In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix stuck flows on cleanup due to pending work To clear the flow table on flow table free, the following sequence normally happens in order: 1) gc_step work is stopped to disable any further stats/del requests. 2) All flow table entries are set to teardown state. 3) Run gc_step which will queue HW del work for each flow table entry. 4) Waiting for the above del work to finish (flush). 5) Run gc_step again, deleting all entries from the flow table. 6) Flow table is freed. But if a flow table entry already has pending HW stats or HW add work step 3 will not queue HW del work (it will be skipped), step 4 will wait for the pending add/stats to finish, and step 5 will queue HW del work which might execute after freeing of the flow table. To fix the above, this patch flushes the pending work, then it sets the teardown flag to all flows in the flowtable and it forces a garbage collector run to queue work to remove the flows from hardware, then it flushes this new pending work and (finally) it forces another garbage collector run to remove the entry from the software flowtable. Stack trace: [47773.882335] BUG: KASAN: use-after-free in down_read+0x99/0x460 [47773.883634] Write of size 8 at addr ffff888103b45aa8 by task kworker/u20:6/543704 [47773.885634] CPU: 3 PID: 543704 Comm: kworker/u20:6 Not tainted 5.12.0-rc7+ #2 [47773.886745] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) [47773.888438] Workqueue: nf_ft_offload_del flow_offload_work_handler [nf_flow_table] [47773.889727] Call Trace: [47773.890214] dump_stack+0xbb/0x107 [47773.890818] print_address_description.constprop.0+0x18/0x140 [47773.892990] kasan_report.cold+0x7c/0xd8 [47773.894459] kasan_check_range+0x145/0x1a0 [47773.895174] down_read+0x99/0x460 [47773.899706] nf_flow_offload_tuple+0x24f/0x3c0 [nf_flow_table] [47773.907137] flow_offload_work_handler+0x72d/0xbe0 [nf_flow_table] [47773.913372] process_one_work+0x8ac/0x14e0 [47773.921325] [47773.921325] Allocated by task 592159: [47773.922031] kasan_save_stack+0x1b/0x40 [47773.922730] __kasan_kmalloc+0x7a/0x90 [47773.923411] tcf_ct_flow_table_get+0x3cb/0x1230 [act_ct] [47773.924363] tcf_ct_init+0x71c/0x1156 [act_ct] [47773.925207] tcf_action_init_1+0x45b/0x700 [47773.925987] tcf_action_init+0x453/0x6b0 [47773.926692] tcf_exts_validate+0x3d0/0x600 [47773.927419] fl_change+0x757/0x4a51 [cls_flower] [47773.928227] tc_new_tfilter+0x89a/0x2070 [47773.936652] [47773.936652] Freed by task 543704: [47773.937303] kasan_save_stack+0x1b/0x40 [47773.938039] kasan_set_track+0x1c/0x30 [47773.938731] kasan_set_free_info+0x20/0x30 [47773.939467] __kasan_slab_free+0xe7/0x120 [47773.940194] slab_free_freelist_hook+0x86/0x190 [47773.941038] kfree+0xce/0x3a0 [47773.941644] tcf_ct_flow_table_cleanup_work Original patch description and stack trace by Paul Blakey.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - netfilter: flowtable: fix stuck flows on cleanup due to pending work To clear the flow table on flow table     free, the following sequence normally happens in order: 1) gc_step work is stopped to disable any further     stats/del requests. 2) All flow table entries are set to teardown state. 3) Run gc_step which will queue     HW del work for each flow table entry. 4) Waiting for the above del work to finish (flush). 5) Run gc_step     again, deleting all entries from the flow table. 6) Flow table is freed. But if a flow table entry already     has pending HW stats or HW add work step 3 will not queue HW del work (it will be skipped), step 4 will     wait for the pending add/stats to finish, and step 5 will queue HW del work which might execute after     freeing of the flow table. To fix the above, this patch flushes the pending work, then it sets the     teardown flag to all flows in the flowtable and it forces a garbage collector run to queue work to remove     the flows from hardware, then it flushes this new pending work and (finally) it forces another garbage     collector run to remove the entry from the software flowtable. Stack trace: [47773.882335] BUG: KASAN:
    use-after-free in down_read+0x99/0x460 [47773.883634] Write of size 8 at addr ffff888103b45aa8 by task     kworker/u20:6/543704 [47773.885634] CPU: 3 PID: 543704 Comm: kworker/u20:6 Not tainted 5.12.0-rc7+ #2     [47773.886745] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) [47773.888438] Workqueue:
    nf_ft_offload_del flow_offload_work_handler [nf_flow_table] [47773.889727] Call Trace: [47773.890214]     dump_stack+0xbb/0x107 [47773.890818] print_address_description.constprop.0+0x18/0x140 [47773.892990]     kasan_report.cold+0x7c/0xd8 [47773.894459] kasan_check_range+0x145/0x1a0 [47773.895174]     down_read+0x99/0x460 [47773.899706] nf_flow_offload_tuple+0x24f/0x3c0 [nf_flow_table] [47773.907137]     flow_offload_work_handler+0x72d/0xbe0 [nf_flow_table] [47773.913372] process_one_work+0x8ac/0x14e0     [47773.921325] [47773.921325] Allocated by task 592159: [47773.922031] kasan_save_stack+0x1b/0x40     [47773.922730] __kasan_kmalloc+0x7a/0x90 [47773.923411] tcf_ct_flow_table_get+0x3cb/0x1230 [act_ct]     [47773.924363] tcf_ct_init+0x71c/0x1156 [act_ct] [47773.925207] tcf_action_init_1+0x45b/0x700     [47773.925987] tcf_action_init+0x453/0x6b0 [47773.926692] tcf_exts_validate+0x3d0/0x600 [47773.927419]     fl_change+0x757/0x4a51 [cls_flower] [47773.928227] tc_new_tfilter+0x89a/0x2070 [47773.936652]     [47773.936652] Freed by task 543704: [47773.937303] kasan_save_stack+0x1b/0x40 [47773.938039]     kasan_set_track+0x1c/0x30 [47773.938731] kasan_set_free_info+0x20/0x30 [47773.939467]
    __kasan_slab_free+0xe7/0x120 [47773.940194] slab_free_freelist_hook+0x86/0x190 [47773.941038]     kfree+0xce/0x3a0 [47773.941644] tcf_ct_flow_table_cleanup_work Original patch description and stack trace     by Paul Blakey. (CVE-2022-50000)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.10.239-236.958. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-098 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: flowtable: fix stuck flows on cleanup due to pending work (CVE-2022-50000)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_socket: fix sk refcount leaks (CVE-2024-46855)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: hugetlb: independent PMD page table shared count (CVE-2024-57883)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: sch_sfq: don't allow 1 packet limit (CVE-2024-57996)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (CVE-2025-37963)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: prio: fix a race in prio_tune() (CVE-2025-38083)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/hugetlb: unshare page tables during VMA split, not before (CVE-2025-38084)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/iopl: Cure TIF_IO_BITMAP inconsistencies (CVE-2025-38100)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: ets: fix a race in ets_qdisc_change() (CVE-2025-38107)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: red: fix a race in __red_change() (CVE-2025-38108)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mdiobus: Fix potential out-of-bounds read/write access (CVE-2025-38111)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Fix TOCTOU issue in sk_is_readable() (CVE-2025-38112)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: sch_sfq: fix a potential crash on gso_skb handling (CVE-2025-38115)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: Fix the dead loop of MPLS parse (CVE-2025-38146)

    In the Linux kernel, the following vulnerability has been resolved:

    calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (CVE-2025-38161)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: fix double free in delayed_free (CVE-2025-38206)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (CVE-2025-38231)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix WARN() in get_bpf_raw_tp_regs (CVE-2025-38285)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (CVE-2025-38312)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (CVE-2025-38320)

    In the Linux kernel, the following vulnerability has been resolved:

    mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (CVE-2025-38324)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0512 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

    * kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHEL-9.1: Update new rfkill event size behavior for compatibility with older applications (BZ#2098082)

    * RHEL9 - ISST-LTE:LPM:Rainer/P9:HPT:SLES15SP4:After successful migration with hardlockups ,LPM failed and     LPAR remained hung (BZ#2103084)

    * Intel 9.1, ADL-P IOTG: rmmod of pmt_telemetry driver results in panic (BZ#2127863)

    * kernel: Update ppc64le key following resolution of CVE-2022-1665 (BZ#2130923)

    * MCHP 9.1: Update SmartPQI driver to latest upstream Second Set of Patches (BZ#2133552)

    * intel_qat: WARNING: CPU: 0 PID: 1440 at kernel/dma/debug.c:973 check_unmap+0xa6f/0x2360 (BZ#2133750)

    * CNB: Update TC subsystem to upstream v5.18 (BZ#2137359)

    * netfilter: backports from upstream (BZ#2137360)

    * netfilter: backports from upstream (BZ#2137361)

    * Cgroups_v2, when creating new cgroup/container, resets the cpu affinity masks for all usr processes on     the system. (BZ#2143767)

    * RHEL 9: ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143977)

    * RHEL 9.0, AMD Genoa: OS cannot boot when enabling SME in UEFI setup and appending 'mem_encrypt=on'     (BZ#2145017)

    * kernel-devel RPM cross-compiled by CKI contains host-arch scripts (BZ#2150019)

    * Azure, RHEL 9: Sometimes newly deployed VMs are not getting accelerated network during provisioning     (BZ#2151606)

    * Scheduler Update (rhel9.2) (BZ#2153793)

    * DELL 9.0 RT BUG - stock clone: On PE R760 system, call traces are observed dmesg when system is running     stress (BZ#2154408)

    * MSFT, MANA RHEL 9: Fix race on per-CQ variable napi_iperf panic fix (BZ#2155146)

    * Azure, RHEL 9: VM Deployment Failures Patch Request (BZ#2155931)

    * kernel-rt-debug: WARNING: possible circular locking dependency detected     (&n->list_lock->&p->pi_lock->&lock->wait_lock) (BZ#2160615)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0101 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

    * kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHEL8.4 - zfcp: fix missing auto port scan and thus missing target ports (BZ#2127849)

    * vfio zero page mappings fail after 2M instances (BZ#2128515)

    * ice: Driver Update up to 5.19 (BZ#2130992)

    * atlantic: missing hybernate/resume fixes (BZ#2131935)

    * Bluefield 2 DPU would crash and reboot due to a kernel panic (BZ#2134084)

    * Fix issue that enables STABLE_WRITES by default and causes performance regressions (BZ#2135813)

    * ice: Intel E810 PTP clock glitching (BZ#2136036)

    * ice: configure link-down-on-close on and change interface mtu to 9000,the interface can't up     (BZ#2136216)

    * ice: dump additional CSRs for Tx hang debugging (BZ#2136513)

    * ice,iavf: system panic during sriov sriov_test_cntvf_reboot testing (BZ#2137270)

    * After upgrading to ocp4.11.1, our dpdk application using vlan strip offload is not working (BZ#2138157)

    * i40e: orphaned-leaky memory when interacting with driver memory parameters (BZ#2138205)

    * WARNING: CPU: 0 PID: 9637 at kernel/time/hrtimer.c:1309 hrtimer_start_range_ns+0x35d/0x400 (BZ#2138953)

    * DELL EMC 8.6-RT: System is not booting into RT Kernel with perc12. (BZ#2139216)

    * Lenovo 8.7: The VGA display shows no signal when install RHEL8.7 (BZ#2140152)

    * Host Pod -> NodePort Service traffic (Host Backend - Same Node) Flow Iperf Cannot Pass Traffic     (BZ#2141878)

    * mlx5_core: mlx5_cmd_check messages scrolling with hardware offload enabled (BZ#2141957)

    * net/ice: VIRTCHNL_OP_CONFIG_VSI_QUEUES command handling failure with in-tree driver (BZ#2142017)

    * RHEL:8.6+ IBM Partner issue - Loopback driver with ABORT_TASKS causing hangs in scsi eh, this bug was     cloned for RHEL8.6 and need this patch in 8.6+ (BZ#2144583)

    * AMdCLIENT 8.8: The kernel command line parameter nomodeset not working properly (BZ#2145218)

    * Path loss during Volume Ownership Change on RHEL 8.7 SAS (BZ#2147374)

    * net/ice: OP_SET_RSS_HENA command not supported with in-tree driver (BZ#2148130)

    * iavf panic: iavf 0000:ca:01.0: Failed to init adminq: -53 (BZ#2149081)

    * Intel 8.8 iavf: Driver Update (bugfixes) (BZ#2149742)

    * Azure RHEL-8 PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150912)

    * RHEL-8.7: System fails to boot with soft lockup while loading/unloading an unsigned (E) kernel module.
    (BZ#2152206)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.69-37.134. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2022-008 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: Fix a potential use after free

    Free the adap structure only after we are done using it.This patch just moves the put_device() down a bit     to avoid theuse after free.

    [wsa: added comment to the code, added Fixes tag] (CVE-2019-25162)

    A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

    A use-after-free flaw was found in the Linux kernel's POSIX CPU timers functionality in the way a user     creates and then deletes the timer in the non-leader thread of the program. This flaw allows a local user     to crash or potentially escalate their privileges on the system. (CVE-2022-2585)

    It was discovered that a nft object or expression could reference a nft set on a different nft table,     leading to a use-after-free once that table was deleted. (CVE-2022-2586)

    A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the     Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege     escalation problem. (CVE-2022-2588)

    Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

    An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

    An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the     bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to     gain unauthorized access to data. (CVE-2022-2905)

    A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

    A use-after-free flaw was found in io_uring in the Linux kernel. This flaw allows a local user to trigger     the issue if a signalfd or binder fd is polled with the io_uring poll due to a lack of io_uring POLLFREE     handling. (CVE-2022-3176)

    A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition. (CVE-2022-3303)

    A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability. (CVE-2022-3625)

    An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

    A flaw was found in the x86 KVM subsystem in kvm_steal_time_set_preempted in arch/x86/kvm/x86.c in the     Linux kernel. Unprivileged guest users can compromise the guest kernel because TLB flush operations are     mishandled in certain KVM_VCPU_PREEMPTED situations. (CVE-2022-39189)

    An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of     service can occur upon binding to an already bound chain. (CVE-2022-39190)

    A race condition in the Linux kernel's EFI capsule loader driver was found in the way it handled write and     flush operations on the device node of the EFI capsule. A local user could potentially use this flaw to     crash the system. (CVE-2022-40307)

    In the Linux kernel, the following vulnerability has been resolved:

    IB/core: Fix a nested dead lock as part of ODP flow (CVE-2022-48675)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: fix UAF when detecting digest errors (CVE-2022-48686)

    In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when     setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment     Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID,     SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and SEG6_ATTR_ALGID. (CVE-2022-48687)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: TX zerocopy should not sense pfmemalloc status (CVE-2022-48689)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: clean up hook list when offload flags check fails (CVE-2022-48691)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpt3sas: Fix use-after-free warning (CVE-2022-48695)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/debug: fix dentry leak in update_sched_domain_debugfs (CVE-2022-48699)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/type1: Unpin zero pages (CVE-2022-48700)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Prevent nested device-reset calls (CVE-2022-49936)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix small mempool leak in SMB2_negotiate() (CVE-2022-49938)

    In the Linux kernel, the following vulnerability has been resolved:

    vt: Clear selection before changing the font (CVE-2022-49948)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level (CVE-2022-49964)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CVE-2022-49977)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix refcount bug in sk_psock_get (2) (CVE-2022-49979)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: hidraw: fix memory leak in hidraw_release() (CVE-2022-49981)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report (CVE-2022-49984)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Don't use tnum_range on array range checking for poke descriptors (CVE-2022-49985)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq (CVE-2022-49986)

    In the Linux kernel, the following vulnerability has been resolved:

    md: call __md_stop_writes in md_stop (CVE-2022-49987)

    In the Linux kernel, the following vulnerability has been resolved:

    xen/privcmd: fix error exit of privcmd_ioctl_dm_op() (CVE-2022-49989)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/hugetlb: avoid corrupting page->mapping in hugetlb_mcopy_atomic_pte (CVE-2022-49991)

    In the Linux kernel, the following vulnerability has been resolved:

    loop: Check for overflow while configuring loop (CVE-2022-49993)

    In the Linux kernel, the following vulnerability has been resolved:

    bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem (CVE-2022-49994)

    In the Linux kernel, the following vulnerability has been resolved:

    writeback: avoid use-after-free after removing device (CVE-2022-49995)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix possible memory leak in btrfs_get_dev_args_from_path() (CVE-2022-49996)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix locking in rxrpc's sendmsg (CVE-2022-49998)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix space cache corruption and potential double allocations (CVE-2022-49999)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: flowtable: fix stuck flows on cleanup due to pending work (CVE-2022-50000)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: policy: fix metadata dst->dev xmit null pointer dereference (CVE-2022-50004)

    In the Linux kernel, the following vulnerability has been resolved:

    kprobes: don't call disarm_kprobe() for disabled kprobes (CVE-2022-50008)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers:md:fix a potential use-after-free bug (CVE-2022-50022)

    In the Linux kernel, the following vulnerability has been resolved:

    net: genl: fix error path memory leak in policy dumping (CVE-2022-50042)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix potential refcount leak in ndisc_router_discovery() (CVE-2022-50043)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: possible module reference underflow in error path (CVE-2022-50048)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix missing i_op in ntfs_read_mft (CVE-2022-50056)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix NULL deref in ntfs_update_mftmirr (CVE-2022-50057)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: don't leak snap_rwsem in handle_cap_grant (CVE-2022-50059)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio_net: fix memory leak inside XPD_TX with mergeable (CVE-2022-50065)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() (CVE-2022-50067)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/ttm: Fix dummy res NULL ptr deref bug (CVE-2022-50068)

    In the Linux kernel, the following vulnerability has been resolved:

    BPF: Fix potential bad pointer dereference in bpf_sys_bpf() (CVE-2022-50069)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/pnfs: Fix a use-after-free bug in open (CVE-2022-50072)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing/eprobes: Have event probes be consistent with kprobes and uprobes (CVE-2022-50075)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix memory leak on the deferred close (CVE-2022-50076)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing/eprobes: Do not allow eprobes to use $stack, or % for regs (CVE-2022-50078)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix warning in ext4_iomap_begin as race between bmap and write (CVE-2022-50082)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h (CVE-2022-50083)

    In the Linux kernel, the following vulnerability has been resolved:

    dm raid: fix address sanitizer warning in raid_status (CVE-2022-50084)

    In the Linux kernel, the following vulnerability has been resolved:

    dm raid: fix address sanitizer warning in raid_resume (CVE-2022-50085)

    In the Linux kernel, the following vulnerability has been resolved:

    block: don't allow the same type rq_qos add more than once (CVE-2022-50086)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (CVE-2022-50087)

    In the Linux kernel, the following vulnerability has been resolved:

    locking/csd_lock: Change csdlock_debug from early_param to __setup (CVE-2022-50091)

    In the Linux kernel, the following vulnerability has been resolved:

    dm thin: fix use-after-free crash in dm_sm_register_threshold_callback (CVE-2022-50092)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/kprobes: Update kcb status flag after singlestepping (CVE-2022-50096)

    In the Linux kernel, the following vulnerability has been resolved:

    video: fbdev: s3fb: Check the size of screen before memset_io() (CVE-2022-50097)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/core: Do not requeue task on CPU excluded from cpus_mask (CVE-2022-50100)

    In the Linux kernel, the following vulnerability has been resolved:

    sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed (CVE-2022-50103)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted (CVE-2022-50126)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/irdma: Fix a window for use-after-free (CVE-2022-50137)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() (CVE-2022-50138)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/mempolicy: fix get_nodes out of bound access (CVE-2022-50147)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: fix potential deadlock in __driver_attach (CVE-2022-50149)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe (CVE-2022-50153)

    In the Linux kernel, the following vulnerability has been resolved:

    of: check previous kernel's ima-kexec-buffer against memory bounds (CVE-2022-50159)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: Add boundary check in put_entry() (CVE-2022-50200)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: hibernate: defer device probing when resuming from hibernation (CVE-2022-50202)

    In the Linux kernel, the following vulnerability has been resolved:

    ext2: Add more validity checks for inode counts (CVE-2022-50205)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: fix oops in concurrently setting insn_emulation sysctls (CVE-2022-50206)

    In the Linux kernel, the following vulnerability has been resolved:

    md-raid10: fix KASAN warning (CVE-2022-50211)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: do not allow CHAIN_ID to refer to another table (CVE-2022-50212)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: do not allow SET_ID to refer to another table (CVE-2022-50213)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: sg: Allow waiting for commands to complete on removed device (CVE-2022-50215)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix KASAN use-after-free Read in compute_effective_progs (CVE-2022-50219)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: vt: initialize unicode screen buffer (CVE-2022-50222)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CVE-2022-50228)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: set UXN on swapper page tables (CVE-2022-50230)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: arm64/poly1305 - fix a read out-of-bound (CVE-2022-50231)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: set UXN on swapper page tables (CVE-2022-50232)

    In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the     transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list
    -- the list head is all zeroes, this results in a NULL pointer dereference. (CVE-2023-1095)

    A flaw was found in the Linux kernel's netdevsim device driver, within the scheduling of events. This     issue results from the improper management of a reference count. This may allow an attacker to create a     denial of service condition on the system. (CVE-2023-2019)

    A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the     extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system     crash or other undefined behaviors. (CVE-2023-2513)

    The upstream advisory describes this issue as follows:

    This vulnerability allows local attackers to disclose sensitive information on affected installations of     the Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target     system in order to exploit this vulnerability.

    The specific flaw exists within the processing of seg6 attributes. The issue results from the lack of     proper validation of user-supplied data, which can result in a read past the end of an allocated buffer.
    An attacker can leverage this in conjunction with other vulnerabilties to escalate privileges and execute     arbitrary code in the context of the kernel. (CVE-2023-2860)

    A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the     Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling     btrfs_ioctl_defrag(). (CVE-2023-3111)

    A use-after-free flaw was found in btrfs_get_dev_args_from_path in fs/btrfs/volumes.c in btrfs file-system     in the Linux Kernel. This flaw allows a local attacker with special privileges to cause a system crash or     leak internal kernel information (CVE-2023-4394)

    A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to     stop further write-back and waits for associated delayed work to complete. However,     wb_inode_writeback_end() may schedule bandwidth estimation work after this has completed, which can result     in the timer attempting to access the recently freed bdi_writeback. (CVE-2024-0562)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
245812	Linux Distros Unpatched Vulnerability : CVE-2022-50000	Nessus	Misc.	high
243421	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2025-098)	Nessus	Amazon Linux Local Security Checks	medium
170855	RHEL 9 : kernel (RHSA-2023:0512)	Nessus	Red Hat Local Security Checks	high
169969	RHEL 8 : kernel (RHSA-2023:0101)	Nessus	Red Hat Local Security Checks	high
166118	Amazon Linux 2 : kernel (ALASKERNEL-5.15-2022-008)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2022-50000

high

Tenable Plugins

high

medium

high

high

high