In the Linux kernel, the following vulnerability has been resolved: riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode When CONFIG_FRAME_POINTER is unset, the stack unwinding function walk_stackframe randomly reads the stack and then, when KASAN is enabled, it can lead to the following backtrace: [ 0.000000] ================================================================== [ 0.000000] BUG: KASAN: stack-out-of-bounds in walk_stackframe+0xa6/0x11a [ 0.000000] Read of size 8 at addr ffffffff81807c40 by task swapper/0 [ 0.000000] [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43 [ 0.000000] Hardware name: riscv-virtio,qemu (DT) [ 0.000000] Call Trace: [ 0.000000] [<ffffffff80007ba8>] walk_stackframe+0x0/0x11a [ 0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a [ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000] [<ffffffff80c49c80>] dump_stack_lvl+0x22/0x36 [ 0.000000] [<ffffffff80c3783e>] print_report+0x198/0x4a8 [ 0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a [ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000] [<ffffffff8015f68a>] kasan_report+0x9a/0xc8 [ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000] [<ffffffff8006e99c>] desc_make_final+0x80/0x84 [ 0.000000] [<ffffffff8009a04e>] stack_trace_save+0x88/0xa6 [ 0.000000] [<ffffffff80099fc2>] filter_irq_stacks+0x72/0x76 [ 0.000000] [<ffffffff8006b95e>] devkmsg_read+0x32a/0x32e [ 0.000000] [<ffffffff8015ec16>] kasan_save_stack+0x28/0x52 [ 0.000000] [<ffffffff8006e998>] desc_make_final+0x7c/0x84 [ 0.000000] [<ffffffff8009a04a>] stack_trace_save+0x84/0xa6 [ 0.000000] [<ffffffff8015ec52>] kasan_set_track+0x12/0x20 [ 0.000000] [<ffffffff8015f22e>] __kasan_slab_alloc+0x58/0x5e [ 0.000000] [<ffffffff8015e7ea>] __kmem_cache_create+0x21e/0x39a [ 0.000000] [<ffffffff80e133ac>] create_boot_cache+0x70/0x9c [ 0.000000] [<ffffffff80e17ab2>] kmem_cache_init+0x6c/0x11e [ 0.000000] [<ffffffff80e00fd6>] mm_init+0xd8/0xfe [ 0.000000] [<ffffffff80e011d8>] start_kernel+0x190/0x3ca [ 0.000000] [ 0.000000] The buggy address belongs to stack of task swapper/0 [ 0.000000] and is located at offset 0 in frame: [ 0.000000] stack_trace_save+0x0/0xa6 [ 0.000000] [ 0.000000] This frame has 1 object: [ 0.000000] [32, 56) 'c' [ 0.000000] [ 0.000000] The buggy address belongs to the physical page: [ 0.000000] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x81a07 [ 0.000000] flags: 0x1000(reserved|zone=0) [ 0.000000] raw: 0000000000001000 ff600003f1e3d150 ff600003f1e3d150 0000000000000000 [ 0.000000] raw: 0000000000000000 0000000000000000 00000001ffffffff [ 0.000000] page dumped because: kasan: bad access detected [ 0.000000] [ 0.000000] Memory state around the buggy address: [ 0.000000] ffffffff81807b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ffffffff81807b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] >ffffffff81807c00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f3 [ 0.000000] ^ [ 0.000000] ffffffff81807c80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ffffffff81807d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ================================================================== Fix that by using READ_ONCE_NOCHECK when reading the stack in imprecise mode.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992949 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode

    When CONFIG_FRAME_POINTER is unset, the stack unwinding function     walk_stackframe randomly reads the stack and then, when KASAN is enabled,     it can lead to the following backtrace:

    [    0.000000] ==================================================================     [    0.000000] BUG: KASAN: stack-out-of-bounds in walk_stackframe+0xa6/0x11a     [    0.000000] Read of size 8 at addr ffffffff81807c40 by task swapper/0     [    0.000000]     [    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43     [    0.000000] Hardware name: riscv-virtio,qemu (DT)     [    0.000000] Call Trace:
    [    0.000000] [<ffffffff80007ba8>] walk_stackframe+0x0/0x11a     [    0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a     [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a     [    0.000000] [<ffffffff80c49c80>] dump_stack_lvl+0x22/0x36     [    0.000000] [<ffffffff80c3783e>] print_report+0x198/0x4a8     [    0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a     [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a     [    0.000000] [<ffffffff8015f68a>] kasan_report+0x9a/0xc8     [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a     [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a     [    0.000000] [<ffffffff8006e99c>] desc_make_final+0x80/0x84     [    0.000000] [<ffffffff8009a04e>] stack_trace_save+0x88/0xa6     [    0.000000] [<ffffffff80099fc2>] filter_irq_stacks+0x72/0x76     [    0.000000] [<ffffffff8006b95e>] devkmsg_read+0x32a/0x32e     [    0.000000] [<ffffffff8015ec16>] kasan_save_stack+0x28/0x52     [    0.000000] [<ffffffff8006e998>] desc_make_final+0x7c/0x84     [    0.000000] [<ffffffff8009a04a>] stack_trace_save+0x84/0xa6     [    0.000000] [<ffffffff8015ec52>] kasan_set_track+0x12/0x20     [    0.000000] [<ffffffff8015f22e>] __kasan_slab_alloc+0x58/0x5e     [    0.000000] [<ffffffff8015e7ea>] __kmem_cache_create+0x21e/0x39a     [    0.000000] [<ffffffff80e133ac>] create_boot_cache+0x70/0x9c     [    0.000000] [<ffffffff80e17ab2>] kmem_cache_init+0x6c/0x11e     [    0.000000] [<ffffffff80e00fd6>] mm_init+0xd8/0xfe     [    0.000000] [<ffffffff80e011d8>] start_kernel+0x190/0x3ca     [    0.000000]     [    0.000000] The buggy address belongs to stack of task swapper/0     [    0.000000]  and is located at offset 0 in frame:
    [    0.000000]  stack_trace_save+0x0/0xa6     [    0.000000]     [    0.000000] This frame has 1 object:
    [    0.000000]  [32, 56) 'c'     [    0.000000]     [    0.000000] The buggy address belongs to the physical page:
    [    0.000000] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x81a07     [    0.000000] flags: 0x1000(reserved|zone=0)     [    0.000000] raw: 0000000000001000 ff600003f1e3d150 ff600003f1e3d150 0000000000000000     [    0.000000] raw: 0000000000000000 0000000000000000 00000001ffffffff     [    0.000000] page dumped because: kasan: bad access detected     [    0.000000]     [    0.000000] Memory state around the buggy address:
    [    0.000000]  ffffffff81807b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     [    0.000000]  ffffffff81807b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     [    0.000000] >ffffffff81807c00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f3     [    0.000000]                                            ^     [    0.000000]  ffffffff81807c80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00     [    0.000000]  ffffffff81807d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     [    0.000000] ==================================================================

    Fix that by using READ_ONCE_NOCHECK when reading the stack in imprecise     mode.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990809 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode

    When CONFIG_FRAME_POINTER is unset, the stack unwinding function     walk_stackframe randomly reads the stack and then, when KASAN is enabled,     it can lead to the following backtrace:

    [    0.000000] ==================================================================     [    0.000000] BUG: KASAN: stack-out-of-bounds in walk_stackframe+0xa6/0x11a     [    0.000000] Read of size 8 at addr ffffffff81807c40 by task swapper/0     [    0.000000]     [    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43     [    0.000000] Hardware name: riscv-virtio,qemu (DT)     [    0.000000] Call Trace:
    [    0.000000] [<ffffffff80007ba8>] walk_stackframe+0x0/0x11a     [    0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a     [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a     [    0.000000] [<ffffffff80c49c80>] dump_stack_lvl+0x22/0x36     [    0.000000] [<ffffffff80c3783e>] print_report+0x198/0x4a8     [    0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a     [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a     [    0.000000] [<ffffffff8015f68a>] kasan_report+0x9a/0xc8     [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a     [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a     [    0.000000] [<ffffffff8006e99c>] desc_make_final+0x80/0x84     [    0.000000] [<ffffffff8009a04e>] stack_trace_save+0x88/0xa6     [    0.000000] [<ffffffff80099fc2>] filter_irq_stacks+0x72/0x76     [    0.000000] [<ffffffff8006b95e>] devkmsg_read+0x32a/0x32e     [    0.000000] [<ffffffff8015ec16>] kasan_save_stack+0x28/0x52     [    0.000000] [<ffffffff8006e998>] desc_make_final+0x7c/0x84     [    0.000000] [<ffffffff8009a04a>] stack_trace_save+0x84/0xa6     [    0.000000] [<ffffffff8015ec52>] kasan_set_track+0x12/0x20     [    0.000000] [<ffffffff8015f22e>] __kasan_slab_alloc+0x58/0x5e     [    0.000000] [<ffffffff8015e7ea>] __kmem_cache_create+0x21e/0x39a     [    0.000000] [<ffffffff80e133ac>] create_boot_cache+0x70/0x9c     [    0.000000] [<ffffffff80e17ab2>] kmem_cache_init+0x6c/0x11e     [    0.000000] [<ffffffff80e00fd6>] mm_init+0xd8/0xfe     [    0.000000] [<ffffffff80e011d8>] start_kernel+0x190/0x3ca     [    0.000000]     [    0.000000] The buggy address belongs to stack of task swapper/0     [    0.000000]  and is located at offset 0 in frame:
    [    0.000000]  stack_trace_save+0x0/0xa6     [    0.000000]     [    0.000000] This frame has 1 object:
    [    0.000000]  [32, 56) 'c'     [    0.000000]     [    0.000000] The buggy address belongs to the physical page:
    [    0.000000] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x81a07     [    0.000000] flags: 0x1000(reserved|zone=0)     [    0.000000] raw: 0000000000001000 ff600003f1e3d150 ff600003f1e3d150 0000000000000000     [    0.000000] raw: 0000000000000000 0000000000000000 00000001ffffffff     [    0.000000] page dumped because: kasan: bad access detected     [    0.000000]     [    0.000000] Memory state around the buggy address:
    [    0.000000]  ffffffff81807b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     [    0.000000]  ffffffff81807b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     [    0.000000] >ffffffff81807c00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f3     [    0.000000]                                            ^     [    0.000000]  ffffffff81807c80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00     [    0.000000]  ffffffff81807d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     [    0.000000] ==================================================================

    Fix that by using READ_ONCE_NOCHECK when reading the stack in imprecise     mode.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode When CONFIG_FRAME_POINTER is unset, the     stack unwinding function walk_stackframe randomly reads the stack and then, when KASAN is enabled, it can     lead to the following backtrace: [ 0.000000]     ================================================================== [ 0.000000] BUG: KASAN: stack-out-of-     bounds in walk_stackframe+0xa6/0x11a [ 0.000000] Read of size 8 at addr ffffffff81807c40 by task swapper/0     [ 0.000000] [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43 [ 0.000000]     Hardware name: riscv-virtio,qemu (DT) [ 0.000000] Call Trace: [ 0.000000] [<ffffffff80007ba8>]     walk_stackframe+0x0/0x11a [ 0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a [ 0.000000]     [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000] [<ffffffff80c49c80>] dump_stack_lvl+0x22/0x36     [ 0.000000] [<ffffffff80c3783e>] print_report+0x198/0x4a8 [ 0.000000] [<ffffffff80099ecc>]     init_param_lock+0x26/0x2a [ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000]     [<ffffffff8015f68a>] kasan_report+0x9a/0xc8 [ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [     0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000] [<ffffffff8006e99c>]     desc_make_final+0x80/0x84 [ 0.000000] [<ffffffff8009a04e>] stack_trace_save+0x88/0xa6 [ 0.000000]     [<ffffffff80099fc2>] filter_irq_stacks+0x72/0x76 [ 0.000000] [<ffffffff8006b95e>] devkmsg_read+0x32a/0x32e     [ 0.000000] [<ffffffff8015ec16>] kasan_save_stack+0x28/0x52 [ 0.000000] [<ffffffff8006e998>]     desc_make_final+0x7c/0x84 [ 0.000000] [<ffffffff8009a04a>] stack_trace_save+0x84/0xa6 [ 0.000000]     [<ffffffff8015ec52>] kasan_set_track+0x12/0x20 [ 0.000000] [<ffffffff8015f22e>]
    __kasan_slab_alloc+0x58/0x5e [ 0.000000] [<ffffffff8015e7ea>] __kmem_cache_create+0x21e/0x39a [ 0.000000]     [<ffffffff80e133ac>] create_boot_cache+0x70/0x9c [ 0.000000] [<ffffffff80e17ab2>]     kmem_cache_init+0x6c/0x11e [ 0.000000] [<ffffffff80e00fd6>] mm_init+0xd8/0xfe [ 0.000000]     [<ffffffff80e011d8>] start_kernel+0x190/0x3ca [ 0.000000] [ 0.000000] The buggy address belongs to stack     of task swapper/0 [ 0.000000] and is located at offset 0 in frame: [ 0.000000] stack_trace_save+0x0/0xa6 [     0.000000] [ 0.000000] This frame has 1 object: [ 0.000000] [32, 56) 'c' [ 0.000000] [ 0.000000] The buggy     address belongs to the physical page: [ 0.000000] page:(____ptrval____) refcount:1 mapcount:0     mapping:0000000000000000 index:0x0 pfn:0x81a07 [ 0.000000] flags: 0x1000(reserved|zone=0) [ 0.000000] raw:
    0000000000001000 ff600003f1e3d150 ff600003f1e3d150 0000000000000000 [ 0.000000] raw: 0000000000000000     0000000000000000 00000001ffffffff [ 0.000000] page dumped because: kasan: bad access detected [ 0.000000]     [ 0.000000] Memory state around the buggy address: [ 0.000000] ffffffff81807b00: 00 00 00 00 00 00 00 00     00 00 00 00 00 00 00 00 [ 0.000000] ffffffff81807b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [     0.000000] >ffffffff81807c00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f3 [ 0.000000] ^ [ 0.000000]     ffffffff81807c80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ffffffff81807d00: 00 00 00     00 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000]     ================================================================== Fix that by using READ_ONCE_NOCHECK     when reading the stack in imprecise mode. (CVE-2023-53135)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
281263	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992949)	Nessus	Unity Linux Local Security Checks	high
275069	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990809)	Nessus	Unity Linux Local Security Checks	high
246354	Linux Distros Unpatched Vulnerability : CVE-2023-53135	Nessus	Misc.	high

Detections

Analytics

CVE-2023-53135

high

Tenable Plugins

high

high

high