In the Linux kernel, the following vulnerability has been resolved: ext4: fix potential out of bound read in ext4_fc_replay_scan() For scan loop must ensure that at least EXT4_FC_TAG_BASE_LEN space. If remain space less than EXT4_FC_TAG_BASE_LEN which will lead to out of bound read when mounting corrupt file system image. ADD_RANGE/HEAD/TAIL is needed to add extra check when do journal scan, as this three tags will read data during scan, tag length couldn't less than data length which will read.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    x86/mce: Work around an erratum on fast string copy instructions(CVE-2022-49124)

    net: preserve skb_end_offset() in skb_unclone_keeptruesize()(CVE-2022-49142)

    scsi: qla2xxx: Fix premature hw access after PCI error(CVE-2022-49157)

    scsi: qla2xxx: Fix warning message due to adisc being flushed(CVE-2022-49158)

    scsi: qla2xxx: Implement ref count for SRB(CVE-2022-49159)

    USB: core: Prevent nested device-reset calls(CVE-2022-49936)

    mmc: vub300: fix return value check of mmc_add_host()(CVE-2022-50251)

    tracing: Fix reading strings from synthetic events(CVE-2022-50255)

    kprobes: Fix check for probe enabled in kill_kprobe()(CVE-2022-50266)

    mmc: rtsx_pci: fix return value check of mmc_add_host()(CVE-2022-50267)

    pnode: terminate at peers of source(CVE-2022-50280)

    ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline(CVE-2022-50286)

    ext4: fix potential out of bound read in ext4_fc_replay_scan()(CVE-2022-50306)

    drivers: serial: jsm: fix some leaks in probe(CVE-2022-50312)

    erofs: fix order = MAX_ORDER warning due to crafted negative i_size(CVE-2022-50313)

    ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS(CVE-2022-50315)

    perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox()(CVE-2022-50318)

    net: do not sense pfmemalloc status in skb_append_pagefrags()(CVE-2022-50323)

    jbd2: fix potential use-after-free in jbd2_fc_wait_bufs(CVE-2022-50328)

    crypto: cavium - prevent integer overflow loading firmware(CVE-2022-50330)

    ext4: fix null-ptr-deref in ext4_write_info(CVE-2022-50344)

    ext4: init quota for 'old.inode' in 'ext4_rename'(CVE-2022-50346)

    scsi: target: iscsi: Fix a race condition between login_work and the login thread(CVE-2022-50350)

    Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering     Authority.(CVE-2022-50377)

    padata: Always leave BHs disabled when running -parallel()(CVE-2022-50382)

    nvme: fix multipath crash caused by flush request when blktrace is enabled(CVE-2022-50388)

    tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak(CVE-2022-50389)

    drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED(CVE-2022-50390)

    i2c: ismt: Fix an out-of-bounds bug in ismt_access()(CVE-2022-50394)

    ACPICA: Fix error code path in acpi_ds_call_control_method()(CVE-2022-50411)

    x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly(CVE-2022-50425)

    mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING(CVE-2022-50430)

    drm/vmwgfx: Validate the box size for the snooped cursor(CVE-2022-50440)

    cpufreq: Init completion before kobject_init_and_add()(CVE-2022-50473)

    ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode(CVE-2022-50485)

    scsi: qla2xxx: Fix crash when I/O abort times out(CVE-2022-50493)

    binfmt_misc: fix shift-out-of-bounds in check_special_flags(CVE-2022-50497)

    perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()(CVE-2022-50510)

    tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'(CVE-2022-50553)

    ext4: avoid deadlock in fs reclaim with page writeback(CVE-2023-53149)

    tracing: Fix null pointer dereference in tracing_err_log_open()(CVE-2023-53167)

    vfio/type1: prevent underflow of locked_vm via exec()(CVE-2023-53171)

    serial: 8250: Reinit port-pm on port specific driver unbind(CVE-2023-53176)

    mm: fix zswap writeback race condition(CVE-2023-53178)

    sched/fair: Don't balance task to its current running CPU(CVE-2023-53215)

    arm64: efi: Make efi_rt_lock a raw_spinlock(CVE-2023-53216)

    media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()(CVE-2023-53220)

    bpf: Fix memleak due to fentry attach failure(CVE-2023-53221)

    thermal/drivers/hisi: Drop second sensor hi3660(CVE-2023-53242)

    firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle(CVE-2023-53250)

    VMCI: check context-notify_page after call to get_user_pages_fast() to avoid GPF(CVE-2023-53259)

    ext4: fix i_disksize exceeding i_size problem in paritally written case(CVE-2023-53270)

    scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue(CVE-2023-53280)

    ext4: add bounds checking in get_max_inline_xattr_value_size()(CVE-2023-53285)

    drm/client: Fix memory leak in drm_client_modeset_probe(CVE-2023-53288)

    ext4: fix WARNING in mb_find_extent(CVE-2023-53317)

    recordmcount: Fix memory leaks in the uwrite function(CVE-2023-53318)

    genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()(CVE-2023-53332)

    tracing: Fix race issue between cpu buffer write and swap(CVE-2023-53368)

    crypto: seqiv - Handle EBUSY correctly(CVE-2023-53373)

    tracing: Free error logs of tracing instances(CVE-2023-53375)

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer(CVE-2023-53395)

    mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()(CVE-2023-53401)

    blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()(CVE-2023-53421)

    media: uvcvideo: Handle cameras with invalid descriptors(CVE-2023-53437)

    bpf: cpumap: Fix memory leak in cpu_map_update_elem(CVE-2023-53441)

    ext4: remove a BUG_ON in ext4_mb_release_group_pa()(CVE-2023-53450)

    scsi: qla4xxx: Add length check when parsing nlattrs(CVE-2023-53456)

    kobject: Add sanity check for kset-kobj.ktype in kset_register()(CVE-2023-53480)

    ext4: allow ext4_get_group_info() to fail(CVE-2023-53503)

    udf: Do not bother merging very long extents(CVE-2023-53506)

    virtio-mmio: don't break lifecycle of vm_dev(CVE-2023-53515)

    scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()(CVE-2023-53521)

    scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()(CVE-2023-53530)

    tracing/histograms: Add histograms to hist_vars if they have referenced variables(CVE-2023-53560)

    null_blk: Always check queue mode setting from configfs(CVE-2023-53576)

    bpf, cpumap: Make sure kthread is running before map update returns(CVE-2023-53577)

    ring-buffer: Sync IRQ works before buffer destruction(CVE-2023-53587)

    ipmi_si: fix a memleak in try_smi_init()(CVE-2023-53611)

    ext4: fix possible double unlock when moving a directory(CVE-2023-53626)

    bnxt: avoid overflow in bnxt_get_nvram_directory()(CVE-2023-53661)

    ring-buffer: Fix deadloop issue on reading trace_pipe(CVE-2023-53668)

    A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D     cache, potentially resulting in the leakage of sensitive information across privileged     boundaries.(CVE-2024-36357)

    drm/dp_mst: Fix MST sideband message body length check(CVE-2024-56616)

    tls: stop recv() if initial process_rx_list gave us non-DATA(CVE-2024-58239)

    crypto: algif_hash - fix double free in hash_accept(CVE-2025-38079)

    thunderbolt: Do not double dequeue a configuration request(CVE-2025-38174)

    mm: fix uprobe pte be overwritten when expanding vma(CVE-2025-38207)

    scsi: lpfc: Use memcpy() for BIOS version(CVE-2025-38332)

    x86/sgx: Prevent attempts to reclaim poisoned pages(CVE-2025-38334)

    HID: core: do not bypass hid_hw_raw_request(CVE-2025-38494)

    clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns(CVE-2025-38499)

    bpf: Fix oob access in cgroup local storage(CVE-2025-38502)

    drm/sched: Increment job count before swapping tail spsc queue(CVE-2025-38515)

    pinctrl: qcom: msm: mark certain pins as invalid for interrupts(CVE-2025-38516)

    HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras(CVE-2025-38540)

    net/sched: Restrict conditions for adding duplicating netems to qdisc tree(CVE-2025-38553)

    crypto: ccp - Fix crash when rebind ccp device for ccp.ko(CVE-2025-38581)

    padata: Fix pd UAF once and for all(CVE-2025-38584)

    net: drop UFO packets in udp_rcv_segment()(CVE-2025-38622)

    regulator: core: fix NULL dereference on unbind due to stale coupling data(CVE-2025-38668)

    media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()(CVE-2025-38680)

    fbdev: Fix vmalloc out-of-bounds write in fast_imageblit(CVE-2025-38685)

    media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and     w7090p_tuner_read_serpar(CVE-2025-38693)

    scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure(CVE-2025-38695)

    ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr(CVE-2025-38701)

    x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper(CVE-2025-39681)

    tracing: Limit access to parser-buffer when trace_get_user failed(CVE-2025-39683)

    ftrace: Also allocate and copy hash for reading of filter files(CVE-2025-39689)

    fs/buffer: fix use-after-free when call bh_read() helper(CVE-2025-39691)

    serial: 8250: fix panic due to PSLVERR(CVE-2025-39724)

    rcu: Fix rcu_read_unlock() deadloop due to IRQ work(CVE-2025-39744)

    rcu: Protect -defer_qs_iw_pending from data race(CVE-2025-39749)

    usb: core: config: Prevent OOB read in SS endpoint companion parsing(CVE-2025-39760)

    jbd2: prevent softlockup in jbd2_log_do_checkpoint()(CVE-2025-39782)

    ftrace: Fix potential warning in trace_printk_seq during ftrace_dump(CVE-2025-39813)

    trace/fgraph: Fix the warning caused by missing unregister notifier(CVE-2025-39829)

    vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects(CVE-2025-39850)

    vxlan: Fix NPD when refreshing an FDB entry with a nexthop object(CVE-2025-39851)

    tee: fix NULL pointer dereference in tee_shm_put(CVE-2025-39865)

    fs: writeback: fix use-after-free in __mark_inode_dirty()(CVE-2025-39866)

    cgroup: split cgroup_destroy_wq into 3 workqueues(CVE-2025-39953)

    fbcon: fix integer overflow in fbcon_do_set_font(CVE-2025-39967)

    i40e: add max boundary check for VF filters(CVE-2025-39968)

    i40e: fix idx validation in config queues msg(CVE-2025-39971)

    i40e: add validation for ring_len param(CVE-2025-39973)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    x86/mce: Work around an erratum on fast string copy instructions(CVE-2022-49124)

    net: preserve skb_end_offset() in skb_unclone_keeptruesize()(CVE-2022-49142)

    scsi: qla2xxx: Fix premature hw access after PCI error(CVE-2022-49157)

    scsi: qla2xxx: Fix warning message due to adisc being flushed(CVE-2022-49158)

    scsi: qla2xxx: Implement ref count for SRB(CVE-2022-49159)

    USB: core: Prevent nested device-reset calls(CVE-2022-49936)

    mmc: vub300: fix return value check of mmc_add_host()(CVE-2022-50251)

    tracing: Fix reading strings from synthetic events(CVE-2022-50255)

    kprobes: Fix check for probe enabled in kill_kprobe()(CVE-2022-50266)

    mmc: rtsx_pci: fix return value check of mmc_add_host()(CVE-2022-50267)

    pnode: terminate at peers of source(CVE-2022-50280)

    ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline(CVE-2022-50286)

    ext4: fix potential out of bound read in ext4_fc_replay_scan()(CVE-2022-50306)

    drivers: serial: jsm: fix some leaks in probe(CVE-2022-50312)

    erofs: fix order = MAX_ORDER warning due to crafted negative i_size(CVE-2022-50313)

    ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS(CVE-2022-50315)

    perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox()(CVE-2022-50318)

    net: do not sense pfmemalloc status in skb_append_pagefrags()(CVE-2022-50323)

    jbd2: fix potential use-after-free in jbd2_fc_wait_bufs(CVE-2022-50328)

    crypto: cavium - prevent integer overflow loading firmware(CVE-2022-50330)

    ext4: fix null-ptr-deref in ext4_write_info(CVE-2022-50344)

    ext4: init quota for 'old.inode' in 'ext4_rename'(CVE-2022-50346)

    scsi: target: iscsi: Fix a race condition between login_work and the login thread(CVE-2022-50350)

    Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering     Authority.(CVE-2022-50377)

    padata: Always leave BHs disabled when running -parallel()(CVE-2022-50382)

    nvme: fix multipath crash caused by flush request when blktrace is enabled(CVE-2022-50388)

    tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak(CVE-2022-50389)

    drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED(CVE-2022-50390)

    i2c: ismt: Fix an out-of-bounds bug in ismt_access()(CVE-2022-50394)

    ACPICA: Fix error code path in acpi_ds_call_control_method()(CVE-2022-50411)

    x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly(CVE-2022-50425)

    mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING(CVE-2022-50430)

    drm/vmwgfx: Validate the box size for the snooped cursor(CVE-2022-50440)

    cpufreq: Init completion before kobject_init_and_add()(CVE-2022-50473)

    ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode(CVE-2022-50485)

    scsi: qla2xxx: Fix crash when I/O abort times out(CVE-2022-50493)

    binfmt_misc: fix shift-out-of-bounds in check_special_flags(CVE-2022-50497)

    perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()(CVE-2022-50510)

    tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'(CVE-2022-50553)

    ext4: avoid deadlock in fs reclaim with page writeback(CVE-2023-53149)

    tracing: Fix null pointer dereference in tracing_err_log_open()(CVE-2023-53167)

    vfio/type1: prevent underflow of locked_vm via exec()(CVE-2023-53171)

    serial: 8250: Reinit port-pm on port specific driver unbind(CVE-2023-53176)

    mm: fix zswap writeback race condition(CVE-2023-53178)

    sched/fair: Don't balance task to its current running CPU(CVE-2023-53215)

    arm64: efi: Make efi_rt_lock a raw_spinlock(CVE-2023-53216)

    media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()(CVE-2023-53220)

    bpf: Fix memleak due to fentry attach failure(CVE-2023-53221)

    thermal/drivers/hisi: Drop second sensor hi3660(CVE-2023-53242)

    firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle(CVE-2023-53250)

    VMCI: check context-notify_page after call to get_user_pages_fast() to avoid GPF(CVE-2023-53259)

    ext4: fix i_disksize exceeding i_size problem in paritally written case(CVE-2023-53270)

    scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue(CVE-2023-53280)

    ext4: add bounds checking in get_max_inline_xattr_value_size()(CVE-2023-53285)

    drm/client: Fix memory leak in drm_client_modeset_probe(CVE-2023-53288)

    ext4: fix WARNING in mb_find_extent(CVE-2023-53317)

    recordmcount: Fix memory leaks in the uwrite function(CVE-2023-53318)

    genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()(CVE-2023-53332)

    tracing: Fix race issue between cpu buffer write and swap(CVE-2023-53368)

    crypto: seqiv - Handle EBUSY correctly(CVE-2023-53373)

    tracing: Free error logs of tracing instances(CVE-2023-53375)

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer(CVE-2023-53395)

    mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()(CVE-2023-53401)

    blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()(CVE-2023-53421)

    media: uvcvideo: Handle cameras with invalid descriptors(CVE-2023-53437)

    bpf: cpumap: Fix memory leak in cpu_map_update_elem(CVE-2023-53441)

    ext4: remove a BUG_ON in ext4_mb_release_group_pa()(CVE-2023-53450)

    scsi: qla4xxx: Add length check when parsing nlattrs(CVE-2023-53456)

    kobject: Add sanity check for kset-kobj.ktype in kset_register()(CVE-2023-53480)

    ext4: allow ext4_get_group_info() to fail(CVE-2023-53503)

    udf: Do not bother merging very long extents(CVE-2023-53506)

    virtio-mmio: don't break lifecycle of vm_dev(CVE-2023-53515)

    scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()(CVE-2023-53521)

    scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()(CVE-2023-53530)

    tracing/histograms: Add histograms to hist_vars if they have referenced variables(CVE-2023-53560)

    null_blk: Always check queue mode setting from configfs(CVE-2023-53576)

    bpf, cpumap: Make sure kthread is running before map update returns(CVE-2023-53577)

    ring-buffer: Sync IRQ works before buffer destruction(CVE-2023-53587)

    ipmi_si: fix a memleak in try_smi_init()(CVE-2023-53611)

    ext4: fix possible double unlock when moving a directory(CVE-2023-53626)

    bnxt: avoid overflow in bnxt_get_nvram_directory()(CVE-2023-53661)

    ring-buffer: Fix deadloop issue on reading trace_pipe(CVE-2023-53668)

    A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D     cache, potentially resulting in the leakage of sensitive information across privileged     boundaries.(CVE-2024-36357)

    drm/dp_mst: Fix MST sideband message body length check(CVE-2024-56616)

    tls: stop recv() if initial process_rx_list gave us non-DATA(CVE-2024-58239)

    crypto: algif_hash - fix double free in hash_accept(CVE-2025-38079)

    thunderbolt: Do not double dequeue a configuration request(CVE-2025-38174)

    mm: fix uprobe pte be overwritten when expanding vma(CVE-2025-38207)

    scsi: lpfc: Use memcpy() for BIOS version(CVE-2025-38332)

    x86/sgx: Prevent attempts to reclaim poisoned pages(CVE-2025-38334)

    HID: core: do not bypass hid_hw_raw_request(CVE-2025-38494)

    clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns(CVE-2025-38499)

    bpf: Fix oob access in cgroup local storage(CVE-2025-38502)

    drm/sched: Increment job count before swapping tail spsc queue(CVE-2025-38515)

    pinctrl: qcom: msm: mark certain pins as invalid for interrupts(CVE-2025-38516)

    HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras(CVE-2025-38540)

    net/sched: Restrict conditions for adding duplicating netems to qdisc tree(CVE-2025-38553)

    crypto: ccp - Fix crash when rebind ccp device for ccp.ko(CVE-2025-38581)

    padata: Fix pd UAF once and for all(CVE-2025-38584)

    net: drop UFO packets in udp_rcv_segment()(CVE-2025-38622)

    regulator: core: fix NULL dereference on unbind due to stale coupling data(CVE-2025-38668)

    media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()(CVE-2025-38680)

    fbdev: Fix vmalloc out-of-bounds write in fast_imageblit(CVE-2025-38685)

    media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and     w7090p_tuner_read_serpar(CVE-2025-38693)

    scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure(CVE-2025-38695)

    ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr(CVE-2025-38701)

    x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper(CVE-2025-39681)

    tracing: Limit access to parser-buffer when trace_get_user failed(CVE-2025-39683)

    ftrace: Also allocate and copy hash for reading of filter files(CVE-2025-39689)

    fs/buffer: fix use-after-free when call bh_read() helper(CVE-2025-39691)

    serial: 8250: fix panic due to PSLVERR(CVE-2025-39724)

    rcu: Fix rcu_read_unlock() deadloop due to IRQ work(CVE-2025-39744)

    rcu: Protect -defer_qs_iw_pending from data race(CVE-2025-39749)

    usb: core: config: Prevent OOB read in SS endpoint companion parsing(CVE-2025-39760)

    jbd2: prevent softlockup in jbd2_log_do_checkpoint()(CVE-2025-39782)

    ftrace: Fix potential warning in trace_printk_seq during ftrace_dump(CVE-2025-39813)

    trace/fgraph: Fix the warning caused by missing unregister notifier(CVE-2025-39829)

    vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects(CVE-2025-39850)

    vxlan: Fix NPD when refreshing an FDB entry with a nexthop object(CVE-2025-39851)

    tee: fix NULL pointer dereference in tee_shm_put(CVE-2025-39865)

    fs: writeback: fix use-after-free in __mark_inode_dirty()(CVE-2025-39866)

    cgroup: split cgroup_destroy_wq into 3 workqueues(CVE-2025-39953)

    fbcon: fix integer overflow in fbcon_do_set_font(CVE-2025-39967)

    i40e: add max boundary check for VF filters(CVE-2025-39968)

    i40e: fix idx validation in config queues msg(CVE-2025-39971)

    i40e: add validation for ring_len param(CVE-2025-39973)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    scsi: qla2xxx: Fix warning message due to adisc being flushed(CVE-2022-49158)

    scsi: qla2xxx: Implement ref count for SRB(CVE-2022-49159)

    tcp: add accessors to read/set tp-snd_cwnd(CVE-2022-49325)

    KVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace(CVE-2022-49932)

    mmc: rtsx_pci: fix return value check of mmc_add_host()(CVE-2022-50267)

    ext4: fix potential out of bound read in ext4_fc_replay_scan()(CVE-2022-50306)

    net: do not sense pfmemalloc status in skb_append_pagefrags()(CVE-2022-50323)

    scsi: target: iscsi: Fix a race condition between login_work and the login thread(CVE-2022-50350)

    drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED(CVE-2022-50390)

    scsi: qla2xxx: Fix crash when I/O abort times out(CVE-2022-50493)

    vfio/type1: prevent underflow of locked_vm via exec()(CVE-2023-53171)

    mm: fix zswap writeback race condition(CVE-2023-53178)

    sched/fair: Don't balance task to its current running CPU(CVE-2023-53215)

    media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()(CVE-2023-53220)

    bpf: Fix memleak due to fentry attach failure(CVE-2023-53221)

    firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle(CVE-2023-53250)

    scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue(CVE-2023-53280)

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer(CVE-2023-53395)

    mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()(CVE-2023-53401)

    blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()(CVE-2023-53421)

    kobject: Add sanity check for kset-kobj.ktype in kset_register()(CVE-2023-53480)

    drm/dp_mst: Fix MST sideband message body length check(CVE-2024-56616)

    tls: stop recv() if initial process_rx_list gave us non-DATA(CVE-2024-58239)

    netfilter: nf_tables: reject mismatching sum of field_len with set key length(CVE-2025-21826)

    drm/nouveau: prime: fix ttm_bo_delayed_delete oops(CVE-2025-37765)

    dmaengine: idxd: fix memory leak in error handling path of idxd_alloc(CVE-2025-38015)

    nvmet-tcp: don't restore null sk_state_change(CVE-2025-38035)

    serial: mctrl_gpio: split disable_ms into sync and no_sync APIs(CVE-2025-38040)

    crypto: algif_hash - fix double free in hash_accept(CVE-2025-38079)

    HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()(CVE-2025-38103)

    net: Fix TOCTOU issue in sk_is_readable()(CVE-2025-38112)

    page_pool: Fix use-after-free in page_pool_recycle_in_ring(CVE-2025-38129)

    net: openvswitch: Fix the dead loop of MPLS parse(CVE-2025-38146)

    calipso: Don't call calipso functions for AF_INET sk.(CVE-2025-38147)

    thunderbolt: Do not double dequeue a configuration request(CVE-2025-38174)

    calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().(CVE-2025-38181)

    mm: fix uprobe pte be overwritten when expanding vma(CVE-2025-38207)

    ipc: fix to protect IPCS lookups using RCU(CVE-2025-38212)

    nvme-tcp: sanitize request list handling(CVE-2025-38264)

    fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()(CVE-2025-38312)

    scsi: lpfc: Use memcpy() for BIOS version(CVE-2025-38332)

    x86/sgx: Prevent attempts to reclaim poisoned pages(CVE-2025-38334)

    NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN(CVE-2025-38393)

    perf: Fix sample vs do_exit()(CVE-2025-38424)

    netlink: Fix wraparounds of sk-sk_rmem_alloc.(CVE-2025-38465)

    clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns(CVE-2025-38499)

    drm/sched: Increment job count before swapping tail spsc queue(CVE-2025-38515)

    pinctrl: qcom: msm: mark certain pins as invalid for interrupts(CVE-2025-38516)

    tracing: Add down_write(trace_event_sem) when adding trace event(CVE-2025-38539)

    HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras(CVE-2025-38540)

    net/sched: Restrict conditions for adding duplicating netems to qdisc tree(CVE-2025-38553)

    perf/core: Prevent VMA split of buffer mappings(CVE-2025-38563)

    perf/core: Exit early on perf_mmap() fail(CVE-2025-38565)

    pptp: ensure minimal skb length in pptp_xmit()(CVE-2025-38574)

    padata: Fix pd UAF once and for all(CVE-2025-38584)

    net: drop UFO packets in udp_rcv_segment()(CVE-2025-38622)

    pinmux: fix race causing mux_owner NULL with active mux_usecount(CVE-2025-38632)

    clk: davinci: Add NULL check in davinci_lpsc_clk_register()(CVE-2025-38635)

    regulator: core: fix NULL dereference on unbind due to stale coupling data(CVE-2025-38668)

    i2c: qup: jump out of the loop in case of timeout(CVE-2025-38671)

    media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()(CVE-2025-38680)

    fbdev: Fix vmalloc out-of-bounds write in fast_imageblit(CVE-2025-38685)

    media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and     w7090p_tuner_read_serpar(CVE-2025-38693)

    scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure(CVE-2025-38695)

    ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr(CVE-2025-38701)

    gfs2: Validate i_depth for exhash directories(CVE-2025-38710)

    x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper(CVE-2025-39681)

    tracing: Limit access to parser-buffer when trace_get_user failed(CVE-2025-39683)

    ftrace: Also allocate and copy hash for reading of filter files(CVE-2025-39689)

    fs/buffer: fix use-after-free when call bh_read() helper(CVE-2025-39691)

    RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()(CVE-2025-39742)

    rcu: Fix rcu_read_unlock() deadloop due to IRQ work(CVE-2025-39744)

    rcu: Protect -defer_qs_iw_pending from data race(CVE-2025-39749)

    usb: core: config: Prevent OOB read in SS endpoint companion parsing(CVE-2025-39760)

    jbd2: prevent softlockup in jbd2_log_do_checkpoint()(CVE-2025-39782)

    ftrace: Fix potential warning in trace_printk_seq during ftrace_dump(CVE-2025-39813)

    trace/fgraph: Fix the warning caused by missing unregister notifier(CVE-2025-39829)

    tee: fix NULL pointer dereference in tee_shm_put(CVE-2025-39865)

    fs: writeback: fix use-after-free in __mark_inode_dirty()(CVE-2025-39866)

    qed: Don't collect too many protection override GRC elements(CVE-2025-39949)

    cgroup: split cgroup_destroy_wq into 3 workqueues(CVE-2025-39953)

    i40e: fix idx validation in config queues msg(CVE-2025-39971)

    i40e: add validation for ring_len param(CVE-2025-39973)

    media: rc: fix races with imon_disconnect()(CVE-2025-39993)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ext4: fix potential out of bound read in ext4_fc_replay_scan() For scan loop must ensure that at least     EXT4_FC_TAG_BASE_LEN space. If remain space less than EXT4_FC_TAG_BASE_LEN which will lead to out of bound     read when mounting corrupt file system image. ADD_RANGE/HEAD/TAIL is needed to add extra check when do     journal scan, as this three tags will read data during scan, tag length couldn't less than data length     which will read. (CVE-2022-50306)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.15.90-54.138. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-013 advisory.

    In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows     an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control     configuration that is set up with tc qdisc and tc class commands. This affects qdisc_graft in     net/sched/sch_api.c. (CVE-2022-47929)

    A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A     local user could use this flaw to crash the system. (CVE-2022-4842)

    In the Linux kernel before 6.1.3, fs/ntfs3/inode.c does not validate the attribute name offset. An     unhandled page fault may occur. (CVE-2022-48424)

    In the Linux kernel, the following vulnerability has been resolved:

    efi: fix NULL-deref in init error path (CVE-2022-48879)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/core: Fix use-after-free bug in dup_user_cpus_ptr() (CVE-2022-48892)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Validate BOOT record_size (CVE-2022-50262)

    In the Linux kernel, the following vulnerability has been resolved:

    pnode: terminate at peers of source (CVE-2022-50280)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline (CVE-2022-50286)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix extent map use-after-free when handling missing device in read_one_chunk (CVE-2022-50300)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix potential out of bound read in ext4_fc_replay_scan() (CVE-2022-50306)

    In the Linux kernel, the following vulnerability has been resolved:

    block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq (CVE-2022-50329)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Add null pointer check to attr_load_runs_vcn (CVE-2022-50336)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix oops during encryption (CVE-2022-50341)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: init quota for 'old.inode' in 'ext4_rename' (CVE-2022-50346)

    In the Linux kernel, the following vulnerability has been resolved:

    md: fix a crash in mempool_free (CVE-2022-50381)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme: fix multipath crash caused by flush request when blktrace is enabled (CVE-2022-50388)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak (CVE-2022-50389)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: fix memory leak in tcindex_set_parms (CVE-2022-50396)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix off-by-one errors in fast-commit block filling (CVE-2022-50428)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't set up encryption key during jbd2 transaction (CVE-2022-50436)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Validate buffer length while parsing index (CVE-2022-50442)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix memory leak on ntfs_fill_super() error path (CVE-2022-50451)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix resolving backrefs for inline extent followed by prealloc (CVE-2022-50456)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix leaking uninitialized memory in fast-commit journal (CVE-2022-50465)

    In the Linux kernel, the following vulnerability has been resolved:

    cpufreq: Init completion before kobject_init_and_add() (CVE-2022-50473)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode (CVE-2022-50485)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache: Fix UAF in destroy() (CVE-2022-50496)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Validate data run offset (CVE-2022-50507)

    In the Linux kernel, the following vulnerability has been resolved:

    dm thin: Use last transaction's pmd->root when commit failed (CVE-2022-50534)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix uninititialized value in 'ext4_evict_inode' (CVE-2022-50546)

    In the Linux kernel, the following vulnerability has been resolved:

    dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata (CVE-2022-50549)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: acpi: Call acpi_put_table() to fix memory leak (CVE-2022-50562)

    In the Linux kernel, the following vulnerability has been resolved:

    dm thin: Fix UAF in run_timer_softirq() (CVE-2022-50563)

    The Linux kernel does not correctly mitigate SMT attacks, as discovered through a strange pattern in the     kernel API using STIBP as a mitigation, leaving the process exposed for a short period of time after a     syscall. The kernel also does not issue an IBPB immediately during the syscall. (CVE-2023-0045)

    A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could     allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to     the root user via arbitrary code execution. (CVE-2023-0179)

    A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

    Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as     well as insufficient hardening of the usercopy functions against spectre-v1. (CVE-2023-0459)

    There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege.

    There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock.

    When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket.
    The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is     created from the listener, the context is inherited and vulnerable.

    The setsockopt TCP_ULP operation does not require any privilege.

    We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

    cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes     indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)

    atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition     rather than valid classification results). (CVE-2023-23455)

    In the Linux kernel 6.0.8, there is a use-after-free in run_unpack in fs/ntfs3/run.c, related to a     difference between NTFS sector size and media sector size. (CVE-2023-26544)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix race between quota rescan and disable leading to NULL pointer deref (CVE-2023-52896)

    In the Linux kernel, the following vulnerability has been resolved:

    xhci: Fix null pointer dereference when host dies (CVE-2023-52898)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: xhci: Check endpoint is valid before dereferencing it (CVE-2023-52901)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring: lock overflowing for IOPOLL (CVE-2023-52903)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: act_mpls: Fix warning during failed attribute validation (CVE-2023-52906)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/iova: Fix alloc iova overflows issue (CVE-2023-52910)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. (CVE-2023-53032)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits (CVE-2023-53033)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: don't hold ni_lock when calling truncate_setsize() (CVE-2023-53163)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: Rework long task execution when adding/deleting entries (CVE-2023-53549)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
281579	EulerOS Virtualization 2.13.0 : kernel (EulerOS-SA-2025-2609)	Nessus	Huawei Local Security Checks	high
281563	EulerOS Virtualization 2.13.1 : kernel (EulerOS-SA-2025-2623)	Nessus	Huawei Local Security Checks	high
278484	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-2501)	Nessus	Huawei Local Security Checks	high
278477	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2025-2483)	Nessus	Huawei Local Security Checks	high
278473	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-2522)	Nessus	Huawei Local Security Checks	high
278438	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2025-2464)	Nessus	Huawei Local Security Checks	high
264976	Linux Distros Unpatched Vulnerability : CVE-2022-50306	Nessus	Misc.	high
171227	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-013 (ALASKERNEL-5.15-2023-013)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2022-50306

high

Tenable Plugins

high

high

high

high

high

high

high

high