In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix race in sock_map_free() sock_map_free() calls release_sock(sk) without owning a reference on the socket. This can cause use-after-free as syzbot found [1] Jakub Sitnicki already took care of a similar issue in sock_hash_free() in commit 75e68e5bf2c7 ("bpf, sockhash: Synchronize delete from bucket list on map free") [1] refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 0 PID: 3785 at lib/refcount.c:31 refcount_warn_saturate+0x17c/0x1a0 lib/refcount.c:31 Modules linked in: CPU: 0 PID: 3785 Comm: kworker/u4:6 Not tainted 6.1.0-rc7-syzkaller-00103-gef4d3ea40565 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: events_unbound bpf_map_free_deferred RIP: 0010:refcount_warn_saturate+0x17c/0x1a0 lib/refcount.c:31 Code: 68 8b 31 c0 e8 75 71 15 fd 0f 0b e9 64 ff ff ff e8 d9 6e 4e fd c6 05 62 9c 3d 0a 01 48 c7 c7 80 bb 68 8b 31 c0 e8 54 71 15 fd <0f> 0b e9 43 ff ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a2 fe ff RSP: 0018:ffffc9000456fb60 EFLAGS: 00010246 RAX: eae59bab72dcd700 RBX: 0000000000000004 RCX: ffff8880207057c0 RDX: 0000000000000000 RSI: 0000000000000201 RDI: 0000000000000000 RBP: 0000000000000004 R08: ffffffff816fdabd R09: fffff520008adee5 R10: fffff520008adee5 R11: 1ffff920008adee4 R12: 0000000000000004 R13: dffffc0000000000 R14: ffff88807b1c6c00 R15: 1ffff1100f638dcf FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b30c30000 CR3: 000000000d08e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __refcount_dec include/linux/refcount.h:344 [inline] refcount_dec include/linux/refcount.h:359 [inline] __sock_put include/net/sock.h:779 [inline] tcp_release_cb+0x2d0/0x360 net/ipv4/tcp_output.c:1092 release_sock+0xaf/0x1c0 net/core/sock.c:3468 sock_map_free+0x219/0x2c0 net/core/sock_map.c:356 process_one_work+0x81c/0xd10 kernel/workqueue.c:2289 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436 kthread+0x266/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK>

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993210 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: fix race in sock_map_free()

    sock_map_free() calls release_sock(sk) without owning a reference     on the socket. This can cause use-after-free as syzbot found [1]

    Jakub Sitnicki already took care of a similar issue     in sock_hash_free() in commit 75e68e5bf2c7 (bpf, sockhash:
    Synchronize delete from bucket list on map free)

    [1]     refcount_t: decrement hit 0; leaking memory.
    WARNING: CPU: 0 PID: 3785 at lib/refcount.c:31 refcount_warn_saturate+0x17c/0x1a0 lib/refcount.c:31     Modules linked in:
    CPU: 0 PID: 3785 Comm: kworker/u4:6 Not tainted 6.1.0-rc7-syzkaller-00103-gef4d3ea40565 #0     Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022     Workqueue: events_unbound bpf_map_free_deferred     RIP: 0010:refcount_warn_saturate+0x17c/0x1a0 lib/refcount.c:31     Code: 68 8b 31 c0 e8 75 71 15 fd 0f 0b e9 64 ff ff ff e8 d9 6e 4e fd c6 05 62 9c 3d 0a 01 48 c7 c7 80 bb     68 8b 31 c0 e8 54 71 15 fd <0f> 0b e9 43 ff ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a2 fe ff     RSP: 0018:ffffc9000456fb60 EFLAGS: 00010246     RAX: eae59bab72dcd700 RBX: 0000000000000004 RCX: ffff8880207057c0     RDX: 0000000000000000 RSI: 0000000000000201 RDI: 0000000000000000     RBP: 0000000000000004 R08: ffffffff816fdabd R09: fffff520008adee5     R10: fffff520008adee5 R11: 1ffff920008adee4 R12: 0000000000000004     R13: dffffc0000000000 R14: ffff88807b1c6c00 R15: 1ffff1100f638dcf     FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000     CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: 0000001b30c30000 CR3: 000000000d08e000 CR4: 00000000003506f0     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000     DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400     Call Trace:
    <TASK>
    __refcount_dec include/linux/refcount.h:344 [inline]     refcount_dec include/linux/refcount.h:359 [inline]
    __sock_put include/net/sock.h:779 [inline]     tcp_release_cb+0x2d0/0x360 net/ipv4/tcp_output.c:1092     release_sock+0xaf/0x1c0 net/core/sock.c:3468     sock_map_free+0x219/0x2c0 net/core/sock_map.c:356     process_one_work+0x81c/0xd10 kernel/workqueue.c:2289     worker_thread+0xb14/0x1330 kernel/workqueue.c:2436     kthread+0x266/0x300 kernel/kthread.c:376     ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306     </TASK>

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992606 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: fix race in sock_map_free()

    sock_map_free() calls release_sock(sk) without owning a reference     on the socket. This can cause use-after-free as syzbot found [1]

    Jakub Sitnicki already took care of a similar issue     in sock_hash_free() in commit 75e68e5bf2c7 (bpf, sockhash:
    Synchronize delete from bucket list on map free)

    [1]     refcount_t: decrement hit 0; leaking memory.
    WARNING: CPU: 0 PID: 3785 at lib/refcount.c:31 refcount_warn_saturate+0x17c/0x1a0 lib/refcount.c:31     Modules linked in:
    CPU: 0 PID: 3785 Comm: kworker/u4:6 Not tainted 6.1.0-rc7-syzkaller-00103-gef4d3ea40565 #0     Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022     Workqueue: events_unbound bpf_map_free_deferred     RIP: 0010:refcount_warn_saturate+0x17c/0x1a0 lib/refcount.c:31     Code: 68 8b 31 c0 e8 75 71 15 fd 0f 0b e9 64 ff ff ff e8 d9 6e 4e fd c6 05 62 9c 3d 0a 01 48 c7 c7 80 bb     68 8b 31 c0 e8 54 71 15 fd <0f> 0b e9 43 ff ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a2 fe ff     RSP: 0018:ffffc9000456fb60 EFLAGS: 00010246     RAX: eae59bab72dcd700 RBX: 0000000000000004 RCX: ffff8880207057c0     RDX: 0000000000000000 RSI: 0000000000000201 RDI: 0000000000000000     RBP: 0000000000000004 R08: ffffffff816fdabd R09: fffff520008adee5     R10: fffff520008adee5 R11: 1ffff920008adee4 R12: 0000000000000004     R13: dffffc0000000000 R14: ffff88807b1c6c00 R15: 1ffff1100f638dcf     FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000     CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: 0000001b30c30000 CR3: 000000000d08e000 CR4: 00000000003506f0     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000     DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400     Call Trace:
    <TASK>
    __refcount_dec include/linux/refcount.h:344 [inline]     refcount_dec include/linux/refcount.h:359 [inline]
    __sock_put include/net/sock.h:779 [inline]     tcp_release_cb+0x2d0/0x360 net/ipv4/tcp_output.c:1092     release_sock+0xaf/0x1c0 net/core/sock.c:3468     sock_map_free+0x219/0x2c0 net/core/sock_map.c:356     process_one_work+0x81c/0xd10 kernel/workqueue.c:2289     worker_thread+0xb14/0x1330 kernel/workqueue.c:2436     kthread+0x266/0x300 kernel/kthread.c:376     ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306     </TASK>

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix race in     sock_map_free() sock_map_free() calls release_sock(sk) without owning a reference on the socket. This can     cause use-after-free as syzbot found [1] Jakub Sitnicki already took care of a similar issue in     sock_hash_free() in commit 75e68e5bf2c7 (bpf, sockhash: Synchronize delete from bucket list on map free)     [1] refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 0 PID: 3785 at lib/refcount.c:31     refcount_warn_saturate+0x17c/0x1a0 lib/refcount.c:31 Modules linked in: CPU: 0 PID: 3785 Comm:
    kworker/u4:6 Not tainted 6.1.0-rc7-syzkaller-00103-gef4d3ea40565 #0 Hardware name: Google Google Compute     Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: events_unbound bpf_map_free_deferred RIP:
    0010:refcount_warn_saturate+0x17c/0x1a0 lib/refcount.c:31 Code: 68 8b 31 c0 e8 75 71 15 fd 0f 0b e9 64 ff     ff ff e8 d9 6e 4e fd c6 05 62 9c 3d 0a 01 48 c7 c7 80 bb 68 8b 31 c0 e8 54 71 15 fd <0f> 0b e9 43 ff ff ff     89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a2 fe ff RSP: 0018:ffffc9000456fb60 EFLAGS: 00010246 RAX:
    eae59bab72dcd700 RBX: 0000000000000004 RCX: ffff8880207057c0 RDX: 0000000000000000 RSI: 0000000000000201     RDI: 0000000000000000 RBP: 0000000000000004 R08: ffffffff816fdabd R09: fffff520008adee5 R10:
    fffff520008adee5 R11: 1ffff920008adee4 R12: 0000000000000004 R13: dffffc0000000000 R14: ffff88807b1c6c00     R15: 1ffff1100f638dcf FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010     DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b30c30000 CR3: 000000000d08e000 CR4: 00000000003506f0     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
    00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __refcount_dec include/linux/refcount.h:344     [inline] refcount_dec include/linux/refcount.h:359 [inline] __sock_put include/net/sock.h:779 [inline]     tcp_release_cb+0x2d0/0x360 net/ipv4/tcp_output.c:1092 release_sock+0xaf/0x1c0 net/core/sock.c:3468     sock_map_free+0x219/0x2c0 net/core/sock_map.c:356 process_one_work+0x81c/0xd10 kernel/workqueue.c:2289     worker_thread+0xb14/0x1330 kernel/workqueue.c:2436 kthread+0x266/0x300 kernel/kthread.c:376     ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK> (CVE-2022-50259)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
301628	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1280)	Nessus	Huawei Local Security Checks	high
301595	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1244)	Nessus	Huawei Local Security Checks	high
280848	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993210)	Nessus	Unity Linux Local Security Checks	medium
280621	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992606)	Nessus	Unity Linux Local Security Checks	medium
265025	Linux Distros Unpatched Vulnerability : CVE-2022-50259	Nessus	Misc.	medium
171848	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2023-042 (ALASKERNEL-5.4-2023-042)	Nessus	Amazon Linux Local Security Checks	high
171216	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-026 (ALASKERNEL-5.10-2023-026)	Nessus	Amazon Linux Local Security Checks	high
170458	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-012 (ALASKERNEL-5.15-2023-012)	Nessus	Amazon Linux Local Security Checks	high
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2022-50259

medium

Tenable Plugins

high

high

medium

medium

medium

high

high

high

high