)

    ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up(CVE-2025-21887)

    net: asix: add proper error handling of usb read errors(CVE-2022-49226)

    mm/khugepaged: fix -anon_vma race(CVE-2023-52935)

    HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections(CVE-2024-57986)

    proc: fix UAF in proc_get_inode().(CVE-2025-21999)

    smb: client: Add check for next_buffer in receive_encrypted_standard().(CVE-2025-21844)

    exec: don't WARN for racy path_noexec check(CVE-2024-50010)

    kthread: unpark only parked kthread(CVE-2024-50019)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-587.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: io_uring: prevent opcode speculation     sqe->opcode is used for different tables, make sure we santitise it against speculations. (CVE-2025-21863)

  - A use-after-free flaw was found in the Linux kernel's SGI GRU driver in the way the first     gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the     gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate     their privileges on the system. (CVE-2022-3424)

  - In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Fix memory leak     problem This reverts commit 46bbe5c671e06f070428b9be142cc4ee5cedebac. As commit 46bbe5c671e0 (tracing:
    fix double free) said, the double free problem reported by clang static analyzer is: > In     parse_var_defs() if there is a problem allocating > var_defs.expr, the earlier var_defs.name is freed. >     This free is duplicated by free_var_defs() which frees > the rest of the list. However, if there is a     problem allocating N-th var_defs.expr: + in parse_var_defs(), the freed 'earlier var_defs.name' is     actually the N-th var_defs.name; + then in free_var_defs(), the names from 0th to (N-1)-th are freed; IF     ALLOCATING PROBLEM HAPPENED HERE!!! -+ \ | 0th 1th (N-1)-th N-th V     +-------------+-------------+-----+-------------+----------- var_defs: | name | expr | name | expr | ... |     name | expr | name | /// +-------------+-------------+-----+-------------+----------- These two frees     don't act on same name, so there was no double free problem before. Conversely, after that commit, we     get a memory leak problem because the above N-th var_defs.name is not freed. If enable     CONFIG_DEBUG_KMEMLEAK and inject a fault at where the N-th var_defs.expr allocated, then execute on shell     like: $ echo 'hist:key=call_site:val=$v1,$v2:v1=bytes_req,v2=bytes_alloc' > \     /sys/kernel/debug/tracing/events/kmem/kmalloc/trigger Then kmemleak reports: unreferenced object     0xffff8fb100ef3518 (size 8): comm bash, pid 196, jiffies 4295681690 (age 28.538s) hex dump (first 8     bytes): 76 31 00 00 b1 8f ff ff v1...... backtrace: [<0000000038fe4895>] kstrdup+0x2d/0x60     [<00000000c99c049a>] event_hist_trigger_parse+0x206f/0x20e0 [<00000000ae70d2cc>]     trigger_process_regex+0xc0/0x110 [<0000000066737a4c>] event_trigger_write+0x75/0xd0 [<000000007341e40c>]     vfs_write+0xbb/0x2a0 [<0000000087fde4c2>] ksys_write+0x59/0xd0 [<00000000581e9cdf>]     do_syscall_64+0x3a/0x80 [<00000000cf3b065c>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 (CVE-2022-49648)

  - In the Linux kernel, the following vulnerability has been resolved: security/keys: fix slab-out-of-bounds     in key_task_permission KASAN reports an out of bounds read: BUG: KASAN: slab-out-of-bounds in __kuid_val     include/linux/uidgid.h:36 BUG: KASAN: slab-out-of-bounds in uid_eq include/linux/uidgid.h:63 [inline] BUG:
    KASAN: slab-out-of-bounds in key_task_permission+0x394/0x410 security/keys/permission.c:54 Read of size 4     at addr ffff88813c3ab618 by task stress-ng/4362 CPU: 2 PID: 4362 Comm: stress-ng Not tainted     5.10.0-14930-gafbffd6c3ede #15 Call Trace: __dump_stack lib/dump_stack.c:82 [inline]     dump_stack+0x107/0x167 lib/dump_stack.c:123 print_address_description.constprop.0+0x19/0x170     mm/kasan/report.c:400 __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560 kasan_report+0x3a/0x50     mm/kasan/report.c:585 __kuid_val include/linux/uidgid.h:36 [inline] uid_eq include/linux/uidgid.h:63     [inline] key_task_permission+0x394/0x410 security/keys/permission.c:54 search_nested_keyrings+0x90e/0xe90     security/keys/keyring.c:793 This issue was also reported by syzbot. It can be reproduced by following     these steps(more details [1]): 1. Obtain more than 32 inputs that have similar hashes, which ends with the     pattern '0xxxxxxxe6'. 2. Reboot and add the keys obtained in step 1. The reproducer demonstrates how this     issue happened: 1. In the search_nested_keyrings function, when it iterates through the slots in a     node(below tag ascend_to_node), if the slot pointer is meta and node->back_pointer != NULL(it means a     root), it will proceed to descend_to_node. However, there is an exception. If node is the root, and one of     the slots points to a shortcut, it will be treated as a keyring. 2. Whether the ptr is keyring decided by     keyring_ptr_is_keyring function. However, KEYRING_PTR_SUBTYPE is 0x2UL, the same as     ASSOC_ARRAY_PTR_SUBTYPE_MASK. 3. When 32 keys with the similar hashes are added to the tree, the ROOT has     keys with hashes that are not similar (e.g. slot 0) and it splits NODE A without using a shortcut. When     NODE A is filled with keys that all hashes are xxe6, the keys are similar, NODE A will split with a     shortcut. Finally, it forms the tree as shown below, where slot 6 points to a shortcut. NODE A     +------>+---+ ROOT | | 0 | xxe6 +---+ | +---+ xxxx | 0 | shortcut : : xxe6 +---+ | +---+ xxe6 : : | | |     xxe6 +---+ | +---+ | 6 |---+ : : xxe6 +---+ +---+ xxe6 : : | f | xxe6 +---+ +---+ xxe6 | f | +---+ 4. As     mentioned above, If a slot(slot 6) of the root points to a shortcut, it may be mistakenly transferred to a     key*, leading to a read out-of-bounds read. To fix this issue, one should jump to descend_to_node if the     ptr is a shortcut, regardless of whether the node is root or not. [1] https://lore.kernel.org/linux-     kernel/1cfa878e-8c7b-4570-8606-21daf5e13ce7@huaweicloud.com/ [jarkko: tweaked the commit message a bit to     have an appropriate closes tag.] (CVE-2024-50301)

  - In the Linux kernel, the following vulnerability has been resolved: af_packet: fix     vlan_get_protocol_dgram() vs MSG_PEEK Blamed commit forgot MSG_PEEK case, allowing a crash [1] as found by     syzbot. Rework vlan_get_protocol_dgram() to not touch skb at all, so that it can be used from many cpus on     the same skb. Add a const qualifier to skb argument. [1] skbuff: skb_under_panic: text:ffffffff8a8ccd05     len:29 put:14 head:ffff88807fc8e400 data:ffff88807fc8e3f4 tail:0x11 end:0x140 dev:<NULL> ------------[ cut     here ]------------ kernel BUG at net/core/skbuff.c:206 ! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN     PTI CPU: 1 UID: 0 PID: 5892 Comm: syz-executor883 Not tainted 6.13.0-rc4-syzkaller-00054-gd6ef8b40d075 #0     Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP:
    0010:skb_panic net/core/skbuff.c:206 [inline] RIP: 0010:skb_under_panic+0x14b/0x150 net/core/skbuff.c:216     Code: 0b 8d 48 c7 c6 86 d5 25 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8     5a 69 79 f7 48 83 c4 20 90 <0f> 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 RSP:
    0018:ffffc900038d7638 EFLAGS: 00010282 RAX: 0000000000000087 RBX: dffffc0000000000 RCX: 609ffd18ea660600     RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffff88802483c8d0 R08:
    ffffffff817f0a8c R09: 1ffff9200071ae60 R10: dffffc0000000000 R11: fffff5200071ae61 R12: 0000000000000140     R13: ffff88807fc8e400 R14: ffff88807fc8e3f4 R15: 0000000000000011 FS: 00007fbac5e006c0(0000)     GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
    00007fbac5e00d58 CR3: 000000001238e000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000     DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK>     skb_push+0xe5/0x100 net/core/skbuff.c:2636 vlan_get_protocol_dgram+0x165/0x290 net/packet/af_packet.c:585     packet_recvmsg+0x948/0x1ef0 net/packet/af_packet.c:3552 sock_recvmsg_nosec net/socket.c:1033 [inline]     sock_recvmsg+0x22f/0x280 net/socket.c:1055 ____sys_recvmsg+0x1c6/0x480 net/socket.c:2803 ___sys_recvmsg     net/socket.c:2845 [inline] do_recvmmsg+0x426/0xab0 net/socket.c:2940 __sys_recvmmsg net/socket.c:3014     [inline] __do_sys_recvmmsg net/socket.c:3037 [inline] __se_sys_recvmmsg net/socket.c:3030 [inline]
    __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3030 do_syscall_x64 arch/x86/entry/common.c:52 [inline]     do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f     (CVE-2024-57901)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1263-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-47248: udp: fix race between close() and udp_abort() (bsc#1224867).
    - CVE-2022-49051: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup (bsc#1237903).
    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49275: can: m_can: m_can_tx_handler(): fix use after free of skb (bsc#1238719).
    - CVE-2022-49413: bfq: Update cgroup information before merging bio (bsc#1238710).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238729).
    - CVE-2022-49563: crypto: qat - add param check for RSA (bsc#1238787).
    - CVE-2022-49564: crypto: qat - add param check for DH (bsc#1238789).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-56642: tipc: Fix use-after-free of kernel socket in cleanup_bearer() (bsc#1235433).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1241-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
    - CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync     (bsc#1239095).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1027-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
    - CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
    - CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Fix memory leak     problem This reverts commit 46bbe5c671e06f070428b9be142cc4ee5cedebac. As commit 46bbe5c671e0 (tracing:
    fix double free) said, the double free problem reported by clang static analyzer is: > In     parse_var_defs() if there is a problem allocating > var_defs.expr, the earlier var_defs.name is freed. >     This free is duplicated by free_var_defs() which frees > the rest of the list. However, if there is a     problem allocating N-th var_defs.expr: + in parse_var_defs(), the freed 'earlier var_defs.name' is     actually the N-th var_defs.name; + then in free_var_defs(), the names from 0th to (N-1)-th are freed; IF     ALLOCATING PROBLEM HAPPENED HERE!!! -+ \ | 0th 1th (N-1)-th N-th V     +-------------+-------------+-----+-------------+----------- var_defs: | name | expr | name | expr | ... |     name | expr | name | /// +-------------+-------------+-----+-------------+----------- These two frees     don't act on same name, so there was no double free problem before. Conversely, after that commit, we     get a memory leak problem because the above N-th var_defs.name is not freed. If enable     CONFIG_DEBUG_KMEMLEAK and inject a fault at where the N-th var_defs.expr allocated, then execute on shell     like: $ echo 'hist:key=call_site:val=$v1,$v2:v1=bytes_req,v2=bytes_alloc' > \     /sys/kernel/debug/tracing/events/kmem/kmalloc/trigger Then kmemleak reports: unreferenced object     0xffff8fb100ef3518 (size 8): comm bash, pid 196, jiffies 4295681690 (age 28.538s) hex dump (first 8     bytes): 76 31 00 00 b1 8f ff ff v1...... backtrace: [<0000000038fe4895>] kstrdup+0x2d/0x60     [<00000000c99c049a>] event_hist_trigger_parse+0x206f/0x20e0 [<00000000ae70d2cc>]     trigger_process_regex+0xc0/0x110 [<0000000066737a4c>] event_trigger_write+0x75/0xd0 [<000000007341e40c>]     vfs_write+0xbb/0x2a0 [<0000000087fde4c2>] ksys_write+0x59/0xd0 [<00000000581e9cdf>]     do_syscall_64+0x3a/0x80 [<00000000cf3b065c>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 (CVE-2022-49648)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
269062	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-986618)	Nessus	Unity Linux Local Security Checks	medium
268627	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986773)	Nessus	Unity Linux Local Security Checks	medium
241806	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2025-1777)	Nessus	Huawei Local Security Checks	high
238226	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-1635)	Nessus	Huawei Local Security Checks	high
238210	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-1618)	Nessus	Huawei Local Security Checks	high
238183	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2025-1590)	Nessus	Huawei Local Security Checks	high
238182	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2025-1589)	Nessus	Huawei Local Security Checks	high
237260	CentOS 9 : kernel-5.14.0-587.el9	Nessus	CentOS Local Security Checks	high
234484	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1263-1)	Nessus	SuSE Local Security Checks	high
234407	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1241-1)	Nessus	SuSE Local Security Checks	high
233410	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1027-1)	Nessus	SuSE Local Security Checks	high
227124	Linux Distros Unpatched Vulnerability : CVE-2022-49648	Nessus	Misc.	medium

Detections

Analytics

CVE-2022-49648

medium

Tenable Plugins

medium

medium

high

high

high

high

high

high

high

high

high

medium