In the Linux kernel, the following vulnerability has been resolved: i2c: piix4: Fix adapter not be removed in piix4_remove() In piix4_probe(), the piix4 adapter will be registered in: piix4_probe() piix4_add_adapters_sb800() / piix4_add_adapter() i2c_add_adapter() Based on the probed device type, piix4_add_adapters_sb800() or single piix4_add_adapter() will be called. For the former case, piix4_adapter_count is set as the number of adapters, while for antoher case it is not set and kept default *zero*. When piix4 is removed, piix4_remove() removes the adapters added in piix4_probe(), basing on the piix4_adapter_count value. Because the count is zero for the single adapter case, the adapter won't be removed and makes the sources allocated for adapter leaked, such as the i2c client and device. These sources can still be accessed by i2c or bus and cause problems. An easily reproduced case is that if a new adapter is registered, i2c will get the leaked adapter and try to call smbus_algorithm, which was already freed: Triggered by: rmmod i2c_piix4 && modprobe max31730 BUG: unable to handle page fault for address: ffffffffc053d860 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 3752 Comm: modprobe Tainted: G Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:i2c_default_probe (drivers/i2c/i2c-core-base.c:2259) i2c_core RSP: 0018:ffff888107477710 EFLAGS: 00000246 ... <TASK> i2c_detect (drivers/i2c/i2c-core-base.c:2302) i2c_core __process_new_driver (drivers/i2c/i2c-core-base.c:1336) i2c_core bus_for_each_dev (drivers/base/bus.c:301) i2c_for_each_dev (drivers/i2c/i2c-core-base.c:1823) i2c_core i2c_register_driver (drivers/i2c/i2c-core-base.c:1861) i2c_core do_one_initcall (init/main.c:1296) do_init_module (kernel/module/main.c:2455) ... </TASK> ---[ end trace 0000000000000000 ]--- Fix this problem by correctly set piix4_adapter_count as 1 for the single adapter so it can be normally removed.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777633439 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: capabilities: fix undefined behavior     in bit shift for CAP_TO_MASK Shifting signed 32-bit value by 31 bits is undefined, so changing significant     bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in     security/commoncap.c:1252:2 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace:
    <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e
    __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c cap_task_prctl+0x561/0x6f0 security_task_prctl+0x5a/0xb0
    __x64_sys_prctl+0x61/0x8f0 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK>     (CVE-2022-49870)

  - In the Linux kernel, the following vulnerability has been resolved: intel_th: Fix a resource leak in an     error handling path If an error occurs after calling 'pci_alloc_irq_vectors()', 'pci_free_irq_vectors()'     must be called as already done in the remove function. (CVE-2022-50143)

  - In the Linux kernel, the following vulnerability has been resolved: xsk: Fix xsk_diag use-after-free error     during socket cleanup Fix a use-after-free error that is possible if the xsk_diag interface is used after     the socket has been unbound from the device. This can happen either due to the socket being closed or the     device disappearing. In the early days of AF_XDP, the way we tested that a socket was not bound to a     device was to simply check if the netdevice pointer in the xsk socket structure was NULL. Later, a better     system was introduced by having an explicit state variable in the xsk socket struct. For example, the     state of a socket that is on the way to being closed and has been unbound from the device is XSK_UNBOUND.
    The commit in the Fixes tag below deleted the old way of signalling that a socket is unbound, setting dev     to NULL. This in the belief that all code using the old way had been exterminated. That was unfortunately     not true as the xsk diagnostics code was still using the old way and thus does not work as intended when a     socket is going down. Fix this by introducing a test against the state variable. If the socket is in the     state XSK_UNBOUND, simply abort the diagnostic's netlink operation. (CVE-2023-53426)

  - In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix use-after-free when removing     resource in vmci_resource_remove() When removing a resource from vmci_resource_table in     vmci_resource_remove(), the search is performed using the resource handle by comparing context and     resource fields. It is possible though to create two resources with different types but same handle (same     context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not     remove the intended one, but the object will still be freed as in the case of the datagram type in     vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource     leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal     include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410     drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-     executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9     lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239
    __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442     vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410     drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9     drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1     drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put     drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6     drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143
    __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164     tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189     kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220
    __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42     kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86     entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the     resource from vmci_resource_table in vmci_resource_remove(). (CVE-2024-46738)

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Consider the NULL character     when validating the event length strlen() returns a string length excluding the null byte. If the string     length equals to the maximum buffer length, the buffer will have no space for the NULL terminating     character. This commit checks this condition and returns failure for it. (CVE-2024-50131)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777633439 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: capabilities: fix undefined behavior     in bit shift for CAP_TO_MASK Shifting signed 32-bit value by 31 bits is undefined, so changing significant     bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in     security/commoncap.c:1252:2 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace:
    <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e
    __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c cap_task_prctl+0x561/0x6f0 security_task_prctl+0x5a/0xb0
    __x64_sys_prctl+0x61/0x8f0 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK>     (CVE-2022-49870)

  - In the Linux kernel, the following vulnerability has been resolved: intel_th: Fix a resource leak in an     error handling path If an error occurs after calling 'pci_alloc_irq_vectors()', 'pci_free_irq_vectors()'     must be called as already done in the remove function. (CVE-2022-50143)

  - In the Linux kernel, the following vulnerability has been resolved: xsk: Fix xsk_diag use-after-free error     during socket cleanup Fix a use-after-free error that is possible if the xsk_diag interface is used after     the socket has been unbound from the device. This can happen either due to the socket being closed or the     device disappearing. In the early days of AF_XDP, the way we tested that a socket was not bound to a     device was to simply check if the netdevice pointer in the xsk socket structure was NULL. Later, a better     system was introduced by having an explicit state variable in the xsk socket struct. For example, the     state of a socket that is on the way to being closed and has been unbound from the device is XSK_UNBOUND.
    The commit in the Fixes tag below deleted the old way of signalling that a socket is unbound, setting dev     to NULL. This in the belief that all code using the old way had been exterminated. That was unfortunately     not true as the xsk diagnostics code was still using the old way and thus does not work as intended when a     socket is going down. Fix this by introducing a test against the state variable. If the socket is in the     state XSK_UNBOUND, simply abort the diagnostic's netlink operation. (CVE-2023-53426)

  - In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix use-after-free when removing     resource in vmci_resource_remove() When removing a resource from vmci_resource_table in     vmci_resource_remove(), the search is performed using the resource handle by comparing context and     resource fields. It is possible though to create two resources with different types but same handle (same     context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not     remove the intended one, but the object will still be freed as in the case of the datagram type in     vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource     leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal     include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410     drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-     executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9     lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239
    __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442     vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410     drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9     drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1     drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put     drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6     drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143
    __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164     tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189     kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220
    __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42     kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86     entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the     resource from vmci_resource_table in vmci_resource_remove(). (CVE-2024-46738)

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Consider the NULL character     when validating the event length strlen() returns a string length excluding the null byte. If the string     length equals to the maximum buffer length, the buffer will have no space for the NULL terminating     character. This commit checks this condition and returns failure for it. (CVE-2024-50131)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1777616064 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in     create_var_ref() In create_var_ref(), init_var_ref() is called to initialize the fields of variable     ref_field, which is allocated in the previous function call to create_hist_field(). Function     init_var_ref() allocates the corresponding fields such as ref_field->system, but frees these fields when     the function encounters an error. The caller later calls destroy_hist_field() to conduct error handling,     which frees the fields and the variable itself. This results in double free of the fields which are     already freed in the previous function. Fix this by storing NULL to the corresponding fields when they are     freed in init_var_ref(). (CVE-2022-49410)

  - In the Linux kernel, the following vulnerability has been resolved: net: mdio: fix undefined behavior in     bit shift for __mdiobus_register Shifting signed 32-bit value by 31 bits is undefined, so changing     significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in     drivers/net/phy/mdio_bus.c:586:27 left shift of 1 by 31 places cannot be represented in type 'int' Call     Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e
    __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c __mdiobus_register+0x49d/0x4e0     fixed_mdio_bus_init+0xd8/0x12d do_one_initcall+0x76/0x430 kernel_init_freeable+0x3b3/0x422     kernel_init+0x24/0x1e0 ret_from_fork+0x1f/0x30 </TASK> (CVE-2022-49907)

  - In the Linux kernel, the following vulnerability has been resolved: vt: Clear selection before changing     the font When changing the console font with ioctl(KDFONTOP) the new font size can be bigger than the     previous font. A previous selection may thus now be outside of the new screen size and thus trigger out-     of-bounds accesses to graphics memory if the selection is removed in vc_do_resize(). Prevent such out-of-     memory accesses by dropping the selection before the various con_font_set() console handlers are called.
    (CVE-2022-49948)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix double free on     tx path. We see kernel crashes and lockups and KASAN errors related to ax210 firmware crashes. One of the     KASAN dumps pointed at the tx path, and it appears there is indeed a way to double-free an skb. If     iwl_mvm_tx_skb_sta returns non-zero, then the 'skb' sent into the method will be freed. But, in case where     we build TSO skb buffer, the skb may also be freed in error case. So, return 0 in that particular error     case and do cleanup manually. BUG: KASAN: use-after-free in __list_del_entry_valid+0x12/0x90 iwlwifi     0000:06:00.0: 0x00000000 | tsf hi Read of size 8 at addr ffff88813cfa4ba0 by task btserver/9650 CPU: 4     PID: 9650 Comm: btserver Tainted: G W 5.19.8+ #5 iwlwifi 0000:06:00.0: 0x00000000 | time gp1 Hardware     name: Default string Default string/SKYBAY, BIOS 5.12 02/19/2019 Call Trace: <TASK>     dump_stack_lvl+0x55/0x6d print_report.cold.12+0xf2/0x684 iwlwifi 0000:06:00.0: 0x1D0915A8 | time gp2 ?
    __list_del_entry_valid+0x12/0x90 kasan_report+0x8b/0x180 iwlwifi 0000:06:00.0: 0x00000001 | uCode revision     type ? __list_del_entry_valid+0x12/0x90 __list_del_entry_valid+0x12/0x90 iwlwifi 0000:06:00.0: 0x00000048     | uCode version major tcp_update_skb_after_send+0x5d/0x170 __tcp_transmit_skb+0xb61/0x15c0 iwlwifi     0000:06:00.0: 0xDAA05125 | uCode version minor ? __tcp_select_window+0x490/0x490 iwlwifi 0000:06:00.0:
    0x00000420 | hw version ? trace_kmalloc_node+0x29/0xd0 ? __kmalloc_node_track_caller+0x12a/0x260 ?     memset+0x1f/0x40 ? __build_skb_around+0x125/0x150 ? __alloc_skb+0x1d4/0x220 ?     skb_zerocopy_clone+0x55/0x230 iwlwifi 0000:06:00.0: 0x00489002 | board version ? kmalloc_reserve+0x80/0x80     ? rcu_read_lock_bh_held+0x60/0xb0 tcp_write_xmit+0x3f1/0x24d0 iwlwifi 0000:06:00.0: 0x034E001C | hcmd ?
    __check_object_size+0x180/0x350 iwlwifi 0000:06:00.0: 0x24020000 | isr0 tcp_sendmsg_locked+0x8a9/0x1520     iwlwifi 0000:06:00.0: 0x01400000 | isr1 ? tcp_sendpage+0x50/0x50 iwlwifi 0000:06:00.0: 0x48F0000A | isr2 ?     lock_release+0xb9/0x400 ? tcp_sendmsg+0x14/0x40 iwlwifi 0000:06:00.0: 0x00C3080C | isr3 ?     lock_downgrade+0x390/0x390 ? do_raw_spin_lock+0x114/0x1d0 iwlwifi 0000:06:00.0: 0x00200000 | isr4 ?     rwlock_bug.part.2+0x50/0x50 iwlwifi 0000:06:00.0: 0x034A001C | last cmd Id ? rwlock_bug.part.2+0x50/0x50 ?     lockdep_hardirqs_on_prepare+0xe/0x200 iwlwifi 0000:06:00.0: 0x0000C2F0 | wait_event ?
    __local_bh_enable_ip+0x87/0xe0 ? inet_send_prepare+0x220/0x220 iwlwifi 0000:06:00.0: 0x000000C4 |     l2p_control tcp_sendmsg+0x22/0x40 sock_sendmsg+0x5f/0x70 iwlwifi 0000:06:00.0: 0x00010034 | l2p_duration
    __sys_sendto+0x19d/0x250 iwlwifi 0000:06:00.0: 0x00000007 | l2p_mhvalid ? __ia32_sys_getpeername+0x40/0x40     iwlwifi 0000:06:00.0: 0x00000000 | l2p_addr_match ? rcu_read_lock_held_common+0x12/0x50 ?     rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? rcu_read_lock_sched_held+0x5a/0xd0     ? rcu_read_lock_sched_held+0x5a/0xd0 ? lock_release+0xb9/0x400 ? lock_downgrade+0x390/0x390 ?     ktime_get+0x64/0x130 ? ktime_get+0x8d/0x130 ? rcu_read_lock_held_common+0x12/0x50 ?     rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_held_common+0x12/0x50 ?     rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? rcu_read_lock_bh_held+0xb0/0xb0
    __x64_sys_sendto+0x6f/0x80 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP:
    0033:0x7f1d126e4531 Code: 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 35 80 0c 00 41 89 ca 8b 00 85 c0     75 1c 45 31 c9 45 31 c0 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 67 c3 66 0f 1f 44 00 00 55 48 83 ec 20     48 89 RSP: 002b:00007ffe21a679d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX:
    000000000000ffdc RCX: 00007f1d126e4531 RDX: 0000000000010000 RSI: 000000000374acf0 RDI: 0000000000000014     RBP: 00007ffe21a67ac0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11:
    0000000000000246 R ---truncated--- (CVE-2022-50248)

  - In the Linux kernel, the following vulnerability has been resolved: mmc: rtsx_usb_sdmmc: fix return value     check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that     allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added     device in the remove path. So fix this by checking the return value and calling mmc_free_host() in the     error path, besides, led_classdev_unregister() and pm_runtime_disable() also need be called.
    (CVE-2022-50347)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993280 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: piix4: Fix adapter not be removed in piix4_remove()

    In piix4_probe(), the piix4 adapter will be registered in:

       piix4_probe()          piix4_add_adapters_sb800() / piix4_add_adapter()            i2c_add_adapter()

    Based on the probed device type, piix4_add_adapters_sb800() or single     piix4_add_adapter() will be called.
    For the former case, piix4_adapter_count is set as the number of adapters,     while for antoher case it is not set and kept default *zero*.

    When piix4 is removed, piix4_remove() removes the adapters added in     piix4_probe(), basing on the piix4_adapter_count value.
    Because the count is zero for the single adapter case, the adapter won't     be removed and makes the sources allocated for adapter leaked, such as     the i2c client and device.

    These sources can still be accessed by i2c or bus and cause problems.
    An easily reproduced case is that if a new adapter is registered, i2c     will get the leaked adapter and try to call smbus_algorithm, which was     already freed:

    Triggered by: rmmod i2c_piix4 && modprobe max31730

     BUG: unable to handle page fault for address: ffffffffc053d860      #PF: supervisor read access in kernel mode      #PF: error_code(0x0000) - not-present page      Oops: 0000 [#1] PREEMPT SMP KASAN      CPU: 0 PID: 3752 Comm: modprobe Tainted: G      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)      RIP: 0010:i2c_default_probe (drivers/i2c/i2c-core-base.c:2259) i2c_core      RSP: 0018:ffff888107477710 EFLAGS: 00000246      ...
     <TASK>       i2c_detect (drivers/i2c/i2c-core-base.c:2302) i2c_core
      __process_new_driver (drivers/i2c/i2c-core-base.c:1336) i2c_core       bus_for_each_dev (drivers/base/bus.c:301)       i2c_for_each_dev (drivers/i2c/i2c-core-base.c:1823) i2c_core       i2c_register_driver (drivers/i2c/i2c-core-base.c:1861) i2c_core       do_one_initcall (init/main.c:1296)       do_init_module (kernel/module/main.c:2455)       ...
     </TASK>
     ---[ end trace 0000000000000000 ]---

    Fix this problem by correctly set piix4_adapter_count as 1 for the     single adapter so it can be normally removed.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990773 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: piix4: Fix adapter not be removed in piix4_remove()

    In piix4_probe(), the piix4 adapter will be registered in:

       piix4_probe()          piix4_add_adapters_sb800() / piix4_add_adapter()            i2c_add_adapter()

    Based on the probed device type, piix4_add_adapters_sb800() or single     piix4_add_adapter() will be called.
    For the former case, piix4_adapter_count is set as the number of adapters,     while for antoher case it is not set and kept default *zero*.

    When piix4 is removed, piix4_remove() removes the adapters added in     piix4_probe(), basing on the piix4_adapter_count value.
    Because the count is zero for the single adapter case, the adapter won't     be removed and makes the sources allocated for adapter leaked, such as     the i2c client and device.

    These sources can still be accessed by i2c or bus and cause problems.
    An easily reproduced case is that if a new adapter is registered, i2c     will get the leaked adapter and try to call smbus_algorithm, which was     already freed:

    Triggered by: rmmod i2c_piix4 && modprobe max31730

     BUG: unable to handle page fault for address: ffffffffc053d860      #PF: supervisor read access in kernel mode      #PF: error_code(0x0000) - not-present page      Oops: 0000 [#1] PREEMPT SMP KASAN      CPU: 0 PID: 3752 Comm: modprobe Tainted: G      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)      RIP: 0010:i2c_default_probe (drivers/i2c/i2c-core-base.c:2259) i2c_core      RSP: 0018:ffff888107477710 EFLAGS: 00000246      ...
     <TASK>       i2c_detect (drivers/i2c/i2c-core-base.c:2302) i2c_core
      __process_new_driver (drivers/i2c/i2c-core-base.c:1336) i2c_core       bus_for_each_dev (drivers/base/bus.c:301)       i2c_for_each_dev (drivers/i2c/i2c-core-base.c:1823) i2c_core       i2c_register_driver (drivers/i2c/i2c-core-base.c:1861) i2c_core       do_one_initcall (init/main.c:1296)       do_init_module (kernel/module/main.c:2455)       ...
     </TASK>
     ---[ end trace 0000000000000000 ]---

    Fix this problem by correctly set piix4_adapter_count as 1 for the     single adapter so it can be normally removed.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    RDMA/core: Silence oversized kvmalloc() warning(CVE-2025-37867)

    igb: revert rtnl_lock() that causes deadlock(CVE-2023-53060)

    bnxt_en: Avoid order-5 memory allocation for TPA data(CVE-2023-53134)

    net_sched: sch_sfq: move the limit validation(CVE-2025-37752)

    ftrace: Add cond_resched() to ftrace_graph_set_hash().(CVE-2025-37940)

    net: annotate races around sk-sk_bound_dev_if(CVE-2022-49420)

    ext4: fix off-by-one error in do_split(CVE-2025-23150)

    jbd2: remove wrong sb-s_sequence check(CVE-2025-37839)

    ext4: update s_journal_inum if it changes after journal replay(CVE-2023-53091)

    udp: Fix memory accounting leak.(CVE-2025-22058)

    netem: Update sch-q.qlen before qdisc_tree_reduce_backlog().(CVE-2025-21703)

    net: fix memory leak in tcp_conn_request().(CVE-2024-57841)

    xfrm: state: fix out-of-bounds read during lookup(CVE-2024-57982)

    Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an     authenticated user to potentially enable denial of service via local access.(CVE-2021-33061)

    udf: Fix a slab-out-of-bounds write bug in udf_find_entry().(CVE-2022-49846)

    nvmet: avoid potential UAF in nvmet_req_complete().(CVE-2023-53116)

    ata: libata-transport: fix error handling in ata_tport_add().(CVE-2022-49825)

    ata: libata-transport: fix double ata_host_put() in ata_tport_add().(CVE-2022-49826)

    bpf: track changes_pkt_data property for global functions(CVE-2024-58098)

    pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map(CVE-2022-49832)

    scsi: core: Fix a procfs host directory removal regression(CVE-2023-53118)

    bpf, verifier: Fix memory leak in array reallocation for stack state(CVE-2022-49878)

    kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case(CVE-2022-49779)

    i2c: piix4: Fix adapter not be removed in piix4_remove().(CVE-2022-49900)

    bpf: Fix kmemleak warning for percpu hashmap(CVE-2025-37807)

    drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker().(CVE-2022-49827)

    RDMA/core: Fix null-ptr-deref in ib_core_cleanup().(CVE-2022-49925)

    net: tun: Fix memory leaks of napi_get_frags(CVE-2022-49871)

    net: sched: Fix use after free in red_enqueue().(CVE-2022-49921)

    bnxt_en: Fix possible crash in bnxt_hwrm_set_coal().(CVE-2022-49869)

    tipc: fix the msg-req tlv len check in tipc_nl_compat_name_table_dump_header(CVE-2022-49862)

    bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb().(CVE-2022-49840)

    net: macvlan: fix memory leaks of macvlan_common_newlink(CVE-2022-49853)

    HID: hyperv: fix possible memory leak in mousevsc_probe().(CVE-2022-49874)

    bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE(CVE-2022-49875)

    ftrace: Fix null pointer dereference in ftrace_add_mod().(CVE-2022-49802)

    tracing: Do not let histogram values have some modifiers(CVE-2023-53093)

    ftrace: Fix invalid address access in lookup_rec() when index is 0(CVE-2023-53075)

    iavf: Fix handling of dummy receive descriptors(CVE-2022-49583)

    ftrace: Fix use-after-free for dynamic ftrace_ops(CVE-2022-49892)

    fscrypt: stop using keyrings subsystem for fscrypt_master_key(CVE-2022-49899)

    bpf: Fix wrong reg type conversion in release_reference().(CVE-2022-49873)

    capabilities: fix potential memleak on error path from vfs_getxattr_alloc().(CVE-2022-49890)

    nfs4: Fix kmemleak when allocate slot failed(CVE-2022-49927)

    scsi: scsi_transport_sas: Fix error handling in sas_phy_add().(CVE-2022-49839)

    ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init().(CVE-2022-49885)

    blk-mq: Fix kmemleak in blk_mq_init_allocated_queue(CVE-2022-49901)

    bpf: Fix memory leaks in __check_func_call(CVE-2022-49837)

    ext4: ignore xattrs past end(CVE-2025-37738)

    ext4: fix another off-by-one fsmap error on 1k block filesystems(CVE-2023-53143)

    ext4: fix WARNING in ext4_update_inline_data(CVE-2023-53100)

    ext4: Fix possible corruption when moving a directory(CVE-2023-53137)

    ext4: zero i_disksize when initializing the bootloader inode(CVE-2023-53101)

    ata: libata-transport: fix error handling in ata_tdev_add().(CVE-2022-49823)

    ext4: fix BUG_ON() when directory entry has invalid rec_len(CVE-2022-49879)

    ext4: fix task hung in ext4_xattr_delete_inode(CVE-2023-53089)

    scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus().(CVE-2022-49780)

    ext4: fix warning in 'ext4_da_release_space'(CVE-2022-49880)

    ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters().(CVE-2022-49889)

    netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets.(CVE-2025-22063)

    clk: samsung: Fix UBSAN panic in samsung_clk_init().(CVE-2025-39728)

    x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range().(CVE-2025-22090)

    misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram().(CVE-2022-49788)

    scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add().(CVE-2023-53124)

    tracing: Fix wild-memory-access in register_synth_event().(CVE-2022-49799)

    hrtimers: Handle CPU state correctly on hotplug(CVE-2024-57951)

    block, bfq: fix uaf for bfqq in bic_set_bfqq().(CVE-2023-52983)

    tcp: Fix data-races around sysctl_tcp_max_reordering.(CVE-2022-49571)

    tcp: Fix data-races around sysctl_tcp_slow_start_after_idle.(CVE-2022-49572)

    tcp: Fix a data-race around sysctl_tcp_early_retrans.(CVE-2022-49573)

    kthread: unpark only parked kthread(CVE-2024-50019)

    media: streamzap: fix race between device disconnection and urb callback(CVE-2025-22027)

    net: openvswitch: fix flow memory leak in ovs_flow_cmd_new(CVE-2023-52977)

    efi: Do not import certificates from UEFI Secure Boot for T2 Macs(CVE-2022-49357)

    Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout(CVE-2022-49474)

    mmc: core: use sysfs_emit() instead of sprintf().(CVE-2022-49267)

    ext4: fix OOB read when checking dotdot dir(CVE-2025-37785)

    tcp: Fix data-races around sysctl_tcp_fastopen.(CVE-2022-49586)

    tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts.(CVE-2022-49575)

    ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg(CVE-2022-49727)

    tcp: Fix a data-race around sysctl_tcp_notsent_lowat.(CVE-2022-49587)

    dlm: prevent NPD when writing a positive value to event_done(CVE-2025-23131)

    thermal: int340x: Add NULL check for adev(CVE-2025-23136)

    nfsd: don't ignore the return code of svc_proc_register().(CVE-2025-22026)

    ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all().(CVE-2025-22121)

    ext4: avoid journaling sb update on error if journal is destroying(CVE-2025-22113)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - i2c: piix4: Fix adapter not be removed in piix4_remove() In piix4_probe(), the piix4 adapter will be     registered in: piix4_probe() piix4_add_adapters_sb800() / piix4_add_adapter() i2c_add_adapter() Based on     the probed device type, piix4_add_adapters_sb800() or single piix4_add_adapter() will be called. For the     former case, piix4_adapter_count is set as the number of adapters, while for antoher case it is not set     and kept default *zero*. When piix4 is removed, piix4_remove() removes the adapters added in     piix4_probe(), basing on the piix4_adapter_count value. Because the count is zero for the single adapter     case, the adapter won't be removed and makes the sources allocated for adapter leaked, such as the i2c     client and device. These sources can still be accessed by i2c or bus and cause problems. An easily     reproduced case is that if a new adapter is registered, i2c will get the leaked adapter and try to call     smbus_algorithm, which was already freed: Triggered by: rmmod i2c_piix4 && modprobe max31730 BUG: unable     to handle page fault for address: ffffffffc053d860 #PF: supervisor read access in kernel mode #PF:
    error_code(0x0000) - not-present page Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 3752 Comm: modprobe     Tainted: G Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:i2c_default_probe     (drivers/i2c/i2c-core-base.c:2259) i2c_core RSP: 0018:ffff888107477710 EFLAGS: 00000246 ... <TASK>     i2c_detect (drivers/i2c/i2c-core-base.c:2302) i2c_core __process_new_driver (drivers/i2c/i2c-core-     base.c:1336) i2c_core bus_for_each_dev (drivers/base/bus.c:301) i2c_for_each_dev (drivers/i2c/i2c-core-     base.c:1823) i2c_core i2c_register_driver (drivers/i2c/i2c-core-base.c:1861) i2c_core do_one_initcall     (init/main.c:1296) do_init_module (kernel/module/main.c:2455) ... </TASK> ---[ end trace 0000000000000000     ]--- Fix this problem by correctly set piix4_adapter_count as 1 for the single adapter so it can be     normally removed. (CVE-2022-49900)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02262-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2022-49110: netfilter: conntrack: revisit gc autotuning (bsc#1237981).
    - CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
    - CVE-2022-49767: 9p/trans_fd: always use O_NONBLOCK read/write (bsc#1242493).
    - CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
    - CVE-2022-49858: octeontx2-pf: Fix SQE threshold checking (bsc#1242589).
    - CVE-2023-53058: net/mlx5: E-Switch, Fix an Oops in error handling code (bsc#1242237).
    - CVE-2023-53060: igb: revert rtnl_lock() that causes deadlock (bsc#1242241).
    - CVE-2023-53064: iavf: Fix hang on reboot with ice (bsc#1242222).
    - CVE-2023-53066: qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info (bsc#1242227).
    - CVE-2023-53079: net/mlx5: Fix steering rules cleanup (bsc#1242765).
    - CVE-2023-53114: i40e: Fix kernel crash during reboot when adapter is in recovery mode (bsc#1242398).
    - CVE-2023-53134: bnxt_en: Avoid order-5 memory allocation for TPA data (bsc#1242380)
    - CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
    - CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
    - CVE-2025-21888: RDMA/mlx5: Fix a WARN during dereg_mr for DM type (bsc#1240177).
    - CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
    - CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
    - CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
    - CVE-2025-23138: watch_queue: fix pipe accounting mismatch (bsc#1241648).
    - CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
    - CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).
    - CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02173-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
    - CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
    - CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
    - CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
    - CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
    - CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
    - CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
    - CVE-2024-28956: x86/its: Add support for ITS-safe indirect thunk (bsc#1242006).
    - CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

ID	Name	Product	Family	Type	Severity
360900	AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1777633439)	Nessus	Alma Linux Local Security Checks	Local	high
360870	Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1777633439)	Nessus	Rocky Linux Local Security Checks	Local	high
353159	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1777616064)	Nessus	Alma Linux Local Security Checks	Local	high
281071	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993280)	Nessus	Unity Linux Local Security Checks	Local	high
275058	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-990773)	Nessus	Unity Linux Local Security Checks	Local	high
265114	EulerOS Virtualization 2.13.1 : kernel (EulerOS-SA-2025-2168)	Nessus	Huawei Local Security Checks	Local	high
265107	EulerOS Virtualization 2.13.0 : kernel (EulerOS-SA-2025-2169)	Nessus	Huawei Local Security Checks	Local	high
249320	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-1979)	Nessus	Huawei Local Security Checks	Local	high
249192	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-1993)	Nessus	Huawei Local Security Checks	Local	high
245621	Linux Distros Unpatched Vulnerability : CVE-2022-49900	Nessus	Misc.	Local	high
241966	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2025:02262-1)	Nessus	SuSE Local Security Checks	Local	high
241036	SUSE SLES15 : Security update for the Linux Kernel (SUSE-SU-2025:02173-1)	Nessus	SuSE Local Security Checks	Local	medium
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2022-49900

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

medium

high