In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix double free on tx path. We see kernel crashes and lockups and KASAN errors related to ax210 firmware crashes. One of the KASAN dumps pointed at the tx path, and it appears there is indeed a way to double-free an skb. If iwl_mvm_tx_skb_sta returns non-zero, then the 'skb' sent into the method will be freed. But, in case where we build TSO skb buffer, the skb may also be freed in error case. So, return 0 in that particular error case and do cleanup manually. BUG: KASAN: use-after-free in __list_del_entry_valid+0x12/0x90 iwlwifi 0000:06:00.0: 0x00000000 | tsf hi Read of size 8 at addr ffff88813cfa4ba0 by task btserver/9650 CPU: 4 PID: 9650 Comm: btserver Tainted: G W 5.19.8+ #5 iwlwifi 0000:06:00.0: 0x00000000 | time gp1 Hardware name: Default string Default string/SKYBAY, BIOS 5.12 02/19/2019 Call Trace: <TASK> dump_stack_lvl+0x55/0x6d print_report.cold.12+0xf2/0x684 iwlwifi 0000:06:00.0: 0x1D0915A8 | time gp2 ? __list_del_entry_valid+0x12/0x90 kasan_report+0x8b/0x180 iwlwifi 0000:06:00.0: 0x00000001 | uCode revision type ? __list_del_entry_valid+0x12/0x90 __list_del_entry_valid+0x12/0x90 iwlwifi 0000:06:00.0: 0x00000048 | uCode version major tcp_update_skb_after_send+0x5d/0x170 __tcp_transmit_skb+0xb61/0x15c0 iwlwifi 0000:06:00.0: 0xDAA05125 | uCode version minor ? __tcp_select_window+0x490/0x490 iwlwifi 0000:06:00.0: 0x00000420 | hw version ? trace_kmalloc_node+0x29/0xd0 ? __kmalloc_node_track_caller+0x12a/0x260 ? memset+0x1f/0x40 ? __build_skb_around+0x125/0x150 ? __alloc_skb+0x1d4/0x220 ? skb_zerocopy_clone+0x55/0x230 iwlwifi 0000:06:00.0: 0x00489002 | board version ? kmalloc_reserve+0x80/0x80 ? rcu_read_lock_bh_held+0x60/0xb0 tcp_write_xmit+0x3f1/0x24d0 iwlwifi 0000:06:00.0: 0x034E001C | hcmd ? __check_object_size+0x180/0x350 iwlwifi 0000:06:00.0: 0x24020000 | isr0 tcp_sendmsg_locked+0x8a9/0x1520 iwlwifi 0000:06:00.0: 0x01400000 | isr1 ? tcp_sendpage+0x50/0x50 iwlwifi 0000:06:00.0: 0x48F0000A | isr2 ? lock_release+0xb9/0x400 ? tcp_sendmsg+0x14/0x40 iwlwifi 0000:06:00.0: 0x00C3080C | isr3 ? lock_downgrade+0x390/0x390 ? do_raw_spin_lock+0x114/0x1d0 iwlwifi 0000:06:00.0: 0x00200000 | isr4 ? rwlock_bug.part.2+0x50/0x50 iwlwifi 0000:06:00.0: 0x034A001C | last cmd Id ? rwlock_bug.part.2+0x50/0x50 ? lockdep_hardirqs_on_prepare+0xe/0x200 iwlwifi 0000:06:00.0: 0x0000C2F0 | wait_event ? __local_bh_enable_ip+0x87/0xe0 ? inet_send_prepare+0x220/0x220 iwlwifi 0000:06:00.0: 0x000000C4 | l2p_control tcp_sendmsg+0x22/0x40 sock_sendmsg+0x5f/0x70 iwlwifi 0000:06:00.0: 0x00010034 | l2p_duration __sys_sendto+0x19d/0x250 iwlwifi 0000:06:00.0: 0x00000007 | l2p_mhvalid ? __ia32_sys_getpeername+0x40/0x40 iwlwifi 0000:06:00.0: 0x00000000 | l2p_addr_match ? rcu_read_lock_held_common+0x12/0x50 ? rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_sched_held+0x5a/0xd0 ? lock_release+0xb9/0x400 ? lock_downgrade+0x390/0x390 ? ktime_get+0x64/0x130 ? ktime_get+0x8d/0x130 ? rcu_read_lock_held_common+0x12/0x50 ? rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_held_common+0x12/0x50 ? rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? rcu_read_lock_bh_held+0xb0/0xb0 __x64_sys_sendto+0x6f/0x80 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f1d126e4531 Code: 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 35 80 0c 00 41 89 ca 8b 00 85 c0 75 1c 45 31 c9 45 31 c0 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 67 c3 66 0f 1f 44 00 00 55 48 83 ec 20 48 89 RSP: 002b:00007ffe21a679d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000000000000ffdc RCX: 00007f1d126e4531 RDX: 0000000000010000 RSI: 000000000374acf0 RDI: 0000000000000014 RBP: 00007ffe21a67ac0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R ---truncated---

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993024 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    wifi: iwlwifi: mvm: fix double free on tx path.

    We see kernel crashes and lockups and KASAN errors related to ax210     firmware crashes.  One of the KASAN dumps pointed at the tx path,     and it appears there is indeed a way to double-free an skb.

    If iwl_mvm_tx_skb_sta returns non-zero, then the 'skb' sent into the     method will be freed.  But, in case where we build TSO skb buffer,     the skb may also be freed in error case.  So, return 0 in that particular     error case and do cleanup manually.

    BUG: KASAN: use-after-free in __list_del_entry_valid+0x12/0x90     iwlwifi 0000:06:00.0: 0x00000000 | tsf hi     Read of size 8 at addr ffff88813cfa4ba0 by task btserver/9650

    CPU: 4 PID: 9650 Comm: btserver Tainted: G        W         5.19.8+ #5     iwlwifi 0000:06:00.0: 0x00000000 | time gp1     Hardware name: Default string Default string/SKYBAY, BIOS 5.12 02/19/2019     Call Trace:
     <TASK>      dump_stack_lvl+0x55/0x6d      print_report.cold.12+0xf2/0x684     iwlwifi 0000:06:00.0: 0x1D0915A8 | time gp2      ? __list_del_entry_valid+0x12/0x90      kasan_report+0x8b/0x180     iwlwifi 0000:06:00.0: 0x00000001 | uCode revision type      ? __list_del_entry_valid+0x12/0x90
     __list_del_entry_valid+0x12/0x90     iwlwifi 0000:06:00.0: 0x00000048 | uCode version major      tcp_update_skb_after_send+0x5d/0x170
     __tcp_transmit_skb+0xb61/0x15c0     iwlwifi 0000:06:00.0: 0xDAA05125 | uCode version minor      ? __tcp_select_window+0x490/0x490     iwlwifi 0000:06:00.0: 0x00000420 | hw version      ? trace_kmalloc_node+0x29/0xd0      ? __kmalloc_node_track_caller+0x12a/0x260      ? memset+0x1f/0x40      ? __build_skb_around+0x125/0x150      ? __alloc_skb+0x1d4/0x220      ? skb_zerocopy_clone+0x55/0x230     iwlwifi 0000:06:00.0: 0x00489002 | board version      ? kmalloc_reserve+0x80/0x80      ? rcu_read_lock_bh_held+0x60/0xb0      tcp_write_xmit+0x3f1/0x24d0     iwlwifi 0000:06:00.0: 0x034E001C | hcmd      ? __check_object_size+0x180/0x350     iwlwifi 0000:06:00.0: 0x24020000 | isr0      tcp_sendmsg_locked+0x8a9/0x1520     iwlwifi 0000:06:00.0: 0x01400000 | isr1      ? tcp_sendpage+0x50/0x50     iwlwifi 0000:06:00.0: 0x48F0000A | isr2      ? lock_release+0xb9/0x400      ? tcp_sendmsg+0x14/0x40     iwlwifi 0000:06:00.0: 0x00C3080C | isr3      ? lock_downgrade+0x390/0x390      ? do_raw_spin_lock+0x114/0x1d0     iwlwifi 0000:06:00.0: 0x00200000 | isr4      ? rwlock_bug.part.2+0x50/0x50     iwlwifi 0000:06:00.0: 0x034A001C | last cmd Id      ? rwlock_bug.part.2+0x50/0x50      ? lockdep_hardirqs_on_prepare+0xe/0x200     iwlwifi 0000:06:00.0: 0x0000C2F0 | wait_event      ? __local_bh_enable_ip+0x87/0xe0      ? inet_send_prepare+0x220/0x220     iwlwifi 0000:06:00.0: 0x000000C4 | l2p_control      tcp_sendmsg+0x22/0x40      sock_sendmsg+0x5f/0x70     iwlwifi 0000:06:00.0: 0x00010034 | l2p_duration
     __sys_sendto+0x19d/0x250     iwlwifi 0000:06:00.0: 0x00000007 | l2p_mhvalid      ? __ia32_sys_getpeername+0x40/0x40     iwlwifi 0000:06:00.0: 0x00000000 | l2p_addr_match      ? rcu_read_lock_held_common+0x12/0x50      ? rcu_read_lock_sched_held+0x5a/0xd0      ? rcu_read_lock_bh_held+0xb0/0xb0      ? rcu_read_lock_sched_held+0x5a/0xd0      ? rcu_read_lock_sched_held+0x5a/0xd0      ? lock_release+0xb9/0x400      ? lock_downgrade+0x390/0x390      ? ktime_get+0x64/0x130      ? ktime_get+0x8d/0x130      ? rcu_read_lock_held_common+0x12/0x50      ? rcu_read_lock_sched_held+0x5a/0xd0      ? rcu_read_lock_held_common+0x12/0x50      ? rcu_read_lock_sched_held+0x5a/0xd0      ? rcu_read_lock_bh_held+0xb0/0xb0      ? rcu_read_lock_bh_held+0xb0/0xb0
     __x64_sys_sendto+0x6f/0x80      do_syscall_64+0x34/0xb0      entry_SYSCALL_64_after_hwframe+0x46/0xb0     RIP: 0033:0x7f1d126e4531     Code: 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 35 80 0c 00 41 89 ca 8b 00 85 c0 75 1c 45 31 c9 45     31 c0 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 67 c3 66 0f 1f 44 00 00 55 48 83 ec 20 48 89     RSP: 002b:00007ffe21a679d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c     RAX: ffffffffffffffda RBX: 000000000000ffdc RCX: 00007f1d126e4531     RDX: 0000000000010000 RSI: 000000000374acf0 RDI: 0000000000000014     RBP: 00007ffe21a67ac0 R08: 0000000000000000 R09: 0000000000000000     R10: 0000000000000000 R11: 0000000000000246 R
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992494 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    wifi: iwlwifi: mvm: fix double free on tx path.

    We see kernel crashes and lockups and KASAN errors related to ax210     firmware crashes.  One of the KASAN dumps pointed at the tx path,     and it appears there is indeed a way to double-free an skb.

    If iwl_mvm_tx_skb_sta returns non-zero, then the 'skb' sent into the     method will be freed.  But, in case where we build TSO skb buffer,     the skb may also be freed in error case.  So, return 0 in that particular     error case and do cleanup manually.

    BUG: KASAN: use-after-free in __list_del_entry_valid+0x12/0x90     iwlwifi 0000:06:00.0: 0x00000000 | tsf hi     Read of size 8 at addr ffff88813cfa4ba0 by task btserver/9650

    CPU: 4 PID: 9650 Comm: btserver Tainted: G        W         5.19.8+ #5     iwlwifi 0000:06:00.0: 0x00000000 | time gp1     Hardware name: Default string Default string/SKYBAY, BIOS 5.12 02/19/2019     Call Trace:
     <TASK>      dump_stack_lvl+0x55/0x6d      print_report.cold.12+0xf2/0x684     iwlwifi 0000:06:00.0: 0x1D0915A8 | time gp2      ? __list_del_entry_valid+0x12/0x90      kasan_report+0x8b/0x180     iwlwifi 0000:06:00.0: 0x00000001 | uCode revision type      ? __list_del_entry_valid+0x12/0x90
     __list_del_entry_valid+0x12/0x90     iwlwifi 0000:06:00.0: 0x00000048 | uCode version major      tcp_update_skb_after_send+0x5d/0x170
     __tcp_transmit_skb+0xb61/0x15c0     iwlwifi 0000:06:00.0: 0xDAA05125 | uCode version minor      ? __tcp_select_window+0x490/0x490     iwlwifi 0000:06:00.0: 0x00000420 | hw version      ? trace_kmalloc_node+0x29/0xd0      ? __kmalloc_node_track_caller+0x12a/0x260      ? memset+0x1f/0x40      ? __build_skb_around+0x125/0x150      ? __alloc_skb+0x1d4/0x220      ? skb_zerocopy_clone+0x55/0x230     iwlwifi 0000:06:00.0: 0x00489002 | board version      ? kmalloc_reserve+0x80/0x80      ? rcu_read_lock_bh_held+0x60/0xb0      tcp_write_xmit+0x3f1/0x24d0     iwlwifi 0000:06:00.0: 0x034E001C | hcmd      ? __check_object_size+0x180/0x350     iwlwifi 0000:06:00.0: 0x24020000 | isr0      tcp_sendmsg_locked+0x8a9/0x1520     iwlwifi 0000:06:00.0: 0x01400000 | isr1      ? tcp_sendpage+0x50/0x50     iwlwifi 0000:06:00.0: 0x48F0000A | isr2      ? lock_release+0xb9/0x400      ? tcp_sendmsg+0x14/0x40     iwlwifi 0000:06:00.0: 0x00C3080C | isr3      ? lock_downgrade+0x390/0x390      ? do_raw_spin_lock+0x114/0x1d0     iwlwifi 0000:06:00.0: 0x00200000 | isr4      ? rwlock_bug.part.2+0x50/0x50     iwlwifi 0000:06:00.0: 0x034A001C | last cmd Id      ? rwlock_bug.part.2+0x50/0x50      ? lockdep_hardirqs_on_prepare+0xe/0x200     iwlwifi 0000:06:00.0: 0x0000C2F0 | wait_event      ? __local_bh_enable_ip+0x87/0xe0      ? inet_send_prepare+0x220/0x220     iwlwifi 0000:06:00.0: 0x000000C4 | l2p_control      tcp_sendmsg+0x22/0x40      sock_sendmsg+0x5f/0x70     iwlwifi 0000:06:00.0: 0x00010034 | l2p_duration
     __sys_sendto+0x19d/0x250     iwlwifi 0000:06:00.0: 0x00000007 | l2p_mhvalid      ? __ia32_sys_getpeername+0x40/0x40     iwlwifi 0000:06:00.0: 0x00000000 | l2p_addr_match      ? rcu_read_lock_held_common+0x12/0x50      ? rcu_read_lock_sched_held+0x5a/0xd0      ? rcu_read_lock_bh_held+0xb0/0xb0      ? rcu_read_lock_sched_held+0x5a/0xd0      ? rcu_read_lock_sched_held+0x5a/0xd0      ? lock_release+0xb9/0x400      ? lock_downgrade+0x390/0x390      ? ktime_get+0x64/0x130      ? ktime_get+0x8d/0x130      ? rcu_read_lock_held_common+0x12/0x50      ? rcu_read_lock_sched_held+0x5a/0xd0      ? rcu_read_lock_held_common+0x12/0x50      ? rcu_read_lock_sched_held+0x5a/0xd0      ? rcu_read_lock_bh_held+0xb0/0xb0      ? rcu_read_lock_bh_held+0xb0/0xb0
     __x64_sys_sendto+0x6f/0x80      do_syscall_64+0x34/0xb0      entry_SYSCALL_64_after_hwframe+0x46/0xb0     RIP: 0033:0x7f1d126e4531     Code: 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 35 80 0c 00 41 89 ca 8b 00 85 c0 75 1c 45 31 c9 45     31 c0 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 67 c3 66 0f 1f 44 00 00 55 48 83 ec 20 48 89     RSP: 002b:00007ffe21a679d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c     RAX: ffffffffffffffda RBX: 000000000000ffdc RCX: 00007f1d126e4531     RDX: 0000000000010000 RSI: 000000000374acf0 RDI: 0000000000000014     RBP: 00007ffe21a67ac0 R08: 0000000000000000 R09: 0000000000000000     R10: 0000000000000000 R11: 0000000000000246 R
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4064-1 advisory.

    This update for the SUSE Linux Enterprise kernel 5.3.18-150300.59.215 fixes various security issues

    The following security issues were fixed:

    - CVE-2022-50248: wifi: iwlwifi: mvm: fix double free on tx path (bsc#1249841).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249847).
    - CVE-2025-38617: net/packet: fix a race in packet_set_ring() and packet_notifier() (bsc#1249208).
    - CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1249207).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248631).

    The following non security issue was fixed:

    - bsc#1249208: fix livepatching target module name (bsc#1252946)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4016-1 advisory.

    This update for the SUSE Linux Enterprise kernel 5.3.18-150300.59.179 fixes various security issues

    The following security issues were fixed:

    - CVE-2022-50248: wifi: iwlwifi: mvm: fix double free on tx path (bsc#1249841).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249847).
    - CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1246019).
    - CVE-2025-38617: net/packet: fix a race in packet_set_ring() and packet_notifier() (bsc#1249208).
    - CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1249207).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248631).

    The following non security issue was fixed:

    - bsc#1249208: fix livepatching target module name (bsc#1252946)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4004-1 advisory.

    This update for the Linux Kernel 5.3.18-150300_59_218 fixes several issues.

    The following security issues were fixed:

    - CVE-2022-50248: wifi: iwlwifi: mvm: fix double free on tx path (bsc#1249841).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248631).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249847).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03628-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
    - CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
    - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
    - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
    - CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
    - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
    - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
    - CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
    - CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
    - CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245498).
    - CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
    - CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
    - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
    - CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
    - CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime     (bsc#1247288).
    - CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree     (bsc#1248255).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
    - CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
    - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
    - CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
    - CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
    - CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03626-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
    - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
    - CVE-2022-50248: wifi: iwlwifi: mvm: fix double free on tx path (bsc#1249840).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
    - CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()     (bsc#1249947).
    - CVE-2022-50381: md: fix a crash in mempool_free (bsc#1250257).
    - CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
    - CVE-2022-50401: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (bsc#1250140).
    - CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
    - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
    - CVE-2022-50412: drm: bridge: adv7511: unregister cec i2c device after cec adapter (bsc#1250189).
    - CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
    - CVE-2023-53220: media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() (bsc#1250337).
    - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
    - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
    - CVE-2024-53093: nvme-multipath: defer partition scanning (bsc#1233640).
    - CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784).
    - CVE-2025-38011: drm/amdgpu: csa unmap use uninterruptible lock (bsc#1244729).
    - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
    - CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree     (bsc#1248255).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
    - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
    - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03615-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
    - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
    - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
    - CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
    - CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
    - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
    - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
    - CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
    - CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
    - CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree     (bsc#1248255).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
    - CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
    - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
    - CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
    - CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
    - CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix double free on     tx path. We see kernel crashes and lockups and KASAN errors related to ax210 firmware crashes. One of the     KASAN dumps pointed at the tx path, and it appears there is indeed a way to double-free an skb. If     iwl_mvm_tx_skb_sta returns non-zero, then the 'skb' sent into the method will be freed. But, in case where     we build TSO skb buffer, the skb may also be freed in error case. So, return 0 in that particular error     case and do cleanup manually. BUG: KASAN: use-after-free in __list_del_entry_valid+0x12/0x90 iwlwifi     0000:06:00.0: 0x00000000 | tsf hi Read of size 8 at addr ffff88813cfa4ba0 by task btserver/9650 CPU: 4     PID: 9650 Comm: btserver Tainted: G W 5.19.8+ #5 iwlwifi 0000:06:00.0: 0x00000000 | time gp1 Hardware     name: Default string Default string/SKYBAY, BIOS 5.12 02/19/2019 Call Trace: <TASK>     dump_stack_lvl+0x55/0x6d print_report.cold.12+0xf2/0x684 iwlwifi 0000:06:00.0: 0x1D0915A8 | time gp2 ?
    __list_del_entry_valid+0x12/0x90 kasan_report+0x8b/0x180 iwlwifi 0000:06:00.0: 0x00000001 | uCode revision     type ? __list_del_entry_valid+0x12/0x90 __list_del_entry_valid+0x12/0x90 iwlwifi 0000:06:00.0: 0x00000048     | uCode version major tcp_update_skb_after_send+0x5d/0x170 __tcp_transmit_skb+0xb61/0x15c0 iwlwifi     0000:06:00.0: 0xDAA05125 | uCode version minor ? __tcp_select_window+0x490/0x490 iwlwifi 0000:06:00.0:
    0x00000420 | hw version ? trace_kmalloc_node+0x29/0xd0 ? __kmalloc_node_track_caller+0x12a/0x260 ?     memset+0x1f/0x40 ? __build_skb_around+0x125/0x150 ? __alloc_skb+0x1d4/0x220 ?     skb_zerocopy_clone+0x55/0x230 iwlwifi 0000:06:00.0: 0x00489002 | board version ? kmalloc_reserve+0x80/0x80     ? rcu_read_lock_bh_held+0x60/0xb0 tcp_write_xmit+0x3f1/0x24d0 iwlwifi 0000:06:00.0: 0x034E001C | hcmd ?
    __check_object_size+0x180/0x350 iwlwifi 0000:06:00.0: 0x24020000 | isr0 tcp_sendmsg_locked+0x8a9/0x1520     iwlwifi 0000:06:00.0: 0x01400000 | isr1 ? tcp_sendpage+0x50/0x50 iwlwifi 0000:06:00.0: 0x48F0000A | isr2 ?     lock_release+0xb9/0x400 ? tcp_sendmsg+0x14/0x40 iwlwifi 0000:06:00.0: 0x00C3080C | isr3 ?     lock_downgrade+0x390/0x390 ? do_raw_spin_lock+0x114/0x1d0 iwlwifi 0000:06:00.0: 0x00200000 | isr4 ?     rwlock_bug.part.2+0x50/0x50 iwlwifi 0000:06:00.0: 0x034A001C | last cmd Id ? rwlock_bug.part.2+0x50/0x50 ?     lockdep_hardirqs_on_prepare+0xe/0x200 iwlwifi 0000:06:00.0: 0x0000C2F0 | wait_event ?
    __local_bh_enable_ip+0x87/0xe0 ? inet_send_prepare+0x220/0x220 iwlwifi 0000:06:00.0: 0x000000C4 |     l2p_control tcp_sendmsg+0x22/0x40 sock_sendmsg+0x5f/0x70 iwlwifi 0000:06:00.0: 0x00010034 | l2p_duration
    __sys_sendto+0x19d/0x250 iwlwifi 0000:06:00.0: 0x00000007 | l2p_mhvalid ? __ia32_sys_getpeername+0x40/0x40     iwlwifi 0000:06:00.0: 0x00000000 | l2p_addr_match ? rcu_read_lock_held_common+0x12/0x50 ?     rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? rcu_read_lock_sched_held+0x5a/0xd0     ? rcu_read_lock_sched_held+0x5a/0xd0 ? lock_release+0xb9/0x400 ? lock_downgrade+0x390/0x390 ?     ktime_get+0x64/0x130 ? ktime_get+0x8d/0x130 ? rcu_read_lock_held_common+0x12/0x50 ?     rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_held_common+0x12/0x50 ?     rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? rcu_read_lock_bh_held+0xb0/0xb0
    __x64_sys_sendto+0x6f/0x80 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP:
    0033:0x7f1d126e4531 Code: 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 35 80 0c 00 41 89 ca 8b 00 85 c0     75 1c 45 31 c9 45 31 c0 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 67 c3 66 0f 1f 44 00 00 55 48 83 ec 20     48 89 RSP: 002b:00007ffe21a679d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX:
    000000000000ffdc RCX: 00007f1d126e4531 RDX: 0000000000010000 RSI: 000000000374acf0 RDI: 0000000000000014     RBP: 00007ffe21a67ac0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11:
    0000000000000246 R ---truncated--- (CVE-2022-50248)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
280907	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993024)	Nessus	Unity Linux Local Security Checks	high
280253	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992494)	Nessus	Unity Linux Local Security Checks	high
275260	SUSE SLES15 Security Update : kernel (Live Patch 60 for SUSE Linux Enterprise 15 SP3) (SUSE-SU-2025:4064-1)	Nessus	SuSE Local Security Checks	high
274708	SUSE SLES15 Security Update : kernel (Live Patch 49 for SUSE Linux Enterprise 15 SP3) (SUSE-SU-2025:4016-1)	Nessus	SuSE Local Security Checks	medium
274701	SUSE SLES15 Security Update : kernel (Live Patch 61 for SLE 15 SP3) (SUSE-SU-2025:4004-1)	Nessus	SuSE Local Security Checks	high
270857	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:03628-1)	Nessus	SuSE Local Security Checks	high
270848	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:03626-1)	Nessus	SuSE Local Security Checks	high
270837	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:03615-1)	Nessus	SuSE Local Security Checks	high
264939	Linux Distros Unpatched Vulnerability : CVE-2022-50248	Nessus	Misc.	high
153035	Photon OS 4.0: Linux PHSA-2021-4.0-0095	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2022-50248

high

Tenable Plugins

high

high

high

medium

high

high

high

high

high

high