In the Linux kernel, the following vulnerability has been resolved: dmaengine: hisilicon: Add multi-thread support for a DMA channel When we get a DMA channel and try to use it in multiple threads it will cause oops and hanging the system. % echo 100 > /sys/module/dmatest/parameters/threads_per_chan % echo 100 > /sys/module/dmatest/parameters/iterations % echo 1 > /sys/module/dmatest/parameters/run [383493.327077] Unable to handle kernel paging request at virtual address dead000000000108 [383493.335103] Mem abort info: [383493.335103] ESR = 0x96000044 [383493.335105] EC = 0x25: DABT (current EL), IL = 32 bits [383493.335107] SET = 0, FnV = 0 [383493.335108] EA = 0, S1PTW = 0 [383493.335109] FSC = 0x04: level 0 translation fault [383493.335110] Data abort info: [383493.335111] ISV = 0, ISS = 0x00000044 [383493.364739] CM = 0, WnR = 1 [383493.367793] [dead000000000108] address between user and kernel address ranges [383493.375021] Internal error: Oops: 96000044 [#1] PREEMPT SMP [383493.437574] CPU: 63 PID: 27895 Comm: dma0chan0-copy2 Kdump: loaded Tainted: GO 5.17.0-rc4+ #2 [383493.457851] pstate: 204000c9 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [383493.465331] pc : vchan_tx_submit+0x64/0xa0 [383493.469957] lr : vchan_tx_submit+0x34/0xa0 This occurs because the transmission timed out, and that's due to data race. Each thread rewrite channels's descriptor as soon as device_issue_pending is called. It leads to the situation that the driver thinks that it uses the right descriptor in interrupt handler while channels's descriptor has been changed by other thread. The descriptor which in fact reported interrupt will not be handled any more, as well as its tx->callback. That's why timeout reports. With current fixes channels' descriptor changes it's value only when it has been used. A new descriptor is acquired from vc->desc_issued queue that is already filled with descriptors that are ready to be sent. Threads have no direct access to DMA channel descriptor. In case of channel's descriptor is busy, try to submit to HW again when a descriptor is completed. In this case, vc->desc_issued may be empty when hisi_dma_start_transfer is called, so delete error reporting on this. Now it is just possible to queue a descriptor for further processing.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993085 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    dmaengine: hisilicon: Add multi-thread support for a DMA channel

    When we get a DMA channel and try to use it in multiple threads it     will cause oops and hanging the system.

    % echo 100 > /sys/module/dmatest/parameters/threads_per_chan     % echo 100 > /sys/module/dmatest/parameters/iterations     % echo 1 > /sys/module/dmatest/parameters/run     [383493.327077] Unable to handle kernel paging request at virtual                     address dead000000000108     [383493.335103] Mem abort info:
    [383493.335103]   ESR = 0x96000044     [383493.335105]   EC = 0x25: DABT (current EL), IL = 32 bits     [383493.335107]   SET = 0, FnV = 0     [383493.335108]   EA = 0, S1PTW = 0     [383493.335109]   FSC = 0x04: level 0 translation fault     [383493.335110] Data abort info:
    [383493.335111]   ISV = 0, ISS = 0x00000044     [383493.364739]   CM = 0, WnR = 1     [383493.367793] [dead000000000108] address between user and kernel                     address ranges     [383493.375021] Internal error: Oops: 96000044 [#1] PREEMPT SMP     [383493.437574] CPU: 63 PID: 27895 Comm: dma0chan0-copy2 Kdump:
                    loaded Tainted: GO 5.17.0-rc4+ #2     [383493.457851] pstate: 204000c9 (nzCv daIF +PAN -UAO -TCO -DIT
                    -SSBS BTYPE=--)     [383493.465331] pc : vchan_tx_submit+0x64/0xa0     [383493.469957] lr : vchan_tx_submit+0x34/0xa0

    This occurs because the transmission timed out, and that's due     to data race. Each thread rewrite channels's descriptor as soon as     device_issue_pending is called. It leads to the situation that     the driver thinks that it uses the right descriptor in interrupt     handler while channels's descriptor has been changed by other     thread. The descriptor which in fact reported interrupt will not     be handled any more, as well as its tx->callback.
    That's why timeout reports.

    With current fixes channels' descriptor changes it's value only     when it has been used. A new descriptor is acquired from     vc->desc_issued queue that is already filled with descriptors     that are ready to be sent. Threads have no direct access to DMA     channel descriptor. In case of channel's descriptor is busy, try     to submit to HW again when a descriptor is completed. In this case,     vc->desc_issued may be empty when hisi_dma_start_transfer is called,     so delete error reporting on this. Now it is just possible to queue     a descriptor for further processing.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992408 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    dmaengine: hisilicon: Add multi-thread support for a DMA channel

    When we get a DMA channel and try to use it in multiple threads it     will cause oops and hanging the system.

    % echo 100 > /sys/module/dmatest/parameters/threads_per_chan     % echo 100 > /sys/module/dmatest/parameters/iterations     % echo 1 > /sys/module/dmatest/parameters/run     [383493.327077] Unable to handle kernel paging request at virtual                     address dead000000000108     [383493.335103] Mem abort info:
    [383493.335103]   ESR = 0x96000044     [383493.335105]   EC = 0x25: DABT (current EL), IL = 32 bits     [383493.335107]   SET = 0, FnV = 0     [383493.335108]   EA = 0, S1PTW = 0     [383493.335109]   FSC = 0x04: level 0 translation fault     [383493.335110] Data abort info:
    [383493.335111]   ISV = 0, ISS = 0x00000044     [383493.364739]   CM = 0, WnR = 1     [383493.367793] [dead000000000108] address between user and kernel                     address ranges     [383493.375021] Internal error: Oops: 96000044 [#1] PREEMPT SMP     [383493.437574] CPU: 63 PID: 27895 Comm: dma0chan0-copy2 Kdump:
                    loaded Tainted: GO 5.17.0-rc4+ #2     [383493.457851] pstate: 204000c9 (nzCv daIF +PAN -UAO -TCO -DIT
                    -SSBS BTYPE=--)     [383493.465331] pc : vchan_tx_submit+0x64/0xa0     [383493.469957] lr : vchan_tx_submit+0x34/0xa0

    This occurs because the transmission timed out, and that's due     to data race. Each thread rewrite channels's descriptor as soon as     device_issue_pending is called. It leads to the situation that     the driver thinks that it uses the right descriptor in interrupt     handler while channels's descriptor has been changed by other     thread. The descriptor which in fact reported interrupt will not     be handled any more, as well as its tx->callback.
    That's why timeout reports.

    With current fixes channels' descriptor changes it's value only     when it has been used. A new descriptor is acquired from     vc->desc_issued queue that is already filled with descriptors     that are ready to be sent. Threads have no direct access to DMA     channel descriptor. In case of channel's descriptor is busy, try     to submit to HW again when a descriptor is completed. In this case,     vc->desc_issued may be empty when hisi_dma_start_transfer is called,     so delete error reporting on this. Now it is just possible to queue     a descriptor for further processing.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03628-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
    - CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
    - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
    - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
    - CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
    - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
    - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
    - CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
    - CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
    - CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245498).
    - CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
    - CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
    - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
    - CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
    - CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime     (bsc#1247288).
    - CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree     (bsc#1248255).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
    - CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
    - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
    - CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
    - CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
    - CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03615-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
    - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
    - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
    - CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
    - CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
    - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
    - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
    - CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
    - CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
    - CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree     (bsc#1248255).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
    - CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
    - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
    - CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
    - CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
    - CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - dmaengine: hisilicon: Add multi-thread support for a DMA channel When we get a DMA channel and try to use     it in multiple threads it will cause oops and hanging the system. % echo 100 >     /sys/module/dmatest/parameters/threads_per_chan % echo 100 > /sys/module/dmatest/parameters/iterations %     echo 1 > /sys/module/dmatest/parameters/run [383493.327077] Unable to handle kernel paging request at     virtual address dead000000000108 [383493.335103] Mem abort info: [383493.335103] ESR = 0x96000044     [383493.335105] EC = 0x25: DABT (current EL), IL = 32 bits [383493.335107] SET = 0, FnV = 0     [383493.335108] EA = 0, S1PTW = 0 [383493.335109] FSC = 0x04: level 0 translation fault [383493.335110]     Data abort info: [383493.335111] ISV = 0, ISS = 0x00000044 [383493.364739] CM = 0, WnR = 1 [383493.367793]     [dead000000000108] address between user and kernel address ranges [383493.375021] Internal error: Oops:
    96000044 [#1] PREEMPT SMP [383493.437574] CPU: 63 PID: 27895 Comm: dma0chan0-copy2 Kdump: loaded Tainted:
    GO 5.17.0-rc4+ #2 [383493.457851] pstate: 204000c9 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)     [383493.465331] pc : vchan_tx_submit+0x64/0xa0 [383493.469957] lr : vchan_tx_submit+0x34/0xa0 This occurs     because the transmission timed out, and that's due to data race. Each thread rewrite channels's descriptor     as soon as device_issue_pending is called. It leads to the situation that the driver thinks that it uses     the right descriptor in interrupt handler while channels's descriptor has been changed by other thread.
    The descriptor which in fact reported interrupt will not be handled any more, as well as its tx->callback.
    That's why timeout reports. With current fixes channels' descriptor changes it's value only when it has     been used. A new descriptor is acquired from vc->desc_issued queue that is already filled with descriptors     that are ready to be sent. Threads have no direct access to DMA channel descriptor. In case of channel's     descriptor is busy, try to submit to HW again when a descriptor is completed. In this case,     vc->desc_issued may be empty when hisi_dma_start_transfer is called, so delete error reporting on this.
    Now it is just possible to queue a descriptor for further processing. (CVE-2022-50362)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
280926	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993085)	Nessus	Unity Linux Local Security Checks	medium
280461	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992408)	Nessus	Unity Linux Local Security Checks	medium
270857	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:03628-1)	Nessus	SuSE Local Security Checks	high
270837	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:03615-1)	Nessus	SuSE Local Security Checks	high
265482	Linux Distros Unpatched Vulnerability : CVE-2022-50362	Nessus	Misc.	medium
153035	Photon OS 4.0: Linux PHSA-2021-4.0-0095	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2022-50362

medium

Tenable Plugins

medium

medium

high

high

medium

high