In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() This patch fixes a shift-out-of-bounds in brcmfmac that occurs in BIT(chiprev) when a 'chiprev' provided by the device is too large. It should also not be equal to or greater than BITS_PER_TYPE(u32) as we do bitwise AND with a u32 variable and BIT(chiprev). The patch adds a check that makes the function return NULL if that is the case. Note that the NULL case is later handled by the bus-specific caller, brcmf_usb_probe_cb() or brcmf_usb_reset_resume(), for example. Found by a modified version of syzkaller. UBSAN: shift-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c shift exponent 151055786 is too large for 64-bit type 'long unsigned int' CPU: 0 PID: 1885 Comm: kworker/0:2 Tainted: G O 5.14.0+ #132 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace: dump_stack_lvl+0x57/0x7d ubsan_epilogue+0x5/0x40 __ubsan_handle_shift_out_of_bounds.cold+0x53/0xdb ? lock_chain_count+0x20/0x20 brcmf_fw_alloc_request.cold+0x19/0x3ea ? brcmf_fw_get_firmwares+0x250/0x250 ? brcmf_usb_ioctl_resp_wait+0x1a7/0x1f0 brcmf_usb_get_fwname+0x114/0x1a0 ? brcmf_usb_reset_resume+0x120/0x120 ? number+0x6c4/0x9a0 brcmf_c_process_clm_blob+0x168/0x590 ? put_dec+0x90/0x90 ? enable_ptr_key_workfn+0x20/0x20 ? brcmf_common_pd_remove+0x50/0x50 ? rcu_read_lock_sched_held+0xa1/0xd0 brcmf_c_preinit_dcmds+0x673/0xc40 ? brcmf_c_set_joinpref_default+0x100/0x100 ? rcu_read_lock_sched_held+0xa1/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? lock_acquire+0x19d/0x4e0 ? find_held_lock+0x2d/0x110 ? brcmf_usb_deq+0x1cc/0x260 ? mark_held_locks+0x9f/0xe0 ? lockdep_hardirqs_on_prepare+0x273/0x3e0 ? _raw_spin_unlock_irqrestore+0x47/0x50 ? trace_hardirqs_on+0x1c/0x120 ? brcmf_usb_deq+0x1a7/0x260 ? brcmf_usb_rx_fill_all+0x5a/0xf0 brcmf_attach+0x246/0xd40 ? wiphy_new_nm+0x1476/0x1d50 ? kmemdup+0x30/0x40 brcmf_usb_probe+0x12de/0x1690 ? brcmf_usbdev_qinit.constprop.0+0x470/0x470 usb_probe_interface+0x25f/0x710 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 ? usb_match_id.part.0+0x88/0xc0 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 ? driver_allows_async_probing+0x120/0x120 bus_for_each_drv+0x123/0x1a0 ? bus_rescan_devices+0x20/0x20 ? lockdep_hardirqs_on_prepare+0x273/0x3e0 ? trace_hardirqs_on+0x1c/0x120 __device_attach+0x207/0x330 ? device_bind_driver+0xb0/0xb0 ? kobject_uevent_env+0x230/0x12c0 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 ? __mutex_unlock_slowpath+0xe7/0x660 ? __fw_devlink_link_to_suppliers+0x550/0x550 usb_set_configuration+0x984/0x1770 ? kernfs_create_link+0x175/0x230 usb_generic_driver_probe+0x69/0x90 usb_probe_device+0x9c/0x220 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 ? driver_allows_async_probing+0x120/0x120 bus_for_each_drv+0x123/0x1a0 ? bus_rescan_devices+0x20/0x20 ? lockdep_hardirqs_on_prepare+0x273/0x3e0 ? trace_hardirqs_on+0x1c/0x120 __device_attach+0x207/0x330 ? device_bind_driver+0xb0/0xb0 ? kobject_uevent_env+0x230/0x12c0 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 ? __fw_devlink_link_to_suppliers+0x550/0x550 usb_new_device.cold+0x463/0xf66 ? hub_disconnect+0x400/0x400 ? _raw_spin_unlock_irq+0x24/0x30 hub_event+0x10d5/0x3330 ? hub_port_debounce+0x280/0x280 ? __lock_acquire+0x1671/0x5790 ? wq_calc_node_cpumask+0x170/0x2a0 ? lock_release+0x640/0x640 ? rcu_read_lock_sched_held+0xa1/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? lockdep_hardirqs_on_prepare+0x273/0x3e0 process_one_work+0x873/0x13e0 ? lock_release+0x640/0x640 ? pwq_dec_nr_in_flight+0x320/0x320 ? rwlock_bug.part.0+0x90/0x90 worker_thread+0x8b/0xd10 ? __kthread_parkme+0xd9/0x1d0 ? pr ---truncated---

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1773048865 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid field-overflowing     memcpy() In preparation for FORTIFY_SOURCE performing compile-time and run-time field bounds checking for     memcpy(), memmove(), and memset(), avoid intentionally writing across neighboring fields. Use flexible     arrays instead of zero-element arrays (which look like they are always overflowing) and split the cross-     field memcpy() into two halves that can be appropriately bounds-checked by the compiler. We were doing:
    #define ETH_HLEN 14 #define VLAN_HLEN 4 ... #define MLX5E_XDP_MIN_INLINE (ETH_HLEN + VLAN_HLEN) ... struct     mlx5e_tx_wqe *wqe = mlx5_wq_cyc_get_wqe(wq, pi); ... struct mlx5_wqe_eth_seg *eseg = &wqe->eth; struct     mlx5_wqe_data_seg *dseg = wqe->data; ... memcpy(eseg->inline_hdr.start, xdptxd->data,     MLX5E_XDP_MIN_INLINE); target is wqe->eth.inline_hdr.start (which the compiler sees as being 2 bytes in     size), but copying 18, intending to write across start (really vlan_tci, 2 bytes). The remaining 16 bytes     get written into wqe->data[0], covering byte_count (4 bytes), lkey (4 bytes), and addr (8 bytes). struct     mlx5e_tx_wqe { struct mlx5_wqe_ctrl_seg ctrl; /* 0 16 */ struct mlx5_wqe_eth_seg eth; /* 16 16 */ struct     mlx5_wqe_data_seg data[]; /* 32 0 */ /* size: 32, cachelines: 1, members: 3 */ /* last cacheline: 32 bytes
    */ }; struct mlx5_wqe_eth_seg { u8 swp_outer_l4_offset; /* 0 1 */ u8 swp_outer_l3_offset; /* 1 1 */ u8     swp_inner_l4_offset; /* 2 1 */ u8 swp_inner_l3_offset; /* 3 1 */ u8 cs_flags; /* 4 1 */ u8 swp_flags; /* 5     1 */ __be16 mss; /* 6 2 */ __be32 flow_table_metadata; /* 8 4 */ union { struct { __be16 sz; /* 12 2 */ u8     start[2]; /* 14 2 */ } inline_hdr; /* 12 4 */ struct { __be16 type; /* 12 2 */ __be16 vlan_tci; /* 14 2 */     } insert; /* 12 4 */ __be32 trailer; /* 12 4 */ }; /* 12 4 */ /* size: 16, cachelines: 1, members: 9 */ /*     last cacheline: 16 bytes */ }; struct mlx5_wqe_data_seg { __be32 byte_count; /* 0 4 */ __be32 lkey; /* 4 4
    */ __be64 addr; /* 8 8 */ /* size: 16, cachelines: 1, members: 3 */ /* last cacheline: 16 bytes */ }; So,     split the memcpy() so the compiler can reason about the buffer sizes. pahole shows no size nor member     offset changes to struct mlx5e_tx_wqe nor struct mlx5e_umr_wqe. objdump -d shows no meaningful object     code changes (i.e. only source line number induced differences and optimizations). (CVE-2022-48744)

  - In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix the behavior of READ near     OFFSET_MAX Dan Aloni reports: > Due to commit 8cfb9015280d (NFS: Always provide aligned buffers to > the     RPC read layers) on the client, a read of 0xfff is aligned up > to server rsize of 0x1000. > > As a     result, in a test where the server has a file of size > 0x7fffffffffffffff, and the client tries to read     from the offset > 0x7ffffffffffff000, the read causes loff_t overflow in the server > and it returns an     NFS code of EINVAL to the client. The client as > a result indefinitely retries the request. The Linux NFS     client does not handle NFS?ERR_INVAL, even though all NFS specifications permit servers to return that     status code for a READ. Instead of NFS?ERR_INVAL, have out-of-range READ requests succeed and return a     short result. Set the EOF flag in the result to prevent the client from retrying the READ request. This     behavior appears to be consistent with Solaris NFS servers. Note that NFSv3 and NFSv4 use u64 offset     values on the wire. These must be converted to loff_t internally before use -- an implicit type cast is     not adequate for this purpose. Otherwise VFS checks against sb->s_maxbytes do not work properly.
    (CVE-2022-48827)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free     This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following     trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref *kref) Bluetooth: chan     0000000023c4974d Bluetooth: parent 00000000ae861c08     ================================================================== BUG: KASAN: use-after-free in
    __mutex_waiter_is_first kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free in
    __mutex_lock_common kernel/locking/mutex.c:671 [inline] BUG: KASAN: use-after-free in
    __mutex_lock+0x278/0x400 kernel/locking/mutex.c:729 Read of size 8 at addr ffff888006a49b08 by task     kworker/u3:2/389 (CVE-2022-50386)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix use-after-free bug     in smp_execute_task_sg() When executing SMP task failed, the smp_execute_task_sg() calls del_timer() to     delete slow_task->timer. However, if the timer handler sas_task_internal_timedout() is running, the     del_timer() in smp_execute_task_sg() will not stop it and a UAF will happen. The process is shown below:
    (thread 1) | (thread 2) smp_execute_task_sg() | sas_task_internal_timedout() ... | del_timer() | ... | ...
    sas_free_task(task) | kfree(task->slow_task) //FREE| | task->slow_task->... //USE Fix by calling     del_timer_sync() in smp_execute_task_sg(), which makes sure the timer handler have finished before the     task->slow_task is deallocated. (CVE-2022-50422)

  - In the Linux kernel, the following vulnerability has been resolved: kernfs: fix use-after-free in
    __kernfs_remove Syzkaller managed to trigger concurrent calls to kernfs_remove_by_name_ns() for the same     file resulting in a KASAN detected use-after-free. The race occurs when the root node is freed during     kernfs_drain(). To prevent this acquire an additional reference for the root of the tree that is removed     before calling __kernfs_remove(). Found by syzkaller with the following reproducer (slab_nomerge is     required): syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x100000, 0x0, 0x0, 0x0, 0x0) r0 =     openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0) close(r0)     pipe2(&(0x7f0000000140)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x800) mount$9p_fd(0x0,     &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x408, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d,     r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@mmap}, {@loose}, {@loose}, {@mmap}],     [{@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@fsmagic={'fsmagic', 0x3d, 0x10001}}, {@dont_hash}]}}) Sample     report: ================================================================== BUG: KASAN: use-after-free in     kernfs_type include/linux/kernfs.h:335 [inline] BUG: KASAN: use-after-free in kernfs_leftmost_descendant     fs/kernfs/dir.c:1261 [inline] BUG: KASAN: use-after-free in __kernfs_remove.part.0+0x843/0x960     fs/kernfs/dir.c:1369 Read of size 2 at addr ffff8880088807f0 by task syz-executor.2/857 CPU: 0 PID: 857     Comm: syz-executor.2 Not tainted 6.0.0-rc3-00363-g7726d4c3e60b #5 Hardware name: QEMU Standard PC (i440FX     + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline]     dump_stack_lvl+0x6e/0x91 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline]     print_report.cold+0x5e/0x5e5 mm/kasan/report.c:433 kasan_report+0xa3/0x130 mm/kasan/report.c:495     kernfs_type include/linux/kernfs.h:335 [inline] kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline]
    __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369 __kernfs_remove fs/kernfs/dir.c:1356 [inline]     kernfs_remove_by_name_ns+0x108/0x190 fs/kernfs/dir.c:1589 sysfs_slab_add+0x133/0x1e0 mm/slub.c:5943
    __kmem_cache_create+0x3e0/0x550 mm/slub.c:4899 create_cache mm/slab_common.c:229 [inline]     kmem_cache_create_usercopy+0x167/0x2a0 mm/slab_common.c:335 p9_client_create+0xd4d/0x1190     net/9p/client.c:993 v9fs_session_init+0x1e6/0x13c0 fs/9p/v9fs.c:408 v9fs_mount+0xb9/0xbd0     fs/9p/vfs_super.c:126 legacy_get_tree+0xf1/0x200 fs/fs_context.c:610 vfs_get_tree+0x85/0x2e0     fs/super.c:1530 do_new_mount fs/namespace.c:3040 [inline] path_mount+0x675/0x1d00 fs/namespace.c:3370     do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount     fs/namespace.c:3568 [inline] __x64_sys_mount+0x282/0x300 fs/namespace.c:3568 do_syscall_x64     arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80     entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f725f983aed Code: 02 b8 ff ff ff ff c3 66 0f 1f 44     00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0     ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f725f0f7028 EFLAGS: 00000246     ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f725faa3f80 RCX: 00007f725f983aed RDX:
    00000000200000c0 RSI: 0000000020000040 RDI: 0000000000000000 RBP: 00007f725f9f419c R08: 0000000020000280     R09: 0000000000000000 R10: 0000000000000408 R11: 0000000000000246 R12: 0000000000000000 R13:
    0000000000000006 R14: 00007f725faa3f80 R15: 00007f725f0d7000 </TASK> Allocated by task 855:
    kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline]     set_alloc_info mm/kasan/common.c:437 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:470     kasan_slab_alloc include/linux/kasan.h:224 [inline] slab_post_alloc_hook mm/slab.h:7 ---truncated---     (CVE-2022-50432)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1788170774 advisory.

  - A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel     privilege escalation from the context of a network service or an unprivileged process. If     sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the     auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network     service privileges to escalate to root or from the context of an unprivileged user directly if a     BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket. (CVE-2021-23133)

  - In the Linux kernel, the following vulnerability has been resolved: drm: Fix use-after-free read in     drm_getunique() There is a time-of-check-to-time-of-use error in drm_getunique() due to retrieving     file_priv->master prior to locking the device's master mutex. An example can be seen in the crash report     of the use-after-free error found by Syzbot:
    https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803 In the report, the master     pointer was used after being freed. This is because another process had acquired the device's master mutex     in drm_setmaster_ioctl(), then overwrote fpriv->master in drm_new_set_master(). The old value of     fpriv->master was subsequently freed before the mutex was unlocked. To fix this, we lock the device's     master mutex before retrieving the pointer from from fpriv->master. This patch passes the Syzbot     reproducer test. (CVE-2021-47280)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix kernel panic during     drive powercycle test While looping over shost's sdev list it is possible that one of the drives is     getting removed and its sas_target object is freed but its sdev object remains intact. Consequently, a     kernel panic can occur while the driver is trying to access the sas_address field of sas_target object     without also checking the sas_target object for NULL. (CVE-2021-47565)

  - In the Linux kernel, the following vulnerability has been resolved: dm btree remove: fix use after free in     rebalance_children() Move dm_tm_unlock() after dm_tm_dec(). (CVE-2021-47600)

  - In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix array-index-out-     of-bounds in pvr2_i2c_core_init Syzbot reported that -1 is used as array index. The problem was in missing     validation check. hdw->unit_number is initialized with -1 and then if init table walk fails this value     remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the     easiest fix for that. hdw->workpoll initialization moved upper to prevent warning in __flush_work.
    (CVE-2022-49478)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1777616064 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in     create_var_ref() In create_var_ref(), init_var_ref() is called to initialize the fields of variable     ref_field, which is allocated in the previous function call to create_hist_field(). Function     init_var_ref() allocates the corresponding fields such as ref_field->system, but frees these fields when     the function encounters an error. The caller later calls destroy_hist_field() to conduct error handling,     which frees the fields and the variable itself. This results in double free of the fields which are     already freed in the previous function. Fix this by storing NULL to the corresponding fields when they are     freed in init_var_ref(). (CVE-2022-49410)

  - In the Linux kernel, the following vulnerability has been resolved: net: mdio: fix undefined behavior in     bit shift for __mdiobus_register Shifting signed 32-bit value by 31 bits is undefined, so changing     significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in     drivers/net/phy/mdio_bus.c:586:27 left shift of 1 by 31 places cannot be represented in type 'int' Call     Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e
    __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c __mdiobus_register+0x49d/0x4e0     fixed_mdio_bus_init+0xd8/0x12d do_one_initcall+0x76/0x430 kernel_init_freeable+0x3b3/0x422     kernel_init+0x24/0x1e0 ret_from_fork+0x1f/0x30 </TASK> (CVE-2022-49907)

  - In the Linux kernel, the following vulnerability has been resolved: vt: Clear selection before changing     the font When changing the console font with ioctl(KDFONTOP) the new font size can be bigger than the     previous font. A previous selection may thus now be outside of the new screen size and thus trigger out-     of-bounds accesses to graphics memory if the selection is removed in vc_do_resize(). Prevent such out-of-     memory accesses by dropping the selection before the various con_font_set() console handlers are called.
    (CVE-2022-49948)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix double free on     tx path. We see kernel crashes and lockups and KASAN errors related to ax210 firmware crashes. One of the     KASAN dumps pointed at the tx path, and it appears there is indeed a way to double-free an skb. If     iwl_mvm_tx_skb_sta returns non-zero, then the 'skb' sent into the method will be freed. But, in case where     we build TSO skb buffer, the skb may also be freed in error case. So, return 0 in that particular error     case and do cleanup manually. BUG: KASAN: use-after-free in __list_del_entry_valid+0x12/0x90 iwlwifi     0000:06:00.0: 0x00000000 | tsf hi Read of size 8 at addr ffff88813cfa4ba0 by task btserver/9650 CPU: 4     PID: 9650 Comm: btserver Tainted: G W 5.19.8+ #5 iwlwifi 0000:06:00.0: 0x00000000 | time gp1 Hardware     name: Default string Default string/SKYBAY, BIOS 5.12 02/19/2019 Call Trace: <TASK>     dump_stack_lvl+0x55/0x6d print_report.cold.12+0xf2/0x684 iwlwifi 0000:06:00.0: 0x1D0915A8 | time gp2 ?
    __list_del_entry_valid+0x12/0x90 kasan_report+0x8b/0x180 iwlwifi 0000:06:00.0: 0x00000001 | uCode revision     type ? __list_del_entry_valid+0x12/0x90 __list_del_entry_valid+0x12/0x90 iwlwifi 0000:06:00.0: 0x00000048     | uCode version major tcp_update_skb_after_send+0x5d/0x170 __tcp_transmit_skb+0xb61/0x15c0 iwlwifi     0000:06:00.0: 0xDAA05125 | uCode version minor ? __tcp_select_window+0x490/0x490 iwlwifi 0000:06:00.0:
    0x00000420 | hw version ? trace_kmalloc_node+0x29/0xd0 ? __kmalloc_node_track_caller+0x12a/0x260 ?     memset+0x1f/0x40 ? __build_skb_around+0x125/0x150 ? __alloc_skb+0x1d4/0x220 ?     skb_zerocopy_clone+0x55/0x230 iwlwifi 0000:06:00.0: 0x00489002 | board version ? kmalloc_reserve+0x80/0x80     ? rcu_read_lock_bh_held+0x60/0xb0 tcp_write_xmit+0x3f1/0x24d0 iwlwifi 0000:06:00.0: 0x034E001C | hcmd ?
    __check_object_size+0x180/0x350 iwlwifi 0000:06:00.0: 0x24020000 | isr0 tcp_sendmsg_locked+0x8a9/0x1520     iwlwifi 0000:06:00.0: 0x01400000 | isr1 ? tcp_sendpage+0x50/0x50 iwlwifi 0000:06:00.0: 0x48F0000A | isr2 ?     lock_release+0xb9/0x400 ? tcp_sendmsg+0x14/0x40 iwlwifi 0000:06:00.0: 0x00C3080C | isr3 ?     lock_downgrade+0x390/0x390 ? do_raw_spin_lock+0x114/0x1d0 iwlwifi 0000:06:00.0: 0x00200000 | isr4 ?     rwlock_bug.part.2+0x50/0x50 iwlwifi 0000:06:00.0: 0x034A001C | last cmd Id ? rwlock_bug.part.2+0x50/0x50 ?     lockdep_hardirqs_on_prepare+0xe/0x200 iwlwifi 0000:06:00.0: 0x0000C2F0 | wait_event ?
    __local_bh_enable_ip+0x87/0xe0 ? inet_send_prepare+0x220/0x220 iwlwifi 0000:06:00.0: 0x000000C4 |     l2p_control tcp_sendmsg+0x22/0x40 sock_sendmsg+0x5f/0x70 iwlwifi 0000:06:00.0: 0x00010034 | l2p_duration
    __sys_sendto+0x19d/0x250 iwlwifi 0000:06:00.0: 0x00000007 | l2p_mhvalid ? __ia32_sys_getpeername+0x40/0x40     iwlwifi 0000:06:00.0: 0x00000000 | l2p_addr_match ? rcu_read_lock_held_common+0x12/0x50 ?     rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? rcu_read_lock_sched_held+0x5a/0xd0     ? rcu_read_lock_sched_held+0x5a/0xd0 ? lock_release+0xb9/0x400 ? lock_downgrade+0x390/0x390 ?     ktime_get+0x64/0x130 ? ktime_get+0x8d/0x130 ? rcu_read_lock_held_common+0x12/0x50 ?     rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_held_common+0x12/0x50 ?     rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? rcu_read_lock_bh_held+0xb0/0xb0
    __x64_sys_sendto+0x6f/0x80 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP:
    0033:0x7f1d126e4531 Code: 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 35 80 0c 00 41 89 ca 8b 00 85 c0     75 1c 45 31 c9 45 31 c0 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 67 c3 66 0f 1f 44 00 00 55 48 83 ec 20     48 89 RSP: 002b:00007ffe21a679d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX:
    000000000000ffdc RCX: 00007f1d126e4531 RDX: 0000000000010000 RSI: 000000000374acf0 RDI: 0000000000000014     RBP: 00007ffe21a67ac0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11:
    0000000000000246 R ---truncated--- (CVE-2022-50248)

  - In the Linux kernel, the following vulnerability has been resolved: mmc: rtsx_usb_sdmmc: fix return value     check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that     allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added     device in the remove path. So fix this by checking the return value and calling mmc_free_host() in the     error path, besides, led_classdev_unregister() and pm_runtime_disable() also need be called.
    (CVE-2022-50347)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1773047921 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: asix: fix uninit-value in     asix_mdio_read() asix_read_cmd() may read less than sizeof(smsr) bytes and in this case smsr will be     uninitialized. Fail log: BUG: KMSAN: uninit-value in asix_check_host_enable     drivers/net/usb/asix_common.c:82 [inline] BUG: KMSAN: uninit-value in asix_check_host_enable     drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497 BUG: KMSAN: uninit-value in     asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497     asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] asix_check_host_enable     drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497 asix_mdio_read+0x3c1/0xb00     drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497 (CVE-2021-47101)

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid field-overflowing     memcpy() In preparation for FORTIFY_SOURCE performing compile-time and run-time field bounds checking for     memcpy(), memmove(), and memset(), avoid intentionally writing across neighboring fields. Use flexible     arrays instead of zero-element arrays (which look like they are always overflowing) and split the cross-     field memcpy() into two halves that can be appropriately bounds-checked by the compiler. We were doing:
    #define ETH_HLEN 14 #define VLAN_HLEN 4 ... #define MLX5E_XDP_MIN_INLINE (ETH_HLEN + VLAN_HLEN) ... struct     mlx5e_tx_wqe *wqe = mlx5_wq_cyc_get_wqe(wq, pi); ... struct mlx5_wqe_eth_seg *eseg = &wqe->eth; struct     mlx5_wqe_data_seg *dseg = wqe->data; ... memcpy(eseg->inline_hdr.start, xdptxd->data,     MLX5E_XDP_MIN_INLINE); target is wqe->eth.inline_hdr.start (which the compiler sees as being 2 bytes in     size), but copying 18, intending to write across start (really vlan_tci, 2 bytes). The remaining 16 bytes     get written into wqe->data[0], covering byte_count (4 bytes), lkey (4 bytes), and addr (8 bytes). struct     mlx5e_tx_wqe { struct mlx5_wqe_ctrl_seg ctrl; /* 0 16 */ struct mlx5_wqe_eth_seg eth; /* 16 16 */ struct     mlx5_wqe_data_seg data[]; /* 32 0 */ /* size: 32, cachelines: 1, members: 3 */ /* last cacheline: 32 bytes
    */ }; struct mlx5_wqe_eth_seg { u8 swp_outer_l4_offset; /* 0 1 */ u8 swp_outer_l3_offset; /* 1 1 */ u8     swp_inner_l4_offset; /* 2 1 */ u8 swp_inner_l3_offset; /* 3 1 */ u8 cs_flags; /* 4 1 */ u8 swp_flags; /* 5     1 */ __be16 mss; /* 6 2 */ __be32 flow_table_metadata; /* 8 4 */ union { struct { __be16 sz; /* 12 2 */ u8     start[2]; /* 14 2 */ } inline_hdr; /* 12 4 */ struct { __be16 type; /* 12 2 */ __be16 vlan_tci; /* 14 2 */     } insert; /* 12 4 */ __be32 trailer; /* 12 4 */ }; /* 12 4 */ /* size: 16, cachelines: 1, members: 9 */ /*     last cacheline: 16 bytes */ }; struct mlx5_wqe_data_seg { __be32 byte_count; /* 0 4 */ __be32 lkey; /* 4 4
    */ __be64 addr; /* 8 8 */ /* size: 16, cachelines: 1, members: 3 */ /* last cacheline: 16 bytes */ }; So,     split the memcpy() so the compiler can reason about the buffer sizes. pahole shows no size nor member     offset changes to struct mlx5e_tx_wqe nor struct mlx5e_umr_wqe. objdump -d shows no meaningful object     code changes (i.e. only source line number induced differences and optimizations). (CVE-2022-48744)

  - In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix the behavior of READ near     OFFSET_MAX Dan Aloni reports: > Due to commit 8cfb9015280d (NFS: Always provide aligned buffers to > the     RPC read layers) on the client, a read of 0xfff is aligned up > to server rsize of 0x1000. > > As a     result, in a test where the server has a file of size > 0x7fffffffffffffff, and the client tries to read     from the offset > 0x7ffffffffffff000, the read causes loff_t overflow in the server > and it returns an     NFS code of EINVAL to the client. The client as > a result indefinitely retries the request. The Linux NFS     client does not handle NFS?ERR_INVAL, even though all NFS specifications permit servers to return that     status code for a READ. Instead of NFS?ERR_INVAL, have out-of-range READ requests succeed and return a     short result. Set the EOF flag in the result to prevent the client from retrying the READ request. This     behavior appears to be consistent with Solaris NFS servers. Note that NFSv3 and NFSv4 use u64 offset     values on the wire. These must be converted to loff_t internally before use -- an implicit type cast is     not adequate for this purpose. Otherwise VFS checks against sb->s_maxbytes do not work properly.
    (CVE-2022-48827)

  - In the Linux kernel, the following vulnerability has been resolved: virtio_net: fix xdp_rxq_info bug after     suspend/resume The following sequence currently causes a driver bug warning when using virtio_net: # ip     link set eth0 up # echo mem > /sys/power/state (or e.g. # rtcwake -s 10 -m mem) <resume> # ip link set     eth0 down Missing register, driver bug WARNING: CPU: 0 PID: 375 at net/core/xdp.c:138     xdp_rxq_info_unreg+0x58/0x60 Call trace: xdp_rxq_info_unreg+0x58/0x60 virtnet_close+0x58/0xac
    __dev_close_many+0xac/0x140 __dev_change_flags+0xd8/0x210 dev_change_flags+0x24/0x64     do_setlink+0x230/0xdd0 ... This happens because virtnet_freeze() frees the receive_queue completely     (including struct xdp_rxq_info) but does not call xdp_rxq_info_unreg(). Similarly, virtnet_restore() sets     up the receive_queue again but does not call xdp_rxq_info_reg(). Actually, parts of virtnet_freeze_down()     and virtnet_restore_up() are almost identical to virtnet_close() and virtnet_open(): only the calls to     xdp_rxq_info_(un)reg() are missing. This means that we can fix this easily and avoid such problems in the     future by just calling virtnet_close()/open() from the freeze/restore handlers. Aside from adding the     missing xdp_rxq_info calls the only difference is that the refill work is only cancelled if     netif_running(). However, this should not make any functional difference since the refill work should only     be active if the network interface is actually up. (CVE-2022-49687)

  - In the Linux kernel, the following vulnerability has been resolved: ceph: avoid putting the realm twice     when decoding snaps fails When decoding the snaps fails it maybe leaving the 'first_realm' and 'realm'     pointing to the same snaprealm memory. And then it'll put it twice and could cause random use-after-free,     BUG_ON, etc issues. (CVE-2022-49770)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010871 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()

    This patch fixes a shift-out-of-bounds in brcmfmac that occurs in     BIT(chiprev) when a 'chiprev' provided by the device is too large.
    It should also not be equal to or greater than BITS_PER_TYPE(u32)     as we do bitwise AND with a u32 variable and BIT(chiprev). The patch     adds a check that makes the function return NULL if that is the case.
    Note that the NULL case is later handled by the bus-specific caller,     brcmf_usb_probe_cb() or brcmf_usb_reset_resume(), for example.

    Found by a modified version of syzkaller.

    UBSAN: shift-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c     shift exponent 151055786 is too large for 64-bit type 'long unsigned int'     CPU: 0 PID: 1885 Comm: kworker/0:2 Tainted: G           O      5.14.0+ #132     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org     04/01/2014     Workqueue: usb_hub_wq hub_event     Call Trace:
     dump_stack_lvl+0x57/0x7d      ubsan_epilogue+0x5/0x40
     __ubsan_handle_shift_out_of_bounds.cold+0x53/0xdb      ? lock_chain_count+0x20/0x20      brcmf_fw_alloc_request.cold+0x19/0x3ea      ? brcmf_fw_get_firmwares+0x250/0x250      ? brcmf_usb_ioctl_resp_wait+0x1a7/0x1f0      brcmf_usb_get_fwname+0x114/0x1a0      ? brcmf_usb_reset_resume+0x120/0x120      ? number+0x6c4/0x9a0      brcmf_c_process_clm_blob+0x168/0x590      ? put_dec+0x90/0x90      ? enable_ptr_key_workfn+0x20/0x20      ? brcmf_common_pd_remove+0x50/0x50      ? rcu_read_lock_sched_held+0xa1/0xd0      brcmf_c_preinit_dcmds+0x673/0xc40      ? brcmf_c_set_joinpref_default+0x100/0x100      ? rcu_read_lock_sched_held+0xa1/0xd0      ? rcu_read_lock_bh_held+0xb0/0xb0      ? lock_acquire+0x19d/0x4e0      ? find_held_lock+0x2d/0x110      ? brcmf_usb_deq+0x1cc/0x260      ? mark_held_locks+0x9f/0xe0      ? lockdep_hardirqs_on_prepare+0x273/0x3e0      ? _raw_spin_unlock_irqrestore+0x47/0x50      ? trace_hardirqs_on+0x1c/0x120      ? brcmf_usb_deq+0x1a7/0x260      ? brcmf_usb_rx_fill_all+0x5a/0xf0      brcmf_attach+0x246/0xd40      ? wiphy_new_nm+0x1476/0x1d50      ? kmemdup+0x30/0x40      brcmf_usb_probe+0x12de/0x1690      ? brcmf_usbdev_qinit.constprop.0+0x470/0x470      usb_probe_interface+0x25f/0x710      really_probe+0x1be/0xa90
     __driver_probe_device+0x2ab/0x460      ? usb_match_id.part.0+0x88/0xc0      driver_probe_device+0x49/0x120
     __device_attach_driver+0x18a/0x250      ? driver_allows_async_probing+0x120/0x120      bus_for_each_drv+0x123/0x1a0      ? bus_rescan_devices+0x20/0x20      ? lockdep_hardirqs_on_prepare+0x273/0x3e0      ? trace_hardirqs_on+0x1c/0x120
     __device_attach+0x207/0x330      ? device_bind_driver+0xb0/0xb0      ? kobject_uevent_env+0x230/0x12c0      bus_probe_device+0x1a2/0x260      device_add+0xa61/0x1ce0      ? __mutex_unlock_slowpath+0xe7/0x660      ? __fw_devlink_link_to_suppliers+0x550/0x550      usb_set_configuration+0x984/0x1770      ? kernfs_create_link+0x175/0x230      usb_generic_driver_probe+0x69/0x90      usb_probe_device+0x9c/0x220      really_probe+0x1be/0xa90
     __driver_probe_device+0x2ab/0x460      driver_probe_device+0x49/0x120
     __device_attach_driver+0x18a/0x250      ? driver_allows_async_probing+0x120/0x120      bus_for_each_drv+0x123/0x1a0      ? bus_rescan_devices+0x20/0x20      ? lockdep_hardirqs_on_prepare+0x273/0x3e0      ? trace_hardirqs_on+0x1c/0x120
     __device_attach+0x207/0x330      ? device_bind_driver+0xb0/0xb0      ? kobject_uevent_env+0x230/0x12c0      bus_probe_device+0x1a2/0x260      device_add+0xa61/0x1ce0      ? __fw_devlink_link_to_suppliers+0x550/0x550      usb_new_device.cold+0x463/0xf66      ? hub_disconnect+0x400/0x400      ? _raw_spin_unlock_irq+0x24/0x30      hub_event+0x10d5/0x3330      ? hub_port_debounce+0x280/0x280      ? __lock_acquire+0x1671/0x5790      ? wq_calc_node_cpumask+0x170/0x2a0      ? lock_release+0x640/0x640      ? rcu_read_lock_sched_held+0xa1/0xd0      ? rcu_read_lock_bh_held+0xb0/0xb0      ? lockdep_hardirqs_on_prepare+0x273/0x3e0      process_one_work+0x873/0x13e0      ? lock_release+0x640/0x640      ? pwq_dec_nr_in_flight+0x320/0x320      ? rwlock_bug.part.0+0x90/0x90      worker_thread+0x8b/0xd10      ? __kthread_parkme+0xd9/0x1d0      ? pr
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006903 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()

    This patch fixes a shift-out-of-bounds in brcmfmac that occurs in     BIT(chiprev) when a 'chiprev' provided by the device is too large.
    It should also not be equal to or greater than BITS_PER_TYPE(u32)     as we do bitwise AND with a u32 variable and BIT(chiprev). The patch     adds a check that makes the function return NULL if that is the case.
    Note that the NULL case is later handled by the bus-specific caller,     brcmf_usb_probe_cb() or brcmf_usb_reset_resume(), for example.

    Found by a modified version of syzkaller.

    UBSAN: shift-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c     shift exponent 151055786 is too large for 64-bit type 'long unsigned int'     CPU: 0 PID: 1885 Comm: kworker/0:2 Tainted: G           O      5.14.0+ #132     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org     04/01/2014     Workqueue: usb_hub_wq hub_event     Call Trace:
     dump_stack_lvl+0x57/0x7d      ubsan_epilogue+0x5/0x40
     __ubsan_handle_shift_out_of_bounds.cold+0x53/0xdb      ? lock_chain_count+0x20/0x20      brcmf_fw_alloc_request.cold+0x19/0x3ea      ? brcmf_fw_get_firmwares+0x250/0x250      ? brcmf_usb_ioctl_resp_wait+0x1a7/0x1f0      brcmf_usb_get_fwname+0x114/0x1a0      ? brcmf_usb_reset_resume+0x120/0x120      ? number+0x6c4/0x9a0      brcmf_c_process_clm_blob+0x168/0x590      ? put_dec+0x90/0x90      ? enable_ptr_key_workfn+0x20/0x20      ? brcmf_common_pd_remove+0x50/0x50      ? rcu_read_lock_sched_held+0xa1/0xd0      brcmf_c_preinit_dcmds+0x673/0xc40      ? brcmf_c_set_joinpref_default+0x100/0x100      ? rcu_read_lock_sched_held+0xa1/0xd0      ? rcu_read_lock_bh_held+0xb0/0xb0      ? lock_acquire+0x19d/0x4e0      ? find_held_lock+0x2d/0x110      ? brcmf_usb_deq+0x1cc/0x260      ? mark_held_locks+0x9f/0xe0      ? lockdep_hardirqs_on_prepare+0x273/0x3e0      ? _raw_spin_unlock_irqrestore+0x47/0x50      ? trace_hardirqs_on+0x1c/0x120      ? brcmf_usb_deq+0x1a7/0x260      ? brcmf_usb_rx_fill_all+0x5a/0xf0      brcmf_attach+0x246/0xd40      ? wiphy_new_nm+0x1476/0x1d50      ? kmemdup+0x30/0x40      brcmf_usb_probe+0x12de/0x1690      ? brcmf_usbdev_qinit.constprop.0+0x470/0x470      usb_probe_interface+0x25f/0x710      really_probe+0x1be/0xa90
     __driver_probe_device+0x2ab/0x460      ? usb_match_id.part.0+0x88/0xc0      driver_probe_device+0x49/0x120
     __device_attach_driver+0x18a/0x250      ? driver_allows_async_probing+0x120/0x120      bus_for_each_drv+0x123/0x1a0      ? bus_rescan_devices+0x20/0x20      ? lockdep_hardirqs_on_prepare+0x273/0x3e0      ? trace_hardirqs_on+0x1c/0x120
     __device_attach+0x207/0x330      ? device_bind_driver+0xb0/0xb0      ? kobject_uevent_env+0x230/0x12c0      bus_probe_device+0x1a2/0x260      device_add+0xa61/0x1ce0      ? __mutex_unlock_slowpath+0xe7/0x660      ? __fw_devlink_link_to_suppliers+0x550/0x550      usb_set_configuration+0x984/0x1770      ? kernfs_create_link+0x175/0x230      usb_generic_driver_probe+0x69/0x90      usb_probe_device+0x9c/0x220      really_probe+0x1be/0xa90
     __driver_probe_device+0x2ab/0x460      driver_probe_device+0x49/0x120
     __device_attach_driver+0x18a/0x250      ? driver_allows_async_probing+0x120/0x120      bus_for_each_drv+0x123/0x1a0      ? bus_rescan_devices+0x20/0x20      ? lockdep_hardirqs_on_prepare+0x273/0x3e0      ? trace_hardirqs_on+0x1c/0x120
     __device_attach+0x207/0x330      ? device_bind_driver+0xb0/0xb0      ? kobject_uevent_env+0x230/0x12c0      bus_probe_device+0x1a2/0x260      device_add+0xa61/0x1ce0      ? __fw_devlink_link_to_suppliers+0x550/0x550      usb_new_device.cold+0x463/0xf66      ? hub_disconnect+0x400/0x400      ? _raw_spin_unlock_irq+0x24/0x30      hub_event+0x10d5/0x3330      ? hub_port_debounce+0x280/0x280      ? __lock_acquire+0x1671/0x5790      ? wq_calc_node_cpumask+0x170/0x2a0      ? lock_release+0x640/0x640      ? rcu_read_lock_sched_held+0xa1/0xd0      ? rcu_read_lock_bh_held+0xb0/0xb0      ? lockdep_hardirqs_on_prepare+0x273/0x3e0      process_one_work+0x873/0x13e0      ? lock_release+0x640/0x640      ? pwq_dec_nr_in_flight+0x320/0x320      ? rwlock_bug.part.0+0x90/0x90      worker_thread+0x8b/0xd10      ? __kthread_parkme+0xd9/0x1d0      ? pr
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4320-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
    - CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (bsc#1249857).
    - CVE-2022-50490: bpf: Propagate error from htab_lock_bucket() to userspace (bsc#1251164).
    - CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
    - CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
    - CVE-2023-53500: xfrm: fix slab-use-after-free in decode_session6 (bsc#1250816).
    - CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
    - CVE-2023-53574: wifi: rtw88: delete timer and free skb queue when unloading (bsc#1251222).
    - CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
    - CVE-2023-53673: Bluetooth: hci_event: call disconnect callback before deleting conn (bsc#1251763).
    - CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-38084: hugetlb: unshare some PMDs when splitting VMAs (bsc#1245498).
    - CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
    - CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
    - CVE-2025-39742: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (bsc#1249479).
    - CVE-2025-39797: xfrm: Duplicate SPI Handling (bsc#1249608).
    - CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
    - CVE-2025-39967: fbcon: fix integer overflow in fbcon_do_set_font (bsc#1252033).
    - CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
    - CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
    - CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).
    - CVE-2025-39981: Bluetooth: MGMT: Fix possible UAFs (bsc#1252060).
    - CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
    - CVE-2025-40044: fs: udf: fix OOB read in lengthAllocDescs handling (bsc#1252785).

    The following non security issues were fixed:

    - NFS: remove revoked delegation from server's delegation list (bsc#1246211).
    - NFSv4: Allow FREE_STATEID to clean up delegations (bsc#1246211).
    - fbcon: Fix OOB access in font allocation (bsc#1252033)
    - kabi fix for NFSv4: Allow FREE_STATEID to clean up delegations (bsc#1246211).
    - kernel-subpackage-spec: Do not doubly-sign modules (bsc#1251930).
    - mm: avoid unnecessary page fault retires on shared memory types (bsc#1251823).
    - net: hv_netvsc: fix loss of early receive events from host during channel open (bsc#1252265).
    - net: mana: Switch to page pool for jumbo frames (bsc#1248754).
    - net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency     (bsc#1248754).
    - netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237).
    - rpm/check-for-config-changes: ignore CONFIG_SCHED_PROXY_EXEC, too (bsc#1250946)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4515-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-50364: i2c: mux: reg: check return value after calling platform_get_resource() (bsc#1250083).
    - CVE-2022-50368: drm/msm/dsi: fix memory corruption with too many bridges (bsc#1250009).
    - CVE-2022-50494: thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash     (bsc#1251173).
    - CVE-2022-50545: r6040: Fix kmemleak in probe and remove (bsc#1251285).
    - CVE-2022-50551: wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()     (bsc#1251322).
    - CVE-2022-50569: xfrm: Update ipcomp_scratches with NULL when freed (bsc#1252640).
    - CVE-2022-50578: class: fix possible memory leak in __class_register() (bsc#1252519).
    - CVE-2023-53229: wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta     (bsc#1249650).
    - CVE-2023-53369: net: dcb: choose correct policy to parse DCB_ATTR_BCN (bsc#1250206).
    - CVE-2023-53431: scsi: ses: Don't attach if enclosure has no components (bsc#1250374).
    - CVE-2023-53542: ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy (bsc#1251154).
    - CVE-2023-53597: cifs: fix mid leak during reconnection after timeout threshold (bsc#1251159).
    - CVE-2023-53641: wifi: ath9k: hif_usb: fix memory leak of remain_skbs (bsc#1251728).
    - CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).
    - CVE-2025-38436: drm/scheduler: signal scheduled fence when kill job (bsc#1247227).
    - CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
    - CVE-2025-39967: fbcon: fix integer overflow in fbcon_do_set_font (bsc#1252033).
    - CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
    - CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
    - CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).
    - CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).
    - CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).
    - CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
    - CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
    - CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
    - CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).
    - CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).
    - CVE-2025-40205: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (bsc#1253456).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4111-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
    - CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (bsc#1249857).
    - CVE-2022-50490: bpf: Propagate error from htab_lock_bucket() to userspace (bsc#1251164).
    - CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
    - CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
    - CVE-2023-53500: xfrm: fix slab-use-after-free in decode_session6 (bsc#1250816).
    - CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
    - CVE-2023-53574: wifi: rtw88: delete timer and free skb queue when unloading (bsc#1251222).
    - CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
    - CVE-2023-53673: Bluetooth: hci_event: call disconnect callback before deleting conn (bsc#1251763).
    - CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
    - CVE-2025-39742: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (bsc#1249479).
    - CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
    - CVE-2025-39967: fbcon: fix integer overflow in fbcon_do_set_font (bsc#1252033).
    - CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
    - CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
    - CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).
    - CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
    - CVE-2025-40044: fs: udf: fix OOB read in lengthAllocDescs handling (bsc#1252785).
    - CVE-2025-40088: hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (bsc#1252904).
    - CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).

    The following non security issues were fixed:

    - fbcon: Fix OOB access in font allocation (bsc#1252033)
    - mm: avoid unnecessary page fault retires on shared memory types (bsc#1251823).
    - net: hv_netvsc: fix loss of early receive events from host during channel open (bsc#1252265).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() This patch fixes a shift-     out-of-bounds in brcmfmac that occurs in BIT(chiprev) when a 'chiprev' provided by the device is too     large. It should also not be equal to or greater than BITS_PER_TYPE(u32) as we do bitwise AND with a u32     variable and BIT(chiprev). The patch adds a check that makes the function return NULL if that is the case.
    Note that the NULL case is later handled by the bus-specific caller, brcmf_usb_probe_cb() or     brcmf_usb_reset_resume(), for example. Found by a modified version of syzkaller. UBSAN: shift-out-of-     bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c shift exponent 151055786 is too     large for 64-bit type 'long unsigned int' CPU: 0 PID: 1885 Comm: kworker/0:2 Tainted: G O 5.14.0+ #132     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org     04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace: dump_stack_lvl+0x57/0x7d ubsan_epilogue+0x5/0x40
    __ubsan_handle_shift_out_of_bounds.cold+0x53/0xdb ? lock_chain_count+0x20/0x20     brcmf_fw_alloc_request.cold+0x19/0x3ea ? brcmf_fw_get_firmwares+0x250/0x250 ?     brcmf_usb_ioctl_resp_wait+0x1a7/0x1f0 brcmf_usb_get_fwname+0x114/0x1a0 ?     brcmf_usb_reset_resume+0x120/0x120 ? number+0x6c4/0x9a0 brcmf_c_process_clm_blob+0x168/0x590 ?     put_dec+0x90/0x90 ? enable_ptr_key_workfn+0x20/0x20 ? brcmf_common_pd_remove+0x50/0x50 ?     rcu_read_lock_sched_held+0xa1/0xd0 brcmf_c_preinit_dcmds+0x673/0xc40 ?     brcmf_c_set_joinpref_default+0x100/0x100 ? rcu_read_lock_sched_held+0xa1/0xd0 ?     rcu_read_lock_bh_held+0xb0/0xb0 ? lock_acquire+0x19d/0x4e0 ? find_held_lock+0x2d/0x110 ?     brcmf_usb_deq+0x1cc/0x260 ? mark_held_locks+0x9f/0xe0 ? lockdep_hardirqs_on_prepare+0x273/0x3e0 ?
    _raw_spin_unlock_irqrestore+0x47/0x50 ? trace_hardirqs_on+0x1c/0x120 ? brcmf_usb_deq+0x1a7/0x260 ?     brcmf_usb_rx_fill_all+0x5a/0xf0 brcmf_attach+0x246/0xd40 ? wiphy_new_nm+0x1476/0x1d50 ? kmemdup+0x30/0x40     brcmf_usb_probe+0x12de/0x1690 ? brcmf_usbdev_qinit.constprop.0+0x470/0x470 usb_probe_interface+0x25f/0x710     really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 ? usb_match_id.part.0+0x88/0xc0     driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 ?     driver_allows_async_probing+0x120/0x120 bus_for_each_drv+0x123/0x1a0 ? bus_rescan_devices+0x20/0x20 ?     lockdep_hardirqs_on_prepare+0x273/0x3e0 ? trace_hardirqs_on+0x1c/0x120 __device_attach+0x207/0x330 ?     device_bind_driver+0xb0/0xb0 ? kobject_uevent_env+0x230/0x12c0 bus_probe_device+0x1a2/0x260     device_add+0xa61/0x1ce0 ? __mutex_unlock_slowpath+0xe7/0x660 ? __fw_devlink_link_to_suppliers+0x550/0x550     usb_set_configuration+0x984/0x1770 ? kernfs_create_link+0x175/0x230 usb_generic_driver_probe+0x69/0x90     usb_probe_device+0x9c/0x220 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460     driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 ?     driver_allows_async_probing+0x120/0x120 bus_for_each_drv+0x123/0x1a0 ? bus_rescan_devices+0x20/0x20 ?     lockdep_hardirqs_on_prepare+0x273/0x3e0 ? trace_hardirqs_on+0x1c/0x120 __device_attach+0x207/0x330 ?     device_bind_driver+0xb0/0xb0 ? kobject_uevent_env+0x230/0x12c0 bus_probe_device+0x1a2/0x260     device_add+0xa61/0x1ce0 ? __fw_devlink_link_to_suppliers+0x550/0x550 usb_new_device.cold+0x463/0xf66 ?     hub_disconnect+0x400/0x400 ? _raw_spin_unlock_irq+0x24/0x30 hub_event+0x10d5/0x3330 ?     hub_port_debounce+0x280/0x280 ? __lock_acquire+0x1671/0x5790 ? wq_calc_node_cpumask+0x170/0x2a0 ?     lock_release+0x640/0x640 ? rcu_read_lock_sched_held+0xa1/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ?     lockdep_hardirqs_on_prepare+0x273/0x3e0 process_one_work+0x873/0x13e0 ? lock_release+0x640/0x640 ?     pwq_dec_nr_in_flight+0x320/0x320 ? rwlock_bug.part.0+0x90/0x90 worker_thread+0x8b/0xd10 ?
    __kthread_parkme+0xd9/0x1d0 ? pr ---truncated--- (CVE-2022-50551)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Type	Severity
361020	CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1773048865)	Nessus	CentOS Local Security Checks	Local	high
359803	CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1788170774)	Nessus	CentOS Local Security Checks	Local	high
353159	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1777616064)	Nessus	Alma Linux Local Security Checks	Local	high
352370	CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1773047921)	Nessus	CentOS Local Security Checks	Local	high
308660	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010871)	Nessus	Unity Linux Local Security Checks	Local	high
308209	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-006903)	Nessus	Unity Linux Local Security Checks	Local	high
280691	SUSE SLES15 : Security update for the Linux Kernel (SUSE-SU-2025:4320-1)	Nessus	SuSE Local Security Checks	Local	high
279908	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2025:4515-1)	Nessus	SuSE Local Security Checks	Local	high
275594	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2025:4111-1)	Nessus	SuSE Local Security Checks	Local	high
270169	Linux Distros Unpatched Vulnerability : CVE-2022-50551	Nessus	Misc.	Local	high
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2022-50551

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high