In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not ignore genmask when looking up chain by id When adding a rule to a chain referring to its ID, if that chain had been deleted on the same batch, the rule might end up referring to a deleted chain. This will lead to a WARNING like following: [ 33.098431] ------------[ cut here ]------------ [ 33.098678] WARNING: CPU: 5 PID: 69 at net/netfilter/nf_tables_api.c:2037 nf_tables_chain_destroy+0x23d/0x260 [ 33.099217] Modules linked in: [ 33.099388] CPU: 5 PID: 69 Comm: kworker/5:1 Not tainted 6.4.0+ #409 [ 33.099726] Workqueue: events nf_tables_trans_destroy_work [ 33.100018] RIP: 0010:nf_tables_chain_destroy+0x23d/0x260 [ 33.100306] Code: 8b 7c 24 68 e8 64 9c ed fe 4c 89 e7 e8 5c 9c ed fe 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 89 c6 89 c7 c3 cc cc cc cc <0f> 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 89 c6 89 c7 [ 33.101271] RSP: 0018:ffffc900004ffc48 EFLAGS: 00010202 [ 33.101546] RAX: 0000000000000001 RBX: ffff888006fc0a28 RCX: 0000000000000000 [ 33.101920] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 33.102649] RBP: ffffc900004ffc78 R08: 0000000000000000 R09: 0000000000000000 [ 33.103018] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880135ef500 [ 33.103385] R13: 0000000000000000 R14: dead000000000122 R15: ffff888006fc0a10 [ 33.103762] FS: 0000000000000000(0000) GS:ffff888024c80000(0000) knlGS:0000000000000000 [ 33.104184] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.104493] CR2: 00007fe863b56a50 CR3: 00000000124b0001 CR4: 0000000000770ee0 [ 33.104872] PKRU: 55555554 [ 33.104999] Call Trace: [ 33.105113] <TASK> [ 33.105214] ? show_regs+0x72/0x90 [ 33.105371] ? __warn+0xa5/0x210 [ 33.105520] ? nf_tables_chain_destroy+0x23d/0x260 [ 33.105732] ? report_bug+0x1f2/0x200 [ 33.105902] ? handle_bug+0x46/0x90 [ 33.106546] ? exc_invalid_op+0x19/0x50 [ 33.106762] ? asm_exc_invalid_op+0x1b/0x20 [ 33.106995] ? nf_tables_chain_destroy+0x23d/0x260 [ 33.107249] ? nf_tables_chain_destroy+0x30/0x260 [ 33.107506] nf_tables_trans_destroy_work+0x669/0x680 [ 33.107782] ? mark_held_locks+0x28/0xa0 [ 33.107996] ? __pfx_nf_tables_trans_destroy_work+0x10/0x10 [ 33.108294] ? _raw_spin_unlock_irq+0x28/0x70 [ 33.108538] process_one_work+0x68c/0xb70 [ 33.108755] ? lock_acquire+0x17f/0x420 [ 33.108977] ? __pfx_process_one_work+0x10/0x10 [ 33.109218] ? do_raw_spin_lock+0x128/0x1d0 [ 33.109435] ? _raw_spin_lock_irq+0x71/0x80 [ 33.109634] worker_thread+0x2bd/0x700 [ 33.109817] ? __pfx_worker_thread+0x10/0x10 [ 33.110254] kthread+0x18b/0x1d0 [ 33.110410] ? __pfx_kthread+0x10/0x10 [ 33.110581] ret_from_fork+0x29/0x50 [ 33.110757] </TASK> [ 33.110866] irq event stamp: 1651 [ 33.111017] hardirqs last enabled at (1659): [<ffffffffa206a209>] __up_console_sem+0x79/0xa0 [ 33.111379] hardirqs last disabled at (1666): [<ffffffffa206a1ee>] __up_console_sem+0x5e/0xa0 [ 33.111740] softirqs last enabled at (1616): [<ffffffffa1f5d40e>] __irq_exit_rcu+0x9e/0xe0 [ 33.112094] softirqs last disabled at (1367): [<ffffffffa1f5d40e>] __irq_exit_rcu+0x9e/0xe0 [ 33.112453] ---[ end trace 0000000000000000 ]--- This is due to the nft_chain_lookup_byid ignoring the genmask. After this change, adding the new rule will fail as it will not find the chain.

suse_linux SUSE-SU-2025:03600-1: SUSE openSUSE 15 : Security update for the Linux Kernel (Important) (SUSE-SU-2025:03600-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3751-1 advisory.

    The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
    - CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
    - CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
    - CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
    - CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
    - CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
    - CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
    - CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
    - CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
    - CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
    - CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in     rproc_attach() (bsc#1247136).
    - CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
    - CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
    - CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
    - CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
    - CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
    - CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
    - CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
    - CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
    - CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
    - CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
    - CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
    - CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
    - CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port     (bsc#1248378).
    - CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
    - CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
    - CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
    - CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
    - CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
    - CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
    - CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
    - CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
    - CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data     (bsc#1248647).
    - CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
    - CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
    - CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
    - CVE-2025-38705: drm/amd/pm: fix null pointer access (bsc#1249334).
    - CVE-2025-38709: loop: Avoid updating block size under exclusive owner (bsc#1249199).
    - CVE-2025-38721: netfilter: ctnetlink: fix refcount leak on table dump (bsc#1249176).
    - CVE-2025-38722: habanalabs: fix UAF in export_dmabuf() (bsc#1249163).
    - CVE-2025-38730: io_uring/net: commit partial buffers on retry (bsc#1249172).
    - CVE-2025-38732: netfilter: nf_reject: do not leak dst refcount for loopback packets (bsc#1249262).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
    - CVE-2025-39677: net/sched: Fix backlog accounting in qdisc_dequeue_internal (bsc#1249300).
    - CVE-2025-39678: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL (bsc#1249290).
    - CVE-2025-39681: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (bsc#1249303).
    - CVE-2025-39682: tls: fix handling of zero-length records on the rx_list (bsc#1249284).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39705: drm/amd/display: fix a Null pointer dereference vulnerability (bsc#1249295).
    - CVE-2025-39718: vsock/virtio: Validate length in packet header before skb_put() (bsc#1249305).
    - CVE-2025-39738: btrfs: do not allow relocation of partially dropped subvolumes (bsc#1249540).
    - CVE-2025-39744: rcu: Fix rcu_read_unlock() deadloop due to IRQ work (bsc#1249494).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39749: rcu: Protect ->defer_qs_iw_pending from data race (bsc#1249533).
    - CVE-2025-39754: mm/smaps: fix race between smaps_hugetlb_range and migration (bsc#1249524).
    - CVE-2025-39764: netfilter: ctnetlink: remove refcounting in expectation dumpers (bsc#1249513).
    - CVE-2025-39766: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (bsc#1249510).
    - CVE-2025-39770: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (bsc#1249508).
    - CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
    - CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
    - CVE-2025-39787: soc: qcom: mdt_loader: Deal with zero e_shentsize (bsc#1249545).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39825: smb: client: fix race with concurrent opens in rename(2) (bsc#1250179).
    - CVE-2025-39832: net/mlx5: Fix lockdep assertion on sync reset unload event (bsc#1249901).
    - CVE-2025-39835: xfs: do not propagate ENODATA disk errors into xattr code (bsc#1250025).
    - CVE-2025-39838: cifs: prevent NULL pointer dereference in UTF16 conversion (bsc#1250365).
    - CVE-2025-39842: ocfs2: prevent release journal inode after journal shutdown (bsc#1250267).
    - CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
    - CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
    - CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
    - CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
    - CVE-2025-39857: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (bsc#1250251).
    - CVE-2025-39865: tee: fix NULL pointer dereference in tee_shm_put (bsc#1250294).
    - CVE-2025-39885: ocfs2: fix recursive semaphore deadlock in fiemap call (bsc#1250407).
    - CVE-2025-40300: x86/vmscape: Warn when STIBP is disabled with SMT (bsc#1247483).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03628-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
    - CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
    - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
    - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
    - CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
    - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
    - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
    - CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
    - CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
    - CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245498).
    - CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
    - CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
    - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
    - CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
    - CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime     (bsc#1247288).
    - CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree     (bsc#1248255).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
    - CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
    - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
    - CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
    - CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
    - CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03626-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
    - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
    - CVE-2022-50248: wifi: iwlwifi: mvm: fix double free on tx path (bsc#1249840).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
    - CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()     (bsc#1249947).
    - CVE-2022-50381: md: fix a crash in mempool_free (bsc#1250257).
    - CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
    - CVE-2022-50401: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (bsc#1250140).
    - CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
    - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
    - CVE-2022-50412: drm: bridge: adv7511: unregister cec i2c device after cec adapter (bsc#1250189).
    - CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
    - CVE-2023-53220: media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() (bsc#1250337).
    - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
    - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
    - CVE-2024-53093: nvme-multipath: defer partition scanning (bsc#1233640).
    - CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784).
    - CVE-2025-38011: drm/amdgpu: csa unmap use uninterruptible lock (bsc#1244729).
    - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
    - CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree     (bsc#1248255).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
    - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
    - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03615-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
    - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
    - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
    - CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
    - CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
    - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
    - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
    - CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
    - CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
    - CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree     (bsc#1248255).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
    - CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
    - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
    - CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
    - CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
    - CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03634-1 advisory.

    The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
    - CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
    - CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
    - CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
    - CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
    - CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
    - CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
    - CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
    - CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
    - CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
    - CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
    - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
    - CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
    - CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
    - CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
    - CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
    - CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
    - CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
    - CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
    - CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
    - CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
    - CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
    - CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
    - CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
    - CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
    - CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
    - CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in     rproc_attach() (bsc#1247136).
    - CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
    - CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()     (bsc#1247167).
    - CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
    - CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
    - CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
    - CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
    - CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
    - CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
    - CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
    - CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
    - CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
    - CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns     (bsc#1247976).
    - CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface     (bsc#1248088).
    - CVE-2025-38506: KVM: Allow CPU to reschedule while setting per-page memory attributes (bsc#1248186).
    - CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
    - CVE-2025-38520: drm/amdkfd: Do not call mmput from MMU notifier callback (bsc#1248217).
    - CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
    - CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
    - CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
    - CVE-2025-38528: bpf: Reject %p% format string in bprintf-like helpers (bsc#1248198).
    - CVE-2025-38531: iio: common: st_sensors: Fix use of uninitialize device structs (bsc#1248205).
    - CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
    - CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
    - CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
    - CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
    - CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
    - CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
    - CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
    - CVE-2025-38585: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (bsc#1248355).
    - CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
    - CVE-2025-38591: bpf: Reject narrower access to pointer ctx fields (bsc#1248363).
    - CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
    - CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
    - CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port     (bsc#1248378).
    - CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
    - CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
    - CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
    - CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
    - CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).
    - CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
    - CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
    - CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
    - CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
    - CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
    - CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data     (bsc#1248647).
    - CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
    - CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
    - CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
    - CVE-2025-38705: drm/amd/pm: fix null pointer access (bsc#1249334).
    - CVE-2025-38709: loop: Avoid updating block size under exclusive owner (bsc#1249199).
    - CVE-2025-38721: netfilter: ctnetlink: fix refcount leak on table dump (bsc#1249176).
    - CVE-2025-38722: habanalabs: fix UAF in export_dmabuf() (bsc#1249163).
    - CVE-2025-38730: io_uring/net: commit partial buffers on retry (bsc#1249172).
    - CVE-2025-38732: netfilter: nf_reject: do not leak dst refcount for loopback packets (bsc#1249262).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
    - CVE-2025-39677: net/sched: Fix backlog accounting in qdisc_dequeue_internal (bsc#1249300).
    - CVE-2025-39678: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL (bsc#1249290).
    - CVE-2025-39681: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (bsc#1249303).
    - CVE-2025-39682: tls: fix handling of zero-length records on the rx_list (bsc#1249284).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39705: drm/amd/display: fix a Null pointer dereference vulnerability (bsc#1249295).
    - CVE-2025-39718: vsock/virtio: Validate length in packet header before skb_put() (bsc#1249305).
    - CVE-2025-39738: btrfs: do not allow relocation of partially dropped subvolumes (bsc#1249540).
    - CVE-2025-39744: rcu: Fix rcu_read_unlock() deadloop due to IRQ work (bsc#1249494).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39749: rcu: Protect ->defer_qs_iw_pending from data race (bsc#1249533).
    - CVE-2025-39754: mm/smaps: fix race between smaps_hugetlb_range and migration (bsc#1249524).
    - CVE-2025-39764: netfilter: ctnetlink: remove refcounting in expectation dumpers (bsc#1249513).
    - CVE-2025-39766: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (bsc#1249510).
    - CVE-2025-39770: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (bsc#1249508).
    - CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
    - CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
    - CVE-2025-39787: soc: qcom: mdt_loader: Deal with zero e_shentsize (bsc#1249545).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39825: smb: client: fix race with concurrent opens in rename(2) (bsc#1250179).
    - CVE-2025-39828: kABI workaround for struct atmdev_ops extension (bsc#1250205).
    - CVE-2025-39832: net/mlx5: Fix lockdep assertion on sync reset unload event (bsc#1249901).
    - CVE-2025-39835: xfs: do not propagate ENODATA disk errors into xattr code (bsc#1250025).
    - CVE-2025-39838: cifs: prevent NULL pointer dereference in UTF16 conversion (bsc#1250365).
    - CVE-2025-39842: ocfs2: prevent release journal inode after journal shutdown (bsc#1250267).
    - CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
    - CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
    - CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
    - CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
    - CVE-2025-39857: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (bsc#1250251).
    - CVE-2025-39865: tee: fix NULL pointer dereference in tee_shm_put (bsc#1250294).
    - CVE-2025-39885: ocfs2: fix recursive semaphore deadlock in fiemap call (bsc#1250407).
    - CVE-2025-40300: x86/vmscape: Warn when STIBP is disabled with SMT (bsc#1247483).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not ignore     genmask when looking up chain by id When adding a rule to a chain referring to its ID, if that chain had     been deleted on the same batch, the rule might end up referring to a deleted chain. This will lead to a     WARNING like following: [ 33.098431] ------------[ cut here ]------------ [ 33.098678] WARNING: CPU: 5     PID: 69 at net/netfilter/nf_tables_api.c:2037 nf_tables_chain_destroy+0x23d/0x260 [ 33.099217] Modules     linked in: [ 33.099388] CPU: 5 PID: 69 Comm: kworker/5:1 Not tainted 6.4.0+ #409 [ 33.099726] Workqueue:
    events nf_tables_trans_destroy_work [ 33.100018] RIP: 0010:nf_tables_chain_destroy+0x23d/0x260 [     33.100306] Code: 8b 7c 24 68 e8 64 9c ed fe 4c 89 e7 e8 5c 9c ed fe 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f     5d 31 c0 89 c6 89 c7 c3 cc cc cc cc <0f> 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 89 c6 89 c7 [     33.101271] RSP: 0018:ffffc900004ffc48 EFLAGS: 00010202 [ 33.101546] RAX: 0000000000000001 RBX:
    ffff888006fc0a28 RCX: 0000000000000000 [ 33.101920] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
    0000000000000000 [ 33.102649] RBP: ffffc900004ffc78 R08: 0000000000000000 R09: 0000000000000000 [     33.103018] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880135ef500 [ 33.103385] R13:
    0000000000000000 R14: dead000000000122 R15: ffff888006fc0a10 [ 33.103762] FS: 0000000000000000(0000)     GS:ffff888024c80000(0000) knlGS:0000000000000000 [ 33.104184] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [ 33.104493] CR2: 00007fe863b56a50 CR3: 00000000124b0001 CR4: 0000000000770ee0 [     33.104872] PKRU: 55555554 [ 33.104999] Call Trace: [ 33.105113] <TASK> [ 33.105214] ? show_regs+0x72/0x90     [ 33.105371] ? __warn+0xa5/0x210 [ 33.105520] ? nf_tables_chain_destroy+0x23d/0x260 [ 33.105732] ?     report_bug+0x1f2/0x200 [ 33.105902] ? handle_bug+0x46/0x90 [ 33.106546] ? exc_invalid_op+0x19/0x50 [     33.106762] ? asm_exc_invalid_op+0x1b/0x20 [ 33.106995] ? nf_tables_chain_destroy+0x23d/0x260 [ 33.107249]     ? nf_tables_chain_destroy+0x30/0x260 [ 33.107506] nf_tables_trans_destroy_work+0x669/0x680 [ 33.107782] ?     mark_held_locks+0x28/0xa0 [ 33.107996] ? __pfx_nf_tables_trans_destroy_work+0x10/0x10 [ 33.108294] ?
    _raw_spin_unlock_irq+0x28/0x70 [ 33.108538] process_one_work+0x68c/0xb70 [ 33.108755] ?     lock_acquire+0x17f/0x420 [ 33.108977] ? __pfx_process_one_work+0x10/0x10 [ 33.109218] ?     do_raw_spin_lock+0x128/0x1d0 [ 33.109435] ? _raw_spin_lock_irq+0x71/0x80 [ 33.109634]     worker_thread+0x2bd/0x700 [ 33.109817] ? __pfx_worker_thread+0x10/0x10 [ 33.110254] kthread+0x18b/0x1d0 [     33.110410] ? __pfx_kthread+0x10/0x10 [ 33.110581] ret_from_fork+0x29/0x50 [ 33.110757] </TASK> [     33.110866] irq event stamp: 1651 [ 33.111017] hardirqs last enabled at (1659): [<ffffffffa206a209>]
    __up_console_sem+0x79/0xa0 [ 33.111379] hardirqs last disabled at (1666): [<ffffffffa206a1ee>]
    __up_console_sem+0x5e/0xa0 [ 33.111740] softirqs last enabled at (1616): [<ffffffffa1f5d40e>]
    __irq_exit_rcu+0x9e/0xe0 [ 33.112094] softirqs last disabled at (1367): [<ffffffffa1f5d40e>]
    __irq_exit_rcu+0x9e/0xe0 [ 33.112453] ---[ end trace 0000000000000000 ]--- This is due to the     nft_chain_lookup_byid ignoring the genmask. After this change, adding the new rule will fail as it will     not find the chain. (CVE-2023-53492)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.15.120-74.144. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-024 advisory.

    A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and     anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel     memory. This flaw allows a local user with CAP_NET_ADMIN capability to crash or potentially escalate their     privileges on the system. (CVE-2023-3117)

    Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()`     failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace     (CVE-2023-31248)

    A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in     net/netfilter/nf_tables_api.c.

    Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same     transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to     cause a privilege escalation issue.

    We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97. (CVE-2023-3390)

    Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation.

    If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or     decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter     and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

    We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc. (CVE-2023-3609)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    Flaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_NEWRULE.
    The vulnerability requires CAP_NET_ADMIN to be triggered.

    We recommend upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795. (CVE-2023-3610)

    In the Linux kernel, the following vulnerability has been resolved:

    nubus: Partially revert proc_create_single_data() conversion (CVE-2023-53217)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: do not ignore genmask when looking up chain by id (CVE-2023-53492)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-251 advisory.

    A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and     anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel     memory. This flaw allows a local user with CAP_NET_ADMIN capability to crash or potentially escalate their     privileges on the system. (CVE-2023-3117)

    Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()`     failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace     (CVE-2023-31248)

    A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in     net/netfilter/nf_tables_api.c.

    Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same     transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to     cause a privilege escalation issue.

    We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97. (CVE-2023-3390)

    Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation.

    If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or     decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter     and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

    We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc. (CVE-2023-3609)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    Flaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_NEWRULE.
    The vulnerability requires CAP_NET_ADMIN to be triggered.

    We recommend upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795. (CVE-2023-3610)

    In the Linux kernel, the following vulnerability has been resolved:

    nubus: Partially revert proc_create_single_data() conversion (CVE-2023-53217)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: do not ignore genmask when looking up chain by id (CVE-2023-53492)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.184-175.749. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-037 advisory.

    A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and     anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel     memory. This flaw allows a local user with CAP_NET_ADMIN capability to crash or potentially escalate their     privileges on the system. (CVE-2023-3117)

    Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()`     failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace     (CVE-2023-31248)

    Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    Flaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_NEWRULE.
    The vulnerability requires CAP_NET_ADMIN to be triggered.

    We recommend upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795. (CVE-2023-3610)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: do not ignore genmask when looking up chain by id (CVE-2023-53492)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
271407	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:3751-1)	Nessus	SuSE Local Security Checks	high
270857	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:03628-1)	Nessus	SuSE Local Security Checks	high
270848	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:03626-1)	Nessus	SuSE Local Security Checks	high
270837	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:03615-1)	Nessus	SuSE Local Security Checks	high
270738	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:03634-1)	Nessus	SuSE Local Security Checks	high
269526	Linux Distros Unpatched Vulnerability : CVE-2023-53492	Nessus	Misc.	high
178545	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-024 (ALASKERNEL-5.15-2023-024)	Nessus	Amazon Linux Local Security Checks	high
178535	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-251)	Nessus	Amazon Linux Local Security Checks	high
178532	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-037 (ALASKERNEL-5.10-2023-037)	Nessus	Amazon Linux Local Security Checks	high
153035	Photon OS 4.0: Linux PHSA-2021-4.0-0095	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2023-53492

medium

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high