In the Linux kernel, the following vulnerability has been resolved: iomap: iomap: fix memory corruption when recording errors during writeback Every now and then I see this crash on arm64: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000f8 Buffer I/O error on dev dm-0, logical block 8733687, async page read Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 64k pages, 42-bit VAs, pgdp=0000000139750000 [00000000000000f8] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000, pmd=0000000000000000 Internal error: Oops: 96000006 [#1] PREEMPT SMP Buffer I/O error on dev dm-0, logical block 8733688, async page read Dumping ftrace buffer: Buffer I/O error on dev dm-0, logical block 8733689, async page read (ftrace buffer empty) XFS (dm-0): log I/O error -5 Modules linked in: dm_thin_pool dm_persistent_data XFS (dm-0): Metadata I/O Error (0x1) detected at xfs_trans_read_buf_map+0x1ec/0x590 [xfs] (fs/xfs/xfs_trans_buf.c:296). dm_bio_prison XFS (dm-0): Please unmount the filesystem and rectify the problem(s) XFS (dm-0): xfs_imap_lookup: xfs_ialloc_read_agi() returned error -5, agno 0 dm_bufio dm_log_writes xfs nft_chain_nat xt_REDIRECT nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_REJECT potentially unexpected fatal signal 6. nf_reject_ipv6 potentially unexpected fatal signal 6. ipt_REJECT nf_reject_ipv4 CPU: 1 PID: 122166 Comm: fsstress Tainted: G W 6.0.0-rc5-djwa #rc5 3004c9f1de887ebae86015f2677638ce51ee7 rpcsec_gss_krb5 auth_rpcgss xt_tcpudp ip_set_hash_ip ip_set_hash_net xt_set nft_compat ip_set_hash_mac ip_set nf_tables Hardware name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021 pstate: 60001000 (nZCv daif -PAN -UAO -TCO -DIT +SSBS BTYPE=--) ip_tables pc : 000003fd6d7df200 x_tables lr : 000003fd6d7df1ec overlay nfsv4 CPU: 0 PID: 54031 Comm: u4:3 Tainted: G W 6.0.0-rc5-djwa #rc5 3004c9f1de887ebae86015f2677638ce51ee7405 Hardware name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021 Workqueue: writeback wb_workfn sp : 000003ffd9522fd0 (flush-253:0) pstate: 60401005 (nZCv daif +PAN -UAO -TCO -DIT +SSBS BTYPE=--) pc : errseq_set+0x1c/0x100 x29: 000003ffd9522fd0 x28: 0000000000000023 x27: 000002acefeb6780 x26: 0000000000000005 x25: 0000000000000001 x24: 0000000000000000 x23: 00000000ffffffff x22: 0000000000000005 lr : __filemap_set_wb_err+0x24/0xe0 x21: 0000000000000006 sp : fffffe000f80f760 x29: fffffe000f80f760 x28: 0000000000000003 x27: fffffe000f80f9f8 x26: 0000000002523000 x25: 00000000fffffffb x24: fffffe000f80f868 x23: fffffe000f80fbb0 x22: fffffc0180c26a78 x21: 0000000002530000 x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000001 x13: 0000000000470af3 x12: fffffc0058f70000 x11: 0000000000000040 x10: 0000000000001b20 x9 : fffffe000836b288 x8 : fffffc00eb9fd480 x7 : 0000000000f83659 x6 : 0000000000000000 x5 : 0000000000000869 x4 : 0000000000000005 x3 : 00000000000000f8 x20: 000003fd6d740020 x19: 000000000001dd36 x18: 0000000000000001 x17: 000003fd6d78704c x16: 0000000000000001 x15: 000002acfac87668 x2 : 0000000000000ffa x1 : 00000000fffffffb x0 : 00000000000000f8 Call trace: errseq_set+0x1c/0x100 __filemap_set_wb_err+0x24/0xe0 iomap_do_writepage+0x5e4/0xd5c write_cache_pages+0x208/0x674 iomap_writepages+0x34/0x60 xfs_vm_writepages+0x8c/0xcc [xfs 7a861f39c43631f15d3a5884246ba5035d4ca78b] x14: 0000000000000000 x13: 2064656e72757465 x12: 0000000000002180 x11: 000003fd6d8a82d0 x10: 0000000000000000 x9 : 000003fd6d8ae288 x8 : 0000000000000083 x7 : 00000000ffffffff x6 : 00000000ffffffee x5 : 00000000fbad2887 x4 : 000003fd6d9abb58 x3 : 000003fd6d740020 x2 : 0000000000000006 x1 : 000000000001dd36 x0 : 0000000000000000 CPU: ---truncated---

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1771078945 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: pid: take a reference when     initializing `cad_pid` During boot, kernel_init_freeable() initializes `cad_pid` to the init task's struct     pid. Later on, we may change `cad_pid` via a sysctl, and when this happens proc_do_cad_pid() will     increment the refcount on the new pid via get_pid(), and will decrement the refcount on the old pid via     put_pid(). As we never called get_pid() when we initialized `cad_pid`, we decrement a reference we never     incremented, can therefore free the init task's struct pid early. As there can be dangling references to     the struct pid, we can later encounter a use-after-free (e.g. when delivering signals). This was spotted     when fuzzing v5.13-rc3 with Syzkaller, but seems to have been around since the conversion of `cad_pid` to     struct pid in commit 9ec52099e4b8 ([PATCH] replace cad_pid by a struct pid) from the pre-KASAN stone age     of v2.6.19. Fix this by getting a reference to the init task's struct pid when we assign it to `cad_pid`.
    Full KASAN splat below. ================================================================== BUG: KASAN:
    use-after-free in ns_of_pid include/linux/pid.h:153 [inline] BUG: KASAN: use-after-free in     task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 Read of size 4 at addr ffff23794dda0004 by task syz-     executor.0/273 CPU: 1 PID: 273 Comm: syz-executor.0 Not tainted 5.12.0-00001-g9aef892b2d15 #1 Hardware     name: linux,dummy-virt (DT) Call trace: ns_of_pid include/linux/pid.h:153 [inline]     task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 do_notify_parent+0x308/0xe60 kernel/signal.c:1950     exit_notify kernel/exit.c:682 [inline] do_exit+0x2334/0x2bd0 kernel/exit.c:845 do_group_exit+0x108/0x2c8     kernel/exit.c:922 get_signal+0x4e4/0x2a88 kernel/signal.c:2781 do_signal arch/arm64/kernel/signal.c:882     [inline] do_notify_resume+0x300/0x970 arch/arm64/kernel/signal.c:936 work_pending+0xc/0x2dc Allocated by     task 0: slab_post_alloc_hook+0x50/0x5c0 mm/slab.h:516 slab_alloc_node mm/slub.c:2907 [inline] slab_alloc     mm/slub.c:2915 [inline] kmem_cache_alloc+0x1f4/0x4c0 mm/slub.c:2920 alloc_pid+0xdc/0xc00 kernel/pid.c:180     copy_process+0x2794/0x5e18 kernel/fork.c:2129 kernel_clone+0x194/0x13c8 kernel/fork.c:2500     kernel_thread+0xd4/0x110 kernel/fork.c:2552 rest_init+0x44/0x4a0 init/main.c:687     arch_call_rest_init+0x1c/0x28 start_kernel+0x520/0x554 init/main.c:1064 0x0 Freed by task 270:
    slab_free_hook mm/slub.c:1562 [inline] slab_free_freelist_hook+0x98/0x260 mm/slub.c:1600 slab_free     mm/slub.c:3161 [inline] kmem_cache_free+0x224/0x8e0 mm/slub.c:3177 put_pid.part.4+0xe0/0x1a8     kernel/pid.c:114 put_pid+0x30/0x48 kernel/pid.c:109 proc_do_cad_pid+0x190/0x1b0 kernel/sysctl.c:1401     proc_sys_call_handler+0x338/0x4b0 fs/proc/proc_sysctl.c:591 proc_sys_write+0x34/0x48     fs/proc/proc_sysctl.c:617 call_write_iter include/linux/fs.h:1977 [inline] new_sync_write+0x3ac/0x510     fs/read_write.c:518 vfs_write fs/read_write.c:605 [inline] vfs_write+0x9c4/0x1018 fs/read_write.c:585     ksys_write+0x124/0x240 fs/read_write.c:658 __do_sys_write fs/read_write.c:670 [inline] __se_sys_write     fs/read_write.c:667 [inline] __arm64_sys_write+0x78/0xb0 fs/read_write.c:667 __invoke_syscall     arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall arch/arm64/kernel/syscall.c:49 [inline]     el0_svc_common.constprop.1+0x16c/0x388 arch/arm64/kernel/syscall.c:129 do_el0_svc+0xf8/0x150     arch/arm64/kernel/syscall.c:168 el0_svc+0x28/0x38 arch/arm64/kernel/entry-common.c:416     el0_sync_handler+0x134/0x180 arch/arm64/kernel/entry-common.c:432 el0_sync+0x154/0x180     arch/arm64/kernel/entry.S:701 The buggy address belongs to the object at ffff23794dda0000 which belongs to     the cache pid of size 224 The buggy address is located 4 bytes inside of 224-byte region [ff
    ---truncated--- (CVE-2021-47118)

  - In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Don't generate an interrupt     on bus reset Now that the i2c-i801 driver supports interrupts, setting the KILL bit in a attempt to     recover from a timed out transaction triggers an interrupt. Unfortunately, the interrupt handler     (i801_isr) is not prepared for this situation and will try to process the interrupt as if it was signaling     the end of a successful transaction. In the case of a block transaction, this can result in an out-of-     range memory access. This condition was reproduced several times by syzbot:
    https://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e     https://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e     https://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e     https://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb     https://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a     https://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79 So disable interrupts while trying to reset     the bus. Interrupts will be enabled again for the following transaction. (CVE-2021-47153)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITE_SAME No Data     Buffer crash In newer version of the SBC specs, we have a NDOB bit that indicates there is no data buffer     that gets written out. If this bit is set using commands like sg_write_same --ndob we will crash in     target_core_iblock/file's execute_write_same handlers when we go to access the se_cmd->t_data_sg because     its NULL. This patch adds a check for the NDOB bit in the common WRITE SAME code because we don't support     it. And, it adds a check for zero SG elements in each handler in case the initiator tries to send a normal     WRITE SAME with no data buffer. (CVE-2022-21546)

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: IPoIB, Block PKEY     interfaces with less rx queues than parent A user is able to configure an arbitrary number of rx queues     when creating an interface via netlink. This doesn't work for child PKEY interfaces because the child     interface uses the parent receive channels. Although the child shares the parent's receive channels, the     number of rx queues is important for the channel_stats array: the parent's rx channel index is used to     access the child's channel_stats. So the array has to be at least as large as the parent's rx queue size     for the counting to work correctly and to prevent out of bound accesses. This patch checks for the     mentioned scenario and returns an error when trying to create the interface. The error is propagated to     the user. (CVE-2022-48883)

  - In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix potential out of bounds     access with invalid rxstatus->rs_keyix The rxstatus->rs_keyix eventually gets passed to test_bit() so we     need to ensure that it is within the bitmap. drivers/net/wireless/ath/ath9k/common.c:46     ath9k_cmn_rx_accept() error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()' (CVE-2022-49503)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1771077729 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: pid: take a reference when     initializing `cad_pid` During boot, kernel_init_freeable() initializes `cad_pid` to the init task's struct     pid. Later on, we may change `cad_pid` via a sysctl, and when this happens proc_do_cad_pid() will     increment the refcount on the new pid via get_pid(), and will decrement the refcount on the old pid via     put_pid(). As we never called get_pid() when we initialized `cad_pid`, we decrement a reference we never     incremented, can therefore free the init task's struct pid early. As there can be dangling references to     the struct pid, we can later encounter a use-after-free (e.g. when delivering signals). This was spotted     when fuzzing v5.13-rc3 with Syzkaller, but seems to have been around since the conversion of `cad_pid` to     struct pid in commit 9ec52099e4b8 ([PATCH] replace cad_pid by a struct pid) from the pre-KASAN stone age     of v2.6.19. Fix this by getting a reference to the init task's struct pid when we assign it to `cad_pid`.
    Full KASAN splat below. ================================================================== BUG: KASAN:
    use-after-free in ns_of_pid include/linux/pid.h:153 [inline] BUG: KASAN: use-after-free in     task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 Read of size 4 at addr ffff23794dda0004 by task syz-     executor.0/273 CPU: 1 PID: 273 Comm: syz-executor.0 Not tainted 5.12.0-00001-g9aef892b2d15 #1 Hardware     name: linux,dummy-virt (DT) Call trace: ns_of_pid include/linux/pid.h:153 [inline]     task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 do_notify_parent+0x308/0xe60 kernel/signal.c:1950     exit_notify kernel/exit.c:682 [inline] do_exit+0x2334/0x2bd0 kernel/exit.c:845 do_group_exit+0x108/0x2c8     kernel/exit.c:922 get_signal+0x4e4/0x2a88 kernel/signal.c:2781 do_signal arch/arm64/kernel/signal.c:882     [inline] do_notify_resume+0x300/0x970 arch/arm64/kernel/signal.c:936 work_pending+0xc/0x2dc Allocated by     task 0: slab_post_alloc_hook+0x50/0x5c0 mm/slab.h:516 slab_alloc_node mm/slub.c:2907 [inline] slab_alloc     mm/slub.c:2915 [inline] kmem_cache_alloc+0x1f4/0x4c0 mm/slub.c:2920 alloc_pid+0xdc/0xc00 kernel/pid.c:180     copy_process+0x2794/0x5e18 kernel/fork.c:2129 kernel_clone+0x194/0x13c8 kernel/fork.c:2500     kernel_thread+0xd4/0x110 kernel/fork.c:2552 rest_init+0x44/0x4a0 init/main.c:687     arch_call_rest_init+0x1c/0x28 start_kernel+0x520/0x554 init/main.c:1064 0x0 Freed by task 270:
    slab_free_hook mm/slub.c:1562 [inline] slab_free_freelist_hook+0x98/0x260 mm/slub.c:1600 slab_free     mm/slub.c:3161 [inline] kmem_cache_free+0x224/0x8e0 mm/slub.c:3177 put_pid.part.4+0xe0/0x1a8     kernel/pid.c:114 put_pid+0x30/0x48 kernel/pid.c:109 proc_do_cad_pid+0x190/0x1b0 kernel/sysctl.c:1401     proc_sys_call_handler+0x338/0x4b0 fs/proc/proc_sysctl.c:591 proc_sys_write+0x34/0x48     fs/proc/proc_sysctl.c:617 call_write_iter include/linux/fs.h:1977 [inline] new_sync_write+0x3ac/0x510     fs/read_write.c:518 vfs_write fs/read_write.c:605 [inline] vfs_write+0x9c4/0x1018 fs/read_write.c:585     ksys_write+0x124/0x240 fs/read_write.c:658 __do_sys_write fs/read_write.c:670 [inline] __se_sys_write     fs/read_write.c:667 [inline] __arm64_sys_write+0x78/0xb0 fs/read_write.c:667 __invoke_syscall     arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall arch/arm64/kernel/syscall.c:49 [inline]     el0_svc_common.constprop.1+0x16c/0x388 arch/arm64/kernel/syscall.c:129 do_el0_svc+0xf8/0x150     arch/arm64/kernel/syscall.c:168 el0_svc+0x28/0x38 arch/arm64/kernel/entry-common.c:416     el0_sync_handler+0x134/0x180 arch/arm64/kernel/entry-common.c:432 el0_sync+0x154/0x180     arch/arm64/kernel/entry.S:701 The buggy address belongs to the object at ffff23794dda0000 which belongs to     the cache pid of size 224 The buggy address is located 4 bytes inside of 224-byte region [ff
    ---truncated--- (CVE-2021-47118)

  - In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Don't generate an interrupt     on bus reset Now that the i2c-i801 driver supports interrupts, setting the KILL bit in a attempt to     recover from a timed out transaction triggers an interrupt. Unfortunately, the interrupt handler     (i801_isr) is not prepared for this situation and will try to process the interrupt as if it was signaling     the end of a successful transaction. In the case of a block transaction, this can result in an out-of-     range memory access. This condition was reproduced several times by syzbot:
    https://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e     https://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e     https://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e     https://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb     https://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a     https://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79 So disable interrupts while trying to reset     the bus. Interrupts will be enabled again for the following transaction. (CVE-2021-47153)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITE_SAME No Data     Buffer crash In newer version of the SBC specs, we have a NDOB bit that indicates there is no data buffer     that gets written out. If this bit is set using commands like sg_write_same --ndob we will crash in     target_core_iblock/file's execute_write_same handlers when we go to access the se_cmd->t_data_sg because     its NULL. This patch adds a check for the NDOB bit in the common WRITE SAME code because we don't support     it. And, it adds a check for zero SG elements in each handler in case the initiator tries to send a normal     WRITE SAME with no data buffer. (CVE-2022-21546)

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: IPoIB, Block PKEY     interfaces with less rx queues than parent A user is able to configure an arbitrary number of rx queues     when creating an interface via netlink. This doesn't work for child PKEY interfaces because the child     interface uses the parent receive channels. Although the child shares the parent's receive channels, the     number of rx queues is important for the channel_stats array: the parent's rx channel index is used to     access the child's channel_stats. So the array has to be at least as large as the parent's rx queue size     for the counting to work correctly and to prevent out of bound accesses. This patch checks for the     mentioned scenario and returns an error when trying to create the interface. The error is propagated to     the user. (CVE-2022-48883)

  - In the Linux kernel, the following vulnerability has been resolved: be2net: Fix buffer overflow in     be_get_module_eeprom be_cmd_read_port_transceiver_data assumes that it is given a buffer that is at least     PAGE_DATA_LEN long, or twice that if the module supports SFF 8472. However, this is not always the case.
    Fix this by passing the desired offset and length to be_cmd_read_port_transceiver_data so that we only     copy the bytes once. (CVE-2022-49581)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1770040438 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: cifs: fix oops during encryption When     running xfstests against Azure the following oops occurred on an arm64 system Unable to handle kernel     write to read-only memory at virtual address ffff0001221cf000 Mem abort info: ESR = 0x9600004f EC = 0x25:
    DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x0f: level 3 permission fault     Data abort info: ISV = 0, ISS = 0x0000004f CM = 0, WnR = 1 swapper pgtable: 4k pages, 48-bit VAs,     pgdp=00000000294f3000 [ffff0001221cf000] pgd=18000001ffff8003, p4d=18000001ffff8003, pud=18000001ff82e003,     pmd=18000001ff71d003, pte=00600001221cf787 Internal error: Oops: 9600004f [#1] PREEMPT SMP ... pstate:
    80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--) pc : __memcpy+0x40/0x230 lr :
    scatterwalk_copychunks+0xe0/0x200 sp : ffff800014e92de0 x29: ffff800014e92de0 x28: ffff000114f9de80 x27:
    0000000000000008 x26: 0000000000000008 x25: ffff800014e92e78 x24: 0000000000000008 x23: 0000000000000001     x22: 0000040000000000 x21: ffff000000000000 x20: 0000000000000001 x19: ffff0001037c4488 x18:
    0000000000000014 x17: 235e1c0d6efa9661 x16: a435f9576b6edd6c x15: 0000000000000058 x14: 0000000000000001     x13: 0000000000000008 x12: ffff000114f2e590 x11: ffffffffffffffff x10: 0000040000000000 x9 :
    ffff8000105c3580 x8 : 2e9413b10000001a x7 : 534b4410fb86b005 x6 : 534b4410fb86b005 x5 : ffff0001221cf008     x4 : ffff0001037c4490 x3 : 0000000000000001 x2 : 0000000000000008 x1 : ffff0001037c4488 x0 :
    ffff0001221cf000 Call trace: __memcpy+0x40/0x230 scatterwalk_map_and_copy+0x98/0x100     crypto_ccm_encrypt+0x150/0x180 crypto_aead_encrypt+0x2c/0x40 crypt_message+0x750/0x880     smb3_init_transform_rq+0x298/0x340 smb_send_rqst.part.11+0xd8/0x180 smb_send_rqst+0x3c/0x100     compound_send_recv+0x534/0xbc0 smb2_query_info_compound+0x32c/0x440 smb2_set_ea+0x438/0x4c0     cifs_xattr_set+0x5d4/0x7c0 This is because in scatterwalk_copychunks(), we attempted to write to a buffer     (@sign) that was allocated in the stack (vmalloc area) by crypt_message() and thus accessing its remaining     8 (x2) bytes ended up crossing a page boundary. To simply fix it, we could just pass @sign kmalloc'd from     crypt_message() and then we're done. Luckily, we don't seem to pass any other vmalloc'd buffers in     smb_rqst::rq_iov... Instead, let's map the correct pages and offsets from vmalloc buffers as well in     cifs_sg_set_buf() and then avoiding such oopses. (CVE-2022-50341)

  - In the Linux kernel, the following vulnerability has been resolved: iomap: iomap: fix memory corruption     when recording errors during writeback Every now and then I see this crash on arm64: Unable to handle     kernel NULL pointer dereference at virtual address 00000000000000f8 Buffer I/O error on dev dm-0, logical     block 8733687, async page read Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL =     32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0,     ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 64k pages, 42-bit VAs, pgdp=0000000139750000     [00000000000000f8] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000, pmd=0000000000000000     Internal error: Oops: 96000006 [#1] PREEMPT SMP Buffer I/O error on dev dm-0, logical block 8733688, async     page read Dumping ftrace buffer: Buffer I/O error on dev dm-0, logical block 8733689, async page read     (ftrace buffer empty) XFS (dm-0): log I/O error -5 Modules linked in: dm_thin_pool dm_persistent_data XFS     (dm-0): Metadata I/O Error (0x1) detected at xfs_trans_read_buf_map+0x1ec/0x590 [xfs]     (fs/xfs/xfs_trans_buf.c:296). dm_bio_prison XFS (dm-0): Please unmount the filesystem and rectify the     problem(s) XFS (dm-0): xfs_imap_lookup: xfs_ialloc_read_agi() returned error -5, agno 0 dm_bufio     dm_log_writes xfs nft_chain_nat xt_REDIRECT nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_REJECT     potentially unexpected fatal signal 6. nf_reject_ipv6 potentially unexpected fatal signal 6. ipt_REJECT     nf_reject_ipv4 CPU: 1 PID: 122166 Comm: fsstress Tainted: G W 6.0.0-rc5-djwa #rc5     3004c9f1de887ebae86015f2677638ce51ee7 rpcsec_gss_krb5 auth_rpcgss xt_tcpudp ip_set_hash_ip ip_set_hash_net     xt_set nft_compat ip_set_hash_mac ip_set nf_tables Hardware name: QEMU KVM Virtual Machine, BIOS 1.5.1     06/16/2021 pstate: 60001000 (nZCv daif -PAN -UAO -TCO -DIT +SSBS BTYPE=--) ip_tables pc : 000003fd6d7df200     x_tables lr : 000003fd6d7df1ec overlay nfsv4 CPU: 0 PID: 54031 Comm: u4:3 Tainted: G W 6.0.0-rc5-djwa #rc5     3004c9f1de887ebae86015f2677638ce51ee7405 Hardware name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021     Workqueue: writeback wb_workfn sp : 000003ffd9522fd0 (flush-253:0) pstate: 60401005 (nZCv daif +PAN -UAO
    -TCO -DIT +SSBS BTYPE=--) pc : errseq_set+0x1c/0x100 x29: 000003ffd9522fd0 x28: 0000000000000023 x27:
    000002acefeb6780 x26: 0000000000000005 x25: 0000000000000001 x24: 0000000000000000 x23: 00000000ffffffff     x22: 0000000000000005 lr : __filemap_set_wb_err+0x24/0xe0 x21: 0000000000000006 sp : fffffe000f80f760 x29:
    fffffe000f80f760 x28: 0000000000000003 x27: fffffe000f80f9f8 x26: 0000000002523000 x25: 00000000fffffffb     x24: fffffe000f80f868 x23: fffffe000f80fbb0 x22: fffffc0180c26a78 x21: 0000000002530000 x20:
    0000000000000000 x19: 0000000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000     x15: 0000000000000000 x14: 0000000000000001 x13: 0000000000470af3 x12: fffffc0058f70000 x11:
    0000000000000040 x10: 0000000000001b20 x9 : fffffe000836b288 x8 : fffffc00eb9fd480 x7 : 0000000000f83659     x6 : 0000000000000000 x5 : 0000000000000869 x4 : 0000000000000005 x3 : 00000000000000f8 x20:
    000003fd6d740020 x19: 000000000001dd36 x18: 0000000000000001 x17: 000003fd6d78704c x16: 0000000000000001     x15: 000002acfac87668 x2 : 0000000000000ffa x1 : 00000000fffffffb x0 : 00000000000000f8 Call trace:
    errseq_set+0x1c/0x100 __filemap_set_wb_err+0x24/0xe0 iomap_do_writepage+0x5e4/0xd5c     write_cache_pages+0x208/0x674 iomap_writepages+0x34/0x60 xfs_vm_writepages+0x8c/0xcc [xfs     7a861f39c43631f15d3a5884246ba5035d4ca78b] x14: 0000000000000000 x13: 2064656e72757465 x12:
    0000000000002180 x11: 000003fd6d8a82d0 x10: 0000000000000000 x9 : 000003fd6d8ae288 x8 : 0000000000000083     x7 : 00000000ffffffff x6 : 00000000ffffffee x5 : 00000000fbad2887 x4 : 000003fd6d9abb58 x3 :
    000003fd6d740020 x2 : 0000000000000006 x1 : 000000000001dd36 x0 : 0000000000000000 CPU: ---truncated---     (CVE-2022-50406)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sysfs: Fix attempting     to call device_add multiple times device_add shall not be called multiple times as stated in its     documentation: 'Do not call this routine or device_register() more than once for any device structure'     Syzkaller reports a bug as follows [1]: ------------[ cut here ]------------ kernel BUG at     lib/list_debug.c:33! invalid opcode: 0000 [#1] PREEMPT SMP KASAN [...] Call Trace: <TASK> __list_add     include/linux/list.h:69 [inline] list_add_tail include/linux/list.h:102 [inline] kobj_kset_join     lib/kobject.c:164 [inline] kobject_add_internal+0x18f/0x8f0 lib/kobject.c:214 kobject_add_varg     lib/kobject.c:358 [inline] kobject_add+0x150/0x1c0 lib/kobject.c:410 device_add+0x368/0x1e90     drivers/base/core.c:3452 hci_conn_add_sysfs+0x9b/0x1b0 net/bluetooth/hci_sysfs.c:53     hci_le_cis_estabilished_evt+0x57c/0xae0 net/bluetooth/hci_event.c:6799 hci_le_meta_evt+0x2b8/0x510     net/bluetooth/hci_event.c:7110 hci_event_func net/bluetooth/hci_event.c:7440 [inline]     hci_event_packet+0x63d/0xfd0 net/bluetooth/hci_event.c:7495 hci_rx_work+0xae7/0x1230     net/bluetooth/hci_core.c:4007 process_one_work+0x991/0x1610 kernel/workqueue.c:2289     worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e4/0x3a0 kernel/kthread.c:376     ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK> (CVE-2022-50419)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix use-after-free bug     in smp_execute_task_sg() When executing SMP task failed, the smp_execute_task_sg() calls del_timer() to     delete slow_task->timer. However, if the timer handler sas_task_internal_timedout() is running, the     del_timer() in smp_execute_task_sg() will not stop it and a UAF will happen. The process is shown below:
    (thread 1) | (thread 2) smp_execute_task_sg() | sas_task_internal_timedout() ... | del_timer() | ... | ...
    sas_free_task(task) | kfree(task->slow_task) //FREE| | task->slow_task->... //USE Fix by calling     del_timer_sync() in smp_execute_task_sg(), which makes sure the timer handler have finished before the     task->slow_task is deallocated. (CVE-2022-50422)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix use-after-free KFENCE     violation during sysfs firmware write During the sysfs firmware write process, a use-after-free read     warning is logged from the lpfc_wr_object() routine: BUG: KFENCE: use-after-free read in     lpfc_wr_object+0x235/0x310 [lpfc] Use-after-free read at 0x0000000000cf164d (in kfence-#111):
    lpfc_wr_object+0x235/0x310 [lpfc] lpfc_write_firmware.cold+0x206/0x30d [lpfc]     lpfc_sli4_request_firmware_update+0xa6/0x100 [lpfc] lpfc_request_firmware_upgrade_store+0x66/0xb0 [lpfc]     kernfs_fop_write_iter+0x121/0x1b0 new_sync_write+0x11c/0x1b0 vfs_write+0x1ef/0x280 ksys_write+0x5f/0xe0     do_syscall_64+0x59/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd The driver accessed wr_object pointer     data, which was initialized into mailbox payload memory, after the mailbox object was released back to the     mailbox pool. Fix by moving the mailbox free calls to the end of the routine ensuring that we don't     reference internal mailbox memory after release. (CVE-2023-53282)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786350974 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: isofs: Fix out of bound access for     corrupted isofs image When isofs image is suitably corrupted isofs_read_inode() can read data beyond the     end of buffer. Sanity-check the directory entry length before using it. (CVE-2021-47478)

  - In the Linux kernel, the following vulnerability has been resolved: ubi: Fix race condition between     ctrl_cdev_ioctl and ubi_cdev_ioctl Hulk Robot reported a KASAN report about use-after-free:
    ================================================================== BUG: KASAN: use-after-free in
    __list_del_entry_valid+0x13d/0x160 Read of size 8 at addr ffff888035e37d98 by task ubiattach/1385 [...]     Call Trace: klist_dec_and_del+0xa7/0x4a0 klist_put+0xc7/0x1a0 device_del+0x4d4/0xed0     cdev_device_del+0x1a/0x80 ubi_attach_mtd_dev+0x2951/0x34b0 [ubi] ctrl_cdev_ioctl+0x286/0x2f0 [ubi]     Allocated by task 1414: device_add+0x60a/0x18b0 cdev_device_add+0x103/0x170     ubi_create_volume+0x1118/0x1a10 [ubi] ubi_cdev_ioctl+0xb7f/0x1ba0 [ubi] Freed by task 1385:
    cdev_device_del+0x1a/0x80 ubi_remove_volume+0x438/0x6c0 [ubi] ubi_cdev_ioctl+0xbf4/0x1ba0 [ubi] [...]     ================================================================== The lock held by ctrl_cdev_ioctl is     ubi_devices_mutex, but the lock held by ubi_cdev_ioctl is ubi->device_mutex. Therefore, the two locks can     be concurrent. ctrl_cdev_ioctl contains two operations: ubi_attach and ubi_detach. ubi_detach is bug-free     because it uses reference counting to prevent concurrency. However, uif_init and uif_close in ubi_attach     may race with ubi_cdev_ioctl. uif_init will race with ubi_cdev_ioctl as in the following stack. cpu1 cpu2     cpu3 _______________________|________________________|______________________ ctrl_cdev_ioctl     ubi_attach_mtd_dev uif_init ubi_cdev_ioctl ubi_create_volume cdev_device_add ubi_add_volume // sysfs exist     kill_volumes ubi_cdev_ioctl ubi_remove_volume cdev_device_del // first free ubi_free_volume cdev_del //     double free cdev_device_del And uif_close will race with ubi_cdev_ioctl as in the following stack. cpu1     cpu2 cpu3 _______________________|________________________|______________________ ctrl_cdev_ioctl     ubi_attach_mtd_dev uif_init ubi_cdev_ioctl ubi_create_volume cdev_device_add ubi_debugfs_init_dev //error     goto out_uif; uif_close kill_volumes ubi_cdev_ioctl ubi_remove_volume cdev_device_del // first free     ubi_free_volume // double free The cause of this problem is that commit 714fb87e8bc0 make device     available before it becomes accessible via sysfs. Therefore, we roll back the modification. We will fix     the race condition between ubi device creation and udev by removing ubi_get_device in vol_attribute_show     and dev_attribute_show.This avoids accessing uninitialized ubi_devices[ubi_num]. ubi_get_device is used to     prevent devices from being deleted during sysfs execution. However, now kernfs ensures that devices will     not be deleted before all reference counting are released. The key process is shown in the following     stack. device_del device_remove_attrs device_remove_groups sysfs_remove_groups sysfs_remove_group     remove_files kernfs_remove_by_name kernfs_remove_by_name_ns __kernfs_remove kernfs_drain (CVE-2021-47634)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix memory leak in
    __qlt_24xx_handle_abts() Commit 8f394da36a36 (scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG) made     the __qlt_24xx_handle_abts() function return early if tcm_qla2xxx_find_cmd_by_tag() didn't find a command,     but it missed to clean up the allocated memory for the management command. (CVE-2022-48650)

  - In the Linux kernel, the following vulnerability has been resolved: ubi: ubi_create_volume: Fix use-after-     free when volume creation failed There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s     error handling path: ubi_eba_replace_table(vol, eba_tbl) vol->eba_tbl = tbl out_mapping:
    ubi_eba_destroy_table(eba_tbl) // Free 'eba_tbl' out_unlock: put_device(&vol->dev) vol_release     kfree(tbl->entries) // UAF Fix it by removing redundant 'eba_tbl' releasing. Fetch a reproducer in [Link].
    (CVE-2022-49388)

  - In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3: Fix error handling in     gic_populate_ppi_partitions of_get_child_by_name() returns a node pointer with refcount incremented, we     should use of_node_put() on it when not need anymore. When kcalloc fails, it missing of_node_put() and     results in refcount leak. Fix this by goto out_put_node label. (CVE-2022-49716)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23947 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ALSA: usb-audio: Validate UAC3 power domain descriptors, too (CVE-2025-38729)

    * kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757)

    * kernel: mm: fix zswap writeback race condition (CVE-2023-53178)

    * kernel: Bluetooth: L2CAP: fix bad unlock balance in l2cap_disconnect_rsp (CVE-2023-53297)

    * kernel: scsi: qla2xxx: Wait for io return on terminate rport (CVE-2023-53322)

    * kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367)

    * kernel: net: sched: sfb: fix null pointer access issue when sfb_init() fails (CVE-2022-50356)

    * kernel: ext4: fix undefined behavior in bit shift for ext4_check_flag_values (CVE-2022-50403)

    * kernel: NFSD: Protect against send buffer overflow in NFSv2 READ (CVE-2022-50410)

    * kernel: iomap: iomap: fix memory corruption when recording errors during writeback (CVE-2022-50406)

    * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23960 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: ALSA: usb-audio: Validate UAC3 power domain descriptors, too (CVE-2025-38729)

    * kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757)

    * kernel: mm: fix zswap writeback race condition (CVE-2023-53178)

    * kernel: Bluetooth: L2CAP: fix bad unlock balance in l2cap_disconnect_rsp (CVE-2023-53297)

    * kernel: scsi: qla2xxx: Wait for io return on terminate rport (CVE-2023-53322)

    * kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367)

    * kernel: net: sched: sfb: fix null pointer access issue when sfb_init() fails (CVE-2022-50356)

    * kernel: ext4: fix undefined behavior in bit shift for ext4_check_flag_values (CVE-2022-50403)

    * kernel: NFSD: Protect against send buffer overflow in NFSv2 READ (CVE-2022-50410)

    * kernel: iomap: iomap: fix memory corruption when recording errors during writeback (CVE-2022-50406)

    * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23463 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ethtool: check device is present when getting link settings (CVE-2024-46679)

    * kernel: ALSA: usb-audio: Validate UAC3 power domain descriptors, too (CVE-2025-38729)

    * kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

    * kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724)

    * kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757)

    * kernel: wifi: mwifiex: Fix OOB and integer underflow when rx packets (CVE-2023-53226)

    * kernel: Bluetooth: L2CAP: fix bad unlock balance in l2cap_disconnect_rsp (CVE-2023-53297)

    * kernel: scsi: qla2xxx: Wait for io return on terminate rport (CVE-2023-53322)

    * kernel: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (CVE-2023-53365)

    * kernel: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device (CVE-2023-53393)

    * kernel: iomap: iomap: fix memory corruption when recording errors during writeback (CVE-2022-50406)

    * kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path (CVE-2025-39841)

    * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955)

    * kernel: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request() (CVE-2025-40186)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23445 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ALSA: usb-audio: ALSA USB Audio Out-of-Bounds Bug (CVE-2022-48701)

    * kernel: ethtool: check device is present when getting link settings (CVE-2024-46679)

    * kernel: ALSA: usb-audio: Validate UAC3 power domain descriptors, too (CVE-2025-38729)

    * kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

    * kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724)

    * kernel: NFS: Fix a race when updating an existing write (CVE-2025-39697)

    * kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757)

    * kernel: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (CVE-2023-53213)

    * kernel: mm: fix zswap writeback race condition (CVE-2023-53178)

    * kernel: wifi: mwifiex: Fix OOB and integer underflow when rx packets (CVE-2023-53226)

    * kernel: Bluetooth: L2CAP: fix bad unlock balance in l2cap_disconnect_rsp (CVE-2023-53297)

    * kernel: smb: client: fix race with concurrent opens in rename(2) (CVE-2025-39825)

    * kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)

    * kernel: Bluetooth: L2CAP: Fix use-after-free (CVE-2023-53305)

    * kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367)

    * kernel: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (CVE-2023-53365)

    * kernel: net: sched: sfb: fix null pointer access issue when sfb_init() fails (CVE-2022-50356)

    * kernel: skbuff: skb_segment, Call zero copy functions before using skbuff frags (CVE-2023-53354)

    * kernel: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device (CVE-2023-53393)

    * kernel: crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)

    * kernel: Bluetooth: L2CAP: Fix user-after-free (CVE-2022-50386)

    * kernel: ext4: fix undefined behavior in bit shift for ext4_check_flag_values (CVE-2022-50403)

    * kernel: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (CVE-2022-50408)

    * kernel: NFSD: Protect against send buffer overflow in NFSv2 READ (CVE-2022-50410)

    * kernel: iomap: iomap: fix memory corruption when recording errors during writeback (CVE-2022-50406)

    * kernel: wifi: cfg80211: fix use-after-free in cmp_bss() (CVE-2025-39864)

    * kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path (CVE-2025-39841)

    * kernel: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CVE-2025-39883)

    * kernel: NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL (CVE-2023-53680)

    * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955)

    * kernel: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request() (CVE-2025-40186)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22998 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: NFS: Fix a race when updating an existing write (CVE-2025-39697)

    * kernel: wifi: mwifiex: Fix OOB and integer underflow when rx packets (CVE-2023-53226)

    * kernel: iomap: iomap: fix memory corruption when recording errors during writeback (CVE-2022-50406)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21128 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: eventpoll: Fix semi-unbounded recursion (CVE-2025-38614)

    * kernel: NFS: Fix a race when updating an existing write (CVE-2025-39697)

    * kernel: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (CVE-2023-53213)

    * kernel: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (CVE-2023-53185)

    * kernel: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data (CVE-2023-53232)

    * kernel: mm: fix zswap writeback race condition (CVE-2023-53178)

    * kernel: wifi: mwifiex: Fix OOB and integer underflow when rx packets (CVE-2023-53226)

    * kernel: Bluetooth: L2CAP: Fix use-after-free (CVE-2023-53305)

    * kernel: pstore/ram: Check start of empty przs during init (CVE-2023-53331)

    * kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367)

    * kernel: net: sched: sfb: fix null pointer access issue when sfb_init() fails (CVE-2022-50356)

    * kernel: crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)

    * kernel: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (CVE-2023-53401)

    * kernel: Bluetooth: Fix potential use-after-free when clear keys (CVE-2023-53386)

    * kernel: iomap: iomap: fix memory corruption when recording errors during writeback (CVE-2022-50406)

    * kernel: crypto: xts - Handle EBUSY correctly (CVE-2023-53494)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21091 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ALSA: usb-audio: ALSA USB Audio Out-of-Bounds Bug (CVE-2022-48701)

    * kernel: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (CVE-2025-38550)

    * kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

    * kernel: NFS: Fix a race when updating an existing write (CVE-2025-39697)

    * kernel: ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702)

    * kernel: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)

    * kernel: wifi: mac80211: check S1G action frame size (CVE-2023-53257)

    * kernel: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (CVE-2023-53213)

    * kernel: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (CVE-2023-53185)

    * kernel: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data (CVE-2023-53232)

    * kernel: mm: fix zswap writeback race condition (CVE-2023-53178)

    * kernel: wifi: mwifiex: Fix OOB and integer underflow when rx packets (CVE-2023-53226)

    * kernel: Bluetooth: L2CAP: Fix use-after-free (CVE-2023-53305)

    * kernel: pstore/ram: Check start of empty przs during init (CVE-2023-53331)

    * kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367)

    * kernel: net: sched: sfb: fix null pointer access issue when sfb_init() fails (CVE-2022-50356)

    * kernel: skbuff: skb_segment, Call zero copy functions before using skbuff frags (CVE-2023-53354)

    * kernel: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (CVE-2023-53401)

    * kernel: Bluetooth: Fix potential use-after-free when clear keys (CVE-2023-53386)

    * kernel: Bluetooth: L2CAP: Fix user-after-free (CVE-2022-50386)

    * kernel: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (CVE-2022-50408)

    * kernel: iomap: iomap: fix memory corruption when recording errors during writeback (CVE-2022-50406)

    * kernel: crypto: xts - Handle EBUSY correctly (CVE-2023-53494)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21136 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: ALSA: usb-audio: ALSA USB Audio Out-of-Bounds Bug (CVE-2022-48701)

    * kernel: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (CVE-2025-38550)

    * kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

    * kernel: NFS: Fix a race when updating an existing write (CVE-2025-39697)

    * kernel: ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702)

    * kernel: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)

    * kernel: wifi: mac80211: check S1G action frame size (CVE-2023-53257)

    * kernel: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (CVE-2023-53213)

    * kernel: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (CVE-2023-53185)

    * kernel: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data (CVE-2023-53232)

    * kernel: mm: fix zswap writeback race condition (CVE-2023-53178)

    * kernel: wifi: mwifiex: Fix OOB and integer underflow when rx packets (CVE-2023-53226)

    * kernel: Bluetooth: L2CAP: Fix use-after-free (CVE-2023-53305)

    * kernel: pstore/ram: Check start of empty przs during init (CVE-2023-53331)

    * kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367)

    * kernel: net: sched: sfb: fix null pointer access issue when sfb_init() fails (CVE-2022-50356)

    * kernel: skbuff: skb_segment, Call zero copy functions before using skbuff frags (CVE-2023-53354)

    * kernel: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (CVE-2023-53401)

    * kernel: Bluetooth: Fix potential use-after-free when clear keys (CVE-2023-53386)

    * kernel: Bluetooth: L2CAP: Fix user-after-free (CVE-2022-50386)

    * kernel: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (CVE-2022-50408)

    * kernel: iomap: iomap: fix memory corruption when recording errors during writeback (CVE-2022-50406)

    * kernel: crypto: xts - Handle EBUSY correctly (CVE-2023-53494)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21084 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ALSA: usb-audio: ALSA USB Audio Out-of-Bounds Bug (CVE-2022-48701)

    * kernel: ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() (CVE-2022-50050)

    * kernel: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (CVE-2023-53213)

    * kernel: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (CVE-2023-53185)

    * kernel: mm: fix zswap writeback race condition (CVE-2023-53178)

    * kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367)

    * kernel: crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)

    * kernel: Bluetooth: Fix potential use-after-free when clear keys (CVE-2023-53386)

    * kernel: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (CVE-2022-50408)

    * kernel: iomap: iomap: fix memory corruption when recording errors during writeback (CVE-2022-50406)

    * kernel: wifi: cfg80211: fix use-after-free in cmp_bss() (CVE-2025-39864)

    * kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path (CVE-2025-39841)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21051 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: eventpoll: Fix semi-unbounded recursion (CVE-2025-38614)

    * kernel: NFS: Fix a race when updating an existing write (CVE-2025-39697)

    * kernel: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (CVE-2023-53213)

    * kernel: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (CVE-2023-53185)

    * kernel: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data (CVE-2023-53232)

    * kernel: mm: fix zswap writeback race condition (CVE-2023-53178)

    * kernel: wifi: mwifiex: Fix OOB and integer underflow when rx packets (CVE-2023-53226)

    * kernel: Bluetooth: L2CAP: Fix use-after-free (CVE-2023-53305)

    * kernel: pstore/ram: Check start of empty przs during init (CVE-2023-53331)

    * kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367)

    * kernel: net: sched: sfb: fix null pointer access issue when sfb_init() fails (CVE-2022-50356)

    * kernel: crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)

    * kernel: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (CVE-2023-53401)

    * kernel: Bluetooth: Fix potential use-after-free when clear keys (CVE-2023-53386)

    * kernel: iomap: iomap: fix memory corruption when recording errors during writeback (CVE-2022-50406)

    * kernel: crypto: xts - Handle EBUSY correctly (CVE-2023-53494)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03615-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
    - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
    - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
    - CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
    - CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
    - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
    - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
    - CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
    - CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
    - CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree     (bsc#1248255).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
    - CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
    - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
    - CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
    - CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
    - CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03614-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
    - CVE-2022-50242: drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() (bsc#1249696).
    - CVE-2022-50244: cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() (bsc#1249647).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
    - CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()     (bsc#1249947).
    - CVE-2022-50265: kcm: annotate data-races around kcm->rx_wait (bsc#1249744).
    - CVE-2022-50278: PNP: fix name memory leak in pnp_alloc_dev() (bsc#1249715).
    - CVE-2022-50285: mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages (bsc#1249803).
    - CVE-2022-50288: qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure (bsc#1249802).
    - CVE-2022-50291: kcm: annotate data-races around kcm->rx_psock (bsc#1249798).
    - CVE-2022-50294: wifi: libertas: fix memory leak in lbs_init_adapter() (bsc#1249799).
    - CVE-2022-50297: wifi: ath9k: verify the expected usb_endpoints are present (bsc#1250250).
    - CVE-2022-50304: mm: export bdi_unregister (bsc#1249725).
    - CVE-2022-50311: cxl: Fix refcount leak in cxl_calc_capp_routing (bsc#1249720).
    - CVE-2022-50312: drivers: serial: jsm: fix some leaks in probe (bsc#1249716).
    - CVE-2022-50321: wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() (bsc#1249706).
    - CVE-2022-50330: crypto: cavium - prevent integer overflow loading firmware (bsc#1249700).
    - CVE-2022-50349: misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() (bsc#1249920).
    - CVE-2022-50352: net: hns: fix possible memory leak in hnae_ae_register() (bsc#1249922).
    - CVE-2022-50359: media: cx88: Fix a null-ptr-deref bug in buffer_prepare() (bsc#1250269).
    - CVE-2022-50365: skbuff: Account for tail adjustment during pull operations (bsc#1250084).
    - CVE-2022-50375: tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown     (bsc#1250132).
    - CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
    - CVE-2022-50396: net: sched: fix memory leak in tcindex_set_parms (bsc#1250104).
    - CVE-2022-50402: drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() (bsc#1250363).
    - CVE-2022-50405: net/tunnel: wait until all sk_user_data reader finish before releasing the sock     (bsc#1250155).
    - CVE-2022-50406: iomap: iomap: fix memory corruption when recording errors during writeback     (bsc#1250165).
    - CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
    - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
    - CVE-2022-50419: Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times (bsc#1250394).
    - CVE-2023-53148: igb: Do not bring the device up after non-fatal error (bsc#1249842).
    - CVE-2023-53153: wifi: cfg80211: Partial revert 'wifi: cfg80211: Fix use after free for wext'     (bsc#1249877).
    - CVE-2023-53176: serial: 8250: Fix oops for port->pm on uart_change_pm() (bsc#1249991).
    - CVE-2023-53178: mm: zswap: fix missing folio cleanup in writeback race path (bsc#1249827 git-fix).
    - CVE-2023-53199: wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails (bsc#1249683).
    - CVE-2023-53201: RDMA/bnxt_re: wraparound mbox producer index (bsc#1249687).
    - CVE-2023-53226: wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (bsc#1249658).
    - CVE-2023-53248: drm/amdgpu: install stub fence into potential unused fence pointers (bsc#1249779).
    - CVE-2023-53254: drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug     (bsc#1249871).
    - CVE-2023-53272: net: ena: fix shift-out-of-bounds in exponential backoff (bsc#1249917).
    - CVE-2023-53277: wifi: iwl3945: Add missing check for create_singlethread_workqueue (bsc#1249936).
    - CVE-2023-53288: drm/client: Fix memory leak in drm_client_modeset_probe (bsc#1250058).
    - CVE-2023-53298: nfc: fix memory leak of se_io context in nfc_genl_se_io (bsc#1249944).
    - CVE-2023-53302: wifi: iwl4965: Add missing check for create_singlethread_workqueue() (bsc#1249958).
    - CVE-2023-53305: Bluetooth: L2CAP: Fix use-after-free (bsc#1250049).
    - CVE-2023-53309: drm/radeon: Fix integer overflow in radeon_cs_parser_init (bsc#1250055).
    - CVE-2023-53317: ext4: fix WARNING in mb_find_extent (bsc#1250081).
    - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
    - CVE-2023-53335: RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() (bsc#1250072).
    - CVE-2023-53344: can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (bsc#1250023).
    - CVE-2023-53348: btrfs: fix deadlock when aborting transaction during relocation with scrub     (bsc#1250018).
    - CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
    - CVE-2023-53384: wifi: mwifiex: avoid possible NULL skb pointer dereference (bsc#1250127).
    - CVE-2023-53393: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device (bsc#1250114).
    - CVE-2023-53395: ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (bsc#1250358).
    - CVE-2023-53397: modpost: fix off by one in is_executable_section() (bsc#1250125).
    - CVE-2023-53400: ALSA: hda: Fix Oops by 9.1 surround channel names (bsc#1250328).
    - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
    - CVE-2023-53441: bpf: cpumap: Fix memory leak in cpu_map_update_elem (bsc#1250150).
    - CVE-2024-53194: PCI: Fix use-after-free of slot->bus on hot remove (bsc#1235459).
    - CVE-2024-58240: tls: separate no-async decryption request handling from async (bsc#1248847).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
    - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree     (bsc#1248255).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
    - CVE-2025-38602: wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() (bsc#1248341).
    - CVE-2025-38604: wifi: rtl818x: Kill URBs before clearing tx status queue (bsc#1248333).
    - CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
    - CVE-2025-38624: PCI: pnv_php: Clean up allocated IRQs on unplug (bsc#1248617).
    - CVE-2025-38632: pinmux: fix race causing mux_owner NULL with active mux_usecount (bsc#1248669).
    - CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
    - CVE-2025-38665: can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode     (bsc#1248648).
    - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
    - CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
    - CVE-2025-38702: fbdev: fix potential buffer overflow in do_register_framebuffer() (bsc#1249254).
    - CVE-2025-38705: drm/amd/pm: fix null pointer access (bsc#1249334).
    - CVE-2025-38712: hfsplus: do not use BUG_ON() in hfsplus_create_attributes_file() (bsc#1249194).
    - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
    - CVE-2025-38729: ALSA: usb-audio: Validate UAC3 power domain descriptors, too (bsc#1249164).
    - CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
    - CVE-2025-39677: net/sched: Fix backlog accounting in qdisc_dequeue_internal (bsc#1249300).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39705: drm/amd/display: fix a Null pointer dereference vulnerability (bsc#1249295).
    - CVE-2025-39706: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (bsc#1249413).
    - CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
    - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
    - CVE-2025-39754: mm/smaps: fix race between smaps_hugetlb_range and migration (bsc#1249524).
    - CVE-2025-39757: ALSA: usb-audio: Fix size validation in convert_chmap_v3() (bsc#1249515).
    - CVE-2025-39760: usb: core: config: Prevent OOB read in SS endpoint companion parsing (bsc#1249598).
    - CVE-2025-39763: ACPICA: Fix error code path in acpi_ds_call_control_method() (bsc#1249615).
    - CVE-2025-39764: netfilter: ctnetlink: remove refcounting in expectation dumpers (bsc#1249513).
    - CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
    - CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
    - CVE-2025-39787: soc: qcom: mdt_loader: Deal with zero e_shentsize (bsc#1249545).
    - CVE-2025-39800: btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (bsc#1250177).
    - CVE-2025-39808: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (bsc#1250088).
    - CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
    - CVE-2025-39833: mISDN: hfcpci: Fix warning when deleting uninitialized timer (bsc#1250028).
    - CVE-2025-39838: cifs: prevent NULL pointer dereference in UTF16 conversion (bsc#1250365).
    - CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
    - CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
    - CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
    - CVE-2025-39863: wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work     (bsc#1250281).
    - CVE-2025-39865: tee: fix NULL pointer dereference in tee_shm_put (bsc#1250294).
    - CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).
    - CVE-2025-39885: ocfs2: fix recursive semaphore deadlock in fiemap call (bsc#1250407).
    - CVE-2025-40300: x86/vmscape: Warn when STIBP is disabled with SMT (bsc#1247483).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - iomap: iomap: fix memory corruption when recording errors during writeback Every now and then I see this     crash on arm64: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000f8     Buffer I/O error on dev dm-0, logical block 8733687, async page read Mem abort info: ESR =     0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC =     0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable:
    64k pages, 42-bit VAs, pgdp=0000000139750000 [00000000000000f8] pgd=0000000000000000,     p4d=0000000000000000, pud=0000000000000000, pmd=0000000000000000 Internal error: Oops: 96000006 [#1]     PREEMPT SMP Buffer I/O error on dev dm-0, logical block 8733688, async page read Dumping ftrace buffer:
    Buffer I/O error on dev dm-0, logical block 8733689, async page read (ftrace buffer empty) XFS (dm-0): log     I/O error -5 Modules linked in: dm_thin_pool dm_persistent_data XFS (dm-0): Metadata I/O Error (0x1)     detected at xfs_trans_read_buf_map+0x1ec/0x590 [xfs] (fs/xfs/xfs_trans_buf.c:296). dm_bio_prison XFS     (dm-0): Please unmount the filesystem and rectify the problem(s) XFS (dm-0): xfs_imap_lookup:
    xfs_ialloc_read_agi() returned error -5, agno 0 dm_bufio dm_log_writes xfs nft_chain_nat xt_REDIRECT     nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_REJECT potentially unexpected fatal signal 6.
    nf_reject_ipv6 potentially unexpected fatal signal 6. ipt_REJECT nf_reject_ipv4 CPU: 1 PID: 122166 Comm:
    fsstress Tainted: G W 6.0.0-rc5-djwa #rc5 3004c9f1de887ebae86015f2677638ce51ee7 rpcsec_gss_krb5     auth_rpcgss xt_tcpudp ip_set_hash_ip ip_set_hash_net xt_set nft_compat ip_set_hash_mac ip_set nf_tables     Hardware name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021 pstate: 60001000 (nZCv daif -PAN -UAO -TCO
    -DIT +SSBS BTYPE=--) ip_tables pc : 000003fd6d7df200 x_tables lr : 000003fd6d7df1ec overlay nfsv4 CPU: 0     PID: 54031 Comm: u4:3 Tainted: G W 6.0.0-rc5-djwa #rc5 3004c9f1de887ebae86015f2677638ce51ee7405 Hardware     name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021 Workqueue: writeback wb_workfn sp : 000003ffd9522fd0     (flush-253:0) pstate: 60401005 (nZCv daif +PAN -UAO -TCO -DIT +SSBS BTYPE=--) pc : errseq_set+0x1c/0x100     x29: 000003ffd9522fd0 x28: 0000000000000023 x27: 000002acefeb6780 x26: 0000000000000005 x25:
    0000000000000001 x24: 0000000000000000 x23: 00000000ffffffff x22: 0000000000000005 lr :
    __filemap_set_wb_err+0x24/0xe0 x21: 0000000000000006 sp : fffffe000f80f760 x29: fffffe000f80f760 x28:
    0000000000000003 x27: fffffe000f80f9f8 x26: 0000000002523000 x25: 00000000fffffffb x24: fffffe000f80f868     x23: fffffe000f80fbb0 x22: fffffc0180c26a78 x21: 0000000002530000 x20: 0000000000000000 x19:
    0000000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000     x14: 0000000000000001 x13: 0000000000470af3 x12: fffffc0058f70000 x11: 0000000000000040 x10:
    0000000000001b20 x9 : fffffe000836b288 x8 : fffffc00eb9fd480 x7 : 0000000000f83659 x6 : 0000000000000000     x5 : 0000000000000869 x4 : 0000000000000005 x3 : 00000000000000f8 x20: 000003fd6d740020 x19:
    000000000001dd36 x18: 0000000000000001 x17: 000003fd6d78704c x16: 0000000000000001 x15: 000002acfac87668     x2 : 0000000000000ffa x1 : 00000000fffffffb x0 : 00000000000000f8 Call trace: errseq_set+0x1c/0x100
    __filemap_set_wb_err+0x24/0xe0 iomap_do_writepage+0x5e4/0xd5c write_cache_pages+0x208/0x674     iomap_writepages+0x34/0x60 xfs_vm_writepages+0x8c/0xcc [xfs 7a861f39c43631f15d3a5884246ba5035d4ca78b] x14:
    0000000000000000 x13: 2064656e72757465 x12: 0000000000002180 x11: 000003fd6d8a82d0 x10: 0000000000000000     x9 : 000003fd6d8ae288 x8 : 0000000000000083 x7 : 00000000ffffffff x6 : 00000000ffffffee x5 :
    00000000fbad2887 x4 : 000003fd6d9abb58 x3 : 000003fd6d740020 x2 : 0000000000000006 x1 : 000000000001dd36     x0 : 0000000000000000 CPU: ---truncated--- (CVE-2022-50406)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
361173	CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1771078945)	Nessus	CentOS Local Security Checks	Local	high
360928	CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1771077729)	Nessus	CentOS Local Security Checks	Local	high
360828	CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1770040438)	Nessus	CentOS Local Security Checks	Local	high
360716	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786350974)	Nessus	Alma Linux Local Security Checks	Local	high
279558	RHEL 7 : kernel (RHSA-2025:23947)	Nessus	Red Hat Local Security Checks	Local	high
279557	RHEL 7 : kernel-rt (RHSA-2025:23960)	Nessus	Red Hat Local Security Checks	Local	high
279030	RHEL 8 : kernel (RHSA-2025:23463)	Nessus	Red Hat Local Security Checks	Local	high
278950	RHEL 8 : kernel (RHSA-2025:23445)	Nessus	Red Hat Local Security Checks	Local	high
278028	RHEL 8 : kernel (RHSA-2025:22998)	Nessus	Red Hat Local Security Checks	Local	high
275415	Photon OS 4.0: Linux PHSA-2025-4.0-0906	Nessus	PhotonOS Local Security Checks	Local	medium
275176	RHEL 9 : kernel-rt (RHSA-2025:21128)	Nessus	Red Hat Local Security Checks	Local	high
275174	RHEL 9 : kernel (RHSA-2025:21091)	Nessus	Red Hat Local Security Checks	Local	high
275173	RHEL 9 : kernel-rt (RHSA-2025:21136)	Nessus	Red Hat Local Security Checks	Local	high
274973	RHEL 8 : kernel (RHSA-2025:21084)	Nessus	Red Hat Local Security Checks	Local	high
274937	RHEL 9 : kernel (RHSA-2025:21051)	Nessus	Red Hat Local Security Checks	Local	high
270837	SUSE SLES15 : Security update for the Linux Kernel (SUSE-SU-2025:03615-1)	Nessus	SuSE Local Security Checks	Local	high
270831	SUSE SLES12 Security Update : kernel (SUSE-SU-2025:03614-1)	Nessus	SuSE Local Security Checks	Local	high
265505	Linux Distros Unpatched Vulnerability : CVE-2022-50406	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2022-50406

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

medium

high

high

high

high

high

high

high

high