In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds Fix a stack-out-of-bounds read in brcmfmac that occurs when 'buf' that is not null-terminated is passed as an argument of strreplace() in brcmf_c_preinit_dcmds(). This buffer is filled with a CLM version string by memcpy() in brcmf_fil_iovar_data_get(). Ensure buf is null-terminated. Found by a modified version of syzkaller. [ 33.004414][ T1896] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available [ 33.013486][ T1896] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM43236/3 wl0: Nov 30 2011 17:33:42 version 5.90.188.22 [ 33.021554][ T1896] ================================================================== [ 33.022379][ T1896] BUG: KASAN: stack-out-of-bounds in strreplace+0xf2/0x110 [ 33.023122][ T1896] Read of size 1 at addr ffffc90001d6efc8 by task kworker/0:2/1896 [ 33.023852][ T1896] [ 33.024096][ T1896] CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G O 5.14.0+ #132 [ 33.024927][ T1896] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 33.026065][ T1896] Workqueue: usb_hub_wq hub_event [ 33.026581][ T1896] Call Trace: [ 33.026896][ T1896] dump_stack_lvl+0x57/0x7d [ 33.027372][ T1896] print_address_description.constprop.0.cold+0xf/0x334 [ 33.028037][ T1896] ? strreplace+0xf2/0x110 [ 33.028403][ T1896] ? strreplace+0xf2/0x110 [ 33.028807][ T1896] kasan_report.cold+0x83/0xdf [ 33.029283][ T1896] ? strreplace+0xf2/0x110 [ 33.029666][ T1896] strreplace+0xf2/0x110 [ 33.029966][ T1896] brcmf_c_preinit_dcmds+0xab1/0xc40 [ 33.030351][ T1896] ? brcmf_c_set_joinpref_default+0x100/0x100 [ 33.030787][ T1896] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 33.031223][ T1896] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 33.031661][ T1896] ? lock_acquire+0x19d/0x4e0 [ 33.032091][ T1896] ? find_held_lock+0x2d/0x110 [ 33.032605][ T1896] ? brcmf_usb_deq+0x1a7/0x260 [ 33.033087][ T1896] ? brcmf_usb_rx_fill_all+0x5a/0xf0 [ 33.033582][ T1896] brcmf_attach+0x246/0xd40 [ 33.034022][ T1896] ? wiphy_new_nm+0x1476/0x1d50 [ 33.034383][ T1896] ? kmemdup+0x30/0x40 [ 33.034722][ T1896] brcmf_usb_probe+0x12de/0x1690 [ 33.035223][ T1896] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470 [ 33.035833][ T1896] usb_probe_interface+0x25f/0x710 [ 33.036315][ T1896] really_probe+0x1be/0xa90 [ 33.036656][ T1896] __driver_probe_device+0x2ab/0x460 [ 33.037026][ T1896] ? usb_match_id.part.0+0x88/0xc0 [ 33.037383][ T1896] driver_probe_device+0x49/0x120 [ 33.037790][ T1896] __device_attach_driver+0x18a/0x250 [ 33.038300][ T1896] ? driver_allows_async_probing+0x120/0x120 [ 33.038986][ T1896] bus_for_each_drv+0x123/0x1a0 [ 33.039906][ T1896] ? bus_rescan_devices+0x20/0x20 [ 33.041412][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 33.041861][ T1896] ? trace_hardirqs_on+0x1c/0x120 [ 33.042330][ T1896] __device_attach+0x207/0x330 [ 33.042664][ T1896] ? device_bind_driver+0xb0/0xb0 [ 33.043026][ T1896] ? kobject_uevent_env+0x230/0x12c0 [ 33.043515][ T1896] bus_probe_device+0x1a2/0x260 [ 33.043914][ T1896] device_add+0xa61/0x1ce0 [ 33.044227][ T1896] ? __mutex_unlock_slowpath+0xe7/0x660 [ 33.044891][ T1896] ? __fw_devlink_link_to_suppliers+0x550/0x550 [ 33.045531][ T1896] usb_set_configuration+0x984/0x1770 [ 33.046051][ T1896] ? kernfs_create_link+0x175/0x230 [ 33.046548][ T1896] usb_generic_driver_probe+0x69/0x90 [ 33.046931][ T1896] usb_probe_device+0x9c/0x220 [ 33.047434][ T1896] really_probe+0x1be/0xa90 [ 33.047760][ T1896] __driver_probe_device+0x2ab/0x460 [ 33.048134][ T1896] driver_probe_device+0x49/0x120 [ 33.048516][ T1896] __device_attach_driver+0x18a/0x250 [ 33.048910][ T1896] ? driver_allows_async_probing+0x120/0x120 ---truncated---

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010924 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds

    Fix a stack-out-of-bounds read in brcmfmac that occurs     when 'buf' that is not null-terminated is passed as an argument of     strreplace() in brcmf_c_preinit_dcmds(). This buffer is filled with     a CLM version string by memcpy() in brcmf_fil_iovar_data_get().
    Ensure buf is null-terminated.

    Found by a modified version of syzkaller.

    [   33.004414][ T1896] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have     limited channels available     [   33.013486][ T1896] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM43236/3 wl0: Nov 30 2011 17:33:42     version 5.90.188.22     [   33.021554][ T1896] ==================================================================     [   33.022379][ T1896] BUG: KASAN: stack-out-of-bounds in strreplace+0xf2/0x110     [   33.023122][ T1896] Read of size 1 at addr ffffc90001d6efc8 by task kworker/0:2/1896     [   33.023852][ T1896]     [   33.024096][ T1896] CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G           O      5.14.0+ #132     [   33.024927][ T1896] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS     rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014     [   33.026065][ T1896] Workqueue: usb_hub_wq hub_event     [   33.026581][ T1896] Call Trace:
    [   33.026896][ T1896]  dump_stack_lvl+0x57/0x7d     [   33.027372][ T1896]  print_address_description.constprop.0.cold+0xf/0x334     [   33.028037][ T1896]  ? strreplace+0xf2/0x110     [   33.028403][ T1896]  ? strreplace+0xf2/0x110     [   33.028807][ T1896]  kasan_report.cold+0x83/0xdf     [   33.029283][ T1896]  ? strreplace+0xf2/0x110     [   33.029666][ T1896]  strreplace+0xf2/0x110     [   33.029966][ T1896]  brcmf_c_preinit_dcmds+0xab1/0xc40     [   33.030351][ T1896]  ? brcmf_c_set_joinpref_default+0x100/0x100     [   33.030787][ T1896]  ? rcu_read_lock_sched_held+0xa1/0xd0     [   33.031223][ T1896]  ? rcu_read_lock_bh_held+0xb0/0xb0     [   33.031661][ T1896]  ? lock_acquire+0x19d/0x4e0     [   33.032091][ T1896]  ? find_held_lock+0x2d/0x110     [   33.032605][ T1896]  ? brcmf_usb_deq+0x1a7/0x260     [   33.033087][ T1896]  ? brcmf_usb_rx_fill_all+0x5a/0xf0     [   33.033582][ T1896]  brcmf_attach+0x246/0xd40     [   33.034022][ T1896]  ? wiphy_new_nm+0x1476/0x1d50     [   33.034383][ T1896]  ? kmemdup+0x30/0x40     [   33.034722][ T1896]  brcmf_usb_probe+0x12de/0x1690     [   33.035223][ T1896]  ? brcmf_usbdev_qinit.constprop.0+0x470/0x470     [   33.035833][ T1896]  usb_probe_interface+0x25f/0x710     [   33.036315][ T1896]  really_probe+0x1be/0xa90     [   33.036656][ T1896]  __driver_probe_device+0x2ab/0x460     [   33.037026][ T1896]  ? usb_match_id.part.0+0x88/0xc0     [   33.037383][ T1896]  driver_probe_device+0x49/0x120     [   33.037790][ T1896]  __device_attach_driver+0x18a/0x250     [   33.038300][ T1896]  ? driver_allows_async_probing+0x120/0x120     [   33.038986][ T1896]  bus_for_each_drv+0x123/0x1a0     [   33.039906][ T1896]  ? bus_rescan_devices+0x20/0x20     [   33.041412][ T1896]  ? lockdep_hardirqs_on_prepare+0x273/0x3e0     [   33.041861][ T1896]  ? trace_hardirqs_on+0x1c/0x120     [   33.042330][ T1896]  __device_attach+0x207/0x330     [   33.042664][ T1896]  ? device_bind_driver+0xb0/0xb0     [   33.043026][ T1896]  ? kobject_uevent_env+0x230/0x12c0     [   33.043515][ T1896]  bus_probe_device+0x1a2/0x260     [   33.043914][ T1896]  device_add+0xa61/0x1ce0     [   33.044227][ T1896]  ? __mutex_unlock_slowpath+0xe7/0x660     [   33.044891][ T1896]  ? __fw_devlink_link_to_suppliers+0x550/0x550     [   33.045531][ T1896]  usb_set_configuration+0x984/0x1770     [   33.046051][ T1896]  ? kernfs_create_link+0x175/0x230     [   33.046548][ T1896]  usb_generic_driver_probe+0x69/0x90     [   33.046931][ T1896]  usb_probe_device+0x9c/0x220     [   33.047434][ T1896]  really_probe+0x1be/0xa90     [   33.047760][ T1896]  __driver_probe_device+0x2ab/0x460     [   33.048134][ T1896]  driver_probe_device+0x49/0x120     [   33.048516][ T1896]  __device_attach_driver+0x18a/0x250     [   33.048910][ T1896]  ? driver_allows_async_probing+0x120/0x120
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006923 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds

    Fix a stack-out-of-bounds read in brcmfmac that occurs     when 'buf' that is not null-terminated is passed as an argument of     strreplace() in brcmf_c_preinit_dcmds(). This buffer is filled with     a CLM version string by memcpy() in brcmf_fil_iovar_data_get().
    Ensure buf is null-terminated.

    Found by a modified version of syzkaller.

    [   33.004414][ T1896] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have     limited channels available     [   33.013486][ T1896] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM43236/3 wl0: Nov 30 2011 17:33:42     version 5.90.188.22     [   33.021554][ T1896] ==================================================================     [   33.022379][ T1896] BUG: KASAN: stack-out-of-bounds in strreplace+0xf2/0x110     [   33.023122][ T1896] Read of size 1 at addr ffffc90001d6efc8 by task kworker/0:2/1896     [   33.023852][ T1896]     [   33.024096][ T1896] CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G           O      5.14.0+ #132     [   33.024927][ T1896] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS     rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014     [   33.026065][ T1896] Workqueue: usb_hub_wq hub_event     [   33.026581][ T1896] Call Trace:
    [   33.026896][ T1896]  dump_stack_lvl+0x57/0x7d     [   33.027372][ T1896]  print_address_description.constprop.0.cold+0xf/0x334     [   33.028037][ T1896]  ? strreplace+0xf2/0x110     [   33.028403][ T1896]  ? strreplace+0xf2/0x110     [   33.028807][ T1896]  kasan_report.cold+0x83/0xdf     [   33.029283][ T1896]  ? strreplace+0xf2/0x110     [   33.029666][ T1896]  strreplace+0xf2/0x110     [   33.029966][ T1896]  brcmf_c_preinit_dcmds+0xab1/0xc40     [   33.030351][ T1896]  ? brcmf_c_set_joinpref_default+0x100/0x100     [   33.030787][ T1896]  ? rcu_read_lock_sched_held+0xa1/0xd0     [   33.031223][ T1896]  ? rcu_read_lock_bh_held+0xb0/0xb0     [   33.031661][ T1896]  ? lock_acquire+0x19d/0x4e0     [   33.032091][ T1896]  ? find_held_lock+0x2d/0x110     [   33.032605][ T1896]  ? brcmf_usb_deq+0x1a7/0x260     [   33.033087][ T1896]  ? brcmf_usb_rx_fill_all+0x5a/0xf0     [   33.033582][ T1896]  brcmf_attach+0x246/0xd40     [   33.034022][ T1896]  ? wiphy_new_nm+0x1476/0x1d50     [   33.034383][ T1896]  ? kmemdup+0x30/0x40     [   33.034722][ T1896]  brcmf_usb_probe+0x12de/0x1690     [   33.035223][ T1896]  ? brcmf_usbdev_qinit.constprop.0+0x470/0x470     [   33.035833][ T1896]  usb_probe_interface+0x25f/0x710     [   33.036315][ T1896]  really_probe+0x1be/0xa90     [   33.036656][ T1896]  __driver_probe_device+0x2ab/0x460     [   33.037026][ T1896]  ? usb_match_id.part.0+0x88/0xc0     [   33.037383][ T1896]  driver_probe_device+0x49/0x120     [   33.037790][ T1896]  __device_attach_driver+0x18a/0x250     [   33.038300][ T1896]  ? driver_allows_async_probing+0x120/0x120     [   33.038986][ T1896]  bus_for_each_drv+0x123/0x1a0     [   33.039906][ T1896]  ? bus_rescan_devices+0x20/0x20     [   33.041412][ T1896]  ? lockdep_hardirqs_on_prepare+0x273/0x3e0     [   33.041861][ T1896]  ? trace_hardirqs_on+0x1c/0x120     [   33.042330][ T1896]  __device_attach+0x207/0x330     [   33.042664][ T1896]  ? device_bind_driver+0xb0/0xb0     [   33.043026][ T1896]  ? kobject_uevent_env+0x230/0x12c0     [   33.043515][ T1896]  bus_probe_device+0x1a2/0x260     [   33.043914][ T1896]  device_add+0xa61/0x1ce0     [   33.044227][ T1896]  ? __mutex_unlock_slowpath+0xe7/0x660     [   33.044891][ T1896]  ? __fw_devlink_link_to_suppliers+0x550/0x550     [   33.045531][ T1896]  usb_set_configuration+0x984/0x1770     [   33.046051][ T1896]  ? kernfs_create_link+0x175/0x230     [   33.046548][ T1896]  usb_generic_driver_probe+0x69/0x90     [   33.046931][ T1896]  usb_probe_device+0x9c/0x220     [   33.047434][ T1896]  really_probe+0x1be/0xa90     [   33.047760][ T1896]  __driver_probe_device+0x2ab/0x460     [   33.048134][ T1896]  driver_probe_device+0x49/0x120     [   33.048516][ T1896]  __device_attach_driver+0x18a/0x250     [   33.048910][ T1896]  ? driver_allows_async_probing+0x120/0x120
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4320-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
    - CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (bsc#1249857).
    - CVE-2022-50490: bpf: Propagate error from htab_lock_bucket() to userspace (bsc#1251164).
    - CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
    - CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
    - CVE-2023-53500: xfrm: fix slab-use-after-free in decode_session6 (bsc#1250816).
    - CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
    - CVE-2023-53574: wifi: rtw88: delete timer and free skb queue when unloading (bsc#1251222).
    - CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
    - CVE-2023-53673: Bluetooth: hci_event: call disconnect callback before deleting conn (bsc#1251763).
    - CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-38084: hugetlb: unshare some PMDs when splitting VMAs (bsc#1245498).
    - CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
    - CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
    - CVE-2025-39742: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (bsc#1249479).
    - CVE-2025-39797: xfrm: Duplicate SPI Handling (bsc#1249608).
    - CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
    - CVE-2025-39967: fbcon: fix integer overflow in fbcon_do_set_font (bsc#1252033).
    - CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
    - CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
    - CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).
    - CVE-2025-39981: Bluetooth: MGMT: Fix possible UAFs (bsc#1252060).
    - CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
    - CVE-2025-40044: fs: udf: fix OOB read in lengthAllocDescs handling (bsc#1252785).

    The following non security issues were fixed:

    - NFS: remove revoked delegation from server's delegation list (bsc#1246211).
    - NFSv4: Allow FREE_STATEID to clean up delegations (bsc#1246211).
    - fbcon: Fix OOB access in font allocation (bsc#1252033)
    - kabi fix for NFSv4: Allow FREE_STATEID to clean up delegations (bsc#1246211).
    - kernel-subpackage-spec: Do not doubly-sign modules (bsc#1251930).
    - mm: avoid unnecessary page fault retires on shared memory types (bsc#1251823).
    - net: hv_netvsc: fix loss of early receive events from host during channel open (bsc#1252265).
    - net: mana: Switch to page pool for jumbo frames (bsc#1248754).
    - net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency     (bsc#1248754).
    - netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237).
    - rpm/check-for-config-changes: ignore CONFIG_SCHED_PROXY_EXEC, too (bsc#1250946)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4189-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2021-4460: drm/amdkfd: Fix UBSAN shift-out-of-bounds warning (bsc#1250764).
    - CVE-2022-48631: ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 (bsc#1223475).
    - CVE-2022-50236: iommu/mediatek: Fix crash on isr after kexec() (bsc#1249702).
    - CVE-2022-50249: memory: of: Fix refcount leak bug in of_get_ddr_timings() (bsc#1249747).
    - CVE-2022-50280: pnode: terminate at peers of source (bsc#1249806).
    - CVE-2022-50293: btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range (bsc#1249752).
    - CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
    - CVE-2022-50350: scsi: target: iscsi: Fix a race condition between login_work and the login thread     (bsc#1250261).
    - CVE-2022-50356: net: sched: sfb: fix null pointer access issue when sfb_init() fails (bsc#1250040).
    - CVE-2022-50367: fs: fix UAF/GPF bug in nilfs_mdt_destroy (bsc#1250277).
    - CVE-2022-50394: i2c: ismt: Fix an out-of-bounds bug in ismt_access() (bsc#1250107).
    - CVE-2022-50395: integrity: Fix memory leakage in keyring allocation error path (bsc#1250211).
    - CVE-2022-50423: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (bsc#1250784).
    - CVE-2022-50443: drm/rockchip: lvds: fix PM usage counter unbalance in poweron (bsc#1250768).
    - CVE-2022-50459: scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() (bsc#1250850).
    - CVE-2022-50481: cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() (bsc#1251051).
    - CVE-2022-50485: ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode (bsc#1251197).
    - CVE-2022-50505: iommu/amd: Fix pci device refcount leak in ppr_notifier() (bsc#1251086).
    - CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
    - CVE-2022-50542: media: si470x: Fix use-after-free in si470x_int_in_callback() (bsc#1251330).
    - CVE-2022-50571: btrfs: call __btrfs_remove_free_space_cache_locked on cache load failure (bsc#1252487).
    - CVE-2023-53183: btrfs: exit gracefully if reloc roots don't match (bsc#1249863).
    - CVE-2023-53185: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (bsc#1249820).
    - CVE-2023-53188: net: openvswitch: fix race on port output (bsc#1249854).
    - CVE-2023-53191: irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains (bsc#1249721).
    - CVE-2023-53204: af_unix: Fix data-races around user->unix_inflight (bsc#1249682).
    - CVE-2023-53271: ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() (bsc#1249916).
    - CVE-2023-53282: scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write     (bsc#1250311).
    - CVE-2023-53289: media: bdisp: Add missing check for create_workqueue (bsc#1249941).
    - CVE-2023-53292: blk-mq: protect q->elevator by ->sysfs_lock in blk_mq_elv_switch_none (bsc#1250163).
    - CVE-2023-53338: lwt: Fix return values of BPF xmit ops (bsc#1250074).
    - CVE-2023-53339: btrfs: fix BUG_ON condition in btrfs_cancel_balance (bsc#1250329).
    - CVE-2023-53373: crypto: seqiv - Handle EBUSY correctly (bsc#1250137).
    - CVE-2023-53433: net: add vlan_get_protocol_and_depth() helper (bsc#1250164).
    - CVE-2023-53476: iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() (bsc#1250839).
    - CVE-2023-53477: ipv6: Add lwtunnel encap size of all siblings in nexthop calculation (bsc#1250840).
    - CVE-2023-53484: lib: cpu_rmap: Avoid use after free on rmap->obj array entries (bsc#1250895).
    - CVE-2023-53517: tipc: do not update mtu if msg_max is too small in mtu negotiation (bsc#1250919).
    - CVE-2023-53519: media: v4l2-mem2mem: add lock to protect parameter num_rdy (bsc#1250964).
    - CVE-2023-53540: wifi: cfg80211: reject auth/assoc to AP with our address (bsc#1251053).
    - CVE-2023-53548: net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb (bsc#1251066).
    - CVE-2023-53556: iavf: Fix use-after-free in free_netdev (bsc#1251059).
    - CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
    - CVE-2023-53582: wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds     (bsc#1251061).
    - CVE-2023-53589: wifi: iwlwifi: mvm: don't trust firmware n_channels (bsc#1251129).
    - CVE-2023-53593: cifs: Release folio lock on fscache read hit (bsc#1251132).
    - CVE-2023-53594: driver core: fix resource leak in device_add() (bsc#1251166).
    - CVE-2023-53596: drivers: base: Free devm resources when unregistering a device (bsc#1251161).
    - CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
    - CVE-2023-53620: md: fix soft lockup in status_resync.
    - CVE-2023-53624: net/sched: sch_fq: fix integer overflow of 'credit' (bsc#1251333).
    - CVE-2023-53635: netfilter: conntrack: fix wrong ct->timeout value (bsc#1251524).
    - CVE-2023-53648: ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer (bsc#1251750).
    - CVE-2023-53687: tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating     clk (bsc#1251772).
    - CVE-2023-53695: udf: Detect system inodes linked into directory hierarchy (bsc#1252539).
    - CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
    - CVE-2023-53707: drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1 (bsc#1252632).
    - CVE-2023-53715: wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex (bsc#1252545).
    - CVE-2023-53717: wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()     (bsc#1252560).
    - CVE-2023-53733: net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode (bsc#1252685).
    - CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).
    - CVE-2025-38680: media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (bsc#1249203).
    - CVE-2025-38691: pNFS: Fix uninited ptr deref in block/scsi layout (bsc#1249215).
    - CVE-2025-38695: scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (bsc#1249285).
    - CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).
    - CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated     (bsc#1249182).
    - CVE-2025-38714: hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (bsc#1249260).
    - CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).
    - CVE-2025-38724: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (bsc#1249169).
    - CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).
    - CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).
    - CVE-2025-39724: serial: 8250: fix panic due to PSLVERR (bsc#1249265).
    - CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).
    - CVE-2025-39772: drm/hisilicon/hibmc: fix the hibmc loaded failed bug (bsc#1249506).
    - CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).
    - CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).
    - CVE-2025-39841: scsi: lpfc: Fix buffer free/clear order in deferred receive path (bsc#1250274).
    - CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).
    - CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).
    - CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).
    - CVE-2025-39923: dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (bsc#1250741).
    - CVE-2025-39929: smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (bsc#1251036).
    - CVE-2025-39931: crypto: af_alg - Set merge to zero early in af_alg_sendmsg (bsc#1251100).
    - CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
    - CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).
    - CVE-2025-39955: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (bsc#1251804).
    - CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
    - CVE-2025-39970: i40e: Fix filter input checks to prevent config with invalid values (bsc#1252051).
    - CVE-2025-39971: i40e: Add bounds check for ch[] array (bsc#1252052).
    - CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).
    - CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
    - CVE-2025-39997: ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (bsc#1252056).
    - CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
    - CVE-2025-40044: fs: udf: fix OOB read in lengthAllocDescs handling (bsc#1252785).
    - CVE-2025-40049: Squashfs: fix uninit-value in squashfs_get_parent (bsc#1252822).
    - CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).
    - CVE-2025-40082: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1252775).
    - CVE-2025-40088: hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (bsc#1252904).

    The following non security issues were fixed:

    - NFSv4.1: fix backchannel max_resp_sz verification check (bsc#1247518).
    - net: hv_netvsc: fix loss of early receive events from host during channel open (bsc#1252265).
    - openvswitch: fix lockup on tx to unregistering netdev with carrier (bsc#1249854)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4111-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
    - CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (bsc#1249857).
    - CVE-2022-50490: bpf: Propagate error from htab_lock_bucket() to userspace (bsc#1251164).
    - CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
    - CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
    - CVE-2023-53500: xfrm: fix slab-use-after-free in decode_session6 (bsc#1250816).
    - CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
    - CVE-2023-53574: wifi: rtw88: delete timer and free skb queue when unloading (bsc#1251222).
    - CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
    - CVE-2023-53673: Bluetooth: hci_event: call disconnect callback before deleting conn (bsc#1251763).
    - CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
    - CVE-2025-39742: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (bsc#1249479).
    - CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
    - CVE-2025-39967: fbcon: fix integer overflow in fbcon_do_set_font (bsc#1252033).
    - CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
    - CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
    - CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).
    - CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
    - CVE-2025-40044: fs: udf: fix OOB read in lengthAllocDescs handling (bsc#1252785).
    - CVE-2025-40088: hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (bsc#1252904).
    - CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).

    The following non security issues were fixed:

    - fbcon: Fix OOB access in font allocation (bsc#1252033)
    - mm: avoid unnecessary page fault retires on shared memory types (bsc#1251823).
    - net: hv_netvsc: fix loss of early receive events from host during channel open (bsc#1252265).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds Fix a stack-out-of-     bounds read in brcmfmac that occurs when 'buf' that is not null-terminated is passed as an argument of     strreplace() in brcmf_c_preinit_dcmds(). This buffer is filled with a CLM version string by memcpy() in     brcmf_fil_iovar_data_get(). Ensure buf is null-terminated. Found by a modified version of syzkaller. [     33.004414][ T1896] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have     limited channels available [ 33.013486][ T1896] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM43236/3 wl0:
    Nov 30 2011 17:33:42 version 5.90.188.22 [ 33.021554][ T1896]     ================================================================== [ 33.022379][ T1896] BUG: KASAN: stack-     out-of-bounds in strreplace+0xf2/0x110 [ 33.023122][ T1896] Read of size 1 at addr ffffc90001d6efc8 by     task kworker/0:2/1896 [ 33.023852][ T1896] [ 33.024096][ T1896] CPU: 0 PID: 1896 Comm: kworker/0:2     Tainted: G O 5.14.0+ #132 [ 33.024927][ T1896] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS     rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 33.026065][ T1896] Workqueue: usb_hub_wq     hub_event [ 33.026581][ T1896] Call Trace: [ 33.026896][ T1896] dump_stack_lvl+0x57/0x7d [ 33.027372][     T1896] print_address_description.constprop.0.cold+0xf/0x334 [ 33.028037][ T1896] ? strreplace+0xf2/0x110 [     33.028403][ T1896] ? strreplace+0xf2/0x110 [ 33.028807][ T1896] kasan_report.cold+0x83/0xdf [ 33.029283][     T1896] ? strreplace+0xf2/0x110 [ 33.029666][ T1896] strreplace+0xf2/0x110 [ 33.029966][ T1896]     brcmf_c_preinit_dcmds+0xab1/0xc40 [ 33.030351][ T1896] ? brcmf_c_set_joinpref_default+0x100/0x100 [     33.030787][ T1896] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 33.031223][ T1896] ?     rcu_read_lock_bh_held+0xb0/0xb0 [ 33.031661][ T1896] ? lock_acquire+0x19d/0x4e0 [ 33.032091][ T1896] ?     find_held_lock+0x2d/0x110 [ 33.032605][ T1896] ? brcmf_usb_deq+0x1a7/0x260 [ 33.033087][ T1896] ?     brcmf_usb_rx_fill_all+0x5a/0xf0 [ 33.033582][ T1896] brcmf_attach+0x246/0xd40 [ 33.034022][ T1896] ?     wiphy_new_nm+0x1476/0x1d50 [ 33.034383][ T1896] ? kmemdup+0x30/0x40 [ 33.034722][ T1896]     brcmf_usb_probe+0x12de/0x1690 [ 33.035223][ T1896] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470 [     33.035833][ T1896] usb_probe_interface+0x25f/0x710 [ 33.036315][ T1896] really_probe+0x1be/0xa90 [     33.036656][ T1896] __driver_probe_device+0x2ab/0x460 [ 33.037026][ T1896] ? usb_match_id.part.0+0x88/0xc0     [ 33.037383][ T1896] driver_probe_device+0x49/0x120 [ 33.037790][ T1896]
    __device_attach_driver+0x18a/0x250 [ 33.038300][ T1896] ? driver_allows_async_probing+0x120/0x120 [     33.038986][ T1896] bus_for_each_drv+0x123/0x1a0 [ 33.039906][ T1896] ? bus_rescan_devices+0x20/0x20 [     33.041412][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 33.041861][ T1896] ?     trace_hardirqs_on+0x1c/0x120 [ 33.042330][ T1896] __device_attach+0x207/0x330 [ 33.042664][ T1896] ?     device_bind_driver+0xb0/0xb0 [ 33.043026][ T1896] ? kobject_uevent_env+0x230/0x12c0 [ 33.043515][ T1896]     bus_probe_device+0x1a2/0x260 [ 33.043914][ T1896] device_add+0xa61/0x1ce0 [ 33.044227][ T1896] ?
    __mutex_unlock_slowpath+0xe7/0x660 [ 33.044891][ T1896] ? __fw_devlink_link_to_suppliers+0x550/0x550 [     33.045531][ T1896] usb_set_configuration+0x984/0x1770 [ 33.046051][ T1896] ?     kernfs_create_link+0x175/0x230 [ 33.046548][ T1896] usb_generic_driver_probe+0x69/0x90 [ 33.046931][     T1896] usb_probe_device+0x9c/0x220 [ 33.047434][ T1896] really_probe+0x1be/0xa90 [ 33.047760][ T1896]
    __driver_probe_device+0x2ab/0x460 [ 33.048134][ T1896] driver_probe_device+0x49/0x120 [ 33.048516][ T1896]
    __device_attach_driver+0x18a/0x250 [ 33.048910][ T1896] ? driver_allows_async_probing+0x120/0x120
    ---truncated--- (CVE-2023-53582)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
308990	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010924)	Nessus	Unity Linux Local Security Checks	medium
308240	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-006923)	Nessus	Unity Linux Local Security Checks	medium
280691	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:4320-1)	Nessus	SuSE Local Security Checks	high
276910	SUSE SLES12 Security Update : kernel (SUSE-SU-2025:4189-1)	Nessus	SuSE Local Security Checks	high
275594	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:4111-1)	Nessus	SuSE Local Security Checks	high
269402	Linux Distros Unpatched Vulnerability : CVE-2023-53582	Nessus	Misc.	high
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2023-53582

medium

Tenable Plugins

medium

medium

high

high

high

high

high