In the Linux kernel, the following vulnerability has been resolved: mptcp: do not queue data on closed subflows Dipanjan reported a syzbot splat at close time: WARNING: CPU: 1 PID: 10818 at net/ipv4/af_inet.c:153 inet_sock_destruct+0x6d0/0x8e0 net/ipv4/af_inet.c:153 Modules linked in: uio_ivshmem(OE) uio(E) CPU: 1 PID: 10818 Comm: kworker/1:16 Tainted: G OE 5.19.0-rc6-g2eae0556bb9d #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: events mptcp_worker RIP: 0010:inet_sock_destruct+0x6d0/0x8e0 net/ipv4/af_inet.c:153 Code: 21 02 00 00 41 8b 9c 24 28 02 00 00 e9 07 ff ff ff e8 34 4d 91 f9 89 ee 4c 89 e7 e8 4a 47 60 ff e9 a6 fc ff ff e8 20 4d 91 f9 <0f> 0b e9 84 fe ff ff e8 14 4d 91 f9 0f 0b e9 d4 fd ff ff e8 08 4d RSP: 0018:ffffc9001b35fa78 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000002879d0 RCX: ffff8881326f3b00 RDX: 0000000000000000 RSI: ffff8881326f3b00 RDI: 0000000000000002 RBP: ffff888179662674 R08: ffffffff87e983a0 R09: 0000000000000000 R10: 0000000000000005 R11: 00000000000004ea R12: ffff888179662400 R13: ffff888179662428 R14: 0000000000000001 R15: ffff88817e38e258 FS: 0000000000000000(0000) GS:ffff8881f5f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020007bc0 CR3: 0000000179592000 CR4: 0000000000150ee0 Call Trace: <TASK> __sk_destruct+0x4f/0x8e0 net/core/sock.c:2067 sk_destruct+0xbd/0xe0 net/core/sock.c:2112 __sk_free+0xef/0x3d0 net/core/sock.c:2123 sk_free+0x78/0xa0 net/core/sock.c:2134 sock_put include/net/sock.h:1927 [inline] __mptcp_close_ssk+0x50f/0x780 net/mptcp/protocol.c:2351 __mptcp_destroy_sock+0x332/0x760 net/mptcp/protocol.c:2828 mptcp_worker+0x5d2/0xc90 net/mptcp/protocol.c:2586 process_one_work+0x9cc/0x1650 kernel/workqueue.c:2289 worker_thread+0x623/0x1070 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 </TASK> The root cause of the problem is that an mptcp-level (re)transmit can race with mptcp_close() and the packet scheduler checks the subflow state before acquiring the socket lock: we can try to (re)transmit on an already closed ssk. Fix the issue checking again the subflow socket status under the subflow socket lock protection. Additionally add the missing check for the fallback-to-tcp case.

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2025:1757962453 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix use after free bugs     After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which     aliases skb memory is accessed after the peak_usb_netif_rx_ni(). Reordering the lines solves the issue.
    (CVE-2021-47670)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Remove WQ_MEM_RECLAIM     from storvsc_error_wq storvsc_error_wq workqueue should not be marked as WQ_MEM_RECLAIM as it doesn't need     to make forward progress under memory pressure. Marking this workqueue as WQ_MEM_RECLAIM may cause     deadlock while flushing a non-WQ_MEM_RECLAIM workqueue. In the current state it causes the following     warning: [ 14.506347] ------------[ cut here ]------------ [ 14.506354] workqueue: WQ_MEM_RECLAIM     storvsc_error_wq_0:storvsc_remove_lun is flushing !WQ_MEM_RECLAIM     events_freezable_power_:disk_events_workfn [ 14.506360] WARNING: CPU: 0 PID: 8 at     <-snip->kernel/workqueue.c:2623 check_flush_dependency+0xb5/0x130 [ 14.506390] CPU: 0 PID: 8 Comm:
    kworker/u4:0 Not tainted 5.4.0-1086-azure #91~18.04.1-Ubuntu [ 14.506391] Hardware name: Microsoft     Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 05/09/2022 [ 14.506393]     Workqueue: storvsc_error_wq_0 storvsc_remove_lun [ 14.506395] RIP: 0010:check_flush_dependency+0xb5/0x130     <-snip-> [ 14.506408] Call Trace: [ 14.506412] __flush_work+0xf1/0x1c0 [ 14.506414]
    __cancel_work_timer+0x12f/0x1b0 [ 14.506417] ? kernfs_put+0xf0/0x190 [ 14.506418]     cancel_delayed_work_sync+0x13/0x20 [ 14.506420] disk_block_events+0x78/0x80 [ 14.506421]     del_gendisk+0x3d/0x2f0 [ 14.506423] sr_remove+0x28/0x70 [ 14.506427]     device_release_driver_internal+0xef/0x1c0 [ 14.506428] device_release_driver+0x12/0x20 [ 14.506429]     bus_remove_device+0xe1/0x150 [ 14.506431] device_del+0x167/0x380 [ 14.506432]
    __scsi_remove_device+0x11d/0x150 [ 14.506433] scsi_remove_device+0x26/0x40 [ 14.506434]     storvsc_remove_lun+0x40/0x60 [ 14.506436] process_one_work+0x209/0x400 [ 14.506437]     worker_thread+0x34/0x400 [ 14.506439] kthread+0x121/0x140 [ 14.506440] ? process_one_work+0x400/0x400 [     14.506441] ? kthread_park+0x90/0x90 [ 14.506443] ret_from_fork+0x35/0x40 [ 14.506445] ---[ end trace     2d9633159fdc6ee7 ]--- (CVE-2022-49986)

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tproxy: restrict to     prerouting hook TPROXY is only allowed from prerouting, but nft_tproxy doesn't check this. This fixes a     crash (null dereference) when using tproxy from e.g. output. (CVE-2022-50001)

  - In the Linux kernel, the following vulnerability has been resolved: ice: xsk: prohibit usage of non-     balanced queue id Fix the following scenario: 1. ethtool -L $IFACE rx 8 tx 96 2. xdpsock -q 10 -t -z Above     refers to a case where user would like to attach XSK socket in txonly mode at a queue id that does not     have a corresponding Rx queue. At this moment ice's XSK logic is tightly bound to act on a queue pair,     e.g. both Tx and Rx queues at a given queue id are disabled/enabled and both of them will get XSK pool     assigned, which is broken for the presented queue configuration. This results in the splat included at the     bottom, which is basically an OOB access to Rx ring array. To fix this, allow using the ids only in scope     of combined queues reported by ethtool. However, logic should be rewritten to allow such configurations     later on, which would end up as a complete rewrite of the control path, so let us go with this temporary     fix. [420160.558008] BUG: kernel NULL pointer dereference, address: 0000000000000082 [420160.566359] #PF:
    supervisor read access in kernel mode [420160.572657] #PF: error_code(0x0000) - not-present page     [420160.579002] PGD 0 P4D 0 [420160.582756] Oops: 0000 [#1] PREEMPT SMP NOPTI [420160.588396] CPU: 10 PID:
    21232 Comm: xdpsock Tainted: G OE 5.19.0-rc7+ #10 [420160.597893] Hardware name: Intel Corporation     S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [420160.609894] RIP:
    0010:ice_xsk_pool_setup+0x44/0x7d0 [ice] [420160.616968] Code: f3 48 83 ec 40 48 8b 4f 20 48 8b 3f 65 48     8b 04 25 28 00 00 00 48 89 44 24 38 31 c0 48 8d 04 ed 00 00 00 00 48 01 c1 48 8b 11 <0f> b7 92 82 00 00 00     48 85 d2 0f 84 2d 75 00 00 48 8d 72 ff 48 85 [420160.639421] RSP: 0018:ffffc9002d2afd48 EFLAGS: 00010282     [420160.646650] RAX: 0000000000000050 RBX: ffff88811d8bdd00 RCX: ffff888112c14ff8 [420160.655893] RDX:
    0000000000000000 RSI: ffff88811d8bdd00 RDI: ffff888109861000 [420160.665166] RBP: 000000000000000a R08:
    000000000000000a R09: 0000000000000000 [420160.674493] R10: 000000000000889f R11: 0000000000000000 R12:
    000000000000000a [420160.683833] R13: 000000000000000a R14: 0000000000000000 R15: ffff888117611828     [420160.693211] FS: 00007fa869fc1f80(0000) GS:ffff8897e0880000(0000) knlGS:0000000000000000     [420160.703645] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [420160.711783] CR2: 0000000000000082     CR3: 00000001d076c001 CR4: 00000000007706e0 [420160.721399] DR0: 0000000000000000 DR1: 0000000000000000     DR2: 0000000000000000 [420160.731045] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400     [420160.740707] PKRU: 55555554 [420160.745960] Call Trace: [420160.750962] <TASK> [420160.755597] ?     kmalloc_large_node+0x79/0x90 [420160.762703] ? __kmalloc_node+0x3f5/0x4b0 [420160.769341]     xp_assign_dev+0xfd/0x210 [420160.775661] ? shmem_file_read_iter+0x29a/0x420 [420160.782896]     xsk_bind+0x152/0x490 [420160.788943] __sys_bind+0xd0/0x100 [420160.795097] ?     exit_to_user_mode_prepare+0x20/0x120 [420160.802801] __x64_sys_bind+0x16/0x20 [420160.809298]     do_syscall_64+0x38/0x90 [420160.815741] entry_SYSCALL_64_after_hwframe+0x63/0xcd [420160.823731] RIP:
    0033:0x7fa86a0dd2fb [420160.830264] Code: c3 66 0f 1f 44 00 00 48 8b 15 69 8b 0c 00 f7 d8 64 89 02 b8 ff     ff ff ff eb bc 0f 1f 44 00 00 f3 0f 1e fa b8 31 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 3d 8b     0c 00 f7 d8 64 89 01 48 [420160.855410] RSP: 002b:00007ffc1146f618 EFLAGS: 00000246 ORIG_RAX:
    0000000000000031 [420160.866366] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa86a0dd2fb     [420160.876957] RDX: 0000000000000010 RSI: 00007ffc1146f680 RDI: 0000000000000003 [420160.887604] RBP:
    000055d7113a0520 R08: 00007fa868fb8000 R09: 0000000080000000 [420160.898293] R10: 0000000000008001 R11:
    0000000000000246 R12: 000055d7113a04e0 [420160.909038] R13: 000055d7113a0320 R14: 000000000000000a R15:
    0000000000000000 [420160.919817] </TASK> [420160.925659] Modules linked in: ice(OE) af_packet binfmt_misc
    ---truncated--- (CVE-2022-50003)

  - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda-ipc: Do not     process IPC reply before firmware boot It is not yet clear, but it is possible to create a firmware so     broken that it will send a reply message before a FW_READY message (it is not yet clear if FW_READY will     arrive later). Since the reply_data is allocated only after the FW_READY message, this will lead to a NULL     pointer dereference if not filtered out. The issue was reported with IPC4 firmware but the same condition     is present for IPC3. (CVE-2022-50015)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0010 advisory.

    This advisory aggregates security fixes for the kernel SRPM in CIQ LTS 8.6. It addresses 28 CVEs:
    CVE-2022-50070, CVE-2025-38159, CVE-2025-39841, CVE-2025-37797, CVE-2025-38200, and 23 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0634 advisory.

    This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 8 Compliant. It addresses 34 CVEs:
    CVE-2022-50137, CVE-2022-50070, CVE-2022-50022, CVE-2022-49111, CVE-2022-49986, and 29 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2025:1757961864 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix use after free bugs     After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which     aliases skb memory is accessed after the peak_usb_netif_rx_ni(). Reordering the lines solves the issue.
    (CVE-2021-47670)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Remove WQ_MEM_RECLAIM     from storvsc_error_wq storvsc_error_wq workqueue should not be marked as WQ_MEM_RECLAIM as it doesn't need     to make forward progress under memory pressure. Marking this workqueue as WQ_MEM_RECLAIM may cause     deadlock while flushing a non-WQ_MEM_RECLAIM workqueue. In the current state it causes the following     warning: [ 14.506347] ------------[ cut here ]------------ [ 14.506354] workqueue: WQ_MEM_RECLAIM     storvsc_error_wq_0:storvsc_remove_lun is flushing !WQ_MEM_RECLAIM     events_freezable_power_:disk_events_workfn [ 14.506360] WARNING: CPU: 0 PID: 8 at     <-snip->kernel/workqueue.c:2623 check_flush_dependency+0xb5/0x130 [ 14.506390] CPU: 0 PID: 8 Comm:
    kworker/u4:0 Not tainted 5.4.0-1086-azure #91~18.04.1-Ubuntu [ 14.506391] Hardware name: Microsoft     Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 05/09/2022 [ 14.506393]     Workqueue: storvsc_error_wq_0 storvsc_remove_lun [ 14.506395] RIP: 0010:check_flush_dependency+0xb5/0x130     <-snip-> [ 14.506408] Call Trace: [ 14.506412] __flush_work+0xf1/0x1c0 [ 14.506414]
    __cancel_work_timer+0x12f/0x1b0 [ 14.506417] ? kernfs_put+0xf0/0x190 [ 14.506418]     cancel_delayed_work_sync+0x13/0x20 [ 14.506420] disk_block_events+0x78/0x80 [ 14.506421]     del_gendisk+0x3d/0x2f0 [ 14.506423] sr_remove+0x28/0x70 [ 14.506427]     device_release_driver_internal+0xef/0x1c0 [ 14.506428] device_release_driver+0x12/0x20 [ 14.506429]     bus_remove_device+0xe1/0x150 [ 14.506431] device_del+0x167/0x380 [ 14.506432]
    __scsi_remove_device+0x11d/0x150 [ 14.506433] scsi_remove_device+0x26/0x40 [ 14.506434]     storvsc_remove_lun+0x40/0x60 [ 14.506436] process_one_work+0x209/0x400 [ 14.506437]     worker_thread+0x34/0x400 [ 14.506439] kthread+0x121/0x140 [ 14.506440] ? process_one_work+0x400/0x400 [     14.506441] ? kthread_park+0x90/0x90 [ 14.506443] ret_from_fork+0x35/0x40 [ 14.506445] ---[ end trace     2d9633159fdc6ee7 ]--- (CVE-2022-49986)

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tproxy: restrict to     prerouting hook TPROXY is only allowed from prerouting, but nft_tproxy doesn't check this. This fixes a     crash (null dereference) when using tproxy from e.g. output. (CVE-2022-50001)

  - In the Linux kernel, the following vulnerability has been resolved: ice: xsk: prohibit usage of non-     balanced queue id Fix the following scenario: 1. ethtool -L $IFACE rx 8 tx 96 2. xdpsock -q 10 -t -z Above     refers to a case where user would like to attach XSK socket in txonly mode at a queue id that does not     have a corresponding Rx queue. At this moment ice's XSK logic is tightly bound to act on a queue pair,     e.g. both Tx and Rx queues at a given queue id are disabled/enabled and both of them will get XSK pool     assigned, which is broken for the presented queue configuration. This results in the splat included at the     bottom, which is basically an OOB access to Rx ring array. To fix this, allow using the ids only in scope     of combined queues reported by ethtool. However, logic should be rewritten to allow such configurations     later on, which would end up as a complete rewrite of the control path, so let us go with this temporary     fix. [420160.558008] BUG: kernel NULL pointer dereference, address: 0000000000000082 [420160.566359] #PF:
    supervisor read access in kernel mode [420160.572657] #PF: error_code(0x0000) - not-present page     [420160.579002] PGD 0 P4D 0 [420160.582756] Oops: 0000 [#1] PREEMPT SMP NOPTI [420160.588396] CPU: 10 PID:
    21232 Comm: xdpsock Tainted: G OE 5.19.0-rc7+ #10 [420160.597893] Hardware name: Intel Corporation     S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [420160.609894] RIP:
    0010:ice_xsk_pool_setup+0x44/0x7d0 [ice] [420160.616968] Code: f3 48 83 ec 40 48 8b 4f 20 48 8b 3f 65 48     8b 04 25 28 00 00 00 48 89 44 24 38 31 c0 48 8d 04 ed 00 00 00 00 48 01 c1 48 8b 11 <0f> b7 92 82 00 00 00     48 85 d2 0f 84 2d 75 00 00 48 8d 72 ff 48 85 [420160.639421] RSP: 0018:ffffc9002d2afd48 EFLAGS: 00010282     [420160.646650] RAX: 0000000000000050 RBX: ffff88811d8bdd00 RCX: ffff888112c14ff8 [420160.655893] RDX:
    0000000000000000 RSI: ffff88811d8bdd00 RDI: ffff888109861000 [420160.665166] RBP: 000000000000000a R08:
    000000000000000a R09: 0000000000000000 [420160.674493] R10: 000000000000889f R11: 0000000000000000 R12:
    000000000000000a [420160.683833] R13: 000000000000000a R14: 0000000000000000 R15: ffff888117611828     [420160.693211] FS: 00007fa869fc1f80(0000) GS:ffff8897e0880000(0000) knlGS:0000000000000000     [420160.703645] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [420160.711783] CR2: 0000000000000082     CR3: 00000001d076c001 CR4: 00000000007706e0 [420160.721399] DR0: 0000000000000000 DR1: 0000000000000000     DR2: 0000000000000000 [420160.731045] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400     [420160.740707] PKRU: 55555554 [420160.745960] Call Trace: [420160.750962] <TASK> [420160.755597] ?     kmalloc_large_node+0x79/0x90 [420160.762703] ? __kmalloc_node+0x3f5/0x4b0 [420160.769341]     xp_assign_dev+0xfd/0x210 [420160.775661] ? shmem_file_read_iter+0x29a/0x420 [420160.782896]     xsk_bind+0x152/0x490 [420160.788943] __sys_bind+0xd0/0x100 [420160.795097] ?     exit_to_user_mode_prepare+0x20/0x120 [420160.802801] __x64_sys_bind+0x16/0x20 [420160.809298]     do_syscall_64+0x38/0x90 [420160.815741] entry_SYSCALL_64_after_hwframe+0x63/0xcd [420160.823731] RIP:
    0033:0x7fa86a0dd2fb [420160.830264] Code: c3 66 0f 1f 44 00 00 48 8b 15 69 8b 0c 00 f7 d8 64 89 02 b8 ff     ff ff ff eb bc 0f 1f 44 00 00 f3 0f 1e fa b8 31 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 3d 8b     0c 00 f7 d8 64 89 01 48 [420160.855410] RSP: 002b:00007ffc1146f618 EFLAGS: 00000246 ORIG_RAX:
    0000000000000031 [420160.866366] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa86a0dd2fb     [420160.876957] RDX: 0000000000000010 RSI: 00007ffc1146f680 RDI: 0000000000000003 [420160.887604] RBP:
    000055d7113a0520 R08: 00007fa868fb8000 R09: 0000000080000000 [420160.898293] R10: 0000000000008001 R11:
    0000000000000246 R12: 000055d7113a04e0 [420160.909038] R13: 000055d7113a0320 R14: 000000000000000a R15:
    0000000000000000 [420160.919817] </TASK> [420160.925659] Modules linked in: ice(OE) af_packet binfmt_misc
    ---truncated--- (CVE-2022-50003)

  - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda-ipc: Do not     process IPC reply before firmware boot It is not yet clear, but it is possible to create a firmware so     broken that it will send a reply message before a FW_READY message (it is not yet clear if FW_READY will     arrive later). Since the reply_data is allocated only after the FW_READY message, this will lead to a NULL     pointer dereference if not filtered out. The issue was reported with IPC4 firmware but the same condition     is present for IPC3. (CVE-2022-50015)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7938-1 advisory.

    Jean-Claude Graf, Sandro Regge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel     contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain     processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this to expose     sensitive information from the host OS. (CVE-2025-40300)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM32 architecture;

    - ARM64 architecture;

    - MIPS architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - ACPI drivers;

    - ATM drivers;

    - DRBD Distributed Replicated Block Device drivers;

    - Bus devices;

    - Clock framework and drivers;

    - Data acquisition framework and drivers;

    - Hardware crypto device drivers;

    - Device frequency scaling framework;

    - Buffer Sharing and Synchronization framework;

    - DMA engine subsystem;

    - ARM SCMI message protocol;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - I3C subsystem;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - IOMMU subsystem;

    - Media drivers;

    - Network drivers;

    - Mellanox network drivers;

    - PCI subsystem;

    - PCCARD (PCMCIA/CardBus) bus subsystem;

    - PHY drivers;

    - Power supply drivers;

    - Voltage and Current Regulator drivers;

    - SCSI subsystem;

    - ASPEED SoC drivers;

    - QCOM SoC drivers;

    - small TFT LCD display modules;

    - Trusted Execution Environment drivers;

    - TTY drivers;

    - UFS subsystem;

    - USB core drivers;

    - DesignWare USB3 driver;

    - USB Gadget drivers;

    - Framebuffer layer;

    - AFS file system;

    - BTRFS file system;

    - File systems infrastructure;

    - EFI Variable file system;

    - Ext4 file system;

    - F2FS file system;

    - JFS file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - SMB network file system;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - BPF subsystem;

    - NFS page cache wrapper;

    - Memory management;

    - Networking subsytem;

    - UDP network protocol;

    - Perf events;

    - RCU subsystem;

    - Tracing infrastructure;

    - 802.1Q VLAN protocol;

    - Appletalk network protocol;

    - Amateur Radio drivers;

    - B.A.T.M.A.N. meshing protocol;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - Networking core;

    - HSR network protocol;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Netfilter;

    - Network traffic control;

    - SCTP protocol;

    - TLS protocol;

    - Wireless networking;

    - SoC audio core drivers;

    - USB sound devices; (CVE-2022-49390, CVE-2022-50070, CVE-2022-50327, CVE-2023-52935, CVE-2023-53074,     CVE-2024-47691, CVE-2024-50061, CVE-2024-50067, CVE-2024-53068, CVE-2024-53090, CVE-2024-53218,     CVE-2025-21855, CVE-2025-37925, CVE-2025-37968, CVE-2025-38095, CVE-2025-38148, CVE-2025-38165,     CVE-2025-38335, CVE-2025-38347, CVE-2025-38468, CVE-2025-38470, CVE-2025-38473, CVE-2025-38474,     CVE-2025-38476, CVE-2025-38478, CVE-2025-38480, CVE-2025-38481, CVE-2025-38482, CVE-2025-38483,     CVE-2025-38487, CVE-2025-38488, CVE-2025-38494, CVE-2025-38495, CVE-2025-38497, CVE-2025-38499,     CVE-2025-38502, CVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530, CVE-2025-38535,     CVE-2025-38538, CVE-2025-38539, CVE-2025-38548, CVE-2025-38550, CVE-2025-38553, CVE-2025-38555,     CVE-2025-38563, CVE-2025-38565, CVE-2025-38569, CVE-2025-38572, CVE-2025-38574, CVE-2025-38576,     CVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581, CVE-2025-38583, CVE-2025-38601,     CVE-2025-38602, CVE-2025-38604, CVE-2025-38608, CVE-2025-38609, CVE-2025-38612, CVE-2025-38614,     CVE-2025-38622, CVE-2025-38623, CVE-2025-38624, CVE-2025-38630, CVE-2025-38634, CVE-2025-38635,     CVE-2025-38639, CVE-2025-38645, CVE-2025-38650, CVE-2025-38652, CVE-2025-38663, CVE-2025-38664,     CVE-2025-38666, CVE-2025-38668, CVE-2025-38670, CVE-2025-38671, CVE-2025-38676, CVE-2025-38677,     CVE-2025-38678, CVE-2025-38680, CVE-2025-38681, CVE-2025-38684, CVE-2025-38685, CVE-2025-38687,     CVE-2025-38691, CVE-2025-38693, CVE-2025-38694, CVE-2025-38695, CVE-2025-38696, CVE-2025-38697,     CVE-2025-38698, CVE-2025-38699, CVE-2025-38700, CVE-2025-38701, CVE-2025-38706, CVE-2025-38707,     CVE-2025-38708, CVE-2025-38711, CVE-2025-38712, CVE-2025-38713, CVE-2025-38714, CVE-2025-38715,     CVE-2025-38718, CVE-2025-38721, CVE-2025-38724, CVE-2025-38725, CVE-2025-38729, CVE-2025-38732,     CVE-2025-39673, CVE-2025-39675, CVE-2025-39676, CVE-2025-39681, CVE-2025-39683, CVE-2025-39684,     CVE-2025-39685, CVE-2025-39686, CVE-2025-39687, CVE-2025-39689, CVE-2025-39691, CVE-2025-39693,     CVE-2025-39697, CVE-2025-39702, CVE-2025-39703, CVE-2025-39709, CVE-2025-39710, CVE-2025-39713,     CVE-2025-39714, CVE-2025-39724, CVE-2025-39730, CVE-2025-39734, CVE-2025-39736, CVE-2025-39737,     CVE-2025-39738, CVE-2025-39742, CVE-2025-39743, CVE-2025-39749, CVE-2025-39752, CVE-2025-39756,     CVE-2025-39757, CVE-2025-39760, CVE-2025-39766, CVE-2025-39772, CVE-2025-39773, CVE-2025-39776,     CVE-2025-39782, CVE-2025-39783, CVE-2025-39787, CVE-2025-39788, CVE-2025-39790, CVE-2025-39794,     CVE-2025-39795, CVE-2025-39798, CVE-2025-39801, CVE-2025-39806, CVE-2025-39808, CVE-2025-39812,     CVE-2025-39813, CVE-2025-39817, CVE-2025-39823, CVE-2025-39824, CVE-2025-39828, CVE-2025-39835,     CVE-2025-39839, CVE-2025-39841, CVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847,     CVE-2025-39848, CVE-2025-39853, CVE-2025-39860, CVE-2025-39864, CVE-2025-39865, CVE-2025-39866,     CVE-2025-39891, CVE-2025-39894, CVE-2025-39902, CVE-2025-39920, CVE-2025-39964, CVE-2025-39993,     CVE-2025-40018)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7933-1 advisory.

    Jean-Claude Graf, Sandro Regge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel     contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain     processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this to expose     sensitive information from the host OS. (CVE-2025-40300)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM32 architecture;

    - ARM64 architecture;

    - MIPS architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - ACPI drivers;

    - ATM drivers;

    - DRBD Distributed Replicated Block Device drivers;

    - Bus devices;

    - Clock framework and drivers;

    - Data acquisition framework and drivers;

    - Hardware crypto device drivers;

    - Device frequency scaling framework;

    - Buffer Sharing and Synchronization framework;

    - DMA engine subsystem;

    - ARM SCMI message protocol;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - I3C subsystem;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - IOMMU subsystem;

    - Media drivers;

    - Network drivers;

    - Mellanox network drivers;

    - PCI subsystem;

    - PCCARD (PCMCIA/CardBus) bus subsystem;

    - PHY drivers;

    - Power supply drivers;

    - Voltage and Current Regulator drivers;

    - SCSI subsystem;

    - ASPEED SoC drivers;

    - QCOM SoC drivers;

    - small TFT LCD display modules;

    - Trusted Execution Environment drivers;

    - TTY drivers;

    - UFS subsystem;

    - USB core drivers;

    - DesignWare USB3 driver;

    - USB Gadget drivers;

    - Framebuffer layer;

    - BTRFS file system;

    - File systems infrastructure;

    - EFI Variable file system;

    - Ext4 file system;

    - F2FS file system;

    - JFS file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - SMB network file system;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - BPF subsystem;

    - NFS page cache wrapper;

    - Memory management;

    - Networking subsytem;

    - UDP network protocol;

    - Perf events;

    - RCU subsystem;

    - Tracing infrastructure;

    - 802.1Q VLAN protocol;

    - Appletalk network protocol;

    - Amateur Radio drivers;

    - B.A.T.M.A.N. meshing protocol;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - Networking core;

    - HSR network protocol;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Netfilter;

    - Netlink;

    - Packet sockets;

    - Network traffic control;

    - SCTP protocol;

    - TLS protocol;

    - VMware vSockets driver;

    - Wireless networking;

    - SoC audio core drivers;

    - USB sound devices; (CVE-2022-50070, CVE-2022-50327, CVE-2023-52593, CVE-2023-52935, CVE-2023-53074,     CVE-2024-26700, CVE-2024-26896, CVE-2024-50061, CVE-2024-53068, CVE-2025-37925, CVE-2025-37968,     CVE-2025-38095, CVE-2025-38148, CVE-2025-38165, CVE-2025-38335, CVE-2025-38347, CVE-2025-38468,     CVE-2025-38470, CVE-2025-38473, CVE-2025-38474, CVE-2025-38476, CVE-2025-38477, CVE-2025-38478,     CVE-2025-38480, CVE-2025-38481, CVE-2025-38482, CVE-2025-38483, CVE-2025-38487, CVE-2025-38488,     CVE-2025-38494, CVE-2025-38495, CVE-2025-38497, CVE-2025-38499, CVE-2025-38502, CVE-2025-38527,     CVE-2025-38528, CVE-2025-38529, CVE-2025-38530, CVE-2025-38535, CVE-2025-38538, CVE-2025-38539,     CVE-2025-38548, CVE-2025-38550, CVE-2025-38553, CVE-2025-38555, CVE-2025-38563, CVE-2025-38565,     CVE-2025-38569, CVE-2025-38572, CVE-2025-38574, CVE-2025-38576, CVE-2025-38577, CVE-2025-38578,     CVE-2025-38579, CVE-2025-38581, CVE-2025-38583, CVE-2025-38601, CVE-2025-38602, CVE-2025-38604,     CVE-2025-38608, CVE-2025-38609, CVE-2025-38612, CVE-2025-38614, CVE-2025-38617, CVE-2025-38618,     CVE-2025-38622, CVE-2025-38623, CVE-2025-38624, CVE-2025-38630, CVE-2025-38634, CVE-2025-38635,     CVE-2025-38639, CVE-2025-38645, CVE-2025-38650, CVE-2025-38652, CVE-2025-38663, CVE-2025-38664,     CVE-2025-38666, CVE-2025-38668, CVE-2025-38670, CVE-2025-38671, CVE-2025-38676, CVE-2025-38677,     CVE-2025-38678, CVE-2025-38680, CVE-2025-38681, CVE-2025-38683, CVE-2025-38684, CVE-2025-38685,     CVE-2025-38687, CVE-2025-38691, CVE-2025-38693, CVE-2025-38694, CVE-2025-38695, CVE-2025-38696,     CVE-2025-38697, CVE-2025-38698, CVE-2025-38699, CVE-2025-38700, CVE-2025-38701, CVE-2025-38706,     CVE-2025-38707, CVE-2025-38708, CVE-2025-38711, CVE-2025-38712, CVE-2025-38713, CVE-2025-38714,     CVE-2025-38715, CVE-2025-38718, CVE-2025-38721, CVE-2025-38724, CVE-2025-38725, CVE-2025-38727,     CVE-2025-38729, CVE-2025-38732, CVE-2025-39673, CVE-2025-39675, CVE-2025-39676, CVE-2025-39681,     CVE-2025-39683, CVE-2025-39684, CVE-2025-39685, CVE-2025-39686, CVE-2025-39687, CVE-2025-39689,     CVE-2025-39691, CVE-2025-39693, CVE-2025-39697, CVE-2025-39702, CVE-2025-39703, CVE-2025-39709,     CVE-2025-39710, CVE-2025-39713, CVE-2025-39714, CVE-2025-39724, CVE-2025-39730, CVE-2025-39734,     CVE-2025-39736, CVE-2025-39737, CVE-2025-39738, CVE-2025-39742, CVE-2025-39743, CVE-2025-39749,     CVE-2025-39752, CVE-2025-39756, CVE-2025-39757, CVE-2025-39760, CVE-2025-39766, CVE-2025-39772,     CVE-2025-39773, CVE-2025-39776, CVE-2025-39782, CVE-2025-39783, CVE-2025-39787, CVE-2025-39788,     CVE-2025-39790, CVE-2025-39794, CVE-2025-39795, CVE-2025-39798, CVE-2025-39801, CVE-2025-39806,     CVE-2025-39808, CVE-2025-39812, CVE-2025-39813, CVE-2025-39817, CVE-2025-39823, CVE-2025-39824,     CVE-2025-39828, CVE-2025-39835, CVE-2025-39839, CVE-2025-39841, CVE-2025-39844, CVE-2025-39845,     CVE-2025-39846, CVE-2025-39847, CVE-2025-39848, CVE-2025-39853, CVE-2025-39860, CVE-2025-39864,     CVE-2025-39865, CVE-2025-39866, CVE-2025-39891, CVE-2025-39894, CVE-2025-39902, CVE-2025-39920)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7910-1 advisory.

    Jean-Claude Graf, Sandro Regge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel     contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain     processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this to expose     sensitive information from the host OS. (CVE-2025-40300)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM32 architecture;

    - ARM64 architecture;

    - MIPS architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - ACPI drivers;

    - ATM drivers;

    - DRBD Distributed Replicated Block Device drivers;

    - Bus devices;

    - Clock framework and drivers;

    - Data acquisition framework and drivers;

    - Hardware crypto device drivers;

    - Device frequency scaling framework;

    - Buffer Sharing and Synchronization framework;

    - DMA engine subsystem;

    - ARM SCMI message protocol;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - I3C subsystem;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - IOMMU subsystem;

    - Media drivers;

    - Network drivers;

    - Mellanox network drivers;

    - PCI subsystem;

    - PCCARD (PCMCIA/CardBus) bus subsystem;

    - PHY drivers;

    - Power supply drivers;

    - Voltage and Current Regulator drivers;

    - SCSI subsystem;

    - ASPEED SoC drivers;

    - QCOM SoC drivers;

    - small TFT LCD display modules;

    - Trusted Execution Environment drivers;

    - TTY drivers;

    - UFS subsystem;

    - USB core drivers;

    - DesignWare USB3 driver;

    - USB Gadget drivers;

    - Framebuffer layer;

    - BTRFS file system;

    - File systems infrastructure;

    - EFI Variable file system;

    - Ext4 file system;

    - F2FS file system;

    - JFS file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - SMB network file system;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - BPF subsystem;

    - NFS page cache wrapper;

    - Memory management;

    - Networking subsytem;

    - UDP network protocol;

    - Perf events;

    - RCU subsystem;

    - Tracing infrastructure;

    - 802.1Q VLAN protocol;

    - Appletalk network protocol;

    - Amateur Radio drivers;

    - B.A.T.M.A.N. meshing protocol;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - Networking core;

    - HSR network protocol;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Netfilter;

    - Network traffic control;

    - SCTP protocol;

    - TLS protocol;

    - Wireless networking;

    - SoC audio core drivers;

    - USB sound devices; (CVE-2022-50070, CVE-2022-50327, CVE-2023-52935, CVE-2023-53074, CVE-2024-50061,     CVE-2024-53068, CVE-2025-37925, CVE-2025-37968, CVE-2025-38095, CVE-2025-38148, CVE-2025-38165,     CVE-2025-38335, CVE-2025-38347, CVE-2025-38468, CVE-2025-38470, CVE-2025-38473, CVE-2025-38474,     CVE-2025-38476, CVE-2025-38478, CVE-2025-38480, CVE-2025-38481, CVE-2025-38482, CVE-2025-38483,     CVE-2025-38487, CVE-2025-38488, CVE-2025-38494, CVE-2025-38495, CVE-2025-38497, CVE-2025-38499,     CVE-2025-38502, CVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530, CVE-2025-38535,     CVE-2025-38538, CVE-2025-38539, CVE-2025-38548, CVE-2025-38550, CVE-2025-38553, CVE-2025-38555,     CVE-2025-38563, CVE-2025-38565, CVE-2025-38569, CVE-2025-38572, CVE-2025-38574, CVE-2025-38576,     CVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581, CVE-2025-38583, CVE-2025-38601,     CVE-2025-38602, CVE-2025-38604, CVE-2025-38608, CVE-2025-38609, CVE-2025-38612, CVE-2025-38614,     CVE-2025-38622, CVE-2025-38623, CVE-2025-38624, CVE-2025-38630, CVE-2025-38634, CVE-2025-38635,     CVE-2025-38639, CVE-2025-38645, CVE-2025-38650, CVE-2025-38652, CVE-2025-38663, CVE-2025-38664,     CVE-2025-38666, CVE-2025-38668, CVE-2025-38670, CVE-2025-38671, CVE-2025-38676, CVE-2025-38677,     CVE-2025-38678, CVE-2025-38680, CVE-2025-38681, CVE-2025-38684, CVE-2025-38685, CVE-2025-38687,     CVE-2025-38691, CVE-2025-38693, CVE-2025-38694, CVE-2025-38695, CVE-2025-38696, CVE-2025-38697,     CVE-2025-38698, CVE-2025-38699, CVE-2025-38700, CVE-2025-38701, CVE-2025-38706, CVE-2025-38707,     CVE-2025-38708, CVE-2025-38711, CVE-2025-38712, CVE-2025-38713, CVE-2025-38714, CVE-2025-38715,     CVE-2025-38718, CVE-2025-38721, CVE-2025-38724, CVE-2025-38725, CVE-2025-38729, CVE-2025-38732,     CVE-2025-39673, CVE-2025-39675, CVE-2025-39676, CVE-2025-39681, CVE-2025-39683, CVE-2025-39684,     CVE-2025-39685, CVE-2025-39686, CVE-2025-39687, CVE-2025-39689, CVE-2025-39691, CVE-2025-39693,     CVE-2025-39697, CVE-2025-39702, CVE-2025-39703, CVE-2025-39709, CVE-2025-39710, CVE-2025-39713,     CVE-2025-39714, CVE-2025-39724, CVE-2025-39730, CVE-2025-39734, CVE-2025-39736, CVE-2025-39737,     CVE-2025-39738, CVE-2025-39742, CVE-2025-39743, CVE-2025-39749, CVE-2025-39752, CVE-2025-39756,     CVE-2025-39757, CVE-2025-39760, CVE-2025-39766, CVE-2025-39772, CVE-2025-39773, CVE-2025-39776,     CVE-2025-39782, CVE-2025-39783, CVE-2025-39787, CVE-2025-39788, CVE-2025-39790, CVE-2025-39794,     CVE-2025-39795, CVE-2025-39798, CVE-2025-39801, CVE-2025-39806, CVE-2025-39808, CVE-2025-39812,     CVE-2025-39813, CVE-2025-39817, CVE-2025-39823, CVE-2025-39824, CVE-2025-39828, CVE-2025-39835,     CVE-2025-39839, CVE-2025-39841, CVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847,     CVE-2025-39848, CVE-2025-39853, CVE-2025-39860, CVE-2025-39864, CVE-2025-39865, CVE-2025-39866,     CVE-2025-39891, CVE-2025-39894, CVE-2025-39902, CVE-2025-39920)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7909-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM32 architecture;

    - ARM64 architecture;

    - MIPS architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - ACPI drivers;

    - ATM drivers;

    - DRBD Distributed Replicated Block Device drivers;

    - Bus devices;

    - Clock framework and drivers;

    - Data acquisition framework and drivers;

    - Hardware crypto device drivers;

    - Device frequency scaling framework;

    - Buffer Sharing and Synchronization framework;

    - DMA engine subsystem;

    - ARM SCMI message protocol;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - I3C subsystem;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - IOMMU subsystem;

    - Media drivers;

    - Network drivers;

    - Mellanox network drivers;

    - PCI subsystem;

    - PCCARD (PCMCIA/CardBus) bus subsystem;

    - PHY drivers;

    - Power supply drivers;

    - Voltage and Current Regulator drivers;

    - SCSI subsystem;

    - ASPEED SoC drivers;

    - QCOM SoC drivers;

    - small TFT LCD display modules;

    - Trusted Execution Environment drivers;

    - TTY drivers;

    - UFS subsystem;

    - USB core drivers;

    - DesignWare USB3 driver;

    - USB Gadget drivers;

    - Framebuffer layer;

    - BTRFS file system;

    - File systems infrastructure;

    - EFI Variable file system;

    - Ext4 file system;

    - F2FS file system;

    - JFS file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - SMB network file system;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - BPF subsystem;

    - NFS page cache wrapper;

    - Memory management;

    - Networking subsytem;

    - UDP network protocol;

    - Perf events;

    - RCU subsystem;

    - Tracing infrastructure;

    - 802.1Q VLAN protocol;

    - Appletalk network protocol;

    - Amateur Radio drivers;

    - B.A.T.M.A.N. meshing protocol;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - Networking core;

    - HSR network protocol;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Netfilter;

    - Network traffic control;

    - SCTP protocol;

    - TLS protocol;

    - Wireless networking;

    - SoC audio core drivers;

    - USB sound devices; (CVE-2022-50070, CVE-2022-50327, CVE-2023-52935, CVE-2023-53074, CVE-2024-50061,     CVE-2024-53068, CVE-2025-37925, CVE-2025-37968, CVE-2025-38095, CVE-2025-38148, CVE-2025-38165,     CVE-2025-38335, CVE-2025-38347, CVE-2025-38468, CVE-2025-38470, CVE-2025-38473, CVE-2025-38474,     CVE-2025-38476, CVE-2025-38478, CVE-2025-38480, CVE-2025-38481, CVE-2025-38482, CVE-2025-38483,     CVE-2025-38487, CVE-2025-38488, CVE-2025-38494, CVE-2025-38495, CVE-2025-38497, CVE-2025-38499,     CVE-2025-38502, CVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530, CVE-2025-38535,     CVE-2025-38538, CVE-2025-38539, CVE-2025-38548, CVE-2025-38550, CVE-2025-38553, CVE-2025-38555,     CVE-2025-38563, CVE-2025-38565, CVE-2025-38569, CVE-2025-38572, CVE-2025-38574, CVE-2025-38576,     CVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581, CVE-2025-38583, CVE-2025-38601,     CVE-2025-38602, CVE-2025-38604, CVE-2025-38608, CVE-2025-38609, CVE-2025-38612, CVE-2025-38614,     CVE-2025-38622, CVE-2025-38623, CVE-2025-38624, CVE-2025-38630, CVE-2025-38634, CVE-2025-38635,     CVE-2025-38639, CVE-2025-38645, CVE-2025-38650, CVE-2025-38652, CVE-2025-38663, CVE-2025-38664,     CVE-2025-38666, CVE-2025-38668, CVE-2025-38670, CVE-2025-38671, CVE-2025-38676, CVE-2025-38677,     CVE-2025-38678, CVE-2025-38680, CVE-2025-38681, CVE-2025-38683, CVE-2025-38684, CVE-2025-38685,     CVE-2025-38687, CVE-2025-38691, CVE-2025-38693, CVE-2025-38694, CVE-2025-38695, CVE-2025-38696,     CVE-2025-38697, CVE-2025-38698, CVE-2025-38699, CVE-2025-38700, CVE-2025-38701, CVE-2025-38706,     CVE-2025-38707, CVE-2025-38708, CVE-2025-38711, CVE-2025-38712, CVE-2025-38713, CVE-2025-38714,     CVE-2025-38715, CVE-2025-38718, CVE-2025-38721, CVE-2025-38724, CVE-2025-38725, CVE-2025-38729,     CVE-2025-38732, CVE-2025-39673, CVE-2025-39675, CVE-2025-39676, CVE-2025-39681, CVE-2025-39683,     CVE-2025-39684, CVE-2025-39685, CVE-2025-39686, CVE-2025-39687, CVE-2025-39689, CVE-2025-39691,     CVE-2025-39693, CVE-2025-39697, CVE-2025-39702, CVE-2025-39703, CVE-2025-39709, CVE-2025-39710,     CVE-2025-39713, CVE-2025-39714, CVE-2025-39724, CVE-2025-39730, CVE-2025-39734, CVE-2025-39736,     CVE-2025-39737, CVE-2025-39738, CVE-2025-39742, CVE-2025-39743, CVE-2025-39749, CVE-2025-39752,     CVE-2025-39756, CVE-2025-39757, CVE-2025-39760, CVE-2025-39766, CVE-2025-39772, CVE-2025-39773,     CVE-2025-39776, CVE-2025-39782, CVE-2025-39783, CVE-2025-39787, CVE-2025-39788, CVE-2025-39790,     CVE-2025-39794, CVE-2025-39795, CVE-2025-39798, CVE-2025-39801, CVE-2025-39806, CVE-2025-39808,     CVE-2025-39812, CVE-2025-39813, CVE-2025-39817, CVE-2025-39823, CVE-2025-39824, CVE-2025-39828,     CVE-2025-39835, CVE-2025-39839, CVE-2025-39841, CVE-2025-39844, CVE-2025-39845, CVE-2025-39846,     CVE-2025-39847, CVE-2025-39848, CVE-2025-39853, CVE-2025-39860, CVE-2025-39864, CVE-2025-39865,     CVE-2025-39866, CVE-2025-39891, CVE-2025-39894, CVE-2025-39902, CVE-2025-39920)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22752 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ALSA: usb-audio: ALSA USB Audio Out-of-Bounds Bug (CVE-2022-48701)

    * kernel: nfsd: don't ignore the return code of svc_proc_register() (CVE-2025-22026)

    * kernel: udp: Fix memory accounting leak. (CVE-2025-22058)

    * kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)

    * kernel: net: usb: smsc75xx: Limit packet length to skb->len (CVE-2023-53125)

    * kernel: net_sched: ets: Fix double list add in class with netem as child qdisc (CVE-2025-37914)

    * kernel: ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() (CVE-2022-50050)

    * kernel: mptcp: do not queue data on closed subflows (CVE-2022-50070)

    * kernel: ALSA: bcd2000: Fix a UAF bug on the error path of probing (CVE-2022-50229)

    * kernel: KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CVE-2022-50228)

    * kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (CVE-2022-50087)

    * kernel: bpf: Don't use tnum_range on array range checking for poke descriptors (CVE-2022-49985)

    * kernel: drm/amd/display: clear optc underflow before turn off odm clock (CVE-2022-49969)

    * kernel: md-raid10: fix KASAN warning (CVE-2022-50211)

    * kernel: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CVE-2025-38200)

    * kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211)

    * kernel: scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332)

    * kernel: vsock: Fix transport_* TOCTOU (CVE-2025-38461)

    * kernel: drm/gem: Acquire references on GEM handles for framebuffers (CVE-2025-38449)

    * kernel: net/sched: sch_qfq: Fix race condition on qfq_aggregate (CVE-2025-38477)

    * kernel: do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498)

    * kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527)

    * kernel: HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)

    * kernel: tls: separate no-async decryption request handling from async (CVE-2024-58240)

    * kernel: NFS: Fix a race when updating an existing write (CVE-2025-39697)

    * kernel: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)

    * kernel: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CVE-2025-39751)

    * kernel: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (CVE-2023-53213)

    * kernel: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (CVE-2023-53185)

    * kernel: mm: fix zswap writeback race condition (CVE-2023-53178)

    * kernel: Bluetooth: L2CAP: Fix use-after-free (CVE-2023-53305)

    * kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367)

    * kernel: net: sched: sfb: fix null pointer access issue when sfb_init() fails (CVE-2022-50356)

    * kernel: skbuff: skb_segment, Call zero copy functions before using skbuff frags (CVE-2023-53354)

    * kernel: crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)

    * kernel: Bluetooth: Fix potential use-after-free when clear keys (CVE-2023-53386)

    * kernel: Bluetooth: L2CAP: Fix user-after-free (CVE-2022-50386)

    * kernel: ext4: fix undefined behavior in bit shift for ext4_check_flag_values (CVE-2022-50403)

    * kernel: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (CVE-2022-50408)

    * kernel: NFSD: Protect against send buffer overflow in NFSv2 READ (CVE-2022-50410)

    * kernel: wifi: cfg80211: fix use-after-free in cmp_bss() (CVE-2025-39864)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19492 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net: usb: smsc75xx: Limit packet length to skb->len (CVE-2023-53125)

    * kernel: ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() (CVE-2022-50050)

    * kernel: mptcp: do not queue data on closed subflows (CVE-2022-50070)

    * kernel: RDMA/irdma: Fix a window for use-after-free (CVE-2022-50137)

    * kernel: KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CVE-2022-50228)

    * kernel: HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)

    * kernel: eventpoll: Fix semi-unbounded recursion (CVE-2025-38614)

    * kernel: tls: separate no-async decryption request handling from async (CVE-2024-58240)

    * kernel: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CVE-2025-39751)

    * kernel: crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19268 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: net: usb: smsc75xx: Limit packet length to skb->len (CVE-2023-53125)

    * kernel: ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() (CVE-2022-50050)

    * kernel: mptcp: do not queue data on closed subflows (CVE-2022-50070)

    * kernel: RDMA/irdma: Fix a window for use-after-free (CVE-2022-50137)

    * kernel: KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CVE-2022-50228)

    * kernel: HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)

    * kernel: eventpoll: Fix semi-unbounded recursion (CVE-2025-38614)

    * kernel: tls: separate no-async decryption request handling from async (CVE-2024-58240)

    * kernel: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CVE-2025-39751)

    * kernel: crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19222 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: nfsd: don't ignore the return code of svc_proc_register() (CVE-2025-22026)

    * kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)

    * kernel: net: usb: smsc75xx: Limit packet length to skb->len (CVE-2023-53125)

    * kernel: mptcp: do not queue data on closed subflows (CVE-2022-50070)

    * kernel: RDMA/irdma: Fix a window for use-after-free (CVE-2022-50137)

    * kernel: KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CVE-2022-50228)

    * kernel: HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)

    * kernel: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)

    * kernel: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CVE-2025-39751)

    * kernel: Bluetooth: L2CAP: Fix use-after-free (CVE-2023-53305)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.189-131.211. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2025-088 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    dma-buf/dma-resv: check if the new fence is really later (CVE-2022-49935)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: do not queue data on closed subflows (CVE-2022-50070)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (CVE-2025-38162)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (CVE-2025-38215)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Don't leave consecutive consumed OOB skbs. (CVE-2025-38236)

    In the Linux kernel, the following vulnerability has been resolved:

    bridge: mcast: Fix use-after-free during router port configuration (CVE-2025-38248)

    In the Linux kernel, the following vulnerability has been resolved:

    netlink: avoid infinite retry looping in netlink_unicast() (CVE-2025-38727)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.240-238.966. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-103 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    dma-buf/dma-resv: check if the new fence is really later (CVE-2022-49935)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix small mempool leak in SMB2_negotiate() (CVE-2022-49938)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: do not queue data on closed subflows (CVE-2022-50070)

    In the Linux kernel, the following vulnerability has been resolved:

    dma-buf: insert memory barrier before updating num_fences (CVE-2025-38095)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (CVE-2025-38162)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (CVE-2025-38215)

    In the Linux kernel, the following vulnerability has been resolved:

    netlink: avoid infinite retry looping in netlink_unicast() (CVE-2025-38727)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: mptcp: do not queue data on closed     subflows Dipanjan reported a syzbot splat at close time: WARNING: CPU: 1 PID: 10818 at     net/ipv4/af_inet.c:153 inet_sock_destruct+0x6d0/0x8e0 net/ipv4/af_inet.c:153 Modules linked in:
    uio_ivshmem(OE) uio(E) CPU: 1 PID: 10818 Comm: kworker/1:16 Tainted: G OE 5.19.0-rc6-g2eae0556bb9d #2     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: events     mptcp_worker RIP: 0010:inet_sock_destruct+0x6d0/0x8e0 net/ipv4/af_inet.c:153 Code: 21 02 00 00 41 8b 9c 24     28 02 00 00 e9 07 ff ff ff e8 34 4d 91 f9 89 ee 4c 89 e7 e8 4a 47 60 ff e9 a6 fc ff ff e8 20 4d 91 f9 <0f>     0b e9 84 fe ff ff e8 14 4d 91 f9 0f 0b e9 d4 fd ff ff e8 08 4d RSP: 0018:ffffc9001b35fa78 EFLAGS: 00010246     RAX: 0000000000000000 RBX: 00000000002879d0 RCX: ffff8881326f3b00 RDX: 0000000000000000 RSI:
    ffff8881326f3b00 RDI: 0000000000000002 RBP: ffff888179662674 R08: ffffffff87e983a0 R09: 0000000000000000     R10: 0000000000000005 R11: 00000000000004ea R12: ffff888179662400 R13: ffff888179662428 R14:
    0000000000000001 R15: ffff88817e38e258 FS: 0000000000000000(0000) GS:ffff8881f5f00000(0000)     knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020007bc0 CR3:
    0000000179592000 CR4: 0000000000150ee0 Call Trace: <TASK> __sk_destruct+0x4f/0x8e0 net/core/sock.c:2067     sk_destruct+0xbd/0xe0 net/core/sock.c:2112 __sk_free+0xef/0x3d0 net/core/sock.c:2123 sk_free+0x78/0xa0     net/core/sock.c:2134 sock_put include/net/sock.h:1927 [inline] __mptcp_close_ssk+0x50f/0x780     net/mptcp/protocol.c:2351 __mptcp_destroy_sock+0x332/0x760 net/mptcp/protocol.c:2828     mptcp_worker+0x5d2/0xc90 net/mptcp/protocol.c:2586 process_one_work+0x9cc/0x1650 kernel/workqueue.c:2289     worker_thread+0x623/0x1070 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376     ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 </TASK> The root cause of the problem is that an     mptcp-level (re)transmit can race with mptcp_close() and the packet scheduler checks the subflow state     before acquiring the socket lock: we can try to (re)transmit on an already closed ssk. Fix the issue     checking again the subflow socket status under the subflow socket lock protection. Additionally add the     missing check for the fallback-to-tcp case. (CVE-2022-50070)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
360866	CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2025:1757962453)	Nessus	CentOS Local Security Checks	Local	high
357821	Rocky Linux 8.6 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (ciqsa-2026_0010)	Nessus	Rocky Linux Local Security Checks	Local	high
357212	Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (ciqsa-2026_0634)	Nessus	Rocky Linux Local Security Checks	Local	high
352831	CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2025:1757961864)	Nessus	CentOS Local Security Checks	Local	high
278787	Ubuntu 20.04 LTS : Linux kernel (Azure) vulnerabilities (USN-7938-1)	Nessus	Ubuntu Local Security Checks	Local	high
278746	Ubuntu 22.04 LTS : Linux kernel (KVM) vulnerabilities (USN-7933-1)	Nessus	Ubuntu Local Security Checks	Local	high
277579	Ubuntu 22.04 LTS : Linux kernel (Azure FIPS) vulnerabilities (USN-7910-1)	Nessus	Ubuntu Local Security Checks	Local	high
277578	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-7909-1)	Nessus	Ubuntu Local Security Checks	Local	high
277472	RHEL 8 : kernel (RHSA-2025:22752)	Nessus	Red Hat Local Security Checks	Local	high
272215	RHEL 9 : kernel (RHSA-2025:19492)	Nessus	Red Hat Local Security Checks	Local	high
272004	RHEL 9 : kernel-rt (RHSA-2025:19268)	Nessus	Red Hat Local Security Checks	Local	high
271975	RHEL 8 : kernel (RHSA-2025:19222)	Nessus	Red Hat Local Security Checks	Local	medium
261436	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2025-088 (ALASKERNEL-5.15-2025-088)	Nessus	Amazon Linux Local Security Checks	Local	high
261434	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2025-103 (ALASKERNEL-5.10-2025-103)	Nessus	Amazon Linux Local Security Checks	Local	high
244356	Linux Distros Unpatched Vulnerability : CVE-2022-50070	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2022-50070

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

medium

high

high

high