In the Linux kernel, the following vulnerability has been resolved: sctp: check send stream number after wait_for_sndbuf This patch fixes a corner case where the asoc out stream count may change after wait_for_sndbuf. When the main thread in the client starts a connection, if its out stream count is set to N while the in stream count in the server is set to N - 2, another thread in the client keeps sending the msgs with stream number N - 1, and waits for sndbuf before processing INIT_ACK. However, after processing INIT_ACK, the out stream count in the client is shrunk to N - 2, the same to the in stream count in the server. The crash occurs when the thread waiting for sndbuf is awake and sends the msg in a non-existing stream(N - 1), the call trace is as below: KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] Call Trace: <TASK> sctp_cmd_send_msg net/sctp/sm_sideeffect.c:1114 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1777 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline] sctp_do_sm+0x197d/0x5310 net/sctp/sm_sideeffect.c:1170 sctp_primitive_SEND+0x9f/0xc0 net/sctp/primitive.c:163 sctp_sendmsg_to_asoc+0x10eb/0x1a30 net/sctp/socket.c:1868 sctp_sendmsg+0x8d4/0x1d90 net/sctp/socket.c:2026 inet_sendmsg+0x9d/0xe0 net/ipv4/af_inet.c:825 sock_sendmsg_nosec net/socket.c:722 [inline] sock_sendmsg+0xde/0x190 net/socket.c:745 The fix is to add an unlikely check for the send stream number after the thread wakes up from the wait_for_sndbuf.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()(CVE-2023-53521)

    binfmt_misc: fix shift-out-of-bounds in check_special_flags(CVE-2022-50497)

    scsi: lpfc: Fix buffer free/clear order in deferred receive path(CVE-2025-39841)

    mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory(CVE-2025-39883)

    md: Replace snprintf with scnprintf(CVE-2022-50299)

    drivers: serial: jsm: fix some leaks in probe(CVE-2022-50312)

    udf: Do not bother merging very long extents(CVE-2023-53506)

    fbdev: fix potential buffer overflow in do_register_framebuffer()(CVE-2025-38702)

    mm/slub: avoid accessing metadata when pointer is invalid in object_err()(CVE-2025-39902)

    xhci: Remove device endpoints from bandwidth list when freeing the device(CVE-2022-50470)

    HID: multitouch: Correct devm device reference for hidinput input_dev name(CVE-2023-53454)

    ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed(CVE-2023-53481)

    thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash(CVE-2022-50494)

    md: fix a crash in mempool_free(CVE-2022-50381)

    scsi: ses: Fix possible desc_ptr out-of-bounds accesses(CVE-2023-53675)

    scsi: target: target_core_configfs: Add length check to avoid buffer overflow(CVE-2025-39998)

    fs: dlm: fix invalid derefence of sb_lvbptr(CVE-2022-50516)

    NFS: Fix a race when updating an existing write(CVE-2025-39697)

    mmc: vub300: fix return value check of mmc_add_host()(CVE-2022-50251)

    tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak(CVE-2022-50389)

    scsi: qla4xxx: Add length check when parsing nlattrs(CVE-2023-53456)

    ext4: avoid deadlock in fs reclaim with page writeback(CVE-2023-53149)

    kobject: Add sanity check for kset-kobj.ktype in kset_register()(CVE-2023-53480)

    scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()(CVE-2023-53676)

    udf: Fix uninitialized array access for some pathnames(CVE-2023-53165)

    ext4: avoid crash when inline data creation follows DIO write(CVE-2022-50435)

    cifs: Fix warning and UAF when destroy the MR list(CVE-2023-53427)

    scsi: qla2xxx: Pointer may be dereferenced(CVE-2023-53150)

    fs: writeback: fix use-after-free in __mark_inode_dirty()(CVE-2025-39866)

    blk-mq: use quiesced elevator switch when reinitializing queues(CVE-2022-50552)

    mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()(CVE-2023-53623)

    ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS(CVE-2022-50315)

    pnode: terminate at peers of source(CVE-2022-50280)

    tracing: Fix race issue between cpu buffer write and swap(CVE-2023-53368)

    igb: Fix igb_down hung on surprise removal(CVE-2023-53148)

    udf: Do not update file length for failed writes to inline files(CVE-2023-53295)

    usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()(CVE-2022-50544)

    cacheinfo: Fix shared_cpu_map to handle shared caches at different levels(CVE-2023-53254)

    net/tunnel: wait until all sk_user_data reader finish before releasing the sock(CVE-2022-50405)

    mtd: Fix device name leak when register device failed in add_mtd_device()(CVE-2022-50566)

    ext4: add bounds checking in get_max_inline_xattr_value_size()(CVE-2023-53285)

    drm/mipi-dsi: Detach devices when removing the host(CVE-2022-50489)

    ipv6: Fix out-of-bounds access in ipv6_find_tlv()(CVE-2023-53705)

    md/raid10: check slab-out-of-bounds in md_bitmap_get_counter(CVE-2023-53357)

    scsi: qla2xxx: Wait for io return on terminate rport(CVE-2023-53322)

    PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free(CVE-2023-53446)

    sctp: check send stream number after wait_for_sndbuf(CVE-2023-53296)

    rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails(CVE-2023-53307)

    md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request(CVE-2023-53380)

    ubi: ensure that VID header offset + VID header size = alloc, size(CVE-2023-53265)

    icmp6: Fix null-ptr-deref of ip6_null_entry-rt6i_idev in icmp6_dev().(CVE-2023-53343)

    calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().(CVE-2025-38181)

    ftrace: Also allocate and copy hash for reading of filter files(CVE-2025-39689)

    firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region(CVE-2023-52989)

    sched/fair: Don't balance task to its current running CPU(CVE-2023-53215)

    dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path(CVE-2023-53604)

    qede: confirm skb is allocated before using(CVE-2022-49084)

    sctp: linearize cloned gso packets in sctp_rcv(CVE-2025-38718)

    af_unix: Fix data-races around user-unix_inflight.(CVE-2023-53204)

    scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue(CVE-2023-53280)

    md/raid10: fix leak of 'r10bio-remaining' for recovery(CVE-2023-53299)

    recordmcount: Fix memory leaks in the uwrite function(CVE-2023-53318)

    cifs: fix oops during encryption(CVE-2022-50341)

    nfsd: call op_release, even when op_func returns an error(CVE-2023-53241)

    uio_hv_generic: Let userspace take care of interrupt mask(CVE-2025-40048)

    posix-timers: Ensure timer ID search-loop limit is valid(CVE-2023-53728)

    tipc: fix a null-ptr-deref in tipc_topsrv_accept(CVE-2022-50555)

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer(CVE-2023-53395)

    x86/MCE: Always save CS register on AMD Zen IF Poison errors(CVE-2023-53438)

    xfrm: fix slab-use-after-free in decode_session6(CVE-2023-53500)

    posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()(CVE-2025-38352)

    i40e: add validation for ring_len param(CVE-2025-39973)

    firewire: net: fix use after free in fwnet_finish_incoming_packet()(CVE-2023-53432)

    NFSD: Protect against send buffer overflow in NFSv2 READ(CVE-2022-50410)

    drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()(CVE-2022-50402)

    net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode(CVE-2023-53733)

    crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg(CVE-2025-39964)

    udf: Detect system inodes linked into directory hierarchy(CVE-2023-53695)

    skbuff: Account for tail adjustment during pull operations(CVE-2022-50365)

    mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING(CVE-2022-50430)

    skbuff: skb_segment, Call zero copy functions before using skbuff frags(CVE-2023-53354)

    tracing/histograms: Add histograms to hist_vars if they have referenced variables(CVE-2023-53560)

    net: fix skb leak in __skb_tstamp_tx()(CVE-2023-53716)

    media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()(CVE-2023-53220)

    serial: arc_uart: fix of_iomap leak in `arc_serial_probe`(CVE-2023-53719)

    fs: udf: fix OOB read in lengthAllocDescs handling(CVE-2025-40044)

    ipvs: Defer ip_vs_ftp unregister during netns cleanup(CVE-2025-40018)

    scsi: target: iscsi: Fix a race condition between login_work and the login thread(CVE-2022-50350)

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare(CVE-2025-39817)

    igb: Do not free q_vector unless new one was allocated(CVE-2022-50252)

    iommu/vt-d: Clean up si_domain in the init_dmars() error path(CVE-2022-50482)

    VMCI: check context-notify_page after call to get_user_pages_fast() to avoid GPF(CVE-2023-53259)

    ext4: fix WARNING in mb_find_extent(CVE-2023-53317)

    ip_vti: fix potential slab-use-after-free in decode_session6(CVE-2023-53559)

    netfilter: conntrack: Avoid nf_ct_helper_hash uses after free(CVE-2023-53619)

    Input: MT - limit max slots(CVE-2024-45008)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992514 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: check send stream number after wait_for_sndbuf

    This patch fixes a corner case where the asoc out stream count may change     after wait_for_sndbuf.

    When the main thread in the client starts a connection, if its out stream     count is set to N while the in stream count in the server is set to N - 2,     another thread in the client keeps sending the msgs with stream number     N - 1, and waits for sndbuf before processing INIT_ACK.

    However, after processing INIT_ACK, the out stream count in the client is     shrunk to N - 2, the same to the in stream count in the server. The crash     occurs when the thread waiting for sndbuf is awake and sends the msg in a     non-existing stream(N - 1), the call trace is as below:

      KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]       Call Trace:
       <TASK>        sctp_cmd_send_msg net/sctp/sm_sideeffect.c:1114 [inline]        sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1777 [inline]        sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline]        sctp_do_sm+0x197d/0x5310 net/sctp/sm_sideeffect.c:1170        sctp_primitive_SEND+0x9f/0xc0 net/sctp/primitive.c:163        sctp_sendmsg_to_asoc+0x10eb/0x1a30 net/sctp/socket.c:1868        sctp_sendmsg+0x8d4/0x1d90 net/sctp/socket.c:2026        inet_sendmsg+0x9d/0xe0 net/ipv4/af_inet.c:825        sock_sendmsg_nosec net/socket.c:722 [inline]        sock_sendmsg+0xde/0x190 net/socket.c:745

    The fix is to add an unlikely check for the send stream number after the     thread wakes up from the wait_for_sndbuf.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - sctp: check send stream number after wait_for_sndbuf This patch fixes a corner case where the asoc out     stream count may change after wait_for_sndbuf. When the main thread in the client starts a connection, if     its out stream count is set to N while the in stream count in the server is set to N - 2, another thread     in the client keeps sending the msgs with stream number N - 1, and waits for sndbuf before processing     INIT_ACK. However, after processing INIT_ACK, the out stream count in the client is shrunk to N - 2, the     same to the in stream count in the server. The crash occurs when the thread waiting for sndbuf is awake     and sends the msg in a non-existing stream(N - 1), the call trace is as below: KASAN: null-ptr-deref in     range [0x0000000000000038-0x000000000000003f] Call Trace: <TASK> sctp_cmd_send_msg     net/sctp/sm_sideeffect.c:1114 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1777 [inline]     sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline] sctp_do_sm+0x197d/0x5310     net/sctp/sm_sideeffect.c:1170 sctp_primitive_SEND+0x9f/0xc0 net/sctp/primitive.c:163     sctp_sendmsg_to_asoc+0x10eb/0x1a30 net/sctp/socket.c:1868 sctp_sendmsg+0x8d4/0x1d90 net/sctp/socket.c:2026     inet_sendmsg+0x9d/0xe0 net/ipv4/af_inet.c:825 sock_sendmsg_nosec net/socket.c:722 [inline]     sock_sendmsg+0xde/0x190 net/socket.c:745 The fix is to add an unlikely check for the send stream number     after the thread wakes up from the wait_for_sndbuf. (CVE-2023-53296)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-169 advisory.

    An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores     an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system. (CVE-2023-2124)

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: Fix a race between coalescing and releasing SKBs (CVE-2023-53186)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix race on port output (CVE-2023-53188)

    In the Linux kernel, the following vulnerability has been resolved:

    raw: Fix NULL deref in raw_get_next(). (CVE-2023-53198)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: call op_release, even when op_func returns an error (CVE-2023-53241)

    In the Linux kernel, the following vulnerability has been resolved:

    Drivers: vmbus: Check for channel allocation before looking up relids (CVE-2023-53273)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: check send stream number after wait_for_sndbuf (CVE-2023-53296)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix a potential overflow in sctp_ifwdtsn_skip (CVE-2023-53372)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Free error logs of tracing instances (CVE-2023-53375)

    In the Linux kernel, the following vulnerability has been resolved:

    cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex (CVE-2023-53522)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/cma: Allow UD qp_type to join multicast only (CVE-2023-53525)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() (CVE-2023-53623)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, arm64: Fixed a BTI error on returning to patched function (CVE-2023-53634)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL (CVE-2023-53680)

    In the Linux kernel, the following vulnerability has been resolved:

    netlink: annotate lockless accesses to nlk->max_recvmsg_len (CVE-2023-53824)

    In the Linux kernel, the following vulnerability has been resolved:

    ping: Fix potentail NULL deref for /proc/net/icmp. (CVE-2023-53987)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/core: Fix GID entry ref leak when create_ah fails (CVE-2023-54003)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring: fix memory leak when removing provided buffers (CVE-2023-54041)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: drop peer group ids under namespace lock (CVE-2023-54128)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: stricter state check in mptcp_worker (CVE-2023-54176)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: fix race condition UAF in i915_perf_add_config_ioctl (CVE-2023-54202)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix an uninit variable access bug in __ip6_make_skb() (CVE-2023-54265)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.241-150.347. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-044 advisory.

    A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that     allows local users to create files for the XFS file-system with an unintended group ownership and with     group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a     certain group and is writable by a user who is not a member of this group. This can lead to excessive     permissions granted in case when they should not.  This vulnerability is similar to the previous     CVE-2018-13405 and adds the missed fix for the XFS. (CVE-2021-4037)

    In the Linux kernel, the following vulnerability has been resolved:

    tun: avoid double free in tun_free_netdev (CVE-2021-47082)

    A double-free flaw was found in the Linux kernel's TUN/TAP device driver functionality in how a user     registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw     allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-4744)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: Always check inode size of inline inodes (CVE-2022-49739)

    A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race     problem. This flaw leads to a denial of service issue. (CVE-2023-0590)

    An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores     an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system. (CVE-2023-2124)

    An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The     userspace data->block[0] variable was not capped to a number between 0-255 and was used as the size of a     memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to     crash the system or potentially achieve code execution. (CVE-2023-2194)

    do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading     to a race condition (with a resultant use-after-free or NULL pointer dereference). (CVE-2023-28466)

    The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in     drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker unplugs an emac based device.
    (CVE-2023-33203)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() (CVE-2023-53035)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Perform lockless command completion in abort path (CVE-2023-53041)

    In the Linux kernel, the following vulnerability has been resolved:

    dm stats: check for and propagate alloc_percpu failure (CVE-2023-53044)

    In the Linux kernel, the following vulnerability has been resolved:

    dm crypt: add cond_resched() to dmcrypt_write() (CVE-2023-53051)

    In the Linux kernel, the following vulnerability has been resolved:

    erspan: do not use skb_mac_header() in ndo_start_xmit() (CVE-2023-53053)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: revert rtnl_lock() that causes deadlock (CVE-2023-53060)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usb: smsc95xx: Limit packet length to skb->len (CVE-2023-53062)

    In the Linux kernel, the following vulnerability has been resolved:

    qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info (CVE-2023-53066)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() (CVE-2023-53078)

    In the Linux kernel, the following vulnerability has been resolved:

    ocfs2: fix data corruption after failed write (CVE-2023-53081)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (CVE-2023-53246)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: check send stream number after wait_for_sndbuf (CVE-2023-53296)

    In the Linux kernel, the following vulnerability has been resolved:

    can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (CVE-2023-53344)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix a potential overflow in sctp_ifwdtsn_skip (CVE-2023-53372)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Free error logs of tracing instances (CVE-2023-53375)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix sysfs interface lifetime (CVE-2023-53440)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() (CVE-2023-53608)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() (CVE-2023-53623)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/core: Fix GID entry ref leak when create_ah fails (CVE-2023-54003)

    In the Linux kernel, the following vulnerability has been resolved:

    can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access (CVE-2023-54039)

    In the Linux kernel, the following vulnerability has been resolved:

    net/net_failover: fix txq exceeding warning (CVE-2023-54236)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix an uninit variable access bug in __ip6_make_skb() (CVE-2023-54265)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.108-65.141. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-017 advisory.

    An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores     an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system. (CVE-2023-2124)

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: Fix a race between coalescing and releasing SKBs (CVE-2023-53186)

    In the Linux kernel, the following vulnerability has been resolved:

    Drivers: vmbus: Check for channel allocation before looking up relids (CVE-2023-53273)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: check send stream number after wait_for_sndbuf (CVE-2023-53296)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix a potential overflow in sctp_ifwdtsn_skip (CVE-2023-53372)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Free error logs of tracing instances (CVE-2023-53375)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/cma: Allow UD qp_type to join multicast only (CVE-2023-53525)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() (CVE-2023-53623)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL (CVE-2023-53680)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/core: Fix GID entry ref leak when create_ah fails (CVE-2023-54003)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: drop peer group ids under namespace lock (CVE-2023-54128)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: stricter state check in mptcp_worker (CVE-2023-54176)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: fix race condition UAF in i915_perf_add_config_ioctl (CVE-2023-54202)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix an uninit variable access bug in __ip6_make_skb() (CVE-2023-54265)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.178-162.673. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-031 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    sysctl: Fix data-races in proc_dou8vec_minmax(). (CVE-2022-49634)

    An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores     an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system. (CVE-2023-2124)

    In the Linux kernel, the following vulnerability has been resolved:

    Drivers: vmbus: Check for channel allocation before looking up relids (CVE-2023-53273)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: check send stream number after wait_for_sndbuf (CVE-2023-53296)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix a potential overflow in sctp_ifwdtsn_skip (CVE-2023-53372)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Free error logs of tracing instances (CVE-2023-53375)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix sysfs interface lifetime (CVE-2023-53440)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() (CVE-2023-53464)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/cma: Allow UD qp_type to join multicast only (CVE-2023-53525)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() (CVE-2023-53608)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() (CVE-2023-53623)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/core: Fix GID entry ref leak when create_ah fails (CVE-2023-54003)

    In the Linux kernel, the following vulnerability has been resolved:

    can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access (CVE-2023-54039)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix an uninit variable access bug in __ip6_make_skb() (CVE-2023-54265)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
297598	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1212)	Nessus	Huawei Local Security Checks	high
297592	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1224)	Nessus	Huawei Local Security Checks	high
297384	EulerOS Virtualization 2.10.0 : kernel (EulerOS-SA-2026-1172)	Nessus	Huawei Local Security Checks	high
284758	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2026-1029)	Nessus	Huawei Local Security Checks	high
280158	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-992514)	Nessus	Unity Linux Local Security Checks	medium
265229	Linux Distros Unpatched Vulnerability : CVE-2023-53296	Nessus	Misc.	medium
175085	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-169)	Nessus	Amazon Linux Local Security Checks	high
174976	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2023-044 (ALASKERNEL-5.4-2023-044)	Nessus	Amazon Linux Local Security Checks	high
174975	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-017 (ALASKERNEL-5.15-2023-017)	Nessus	Amazon Linux Local Security Checks	high
174973	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-031 (ALASKERNEL-5.10-2023-031)	Nessus	Amazon Linux Local Security Checks	high
153035	Photon OS 4.0: Linux PHSA-2021-4.0-0095	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2023-53296

medium

Tenable Plugins

high

high

high

high

medium

medium

high

high

high

high

high