In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in ./include/drm/ttm/ttm_tt.h:122:26 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c ttm_bo_move_memcpy+0x3b4/0x460 [ttm] bo_driver_move+0x32/0x40 [drm_vram_helper] ttm_bo_handle_move_mem+0x118/0x200 [ttm] ttm_bo_validate+0xfa/0x220 [ttm] drm_gem_vram_pin_locked+0x70/0x1b0 [drm_vram_helper] drm_gem_vram_pin+0x48/0xb0 [drm_vram_helper] drm_gem_vram_plane_helper_prepare_fb+0x53/0xe0 [drm_vram_helper] drm_gem_vram_simple_display_pipe_prepare_fb+0x26/0x30 [drm_vram_helper] drm_simple_kms_plane_prepare_fb+0x4d/0xe0 [drm_kms_helper] drm_atomic_helper_prepare_planes+0xda/0x210 [drm_kms_helper] drm_atomic_helper_commit+0xc3/0x1e0 [drm_kms_helper] drm_atomic_commit+0x9c/0x160 [drm] drm_client_modeset_commit_atomic+0x33a/0x380 [drm] drm_client_modeset_commit_locked+0x77/0x220 [drm] drm_client_modeset_commit+0x31/0x60 [drm] __drm_fb_helper_restore_fbdev_mode_unlocked+0xa7/0x170 [drm_kms_helper] drm_fb_helper_set_par+0x51/0x90 [drm_kms_helper] fbcon_init+0x316/0x790 visual_init+0x113/0x1d0 do_bind_con_driver+0x2a3/0x5c0 do_take_over_console+0xa9/0x270 do_fbcon_takeover+0xa1/0x170 do_fb_registered+0x2a8/0x340 fbcon_fb_registered+0x47/0xe0 register_framebuffer+0x294/0x4a0 __drm_fb_helper_initial_config_and_unlock+0x43c/0x880 [drm_kms_helper] drm_fb_helper_initial_config+0x52/0x80 [drm_kms_helper] drm_fbdev_client_hotplug+0x156/0x1b0 [drm_kms_helper] drm_fbdev_generic_setup+0xfc/0x290 [drm_kms_helper] bochs_pci_probe+0x6ca/0x772 [bochs] local_pci_probe+0x4d/0xb0 pci_device_probe+0x119/0x320 really_probe+0x181/0x550 __driver_probe_device+0xc6/0x220 driver_probe_device+0x32/0x100 __driver_attach+0x195/0x200 bus_for_each_dev+0xbb/0x120 driver_attach+0x27/0x30 bus_add_driver+0x22e/0x2f0 driver_register+0xa9/0x190 __pci_register_driver+0x90/0xa0 bochs_pci_driver_init+0x52/0x1000 [bochs] do_one_initcall+0x76/0x430 do_init_module+0x61/0x28a load_module+0x1f82/0x2e50 __do_sys_finit_module+0xf8/0x190 __x64_sys_finit_module+0x23/0x30 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK>

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    x86/mce: Work around an erratum on fast string copy instructions(CVE-2022-49124)

    net: preserve skb_end_offset() in skb_unclone_keeptruesize()(CVE-2022-49142)

    scsi: qla2xxx: Fix premature hw access after PCI error(CVE-2022-49157)

    scsi: qla2xxx: Fix warning message due to adisc being flushed(CVE-2022-49158)

    scsi: qla2xxx: Implement ref count for SRB(CVE-2022-49159)

    USB: core: Prevent nested device-reset calls(CVE-2022-49936)

    mmc: vub300: fix return value check of mmc_add_host()(CVE-2022-50251)

    tracing: Fix reading strings from synthetic events(CVE-2022-50255)

    kprobes: Fix check for probe enabled in kill_kprobe()(CVE-2022-50266)

    mmc: rtsx_pci: fix return value check of mmc_add_host()(CVE-2022-50267)

    pnode: terminate at peers of source(CVE-2022-50280)

    ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline(CVE-2022-50286)

    ext4: fix potential out of bound read in ext4_fc_replay_scan()(CVE-2022-50306)

    drivers: serial: jsm: fix some leaks in probe(CVE-2022-50312)

    erofs: fix order = MAX_ORDER warning due to crafted negative i_size(CVE-2022-50313)

    ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS(CVE-2022-50315)

    perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox()(CVE-2022-50318)

    net: do not sense pfmemalloc status in skb_append_pagefrags()(CVE-2022-50323)

    jbd2: fix potential use-after-free in jbd2_fc_wait_bufs(CVE-2022-50328)

    crypto: cavium - prevent integer overflow loading firmware(CVE-2022-50330)

    ext4: fix null-ptr-deref in ext4_write_info(CVE-2022-50344)

    ext4: init quota for 'old.inode' in 'ext4_rename'(CVE-2022-50346)

    scsi: target: iscsi: Fix a race condition between login_work and the login thread(CVE-2022-50350)

    Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering     Authority.(CVE-2022-50377)

    padata: Always leave BHs disabled when running -parallel()(CVE-2022-50382)

    nvme: fix multipath crash caused by flush request when blktrace is enabled(CVE-2022-50388)

    tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak(CVE-2022-50389)

    drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED(CVE-2022-50390)

    i2c: ismt: Fix an out-of-bounds bug in ismt_access()(CVE-2022-50394)

    ACPICA: Fix error code path in acpi_ds_call_control_method()(CVE-2022-50411)

    x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly(CVE-2022-50425)

    mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING(CVE-2022-50430)

    drm/vmwgfx: Validate the box size for the snooped cursor(CVE-2022-50440)

    cpufreq: Init completion before kobject_init_and_add()(CVE-2022-50473)

    ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode(CVE-2022-50485)

    scsi: qla2xxx: Fix crash when I/O abort times out(CVE-2022-50493)

    binfmt_misc: fix shift-out-of-bounds in check_special_flags(CVE-2022-50497)

    perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()(CVE-2022-50510)

    tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'(CVE-2022-50553)

    ext4: avoid deadlock in fs reclaim with page writeback(CVE-2023-53149)

    tracing: Fix null pointer dereference in tracing_err_log_open()(CVE-2023-53167)

    vfio/type1: prevent underflow of locked_vm via exec()(CVE-2023-53171)

    serial: 8250: Reinit port-pm on port specific driver unbind(CVE-2023-53176)

    mm: fix zswap writeback race condition(CVE-2023-53178)

    sched/fair: Don't balance task to its current running CPU(CVE-2023-53215)

    arm64: efi: Make efi_rt_lock a raw_spinlock(CVE-2023-53216)

    media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()(CVE-2023-53220)

    bpf: Fix memleak due to fentry attach failure(CVE-2023-53221)

    thermal/drivers/hisi: Drop second sensor hi3660(CVE-2023-53242)

    firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle(CVE-2023-53250)

    VMCI: check context-notify_page after call to get_user_pages_fast() to avoid GPF(CVE-2023-53259)

    ext4: fix i_disksize exceeding i_size problem in paritally written case(CVE-2023-53270)

    scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue(CVE-2023-53280)

    ext4: add bounds checking in get_max_inline_xattr_value_size()(CVE-2023-53285)

    drm/client: Fix memory leak in drm_client_modeset_probe(CVE-2023-53288)

    ext4: fix WARNING in mb_find_extent(CVE-2023-53317)

    recordmcount: Fix memory leaks in the uwrite function(CVE-2023-53318)

    genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()(CVE-2023-53332)

    tracing: Fix race issue between cpu buffer write and swap(CVE-2023-53368)

    crypto: seqiv - Handle EBUSY correctly(CVE-2023-53373)

    tracing: Free error logs of tracing instances(CVE-2023-53375)

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer(CVE-2023-53395)

    mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()(CVE-2023-53401)

    blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()(CVE-2023-53421)

    media: uvcvideo: Handle cameras with invalid descriptors(CVE-2023-53437)

    bpf: cpumap: Fix memory leak in cpu_map_update_elem(CVE-2023-53441)

    ext4: remove a BUG_ON in ext4_mb_release_group_pa()(CVE-2023-53450)

    scsi: qla4xxx: Add length check when parsing nlattrs(CVE-2023-53456)

    kobject: Add sanity check for kset-kobj.ktype in kset_register()(CVE-2023-53480)

    ext4: allow ext4_get_group_info() to fail(CVE-2023-53503)

    udf: Do not bother merging very long extents(CVE-2023-53506)

    virtio-mmio: don't break lifecycle of vm_dev(CVE-2023-53515)

    scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()(CVE-2023-53521)

    scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()(CVE-2023-53530)

    tracing/histograms: Add histograms to hist_vars if they have referenced variables(CVE-2023-53560)

    null_blk: Always check queue mode setting from configfs(CVE-2023-53576)

    bpf, cpumap: Make sure kthread is running before map update returns(CVE-2023-53577)

    ring-buffer: Sync IRQ works before buffer destruction(CVE-2023-53587)

    ipmi_si: fix a memleak in try_smi_init()(CVE-2023-53611)

    ext4: fix possible double unlock when moving a directory(CVE-2023-53626)

    bnxt: avoid overflow in bnxt_get_nvram_directory()(CVE-2023-53661)

    ring-buffer: Fix deadloop issue on reading trace_pipe(CVE-2023-53668)

    A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D     cache, potentially resulting in the leakage of sensitive information across privileged     boundaries.(CVE-2024-36357)

    drm/dp_mst: Fix MST sideband message body length check(CVE-2024-56616)

    tls: stop recv() if initial process_rx_list gave us non-DATA(CVE-2024-58239)

    crypto: algif_hash - fix double free in hash_accept(CVE-2025-38079)

    thunderbolt: Do not double dequeue a configuration request(CVE-2025-38174)

    mm: fix uprobe pte be overwritten when expanding vma(CVE-2025-38207)

    scsi: lpfc: Use memcpy() for BIOS version(CVE-2025-38332)

    x86/sgx: Prevent attempts to reclaim poisoned pages(CVE-2025-38334)

    HID: core: do not bypass hid_hw_raw_request(CVE-2025-38494)

    clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns(CVE-2025-38499)

    bpf: Fix oob access in cgroup local storage(CVE-2025-38502)

    drm/sched: Increment job count before swapping tail spsc queue(CVE-2025-38515)

    pinctrl: qcom: msm: mark certain pins as invalid for interrupts(CVE-2025-38516)

    HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras(CVE-2025-38540)

    net/sched: Restrict conditions for adding duplicating netems to qdisc tree(CVE-2025-38553)

    crypto: ccp - Fix crash when rebind ccp device for ccp.ko(CVE-2025-38581)

    padata: Fix pd UAF once and for all(CVE-2025-38584)

    net: drop UFO packets in udp_rcv_segment()(CVE-2025-38622)

    regulator: core: fix NULL dereference on unbind due to stale coupling data(CVE-2025-38668)

    media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()(CVE-2025-38680)

    fbdev: Fix vmalloc out-of-bounds write in fast_imageblit(CVE-2025-38685)

    media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and     w7090p_tuner_read_serpar(CVE-2025-38693)

    scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure(CVE-2025-38695)

    ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr(CVE-2025-38701)

    x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper(CVE-2025-39681)

    tracing: Limit access to parser-buffer when trace_get_user failed(CVE-2025-39683)

    ftrace: Also allocate and copy hash for reading of filter files(CVE-2025-39689)

    fs/buffer: fix use-after-free when call bh_read() helper(CVE-2025-39691)

    serial: 8250: fix panic due to PSLVERR(CVE-2025-39724)

    rcu: Fix rcu_read_unlock() deadloop due to IRQ work(CVE-2025-39744)

    rcu: Protect -defer_qs_iw_pending from data race(CVE-2025-39749)

    usb: core: config: Prevent OOB read in SS endpoint companion parsing(CVE-2025-39760)

    jbd2: prevent softlockup in jbd2_log_do_checkpoint()(CVE-2025-39782)

    ftrace: Fix potential warning in trace_printk_seq during ftrace_dump(CVE-2025-39813)

    trace/fgraph: Fix the warning caused by missing unregister notifier(CVE-2025-39829)

    vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects(CVE-2025-39850)

    vxlan: Fix NPD when refreshing an FDB entry with a nexthop object(CVE-2025-39851)

    tee: fix NULL pointer dereference in tee_shm_put(CVE-2025-39865)

    fs: writeback: fix use-after-free in __mark_inode_dirty()(CVE-2025-39866)

    cgroup: split cgroup_destroy_wq into 3 workqueues(CVE-2025-39953)

    fbcon: fix integer overflow in fbcon_do_set_font(CVE-2025-39967)

    i40e: add max boundary check for VF filters(CVE-2025-39968)

    i40e: fix idx validation in config queues msg(CVE-2025-39971)

    i40e: add validation for ring_len param(CVE-2025-39973)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    scsi: qla2xxx: Fix warning message due to adisc being flushed(CVE-2022-49158)

    scsi: qla2xxx: Implement ref count for SRB(CVE-2022-49159)

    tcp: add accessors to read/set tp-snd_cwnd(CVE-2022-49325)

    KVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace(CVE-2022-49932)

    mmc: rtsx_pci: fix return value check of mmc_add_host()(CVE-2022-50267)

    ext4: fix potential out of bound read in ext4_fc_replay_scan()(CVE-2022-50306)

    net: do not sense pfmemalloc status in skb_append_pagefrags()(CVE-2022-50323)

    scsi: target: iscsi: Fix a race condition between login_work and the login thread(CVE-2022-50350)

    drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED(CVE-2022-50390)

    scsi: qla2xxx: Fix crash when I/O abort times out(CVE-2022-50493)

    vfio/type1: prevent underflow of locked_vm via exec()(CVE-2023-53171)

    mm: fix zswap writeback race condition(CVE-2023-53178)

    sched/fair: Don't balance task to its current running CPU(CVE-2023-53215)

    media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()(CVE-2023-53220)

    bpf: Fix memleak due to fentry attach failure(CVE-2023-53221)

    firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle(CVE-2023-53250)

    scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue(CVE-2023-53280)

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer(CVE-2023-53395)

    mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()(CVE-2023-53401)

    blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()(CVE-2023-53421)

    kobject: Add sanity check for kset-kobj.ktype in kset_register()(CVE-2023-53480)

    drm/dp_mst: Fix MST sideband message body length check(CVE-2024-56616)

    tls: stop recv() if initial process_rx_list gave us non-DATA(CVE-2024-58239)

    netfilter: nf_tables: reject mismatching sum of field_len with set key length(CVE-2025-21826)

    drm/nouveau: prime: fix ttm_bo_delayed_delete oops(CVE-2025-37765)

    dmaengine: idxd: fix memory leak in error handling path of idxd_alloc(CVE-2025-38015)

    nvmet-tcp: don't restore null sk_state_change(CVE-2025-38035)

    serial: mctrl_gpio: split disable_ms into sync and no_sync APIs(CVE-2025-38040)

    crypto: algif_hash - fix double free in hash_accept(CVE-2025-38079)

    HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()(CVE-2025-38103)

    net: Fix TOCTOU issue in sk_is_readable()(CVE-2025-38112)

    page_pool: Fix use-after-free in page_pool_recycle_in_ring(CVE-2025-38129)

    net: openvswitch: Fix the dead loop of MPLS parse(CVE-2025-38146)

    calipso: Don't call calipso functions for AF_INET sk.(CVE-2025-38147)

    thunderbolt: Do not double dequeue a configuration request(CVE-2025-38174)

    calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().(CVE-2025-38181)

    mm: fix uprobe pte be overwritten when expanding vma(CVE-2025-38207)

    ipc: fix to protect IPCS lookups using RCU(CVE-2025-38212)

    nvme-tcp: sanitize request list handling(CVE-2025-38264)

    fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()(CVE-2025-38312)

    scsi: lpfc: Use memcpy() for BIOS version(CVE-2025-38332)

    x86/sgx: Prevent attempts to reclaim poisoned pages(CVE-2025-38334)

    NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN(CVE-2025-38393)

    perf: Fix sample vs do_exit()(CVE-2025-38424)

    netlink: Fix wraparounds of sk-sk_rmem_alloc.(CVE-2025-38465)

    clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns(CVE-2025-38499)

    drm/sched: Increment job count before swapping tail spsc queue(CVE-2025-38515)

    pinctrl: qcom: msm: mark certain pins as invalid for interrupts(CVE-2025-38516)

    tracing: Add down_write(trace_event_sem) when adding trace event(CVE-2025-38539)

    HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras(CVE-2025-38540)

    net/sched: Restrict conditions for adding duplicating netems to qdisc tree(CVE-2025-38553)

    perf/core: Prevent VMA split of buffer mappings(CVE-2025-38563)

    perf/core: Exit early on perf_mmap() fail(CVE-2025-38565)

    pptp: ensure minimal skb length in pptp_xmit()(CVE-2025-38574)

    padata: Fix pd UAF once and for all(CVE-2025-38584)

    net: drop UFO packets in udp_rcv_segment()(CVE-2025-38622)

    pinmux: fix race causing mux_owner NULL with active mux_usecount(CVE-2025-38632)

    clk: davinci: Add NULL check in davinci_lpsc_clk_register()(CVE-2025-38635)

    regulator: core: fix NULL dereference on unbind due to stale coupling data(CVE-2025-38668)

    i2c: qup: jump out of the loop in case of timeout(CVE-2025-38671)

    media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()(CVE-2025-38680)

    fbdev: Fix vmalloc out-of-bounds write in fast_imageblit(CVE-2025-38685)

    media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and     w7090p_tuner_read_serpar(CVE-2025-38693)

    scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure(CVE-2025-38695)

    ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr(CVE-2025-38701)

    gfs2: Validate i_depth for exhash directories(CVE-2025-38710)

    x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper(CVE-2025-39681)

    tracing: Limit access to parser-buffer when trace_get_user failed(CVE-2025-39683)

    ftrace: Also allocate and copy hash for reading of filter files(CVE-2025-39689)

    fs/buffer: fix use-after-free when call bh_read() helper(CVE-2025-39691)

    RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()(CVE-2025-39742)

    rcu: Fix rcu_read_unlock() deadloop due to IRQ work(CVE-2025-39744)

    rcu: Protect -defer_qs_iw_pending from data race(CVE-2025-39749)

    usb: core: config: Prevent OOB read in SS endpoint companion parsing(CVE-2025-39760)

    jbd2: prevent softlockup in jbd2_log_do_checkpoint()(CVE-2025-39782)

    ftrace: Fix potential warning in trace_printk_seq during ftrace_dump(CVE-2025-39813)

    trace/fgraph: Fix the warning caused by missing unregister notifier(CVE-2025-39829)

    tee: fix NULL pointer dereference in tee_shm_put(CVE-2025-39865)

    fs: writeback: fix use-after-free in __mark_inode_dirty()(CVE-2025-39866)

    qed: Don't collect too many protection override GRC elements(CVE-2025-39949)

    cgroup: split cgroup_destroy_wq into 3 workqueues(CVE-2025-39953)

    i40e: fix idx validation in config queues msg(CVE-2025-39971)

    i40e: add validation for ring_len param(CVE-2025-39973)

    media: rc: fix races with imon_disconnect()(CVE-2025-39993)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03615-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
    - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
    - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
    - CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
    - CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
    - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
    - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
    - CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
    - CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
    - CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree     (bsc#1248255).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
    - CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
    - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
    - CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
    - CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
    - CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED Shifting signed 32-bit value     by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below:
    UBSAN: shift-out-of-bounds in ./include/drm/ttm/ttm_tt.h:122:26 left shift of 1 by 31 places cannot be     represented in type 'int' Call Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b     ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c ttm_bo_move_memcpy+0x3b4/0x460     [ttm] bo_driver_move+0x32/0x40 [drm_vram_helper] ttm_bo_handle_move_mem+0x118/0x200 [ttm]     ttm_bo_validate+0xfa/0x220 [ttm] drm_gem_vram_pin_locked+0x70/0x1b0 [drm_vram_helper]     drm_gem_vram_pin+0x48/0xb0 [drm_vram_helper] drm_gem_vram_plane_helper_prepare_fb+0x53/0xe0     [drm_vram_helper] drm_gem_vram_simple_display_pipe_prepare_fb+0x26/0x30 [drm_vram_helper]     drm_simple_kms_plane_prepare_fb+0x4d/0xe0 [drm_kms_helper] drm_atomic_helper_prepare_planes+0xda/0x210     [drm_kms_helper] drm_atomic_helper_commit+0xc3/0x1e0 [drm_kms_helper] drm_atomic_commit+0x9c/0x160 [drm]     drm_client_modeset_commit_atomic+0x33a/0x380 [drm] drm_client_modeset_commit_locked+0x77/0x220 [drm]     drm_client_modeset_commit+0x31/0x60 [drm] __drm_fb_helper_restore_fbdev_mode_unlocked+0xa7/0x170     [drm_kms_helper] drm_fb_helper_set_par+0x51/0x90 [drm_kms_helper] fbcon_init+0x316/0x790     visual_init+0x113/0x1d0 do_bind_con_driver+0x2a3/0x5c0 do_take_over_console+0xa9/0x270     do_fbcon_takeover+0xa1/0x170 do_fb_registered+0x2a8/0x340 fbcon_fb_registered+0x47/0xe0     register_framebuffer+0x294/0x4a0 __drm_fb_helper_initial_config_and_unlock+0x43c/0x880 [drm_kms_helper]     drm_fb_helper_initial_config+0x52/0x80 [drm_kms_helper] drm_fbdev_client_hotplug+0x156/0x1b0     [drm_kms_helper] drm_fbdev_generic_setup+0xfc/0x290 [drm_kms_helper] bochs_pci_probe+0x6ca/0x772 [bochs]     local_pci_probe+0x4d/0xb0 pci_device_probe+0x119/0x320 really_probe+0x181/0x550
    __driver_probe_device+0xc6/0x220 driver_probe_device+0x32/0x100 __driver_attach+0x195/0x200     bus_for_each_dev+0xbb/0x120 driver_attach+0x27/0x30 bus_add_driver+0x22e/0x2f0 driver_register+0xa9/0x190
    __pci_register_driver+0x90/0xa0 bochs_pci_driver_init+0x52/0x1000 [bochs] do_one_initcall+0x76/0x430     do_init_module+0x61/0x28a load_module+0x1f82/0x2e50 __do_sys_finit_module+0xf8/0x190
    __x64_sys_finit_module+0x23/0x30 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK>     (CVE-2022-50390)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
278484	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-2501)	Nessus	Huawei Local Security Checks	high
278477	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2025-2483)	Nessus	Huawei Local Security Checks	high
278473	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-2522)	Nessus	Huawei Local Security Checks	high
278438	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2025-2464)	Nessus	Huawei Local Security Checks	high
270837	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:03615-1)	Nessus	SuSE Local Security Checks	high
265540	Linux Distros Unpatched Vulnerability : CVE-2022-50390	Nessus	Misc.	high

Detections

Analytics

CVE-2022-50390

medium

Tenable Plugins

high

high

high

high

high

high