In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level Though acpi_find_last_cache_level() always returned signed value and the document states it will return any errors caused by lack of a PPTT table, it never returned negative values before. Commit 0c80f9e165f8 ("ACPI: PPTT: Leave the table mapped for the runtime usage") however changed it by returning -ENOENT if no PPTT was found. The value returned from acpi_find_last_cache_level() is then assigned to unsigned fw_level. It will result in the number of cache leaves calculated incorrectly as a huge value which will then cause the following warning from __alloc_pages as the order would be great than MAX_ORDER because of incorrect and huge cache leaves value. | WARNING: CPU: 0 PID: 1 at mm/page_alloc.c:5407 __alloc_pages+0x74/0x314 | Modules linked in: | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-10393-g7c2a8d3ac4c0 #73 | pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : __alloc_pages+0x74/0x314 | lr : alloc_pages+0xe8/0x318 | Call trace: | __alloc_pages+0x74/0x314 | alloc_pages+0xe8/0x318 | kmalloc_order_trace+0x68/0x1dc | __kmalloc+0x240/0x338 | detect_cache_attributes+0xe0/0x56c | update_siblings_masks+0x38/0x284 | store_cpu_topology+0x78/0x84 | smp_prepare_cpus+0x48/0x134 | kernel_init_freeable+0xc4/0x14c | kernel_init+0x2c/0x1b4 | ret_from_fork+0x10/0x20 Fix the same by changing fw_level to be signed integer and return the error from init_cache_level() early in case of error.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    ext4: update s_journal_inum if it changes after journal replay(CVE-2023-53091)

    arp: use RCU protection in arp_xmit().(CVE-2025-21762)

    io_uring: prevent opcode speculation(CVE-2025-21863)

    jbd2: remove wrong sb-s_sequence check(CVE-2025-37839)

    udf: Fix a slab-out-of-bounds write bug in udf_find_entry().(CVE-2022-49846)

    udp: Fix memory accounting leak.(CVE-2025-22058)

    nvmet: avoid potential UAF in nvmet_req_complete().(CVE-2023-53116)

    ext4: fix off-by-one error in do_split(CVE-2025-23150)

    cgroup: Use separate src/dst nodes when preloading css_sets for migration(CVE-2022-49647)

    PM: hibernate: defer device probing when resuming from hibernation(CVE-2022-50202)

    video: fbdev: amba-clcd: Fix refcount leak bugs(CVE-2022-50109)

    mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put().(CVE-2022-49787)

    capabilities: fix undefined behavior in bit shift for CAP_TO_MASK(CVE-2022-49870)

    tty: vt: initialize unicode screen buffer(CVE-2022-50222)

    ndisc: extend RCU protection in ndisc_send_skb().(CVE-2025-21760)

    ndisc: use RCU protection in ndisc_alloc_skb().(CVE-2025-21764)

    ata: libata-transport: fix double ata_host_put() in ata_tport_add().(CVE-2022-49826)

    proc: fix UAF in proc_get_inode().(CVE-2025-21999)

    vt: Clear selection before changing the font(CVE-2022-49948)

    module: ensure that kobject_put() is safe for module type kobjects(CVE-2025-37995)

    openvswitch: use RCU protection in ovs_vport_cmd_fill_info().(CVE-2025-21761)

    arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level(CVE-2022-49964)

    neighbour: use RCU protection in __neigh_notify().(CVE-2025-21763)

    ipv6: mcast: extend RCU protection in igmp6_send().(CVE-2025-21759)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level Though     acpi_find_last_cache_level() always returned signed value and the document states it will return any     errors caused by lack of a PPTT table, it never returned negative values before. Commit 0c80f9e165f8     (ACPI: PPTT: Leave the table mapped for the runtime usage) however changed it by returning -ENOENT if no     PPTT was found. The value returned from acpi_find_last_cache_level() is then assigned to unsigned     fw_level. It will result in the number of cache leaves calculated incorrectly as a huge value which will     then cause the following warning from __alloc_pages as the order would be great than MAX_ORDER because of     incorrect and huge cache leaves value. | WARNING: CPU: 0 PID: 1 at mm/page_alloc.c:5407
    __alloc_pages+0x74/0x314 | Modules linked in: | CPU: 0 PID: 1 Comm: swapper/0 Not tainted     5.19.0-10393-g7c2a8d3ac4c0 #73 | pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc :
    __alloc_pages+0x74/0x314 | lr : alloc_pages+0xe8/0x318 | Call trace: | __alloc_pages+0x74/0x314 |     alloc_pages+0xe8/0x318 | kmalloc_order_trace+0x68/0x1dc | __kmalloc+0x240/0x338 |     detect_cache_attributes+0xe0/0x56c | update_siblings_masks+0x38/0x284 | store_cpu_topology+0x78/0x84 |     smp_prepare_cpus+0x48/0x134 | kernel_init_freeable+0xc4/0x14c | kernel_init+0x2c/0x1b4 |     ret_from_fork+0x10/0x20 Fix the same by changing fw_level to be signed integer and return the error from     init_cache_level() early in case of error. (CVE-2022-49964)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02537-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-47557: net/sched: sch_ets: do not peek at classes beyond 'nbands' (bsc#1207361 bsc#1225468).
    - CVE-2021-47595: net/sched: sch_ets: do not remove idle classes from the round-robin list (bsc#1207361     bsc#1226552).
    - CVE-2023-52924: netfilter: nf_tables: do not skip expired elements during walk (bsc#1236821).
    - CVE-2023-52925: netfilter: nf_tables: do not fail inserts if duplicate has expired (bsc#1236822).
    - CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain     (bsc#1222634).
    - CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
    - CVE-2024-27397: kabi: place tstamp needed for nftables set in a hole (bsc#1224095).
    - CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
    - CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
    - CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
    - CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
    - CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
    - CVE-2024-56770: sch/netem: fix use after free in netem_dequeue (bsc#1235637).
    - CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
    - CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
    - CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
    - CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
    - CVE-2025-21756: vsock: Orphan socket after transport release (bsc#1238876).
    - CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses     (bsc#1242782).
    - CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
    - CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
    - CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
    - CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc     (bsc#1243330).
    - CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
    - CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
    - CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
    - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
    - CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02264-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-47557: net/sched: sch_ets: do not peek at classes beyond 'nbands' (bsc#1207361 bsc#1225468).
    - CVE-2021-47595: net/sched: sch_ets: do not remove idle classes from the round-robin list (bsc#1207361     bsc#1226552).
    - CVE-2023-52924: netfilter: nf_tables: do not skip expired elements during walk (bsc#1236821).
    - CVE-2023-52925: netfilter: nf_tables: do not fail inserts if duplicate has expired (bsc#1236822).
    - CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain     (bsc#1222634).
    - CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
    - CVE-2024-27397: kabi: place tstamp needed for nftables set in a hole (bsc#1224095).
    - CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
    - CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
    - CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
    - CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
    - CVE-2024-53197: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices     (bsc#1235464).
    - CVE-2024-56770: sch/netem: fix use after free in netem_dequeue (bsc#1235637).
    - CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
    - CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
    - CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
    - CVE-2025-21756: vsock: Orphan socket after transport release (bsc#1238876).
    - CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses     (bsc#1242782).
    - CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
    - CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
    - CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc     (bsc#1243330).
    - CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
    - CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
    - CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
    - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
    - CVE-2025-38060: bpf: abort verification if env->cur_state->loop_entry != NULL (bsc#1245155).
    - CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.214-120.368. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-036 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: Fix a potential use after free

    Free the adap structure only after we are done using it.This patch just moves the put_device() down a bit     to avoid theuse after free.

    [wsa: added comment to the code, added Fixes tag] (CVE-2019-25162)

    A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures.
    Internal memory locations could be returned to userspace.  A local attacker with the permissions to insert     eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit     mitigations in place for the kernel. (CVE-2021-4159)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal: Fix NULL pointer dereferences in of_thermal_ functions (CVE-2021-47202)

    A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

    In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input     validation. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-223375145References: Upstream kernel (CVE-2022-20369)

    A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. This issue makes it     possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This     flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel     oops condition that results in a denial of service. (CVE-2022-2153)

    It was discovered that a nft object or expression could reference a nft set on a different nft table,     leading to a use-after-free once that table was deleted. (CVE-2022-2586)

    A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the     Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege     escalation problem. (CVE-2022-2588)

    Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

    An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

    A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

    A use-after-free flaw was found in io_uring in the Linux kernel. This flaw allows a local user to trigger     the issue if a signalfd or binder fd is polled with the io_uring poll due to a lack of io_uring POLLFREE     handling. (CVE-2022-3176)

    A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability. (CVE-2022-3625)

    An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

    A race condition in the Linux kernel's EFI capsule loader driver was found in the way it handled write and     flush operations on the device node of the EFI capsule. A local user could potentially use this flaw to     crash the system. (CVE-2022-40307)

    mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is     not held during a PUD move. (CVE-2022-41222)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: fix UAF when detecting digest errors (CVE-2022-48686)

    In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when     setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment     Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID,     SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and SEG6_ATTR_ALGID. (CVE-2022-48687)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: Fix kernel crash during module removal (CVE-2022-48688)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpt3sas: Fix use-after-free warning (CVE-2022-48695)

    In the Linux kernel, the following vulnerability has been resolved:

    nvmet: fix a use-after-free (CVE-2022-48697)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: add a force flush to delay work when radeon (CVE-2022-48704)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Don't null dereference ops->destroy (CVE-2022-49568)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Prevent nested device-reset calls (CVE-2022-49936)

    In the Linux kernel, the following vulnerability has been resolved:

    vt: Clear selection before changing the font (CVE-2022-49948)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level (CVE-2022-49964)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Don't redirect packets with invalid pkt_len (CVE-2022-49975)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CVE-2022-49977)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: hidraw: fix memory leak in hidraw_release() (CVE-2022-49981)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report (CVE-2022-49984)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq (CVE-2022-49986)

    In the Linux kernel, the following vulnerability has been resolved:

    md: call __md_stop_writes in md_stop (CVE-2022-49987)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix refcount leak in __xfrm_policy_check() (CVE-2022-50007)

    In the Linux kernel, the following vulnerability has been resolved:

    kprobes: don't call disarm_kprobe() for disabled kprobes (CVE-2022-50008)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid resizing to a partial cluster size (CVE-2022-50020)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers:md:fix a potential use-after-free bug (CVE-2022-50022)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input (CVE-2022-50030)

    In the Linux kernel, the following vulnerability has been resolved:

    iavf: Fix adminq error handling (CVE-2022-50055)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/pnfs: Fix a use-after-free bug in open (CVE-2022-50072)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h (CVE-2022-50083)

    In the Linux kernel, the following vulnerability has been resolved:

    dm raid: fix address sanitizer warning in raid_status (CVE-2022-50084)

    In the Linux kernel, the following vulnerability has been resolved:

    dm raid: fix address sanitizer warning in raid_resume (CVE-2022-50085)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (CVE-2022-50087)

    In the Linux kernel, the following vulnerability has been resolved:

    dm thin: fix use-after-free crash in dm_sm_register_threshold_callback (CVE-2022-50092)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) (CVE-2022-50093)

    In the Linux kernel, the following vulnerability has been resolved:

    video: fbdev: s3fb: Check the size of screen before memset_io() (CVE-2022-50097)

    In the Linux kernel, the following vulnerability has been resolved:

    video: fbdev: amba-clcd: Fix refcount leak bugs (CVE-2022-50109)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted (CVE-2022-50126)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/rxe: Fix error unwind in rxe_create_qp() (CVE-2022-50127)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: fix potential deadlock in __driver_attach (CVE-2022-50149)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe (CVE-2022-50153)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() (CVE-2022-50185)

    In the Linux kernel, the following vulnerability has been resolved:

    regulator: of: Fix refcount leak bug in of_get_regulation_constraints() (CVE-2022-50191)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: Add boundary check in put_entry() (CVE-2022-50200)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: hibernate: defer device probing when resuming from hibernation (CVE-2022-50202)

    In the Linux kernel, the following vulnerability has been resolved:

    ext2: Add more validity checks for inode counts (CVE-2022-50205)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: fix oops in concurrently setting insn_emulation sysctls (CVE-2022-50206)

    In the Linux kernel, the following vulnerability has been resolved:

    md-raid10: fix KASAN warning (CVE-2022-50211)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: sg: Allow waiting for commands to complete on removed device (CVE-2022-50215)

    In the Linux kernel, the following vulnerability has been resolved:

    usbnet: Fix linkwatch use-after-free on disconnect (CVE-2022-50220)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: vt: initialize unicode screen buffer (CVE-2022-50222)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CVE-2022-50228)

    In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the     transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list
    -- the list head is all zeroes, this results in a NULL pointer dereference. (CVE-2023-1095)

    The upstream advisory describes this issue as follows:

    This vulnerability allows local attackers to disclose sensitive information on affected installations of     the Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target     system in order to exploit this vulnerability.

    The specific flaw exists within the processing of seg6 attributes. The issue results from the lack of     proper validation of user-supplied data, which can result in a read past the end of an allocated buffer.
    An attacker can leverage this in conjunction with other vulnerabilties to escalate privileges and execute     arbitrary code in the context of the kernel. (CVE-2023-2860)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.144-127.601. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-020 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: Fix a potential use after free

    Free the adap structure only after we are done using it.This patch just moves the put_device() down a bit     to avoid theuse after free.

    [wsa: added comment to the code, added Fixes tag] (CVE-2019-25162)

    In the Linux kernel, the following vulnerability has been resolved:

    tun: avoid double free in tun_free_netdev (CVE-2021-47082)

    A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

    A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. This issue makes it     possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This     flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel     oops condition that results in a denial of service. (CVE-2022-2153)

    A use-after-free flaw was found in the Linux kernel's POSIX CPU timers functionality in the way a user     creates and then deletes the timer in the non-leader thread of the program. This flaw allows a local user     to crash or potentially escalate their privileges on the system. (CVE-2022-2585)

    It was discovered that a nft object or expression could reference a nft set on a different nft table,     leading to a use-after-free once that table was deleted. (CVE-2022-2586)

    A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the     Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege     escalation problem. (CVE-2022-2588)

    Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

    An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

    An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the     bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to     gain unauthorized access to data. (CVE-2022-2905)

    A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

    A use-after-free flaw was found in io_uring in the Linux kernel. This flaw allows a local user to trigger     the issue if a signalfd or binder fd is polled with the io_uring poll due to a lack of io_uring POLLFREE     handling. (CVE-2022-3176)

    A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability. (CVE-2022-3625)

    An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

    An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of     service can occur upon binding to an already bound chain. (CVE-2022-39190)

    A race condition in the Linux kernel's EFI capsule loader driver was found in the way it handled write and     flush operations on the device node of the EFI capsule. A local user could potentially use this flaw to     crash the system. (CVE-2022-40307)

    mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is     not held during a PUD move. (CVE-2022-41222)

    A double-free flaw was found in the Linux kernel's TUN/TAP device driver functionality in how a user     registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw     allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-4744)

    In the Linux kernel, the following vulnerability has been resolved:

    IB/core: Fix a nested dead lock as part of ODP flow (CVE-2022-48675)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: fix UAF when detecting digest errors (CVE-2022-48686)

    In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when     setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment     Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID,     SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and SEG6_ATTR_ALGID. (CVE-2022-48687)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: Fix kernel crash during module removal (CVE-2022-48688)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: clean up hook list when offload flags check fails (CVE-2022-48691)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpt3sas: Fix use-after-free warning (CVE-2022-48695)

    In the Linux kernel, the following vulnerability has been resolved:

    nvmet: fix a use-after-free (CVE-2022-48697)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: add a force flush to delay work when radeon (CVE-2022-48704)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix data-races around sysctl_tcp_l3mdev_accept. (CVE-2022-49599)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Prevent nested device-reset calls (CVE-2022-49936)

    In the Linux kernel, the following vulnerability has been resolved:

    vt: Clear selection before changing the font (CVE-2022-49948)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: fix netdevice reference leaks in attach_default_qdiscs() (CVE-2022-49958)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level (CVE-2022-49964)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Don't redirect packets with invalid pkt_len (CVE-2022-49975)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CVE-2022-49977)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix refcount bug in sk_psock_get (2) (CVE-2022-49979)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: hidraw: fix memory leak in hidraw_release() (CVE-2022-49981)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report (CVE-2022-49984)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Don't use tnum_range on array range checking for poke descriptors (CVE-2022-49985)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq (CVE-2022-49986)

    In the Linux kernel, the following vulnerability has been resolved:

    md: call __md_stop_writes in md_stop (CVE-2022-49987)

    In the Linux kernel, the following vulnerability has been resolved:

    xen/privcmd: fix error exit of privcmd_ioctl_dm_op() (CVE-2022-49989)

    In the Linux kernel, the following vulnerability has been resolved:

    loop: Check for overflow while configuring loop (CVE-2022-49993)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix locking in rxrpc's sendmsg (CVE-2022-49998)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: policy: fix metadata dst->dev xmit null pointer dereference (CVE-2022-50004)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4.2 fix problems with __nfs42_ssc_open (CVE-2022-50006)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix refcount leak in __xfrm_policy_check() (CVE-2022-50007)

    In the Linux kernel, the following vulnerability has been resolved:

    kprobes: don't call disarm_kprobe() for disabled kprobes (CVE-2022-50008)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers:md:fix a potential use-after-free bug (CVE-2022-50022)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input (CVE-2022-50030)

    In the Linux kernel, the following vulnerability has been resolved:

    net: genl: fix error path memory leak in policy dumping (CVE-2022-50042)

    In the Linux kernel, the following vulnerability has been resolved:

    iavf: Fix adminq error handling (CVE-2022-50055)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: don't leak snap_rwsem in handle_cap_grant (CVE-2022-50059)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio_net: fix memory leak inside XPD_TX with mergeable (CVE-2022-50065)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/pnfs: Fix a use-after-free bug in open (CVE-2022-50072)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix warning in ext4_iomap_begin as race between bmap and write (CVE-2022-50082)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h (CVE-2022-50083)

    In the Linux kernel, the following vulnerability has been resolved:

    dm raid: fix address sanitizer warning in raid_status (CVE-2022-50084)

    In the Linux kernel, the following vulnerability has been resolved:

    dm raid: fix address sanitizer warning in raid_resume (CVE-2022-50085)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (CVE-2022-50087)

    In the Linux kernel, the following vulnerability has been resolved:

    dm thin: fix use-after-free crash in dm_sm_register_threshold_callback (CVE-2022-50092)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) (CVE-2022-50093)

    In the Linux kernel, the following vulnerability has been resolved:

    posix-cpu-timers: Cleanup CPU timers before freeing them during exec (CVE-2022-50095)

    In the Linux kernel, the following vulnerability has been resolved:

    video: fbdev: s3fb: Check the size of screen before memset_io() (CVE-2022-50097)

    In the Linux kernel, the following vulnerability has been resolved:

    sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed (CVE-2022-50103)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted (CVE-2022-50126)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/rxe: Fix error unwind in rxe_create_qp() (CVE-2022-50127)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/srpt: Fix a use-after-free (CVE-2022-50129)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() (CVE-2022-50138)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: fix potential deadlock in __driver_attach (CVE-2022-50149)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe (CVE-2022-50153)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-gpu: fix a missing check to avoid NULL dereference (CVE-2022-50181)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() (CVE-2022-50185)

    In the Linux kernel, the following vulnerability has been resolved:

    regulator: of: Fix refcount leak bug in of_get_regulation_constraints() (CVE-2022-50191)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: Add boundary check in put_entry() (CVE-2022-50200)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: hibernate: defer device probing when resuming from hibernation (CVE-2022-50202)

    In the Linux kernel, the following vulnerability has been resolved:

    ext2: Add more validity checks for inode counts (CVE-2022-50205)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: fix oops in concurrently setting insn_emulation sysctls (CVE-2022-50206)

    In the Linux kernel, the following vulnerability has been resolved:

    md-raid10: fix KASAN warning (CVE-2022-50211)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: do not allow CHAIN_ID to refer to another table (CVE-2022-50212)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: do not allow SET_ID to refer to another table (CVE-2022-50213)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: sg: Allow waiting for commands to complete on removed device (CVE-2022-50215)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix KASAN use-after-free Read in compute_effective_progs (CVE-2022-50219)

    In the Linux kernel, the following vulnerability has been resolved:

    usbnet: Fix linkwatch use-after-free on disconnect (CVE-2022-50220)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: vt: initialize unicode screen buffer (CVE-2022-50222)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CVE-2022-50228)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: arm64/poly1305 - fix a read out-of-bound (CVE-2022-50231)

    In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the     transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list
    -- the list head is all zeroes, this results in a NULL pointer dereference. (CVE-2023-1095)

    The upstream advisory describes this issue as follows:

    This vulnerability allows local attackers to disclose sensitive information on affected installations of     the Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target     system in order to exploit this vulnerability.

    The specific flaw exists within the processing of seg6 attributes. The issue results from the lack of     proper validation of user-supplied data, which can result in a read past the end of an allocated buffer.
    An attacker can leverage this in conjunction with other vulnerabilties to escalate privileges and execute     arbitrary code in the context of the kernel. (CVE-2023-2860)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
261888	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2025-2072)	Nessus	Huawei Local Security Checks	high
246533	Linux Distros Unpatched Vulnerability : CVE-2022-49964	Nessus	Misc.	medium
242951	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:02537-1)	Nessus	SuSE Local Security Checks	high
241963	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:02264-1)	Nessus	SuSE Local Security Checks	high
166131	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2022-036 (ALASKERNEL-5.4-2022-036)	Nessus	Amazon Linux Local Security Checks	high
166124	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2022-020 (ALASKERNEL-5.10-2022-020)	Nessus	Amazon Linux Local Security Checks	high
166118	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2022-008 (ALASKERNEL-5.15-2022-008)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2022-49964

medium

Tenable Plugins

high

medium

high

high

high

high

high