In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix stuck flows on cleanup due to pending work To clear the flow table on flow table free, the following sequence normally happens in order: 1) gc_step work is stopped to disable any further stats/del requests. 2) All flow table entries are set to teardown state. 3) Run gc_step which will queue HW del work for each flow table entry. 4) Waiting for the above del work to finish (flush). 5) Run gc_step again, deleting all entries from the flow table. 6) Flow table is freed. But if a flow table entry already has pending HW stats or HW add work step 3 will not queue HW del work (it will be skipped), step 4 will wait for the pending add/stats to finish, and step 5 will queue HW del work which might execute after freeing of the flow table. To fix the above, this patch flushes the pending work, then it sets the teardown flag to all flows in the flowtable and it forces a garbage collector run to queue work to remove the flows from hardware, then it flushes this new pending work and (finally) it forces another garbage collector run to remove the entry from the software flowtable. Stack trace: [47773.882335] BUG: KASAN: use-after-free in down_read+0x99/0x460 [47773.883634] Write of size 8 at addr ffff888103b45aa8 by task kworker/u20:6/543704 [47773.885634] CPU: 3 PID: 543704 Comm: kworker/u20:6 Not tainted 5.12.0-rc7+ #2 [47773.886745] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) [47773.888438] Workqueue: nf_ft_offload_del flow_offload_work_handler [nf_flow_table] [47773.889727] Call Trace: [47773.890214] dump_stack+0xbb/0x107 [47773.890818] print_address_description.constprop.0+0x18/0x140 [47773.892990] kasan_report.cold+0x7c/0xd8 [47773.894459] kasan_check_range+0x145/0x1a0 [47773.895174] down_read+0x99/0x460 [47773.899706] nf_flow_offload_tuple+0x24f/0x3c0 [nf_flow_table] [47773.907137] flow_offload_work_handler+0x72d/0xbe0 [nf_flow_table] [47773.913372] process_one_work+0x8ac/0x14e0 [47773.921325] [47773.921325] Allocated by task 592159: [47773.922031] kasan_save_stack+0x1b/0x40 [47773.922730] __kasan_kmalloc+0x7a/0x90 [47773.923411] tcf_ct_flow_table_get+0x3cb/0x1230 [act_ct] [47773.924363] tcf_ct_init+0x71c/0x1156 [act_ct] [47773.925207] tcf_action_init_1+0x45b/0x700 [47773.925987] tcf_action_init+0x453/0x6b0 [47773.926692] tcf_exts_validate+0x3d0/0x600 [47773.927419] fl_change+0x757/0x4a51 [cls_flower] [47773.928227] tc_new_tfilter+0x89a/0x2070 [47773.936652] [47773.936652] Freed by task 543704: [47773.937303] kasan_save_stack+0x1b/0x40 [47773.938039] kasan_set_track+0x1c/0x30 [47773.938731] kasan_set_free_info+0x20/0x30 [47773.939467] __kasan_slab_free+0xe7/0x120 [47773.940194] slab_free_freelist_hook+0x86/0x190 [47773.941038] kfree+0xce/0x3a0 [47773.941644] tcf_ct_flow_table_cleanup_work Original patch description and stack trace by Paul Blakey.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:15660 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ext4: use-after-free in ext4_xattr_set_entry() (CVE-2023-2513)

    * kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)

    * kernel: netfilter: flowtable: fix stuck flows on cleanup due to pending work (CVE-2022-50000)

    * kernel: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085)

    * kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CVE-2025-38159)

    * kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()     (CVE-2025-38352)

    * kernel: tipc: Fix use-after-free in tipc_conn_close() (CVE-2025-38464)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - netfilter: flowtable: fix stuck flows on cleanup due to pending work To clear the flow table on flow table     free, the following sequence normally happens in order: 1) gc_step work is stopped to disable any further     stats/del requests. 2) All flow table entries are set to teardown state. 3) Run gc_step which will queue     HW del work for each flow table entry. 4) Waiting for the above del work to finish (flush). 5) Run gc_step     again, deleting all entries from the flow table. 6) Flow table is freed. But if a flow table entry already     has pending HW stats or HW add work step 3 will not queue HW del work (it will be skipped), step 4 will     wait for the pending add/stats to finish, and step 5 will queue HW del work which might execute after     freeing of the flow table. To fix the above, this patch flushes the pending work, then it sets the     teardown flag to all flows in the flowtable and it forces a garbage collector run to queue work to remove     the flows from hardware, then it flushes this new pending work and (finally) it forces another garbage     collector run to remove the entry from the software flowtable. Stack trace: [47773.882335] BUG: KASAN:
    use-after-free in down_read+0x99/0x460 [47773.883634] Write of size 8 at addr ffff888103b45aa8 by task     kworker/u20:6/543704 [47773.885634] CPU: 3 PID: 543704 Comm: kworker/u20:6 Not tainted 5.12.0-rc7+ #2     [47773.886745] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) [47773.888438] Workqueue:
    nf_ft_offload_del flow_offload_work_handler [nf_flow_table] [47773.889727] Call Trace: [47773.890214]     dump_stack+0xbb/0x107 [47773.890818] print_address_description.constprop.0+0x18/0x140 [47773.892990]     kasan_report.cold+0x7c/0xd8 [47773.894459] kasan_check_range+0x145/0x1a0 [47773.895174]     down_read+0x99/0x460 [47773.899706] nf_flow_offload_tuple+0x24f/0x3c0 [nf_flow_table] [47773.907137]     flow_offload_work_handler+0x72d/0xbe0 [nf_flow_table] [47773.913372] process_one_work+0x8ac/0x14e0     [47773.921325] [47773.921325] Allocated by task 592159: [47773.922031] kasan_save_stack+0x1b/0x40     [47773.922730] __kasan_kmalloc+0x7a/0x90 [47773.923411] tcf_ct_flow_table_get+0x3cb/0x1230 [act_ct]     [47773.924363] tcf_ct_init+0x71c/0x1156 [act_ct] [47773.925207] tcf_action_init_1+0x45b/0x700     [47773.925987] tcf_action_init+0x453/0x6b0 [47773.926692] tcf_exts_validate+0x3d0/0x600 [47773.927419]     fl_change+0x757/0x4a51 [cls_flower] [47773.928227] tc_new_tfilter+0x89a/0x2070 [47773.936652]     [47773.936652] Freed by task 543704: [47773.937303] kasan_save_stack+0x1b/0x40 [47773.938039]     kasan_set_track+0x1c/0x30 [47773.938731] kasan_set_free_info+0x20/0x30 [47773.939467]
    __kasan_slab_free+0xe7/0x120 [47773.940194] slab_free_freelist_hook+0x86/0x190 [47773.941038]     kfree+0xce/0x3a0 [47773.941644] tcf_ct_flow_table_cleanup_work Original patch description and stack trace     by Paul Blakey. (CVE-2022-50000)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.10.239-236.958. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-098 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: flowtable: fix stuck flows on cleanup due to pending work (CVE-2022-50000)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_socket: fix sk refcount leaks (CVE-2024-46855)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: hugetlb: independent PMD page table shared count (CVE-2024-57883)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: sch_sfq: don't allow 1 packet limit (CVE-2024-57996)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (CVE-2025-37963)

    In the Linux kernel, the following vulnerability has been resolved:

    genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie (CVE-2025-38062)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: prio: fix a race in prio_tune() (CVE-2025-38083)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/hugetlb: unshare page tables during VMA split, not before (CVE-2025-38084)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/iopl: Cure TIF_IO_BITMAP inconsistencies (CVE-2025-38100)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (CVE-2025-38103)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: ets: fix a race in ets_qdisc_change() (CVE-2025-38107)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: red: fix a race in __red_change() (CVE-2025-38108)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mdiobus: Fix potential out-of-bounds read/write access (CVE-2025-38111)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Fix TOCTOU issue in sk_is_readable() (CVE-2025-38112)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: sch_sfq: fix a potential crash on gso_skb handling (CVE-2025-38115)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: Fix the dead loop of MPLS parse (CVE-2025-38146)

    In the Linux kernel, the following vulnerability has been resolved:

    calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (CVE-2025-38161)

    In the Linux kernel, the following vulnerability has been resolved:

    calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (CVE-2025-38181)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (CVE-2025-38184)

    In the Linux kernel, the following vulnerability has been resolved:

    platform/x86: dell_rbu: Fix list usage (CVE-2025-38197)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CVE-2025-38200)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: fix double free in delayed_free (CVE-2025-38206)

    In the Linux kernel, the following vulnerability has been resolved:

    ipc: fix to protect IPCS lookups using RCU (CVE-2025-38212)

    In the Linux kernel, the following vulnerability has been resolved:

    vgacon: Add check for vc_origin address range in vgacon_scroll() (CVE-2025-38213)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (CVE-2025-38214)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: inline: fix len overflow in ext4_prepare_inline_data (CVE-2025-38222)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (CVE-2025-38231)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tipc: fix refcount warning in tipc_aead_encrypt (CVE-2025-38273)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix WARN() in get_bpf_raw_tp_regs (CVE-2025-38285)

    In the Linux kernel, the following vulnerability has been resolved:

    EDAC/skx_common: Fix general protection fault (CVE-2025-38298)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (CVE-2025-38312)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (CVE-2025-38320)

    In the Linux kernel, the following vulnerability has been resolved:

    mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (CVE-2025-38324)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (CVE-2025-38337)

    In the Linux kernel, the following vulnerability has been resolved:

    software node: Correct a OOB check in software_node_get_reference_args() (CVE-2025-38342)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: fix acpi parse and parseext cache leaks (CVE-2025-38344)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346)

    In the Linux kernel, the following vulnerability has been resolved:

    posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352)

    In the Linux kernel, the following vulnerability has been resolved:

    Squashfs: check return result of sb_min_blocksize (CVE-2025-38415)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: Fix sample vs do_exit() (CVE-2025-38424)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (CVE-2025-38430)

    In the Linux kernel, the following vulnerability has been resolved:

    do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2951 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    The following packages have been upgraded to a later upstream version: kernel (4.18.0). (BZ#2122230,     BZ#2122267)

    Security Fix(es):

    * use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)

    * net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)

    * hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)

    * malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)

    * when setting font with malicious data by ioctl PIO_FONT, kernel will write memory out of bounds     (CVE-2021-33656)

    * possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)

    * use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)

    * KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)

    * KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)

    * netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)

    * race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)

    * media: em28xx: initialize refcount before kref_get (CVE-2022-3239)

    * race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)

    * memory leak in ipv6_renew_options() (CVE-2022-3524)

    * data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)

    * data races around sk->sk_prot (CVE-2022-3567)

    * memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)

    * denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)

    * use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)

    * USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)

    * Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)

    * l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)

    * igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)

    * Executable Space Protection Bypass (CVE-2022-25265)

    * Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

    * unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)

    * TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning     (CVE-2022-39189)

    * Report vmalloc UAF in dvb-core/dmxdev (CVE-2022-41218)

    * u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)

    * use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)

    * use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)

    * BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)

    * Denial of service in beacon protection for P2P-device (CVE-2022-42722)

    * memory corruption in usbmon driver (CVE-2022-43750)

    * NULL pointer dereference in traffic control subsystem (CVE-2022-47929)

    * NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)

    * use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)

    * Soft lockup occurred during __page_mapcount (CVE-2023-1582)

    * slab-out-of-bounds read vulnerabilities in cbq_classify (CVE-2023-23454)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0512 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

    * kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHEL-9.1: Update new rfkill event size behavior for compatibility with older applications (BZ#2098082)

    * RHEL9 - ISST-LTE:LPM:Rainer/P9:HPT:SLES15SP4:After successful migration with hardlockups ,LPM failed and     LPAR remained hung (BZ#2103084)

    * Intel 9.1, ADL-P IOTG: rmmod of pmt_telemetry driver results in panic (BZ#2127863)

    * kernel: Update ppc64le key following resolution of CVE-2022-1665 (BZ#2130923)

    * MCHP 9.1: Update SmartPQI driver to latest upstream Second Set of Patches (BZ#2133552)

    * intel_qat: WARNING: CPU: 0 PID: 1440 at kernel/dma/debug.c:973 check_unmap+0xa6f/0x2360 (BZ#2133750)

    * CNB: Update TC subsystem to upstream v5.18 (BZ#2137359)

    * netfilter: backports from upstream (BZ#2137360)

    * netfilter: backports from upstream (BZ#2137361)

    * Cgroups_v2, when creating new cgroup/container, resets the cpu affinity masks for all usr processes on     the system. (BZ#2143767)

    * RHEL 9: ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143977)

    * RHEL 9.0, AMD Genoa: OS cannot boot when enabling SME in UEFI setup and appending 'mem_encrypt=on'     (BZ#2145017)

    * kernel-devel RPM cross-compiled by CKI contains host-arch scripts (BZ#2150019)

    * Azure, RHEL 9: Sometimes newly deployed VMs are not getting accelerated network during provisioning     (BZ#2151606)

    * Scheduler Update (rhel9.2) (BZ#2153793)

    * DELL 9.0 RT BUG - stock clone: On PE R760 system, call traces are observed dmesg when system is running     stress (BZ#2154408)

    * MSFT, MANA RHEL 9: Fix race on per-CQ variable napi_iperf panic fix (BZ#2155146)

    * Azure, RHEL 9: VM Deployment Failures Patch Request (BZ#2155931)

    * kernel-rt-debug: WARNING: possible circular locking dependency detected     (&n->list_lock->&p->pi_lock->&lock->wait_lock) (BZ#2160615)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0101 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

    * kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHEL8.4 - zfcp: fix missing auto port scan and thus missing target ports (BZ#2127849)

    * vfio zero page mappings fail after 2M instances (BZ#2128515)

    * ice: Driver Update up to 5.19 (BZ#2130992)

    * atlantic: missing hybernate/resume fixes (BZ#2131935)

    * Bluefield 2 DPU would crash and reboot due to a kernel panic (BZ#2134084)

    * Fix issue that enables STABLE_WRITES by default and causes performance regressions (BZ#2135813)

    * ice: Intel E810 PTP clock glitching (BZ#2136036)

    * ice: configure link-down-on-close on and change interface mtu to 9000,the interface can't up     (BZ#2136216)

    * ice: dump additional CSRs for Tx hang debugging (BZ#2136513)

    * ice,iavf: system panic during sriov sriov_test_cntvf_reboot testing (BZ#2137270)

    * After upgrading to ocp4.11.1, our dpdk application using vlan strip offload is not working (BZ#2138157)

    * i40e: orphaned-leaky memory when interacting with driver memory parameters (BZ#2138205)

    * WARNING: CPU: 0 PID: 9637 at kernel/time/hrtimer.c:1309 hrtimer_start_range_ns+0x35d/0x400 (BZ#2138953)

    * DELL EMC 8.6-RT: System is not booting into RT Kernel with perc12. (BZ#2139216)

    * Lenovo 8.7: The VGA display shows no signal when install RHEL8.7 (BZ#2140152)

    * Host Pod -> NodePort Service traffic (Host Backend - Same Node) Flow Iperf Cannot Pass Traffic     (BZ#2141878)

    * mlx5_core: mlx5_cmd_check messages scrolling with hardware offload enabled (BZ#2141957)

    * net/ice: VIRTCHNL_OP_CONFIG_VSI_QUEUES command handling failure with in-tree driver (BZ#2142017)

    * RHEL:8.6+ IBM Partner issue - Loopback driver with ABORT_TASKS causing hangs in scsi eh, this bug was     cloned for RHEL8.6 and need this patch in 8.6+ (BZ#2144583)

    * AMdCLIENT 8.8: The kernel command line parameter nomodeset not working properly (BZ#2145218)

    * Path loss during Volume Ownership Change on RHEL 8.7 SAS (BZ#2147374)

    * net/ice: OP_SET_RSS_HENA command not supported with in-tree driver (BZ#2148130)

    * iavf panic: iavf 0000:ca:01.0: Failed to init adminq: -53 (BZ#2149081)

    * Intel 8.8 iavf: Driver Update (bugfixes) (BZ#2149742)

    * Azure RHEL-8 PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150912)

    * RHEL-8.7: System fails to boot with soft lockup while loading/unloading an unsigned (E) kernel module.
    (BZ#2152206)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8267 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

    * use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

    * smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)

    * NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

    * swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

    * uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)

    * race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

    * use-after-free and memory errors in ext4 when mounting and operating on a corrupted image     (CVE-2022-1184)

    * concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280)

    * kernel info leak issue in pfkey_register (CVE-2022-1353)

    * use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)

    * NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

    * fanotify misuses fd_install() which could lead to use-after-free (CVE-2022-1998)

    * nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)

    * integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

    * slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

    * incomplete clean-up of multi-core shared buffers (aka SBDR) (CVE-2022-21123)

    * incomplete clean-up of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125)

    * incomplete clean-up in specific special register write operations (aka DRPW) (CVE-2022-21166)

    * possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

    * AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816,     CVE-2022-29900)

    * AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)

    * Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

    * double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

    * use after free in SUNRPC subsystem (CVE-2022-28893)

    * use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

    * Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

    * DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

    * nf_tables disallow binding to already bound chain (CVE-2022-39190)

    * nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
264523	RHEL 8 : kernel (RHSA-2025:15660)	Nessus	Red Hat Local Security Checks	medium
245812	Linux Distros Unpatched Vulnerability : CVE-2022-50000	Nessus	Misc.	high
243421	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2025-098 (ALASKERNEL-5.10-2025-098)	Nessus	Amazon Linux Local Security Checks	medium
175900	RHEL 8 : kernel (RHSA-2023:2951)	Nessus	Red Hat Local Security Checks	high
170855	RHEL 9 : kernel (RHSA-2023:0512)	Nessus	Red Hat Local Security Checks	high
169969	RHEL 8 : kernel (RHSA-2023:0101)	Nessus	Red Hat Local Security Checks	high
167620	RHEL 9 : kernel (RHSA-2022:8267)	Nessus	Red Hat Local Security Checks	high
166118	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2022-008 (ALASKERNEL-5.15-2022-008)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2022-50000

high

Tenable Plugins

medium

high

medium

high

high

high

high

high