In the Linux kernel, the following vulnerability has been resolved: net: nfc: Fix use-after-free in local_cleanup() Fix a use-after-free that occurs in kfree_skb() called from local_cleanup(). This could happen when killing nfc daemon (e.g. neard) after detaching an nfc device. When detaching an nfc device, local_cleanup() called from nfc_llcp_unregister_device() frees local->rx_pending and decreases local->ref by kref_put() in nfc_llcp_local_put(). In the terminating process, nfc daemon releases all sockets and it leads to decreasing local->ref. After the last release of local->ref, local_cleanup() called from local_release() frees local->rx_pending again, which leads to the bug. Setting local->rx_pending to NULL in local_cleanup() could prevent use-after-free when local_cleanup() is called twice. Found by a modified version of syzkaller. BUG: KASAN: use-after-free in kfree_skb() Call Trace: dump_stack_lvl (lib/dump_stack.c:106) print_address_description.constprop.0.cold (mm/kasan/report.c:306) kasan_check_range (mm/kasan/generic.c:189) kfree_skb (net/core/skbuff.c:955) local_cleanup (net/nfc/llcp_core.c:159) nfc_llcp_local_put.part.0 (net/nfc/llcp_core.c:172) nfc_llcp_local_put (net/nfc/llcp_core.c:181) llcp_sock_destruct (net/nfc/llcp_sock.c:959) __sk_destruct (net/core/sock.c:2133) sk_destruct (net/core/sock.c:2181) __sk_free (net/core/sock.c:2192) sk_free (net/core/sock.c:2203) llcp_sock_release (net/nfc/llcp_sock.c:646) __sock_release (net/socket.c:650) sock_close (net/socket.c:1365) __fput (fs/file_table.c:306) task_work_run (kernel/task_work.c:179) ptrace_notify (kernel/signal.c:2354) syscall_exit_to_user_mode_prepare (kernel/entry/common.c:278) syscall_exit_to_user_mode (kernel/entry/common.c:296) do_syscall_64 (arch/x86/entry/common.c:86) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:106) Allocated by task 4719: kasan_save_stack (mm/kasan/common.c:45) __kasan_slab_alloc (mm/kasan/common.c:325) slab_post_alloc_hook (mm/slab.h:766) kmem_cache_alloc_node (mm/slub.c:3497) __alloc_skb (net/core/skbuff.c:552) pn533_recv_response (drivers/nfc/pn533/usb.c:65) __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1671) usb_giveback_urb_bh (drivers/usb/core/hcd.c:1704) tasklet_action_common.isra.0 (kernel/softirq.c:797) __do_softirq (kernel/softirq.c:571) Freed by task 1901: kasan_save_stack (mm/kasan/common.c:45) kasan_set_track (mm/kasan/common.c:52) kasan_save_free_info (mm/kasan/genericdd.c:518) __kasan_slab_free (mm/kasan/common.c:236) kmem_cache_free (mm/slub.c:3809) kfree_skbmem (net/core/skbuff.c:874) kfree_skb (net/core/skbuff.c:931) local_cleanup (net/nfc/llcp_core.c:159) nfc_llcp_unregister_device (net/nfc/llcp_core.c:1617) nfc_unregister_device (net/nfc/core.c:1179) pn53x_unregister_nfc (drivers/nfc/pn533/pn533.c:2846) pn533_usb_disconnect (drivers/nfc/pn533/usb.c:579) usb_unbind_interface (drivers/usb/core/driver.c:458) device_release_driver_internal (drivers/base/dd.c:1279) bus_remove_device (drivers/base/bus.c:529) device_del (drivers/base/core.c:3665) usb_disable_device (drivers/usb/core/message.c:1420) usb_disconnect (drivers/usb/core.c:2261) hub_event (drivers/usb/core/hub.c:5833) process_one_work (arch/x86/include/asm/jump_label.h:27 include/linux/jump_label.h:212 include/trace/events/workqueue.h:108 kernel/workqueue.c:2281) worker_thread (include/linux/list.h:282 kernel/workqueue.c:2423) kthread (kernel/kthread.c:319) ret_from_fork (arch/x86/entry/entry_64.S:301)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990350 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: nfc: Fix use-after-free in local_cleanup()

    Fix a use-after-free that occurs in kfree_skb() called from     local_cleanup(). This could happen when killing nfc daemon (e.g. neard)     after detaching an nfc device.
    When detaching an nfc device, local_cleanup() called from     nfc_llcp_unregister_device() frees local->rx_pending and decreases     local->ref by kref_put() in nfc_llcp_local_put().
    In the terminating process, nfc daemon releases all sockets and it leads     to decreasing local->ref. After the last release of local->ref,     local_cleanup() called from local_release() frees local->rx_pending     again, which leads to the bug.

    Setting local->rx_pending to NULL in local_cleanup() could prevent     use-after-free when local_cleanup() is called twice.

    Found by a modified version of syzkaller.

    BUG: KASAN: use-after-free in kfree_skb()

    Call Trace:
    dump_stack_lvl (lib/dump_stack.c:106)     print_address_description.constprop.0.cold (mm/kasan/report.c:306)     kasan_check_range (mm/kasan/generic.c:189)     kfree_skb (net/core/skbuff.c:955)     local_cleanup (net/nfc/llcp_core.c:159)     nfc_llcp_local_put.part.0 (net/nfc/llcp_core.c:172)     nfc_llcp_local_put (net/nfc/llcp_core.c:181)     llcp_sock_destruct (net/nfc/llcp_sock.c:959)
    __sk_destruct (net/core/sock.c:2133)     sk_destruct (net/core/sock.c:2181)
    __sk_free (net/core/sock.c:2192)     sk_free (net/core/sock.c:2203)     llcp_sock_release (net/nfc/llcp_sock.c:646)
    __sock_release (net/socket.c:650)     sock_close (net/socket.c:1365)
    __fput (fs/file_table.c:306)     task_work_run (kernel/task_work.c:179)     ptrace_notify (kernel/signal.c:2354)     syscall_exit_to_user_mode_prepare (kernel/entry/common.c:278)     syscall_exit_to_user_mode (kernel/entry/common.c:296)     do_syscall_64 (arch/x86/entry/common.c:86)     entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:106)

    Allocated by task 4719:
    kasan_save_stack (mm/kasan/common.c:45)
    __kasan_slab_alloc (mm/kasan/common.c:325)     slab_post_alloc_hook (mm/slab.h:766)     kmem_cache_alloc_node (mm/slub.c:3497)
    __alloc_skb (net/core/skbuff.c:552)     pn533_recv_response (drivers/nfc/pn533/usb.c:65)
    __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1671)     usb_giveback_urb_bh (drivers/usb/core/hcd.c:1704)     tasklet_action_common.isra.0 (kernel/softirq.c:797)
    __do_softirq (kernel/softirq.c:571)

    Freed by task 1901:
    kasan_save_stack (mm/kasan/common.c:45)     kasan_set_track (mm/kasan/common.c:52)     kasan_save_free_info (mm/kasan/genericdd.c:518)
    __kasan_slab_free (mm/kasan/common.c:236)     kmem_cache_free (mm/slub.c:3809)     kfree_skbmem (net/core/skbuff.c:874)     kfree_skb (net/core/skbuff.c:931)     local_cleanup (net/nfc/llcp_core.c:159)     nfc_llcp_unregister_device (net/nfc/llcp_core.c:1617)     nfc_unregister_device (net/nfc/core.c:1179)     pn53x_unregister_nfc (drivers/nfc/pn533/pn533.c:2846)     pn533_usb_disconnect (drivers/nfc/pn533/usb.c:579)     usb_unbind_interface (drivers/usb/core/driver.c:458)     device_release_driver_internal (drivers/base/dd.c:1279)     bus_remove_device (drivers/base/bus.c:529)     device_del (drivers/base/core.c:3665)     usb_disable_device (drivers/usb/core/message.c:1420)     usb_disconnect (drivers/usb/core.c:2261)     hub_event (drivers/usb/core/hub.c:5833)     process_one_work (arch/x86/include/asm/jump_label.h:27 include/linux/jump_label.h:212     include/trace/events/workqueue.h:108 kernel/workqueue.c:2281)     worker_thread (include/linux/list.h:282 kernel/workqueue.c:2423)     kthread (kernel/kthread.c:319)     ret_from_fork (arch/x86/entry/entry_64.S:301)

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987343 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: nfc: Fix use-after-free in local_cleanup()

    Fix a use-after-free that occurs in kfree_skb() called from     local_cleanup(). This could happen when killing nfc daemon (e.g. neard)     after detaching an nfc device.
    When detaching an nfc device, local_cleanup() called from     nfc_llcp_unregister_device() frees local->rx_pending and decreases     local->ref by kref_put() in nfc_llcp_local_put().
    In the terminating process, nfc daemon releases all sockets and it leads     to decreasing local->ref. After the last release of local->ref,     local_cleanup() called from local_release() frees local->rx_pending     again, which leads to the bug.

    Setting local->rx_pending to NULL in local_cleanup() could prevent     use-after-free when local_cleanup() is called twice.

    Found by a modified version of syzkaller.

    BUG: KASAN: use-after-free in kfree_skb()

    Call Trace:
    dump_stack_lvl (lib/dump_stack.c:106)     print_address_description.constprop.0.cold (mm/kasan/report.c:306)     kasan_check_range (mm/kasan/generic.c:189)     kfree_skb (net/core/skbuff.c:955)     local_cleanup (net/nfc/llcp_core.c:159)     nfc_llcp_local_put.part.0 (net/nfc/llcp_core.c:172)     nfc_llcp_local_put (net/nfc/llcp_core.c:181)     llcp_sock_destruct (net/nfc/llcp_sock.c:959)
    __sk_destruct (net/core/sock.c:2133)     sk_destruct (net/core/sock.c:2181)
    __sk_free (net/core/sock.c:2192)     sk_free (net/core/sock.c:2203)     llcp_sock_release (net/nfc/llcp_sock.c:646)
    __sock_release (net/socket.c:650)     sock_close (net/socket.c:1365)
    __fput (fs/file_table.c:306)     task_work_run (kernel/task_work.c:179)     ptrace_notify (kernel/signal.c:2354)     syscall_exit_to_user_mode_prepare (kernel/entry/common.c:278)     syscall_exit_to_user_mode (kernel/entry/common.c:296)     do_syscall_64 (arch/x86/entry/common.c:86)     entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:106)

    Allocated by task 4719:
    kasan_save_stack (mm/kasan/common.c:45)
    __kasan_slab_alloc (mm/kasan/common.c:325)     slab_post_alloc_hook (mm/slab.h:766)     kmem_cache_alloc_node (mm/slub.c:3497)
    __alloc_skb (net/core/skbuff.c:552)     pn533_recv_response (drivers/nfc/pn533/usb.c:65)
    __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1671)     usb_giveback_urb_bh (drivers/usb/core/hcd.c:1704)     tasklet_action_common.isra.0 (kernel/softirq.c:797)
    __do_softirq (kernel/softirq.c:571)

    Freed by task 1901:
    kasan_save_stack (mm/kasan/common.c:45)     kasan_set_track (mm/kasan/common.c:52)     kasan_save_free_info (mm/kasan/genericdd.c:518)
    __kasan_slab_free (mm/kasan/common.c:236)     kmem_cache_free (mm/slub.c:3809)     kfree_skbmem (net/core/skbuff.c:874)     kfree_skb (net/core/skbuff.c:931)     local_cleanup (net/nfc/llcp_core.c:159)     nfc_llcp_unregister_device (net/nfc/llcp_core.c:1617)     nfc_unregister_device (net/nfc/core.c:1179)     pn53x_unregister_nfc (drivers/nfc/pn533/pn533.c:2846)     pn533_usb_disconnect (drivers/nfc/pn533/usb.c:579)     usb_unbind_interface (drivers/usb/core/driver.c:458)     device_release_driver_internal (drivers/base/dd.c:1279)     bus_remove_device (drivers/base/bus.c:529)     device_del (drivers/base/core.c:3665)     usb_disable_device (drivers/usb/core/message.c:1420)     usb_disconnect (drivers/usb/core.c:2261)     hub_event (drivers/usb/core/hub.c:5833)     process_one_work (arch/x86/include/asm/jump_label.h:27 include/linux/jump_label.h:212     include/trace/events/workqueue.h:108 kernel/workqueue.c:2281)     worker_thread (include/linux/list.h:282 kernel/workqueue.c:2423)     kthread (kernel/kthread.c:319)     ret_from_fork (arch/x86/entry/entry_64.S:301)

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: nfc: Fix use-after-free in local_cleanup() Fix a use-after-free that occurs in kfree_skb() called     from local_cleanup(). This could happen when killing nfc daemon (e.g. neard) after detaching an nfc     device. When detaching an nfc device, local_cleanup() called from nfc_llcp_unregister_device() frees     local->rx_pending and decreases local->ref by kref_put() in nfc_llcp_local_put(). In the terminating     process, nfc daemon releases all sockets and it leads to decreasing local->ref. After the last release of     local->ref, local_cleanup() called from local_release() frees local->rx_pending again, which leads to the     bug. Setting local->rx_pending to NULL in local_cleanup() could prevent use-after-free when     local_cleanup() is called twice. Found by a modified version of syzkaller. BUG: KASAN: use-after-free in     kfree_skb() Call Trace: dump_stack_lvl (lib/dump_stack.c:106) print_address_description.constprop.0.cold     (mm/kasan/report.c:306) kasan_check_range (mm/kasan/generic.c:189) kfree_skb (net/core/skbuff.c:955)     local_cleanup (net/nfc/llcp_core.c:159) nfc_llcp_local_put.part.0 (net/nfc/llcp_core.c:172)     nfc_llcp_local_put (net/nfc/llcp_core.c:181) llcp_sock_destruct (net/nfc/llcp_sock.c:959) __sk_destruct     (net/core/sock.c:2133) sk_destruct (net/core/sock.c:2181) __sk_free (net/core/sock.c:2192) sk_free     (net/core/sock.c:2203) llcp_sock_release (net/nfc/llcp_sock.c:646) __sock_release (net/socket.c:650)     sock_close (net/socket.c:1365) __fput (fs/file_table.c:306) task_work_run (kernel/task_work.c:179)     ptrace_notify (kernel/signal.c:2354) syscall_exit_to_user_mode_prepare (kernel/entry/common.c:278)     syscall_exit_to_user_mode (kernel/entry/common.c:296) do_syscall_64 (arch/x86/entry/common.c:86)     entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:106) Allocated by task 4719: kasan_save_stack     (mm/kasan/common.c:45) __kasan_slab_alloc (mm/kasan/common.c:325) slab_post_alloc_hook (mm/slab.h:766)     kmem_cache_alloc_node (mm/slub.c:3497) __alloc_skb (net/core/skbuff.c:552) pn533_recv_response     (drivers/nfc/pn533/usb.c:65) __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1671) usb_giveback_urb_bh     (drivers/usb/core/hcd.c:1704) tasklet_action_common.isra.0 (kernel/softirq.c:797) __do_softirq     (kernel/softirq.c:571) Freed by task 1901: kasan_save_stack (mm/kasan/common.c:45) kasan_set_track     (mm/kasan/common.c:52) kasan_save_free_info (mm/kasan/genericdd.c:518) __kasan_slab_free     (mm/kasan/common.c:236) kmem_cache_free (mm/slub.c:3809) kfree_skbmem (net/core/skbuff.c:874) kfree_skb     (net/core/skbuff.c:931) local_cleanup (net/nfc/llcp_core.c:159) nfc_llcp_unregister_device     (net/nfc/llcp_core.c:1617) nfc_unregister_device (net/nfc/core.c:1179) pn53x_unregister_nfc     (drivers/nfc/pn533/pn533.c:2846) pn533_usb_disconnect (drivers/nfc/pn533/usb.c:579) usb_unbind_interface     (drivers/usb/core/driver.c:458) device_release_driver_internal (drivers/base/dd.c:1279) bus_remove_device     (drivers/base/bus.c:529) device_del (drivers/base/core.c:3665) usb_disable_device     (drivers/usb/core/message.c:1420) usb_disconnect (drivers/usb/core.c:2261) hub_event     (drivers/usb/core/hub.c:5833) process_one_work (arch/x86/include/asm/jump_label.h:27     include/linux/jump_label.h:212 include/trace/events/workqueue.h:108 kernel/workqueue.c:2281) worker_thread     (include/linux/list.h:282 kernel/workqueue.c:2423) kthread (kernel/kthread.c:319) ret_from_fork     (arch/x86/entry/entry_64.S:301) (CVE-2023-53023)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01600-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-47659: drm/plane: Move range check for format_count earlier (bsc#1237839).
    - CVE-2022-49044: dm integrity: fix memory corruption when tag_size is less than digest size     (bsc#1237840).
    - CVE-2022-49055: drm/amdkfd: Check for potential null return of kmalloc_array() (bsc#1237868).
    - CVE-2022-49060: net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() (bsc#1237845).
    - CVE-2022-49086: net: openvswitch: fix leak of nested actions (bsc#1238037).
    - CVE-2022-49111: Bluetooth: Fix use after free in hci_send_acl (bsc#1237984).
    - CVE-2022-49118: scsi: hisi_sas: Free irq vectors in order for v3 HW (bsc#1237979).
    - CVE-2022-49121: scsi: pm8001: Fix tag leaks on error (bsc#1237926).
    - CVE-2022-49137: drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj (bsc#1238155).
    - CVE-2022-49175: PM: core: keep irq flags in device_pm_check_callbacks() (bsc#1238099).
    - CVE-2022-49176: bfq: fix use-after-free in bfq_dispatch_request (bsc#1238097).
    - CVE-2022-49179: block, bfq: do not move oom_bfqq (bsc#1238092).
    - CVE-2022-49188: remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region (bsc#1238138).
    - CVE-2022-49197: af_netlink: Fix shift out of bounds in group mask calculation (bsc#1238455).
    - CVE-2022-49205: bpf, sockmap: Fix double uncharge the mem of sk_msg (bsc#1238335).
    - CVE-2022-49232: drm/amd/display: Fix a NULL pointer dereference in     amdgpu_dm_connector_add_common_modes() (bsc#1238139).
    - CVE-2022-49290: mac80211: fix potential double free on mesh join (bsc#1238156).
    - CVE-2022-49305: drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() (bsc#1238645).
    - CVE-2022-49325: tcp: add accessors to read/set tp->snd_cwnd (bsc#1238398).
    - CVE-2022-49335: drm/amdgpu/cs: make commands with 0 chunks illegal behaviour (bsc#1238377).
    - CVE-2022-49351: net: altera: Fix refcount leak in altera_tse_mdio_create (bsc#1237939).
    - CVE-2022-49385: driver: base: fix UAF when driver_attach failed (bsc#1237951).
    - CVE-2022-49390: macsec: fix UAF bug for real_dev (bsc#1238233).
    - CVE-2022-49411: bfq: Make sure bfqg for which we are queueing requests is online (bsc#1238307).
    - CVE-2022-49442: drivers/base/node.c: fix compaction sysfs file leak (bsc#1238243).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49478: media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init (bsc#1238000).
    - CVE-2022-49489: drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm     runtime resume (bsc#1238244).
    - CVE-2022-49504: scsi: lpfc: Inhibit aborts if external loopback plug is inserted (bsc#1238835).
    - CVE-2022-49521: scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() (bsc#1238938).
    - CVE-2022-49525: media: cx25821: Fix the warning when removing the module (bsc#1238022).
    - CVE-2022-49534: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT (bsc#1238893).
    - CVE-2022-49535: scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI     (bsc#1238937).
    - CVE-2022-49536: scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock (bsc#1238838).
    - CVE-2022-49537: scsi: lpfc: Fix call trace observed during I/O with CMF enabled (bsc#1238930).
    - CVE-2022-49542: scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg() (bsc#1238722).
    - CVE-2022-49561: netfilter: conntrack: re-fetch conntrack after insertion (bsc#1238537).
    - CVE-2022-49590: igmp: Fix data-races around sysctl_igmp_llm_reports (bsc#1238844).
    - CVE-2022-49658: bpf, selftests: Add verifier test case for imm=0,umin=0,umax=1 scalar (bsc#1238803).
    - CVE-2022-49668: PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events (bsc#1237957).
    - CVE-2022-49693: drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf (bsc#1237954).
    - CVE-2022-49725: i40e: Fix call trace in setup_tx_descriptors (bsc#1238016).
    - CVE-2022-49728: kABI workaround for changeing the variable length type to size_t (bsc#1239111).
    - CVE-2022-49730: scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted (bsc#1239070).
    - CVE-2022-49749: i2c: designware: use casting of u64 in clock multiplication to avoid overflow     (bsc#1240243).
    - CVE-2022-49753: dmaengine: Fix double increment of client_count in dma_chan_get() (bsc#1240250).
    - CVE-2023-53023: net: nfc: Fix use-after-free in local_cleanup() (bsc#1240309).
    - CVE-2023-53032: netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function     (bsc#1240270).
    - CVE-2024-49994: block: fix integer overflow in BLKSECDISCARD (bsc#1237757).
    - CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
    - CVE-2024-50272: filemap: Fix bounds checking in filemap_read() (bsc#1233461 bsc#1234209).
    - CVE-2024-52559: drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit() (bsc#1238507).
    - CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
    - CVE-2024-56590: skbuff: introduce skb_pull_data (bsc#1235038).
    - CVE-2024-56641: net/smc: initialize close_work early to avoid warning (bsc#1235526).
    - CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
    - CVE-2024-57980: media: uvcvideo: Fix double free in error path (bsc#1237911).
    - CVE-2024-57981: usb: xhci: Fix NULL pointer dereference on certain command aborts (bsc#1237912).
    - CVE-2024-58005: tpm: Change to kvalloc() in eventlog/acpi.c (bsc#1237873).
    - CVE-2024-58009: Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc (bsc#1238760).
    - CVE-2024-58017: printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX (bsc#1237950     bsc#1239112).
    - CVE-2024-58063: wifi: rtlwifi: fix memory leaks and invalid access at probe error path (bsc#1238984).
    - CVE-2024-58093: PCI/ASPM: Fix link state exit during switch upstream function removal (bsc#1241347).
    - CVE-2025-21635: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy (bsc#1236111).
    - CVE-2025-21735: NFC: nci: Add bounds checking in nci_hci_create_pipe() (bsc#1238497).
    - CVE-2025-21750: wifi: brcmfmac: Check the return value of of_property_read_string_index() (bsc#1238905).
    - CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
    - CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21779: KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel     (bsc#1238768).
    - CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
    - CVE-2025-21862: drop_monitor: fix incorrect initialization order (bsc#1239474).
    - CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
    - CVE-2025-21909: wifi: nl80211: reject cooked mode if it is set along with other flags (bsc#1240590).
    - CVE-2025-21910: wifi: cfg80211: regulatory: improve invalid hints checking (bsc#1240583).
    - CVE-2025-21926: net: gso: fix ownership in __udp_gso_segment (bsc#1240712).
    - CVE-2025-21927: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (bsc#1240714).
    - CVE-2025-21931: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio (bsc#1240709).
    - CVE-2025-21941: drm/amd/display: Fix null check for pipe_ctx->plane_state in (bsc#1240701).
    - CVE-2025-21948: HID: appleir: Fix potential NULL dereference at raw event handle (bsc#1240703).
    - CVE-2025-21956: drm/amd/display: Assign normalized_pix_clk when color depth = 14 (bsc#1240739).
    - CVE-2025-21957: scsi: qla1280: Fix kernel oops when debug level > 2 (bsc#1240742).
    - CVE-2025-21963: cifs: Fix integer overflow while processing acdirmax mount option (bsc#1240717).
    - CVE-2025-21964: cifs: Fix integer overflow while processing acregmax mount option (bsc#1240740).
    - CVE-2025-21976: fbdev: hyperv_fb: Allow graceful removal of framebuffer (bsc#1241145).
    - CVE-2025-22004: net: atm: fix use after free in lec_send() (bsc#1240835).
    - CVE-2025-22008: regulator: check that dummy regulator has been probed before using it (bsc#1240942).
    - CVE-2025-22010: RDMA/hns: Fix soft lockup during bt pages loop (bsc#1240943).
    - CVE-2025-22018: atm: Fix NULL pointer dereference (bsc#1241266).
    - CVE-2025-22053: net: ibmveth: make veth_pool_store stop hanging (bsc#1241373).
    - CVE-2025-22055: net: fix geneve_opt length integer overflow (bsc#1241371).
    - CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
    - CVE-2025-22086: RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (bsc#1241458).
    - CVE-2025-23131: dlm: prevent NPD when writing a positive value to event_done (bsc#1241601).
    - CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1241-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
    - CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync     (bsc#1239095).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1195-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
    - CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
    - CVE-2025-21714: RDMA/mlx5: Fix implicit ODP use after free (bsc#1237890).
    - CVE-2025-21732: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (bsc#1237877).
    - CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
272499	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990350)	Nessus	Unity Linux Local Security Checks	high
268580	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987343)	Nessus	Unity Linux Local Security Checks	high
247977	Linux Distros Unpatched Vulnerability : CVE-2023-53023	Nessus	Misc.	high
237099	SUSE SLES12 Security Update : kernel (SUSE-SU-2025:01600-1)	Nessus	SuSE Local Security Checks	high
234407	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1241-1)	Nessus	SuSE Local Security Checks	high
234182	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1195-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2023-53023

high

Tenable Plugins

high

high

high

high

high

high