In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix deadlock in tc route query code Cited commit causes ABBA deadlock[0] when peer flows are created while holding the devcom rw semaphore. Due to peer flows offload implementation the lock is taken much higher up the call chain and there is no obvious way to easily fix the deadlock. Instead, since tc route query code needs the peer eswitch structure only to perform a lookup in xarray and doesn't perform any sleeping operations with it, refactor the code for lockless execution in following ways: - RCUify the devcom 'data' pointer. When resetting the pointer synchronously wait for RCU grace period before returning. This is fine since devcom is currently only used for synchronization of pairing/unpairing of eswitches which is rare and already expensive as-is. - Wrap all usages of 'paired' boolean in {READ|WRITE}_ONCE(). The flag has already been used in some unlocked contexts without proper annotations (e.g. users of mlx5_devcom_is_paired() function), but it wasn't an issue since all relevant code paths checked it again after obtaining the devcom semaphore. Now it is also used by mlx5_devcom_get_peer_data_rcu() as "best effort" check to return NULL when devcom is being unpaired. Note that while RCU read lock doesn't prevent the unpaired flag from being changed concurrently it still guarantees that reader can continue to use 'data'. - Refactor mlx5e_tc_query_route_vport() function to use new mlx5_devcom_get_peer_data_rcu() API which fixes the deadlock. [0]: [ 164.599612] ====================================================== [ 164.600142] WARNING: possible circular locking dependency detected [ 164.600667] 6.3.0-rc3+ #1 Not tainted [ 164.601021] ------------------------------------------------------ [ 164.601557] handler1/3456 is trying to acquire lock: [ 164.601998] ffff88811f1714b0 (&esw->offloads.encap_tbl_lock){+.+.}-{3:3}, at: mlx5e_attach_encap+0xd8/0x8b0 [mlx5_core] [ 164.603078] but task is already holding lock: [ 164.603617] ffff88810137fc98 (&comp->sem){++++}-{3:3}, at: mlx5_devcom_get_peer_data+0x37/0x80 [mlx5_core] [ 164.604459] which lock already depends on the new lock. [ 164.605190] the existing dependency chain (in reverse order) is: [ 164.605848] -> #1 (&comp->sem){++++}-{3:3}: [ 164.606380] down_read+0x39/0x50 [ 164.606772] mlx5_devcom_get_peer_data+0x37/0x80 [mlx5_core] [ 164.607336] mlx5e_tc_query_route_vport+0x86/0xc0 [mlx5_core] [ 164.607914] mlx5e_tc_tun_route_lookup+0x1a4/0x1d0 [mlx5_core] [ 164.608495] mlx5e_attach_decap_route+0xc6/0x1e0 [mlx5_core] [ 164.609063] mlx5e_tc_add_fdb_flow+0x1ea/0x360 [mlx5_core] [ 164.609627] __mlx5e_add_fdb_flow+0x2d2/0x430 [mlx5_core] [ 164.610175] mlx5e_configure_flower+0x952/0x1a20 [mlx5_core] [ 164.610741] tc_setup_cb_add+0xd4/0x200 [ 164.611146] fl_hw_replace_filter+0x14c/0x1f0 [cls_flower] [ 164.611661] fl_change+0xc95/0x18a0 [cls_flower] [ 164.612116] tc_new_tfilter+0x3fc/0xd20 [ 164.612516] rtnetlink_rcv_msg+0x418/0x5b0 [ 164.612936] netlink_rcv_skb+0x54/0x100 [ 164.613339] netlink_unicast+0x190/0x250 [ 164.613746] netlink_sendmsg+0x245/0x4a0 [ 164.614150] sock_sendmsg+0x38/0x60 [ 164.614522] ____sys_sendmsg+0x1d0/0x1e0 [ 164.614934] ___sys_sendmsg+0x80/0xc0 [ 164.615320] __sys_sendmsg+0x51/0x90 [ 164.615701] do_syscall_64+0x3d/0x90 [ 164.616083] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 164.616568] -> #0 (&esw->offloads.encap_tbl_lock){+.+.}-{3:3}: [ 164.617210] __lock_acquire+0x159e/0x26e0 [ 164.617638] lock_acquire+0xc2/0x2a0 [ 164.618018] __mutex_lock+0x92/0xcd0 [ 164.618401] mlx5e_attach_encap+0xd8/0x8b0 [mlx5_core] [ 164.618943] post_process_attr+0x153/0x2d0 [ ---truncated---

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4320-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
    - CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (bsc#1249857).
    - CVE-2022-50490: bpf: Propagate error from htab_lock_bucket() to userspace (bsc#1251164).
    - CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
    - CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
    - CVE-2023-53500: xfrm: fix slab-use-after-free in decode_session6 (bsc#1250816).
    - CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
    - CVE-2023-53574: wifi: rtw88: delete timer and free skb queue when unloading (bsc#1251222).
    - CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
    - CVE-2023-53673: Bluetooth: hci_event: call disconnect callback before deleting conn (bsc#1251763).
    - CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-38084: hugetlb: unshare some PMDs when splitting VMAs (bsc#1245498).
    - CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
    - CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
    - CVE-2025-39742: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (bsc#1249479).
    - CVE-2025-39797: xfrm: Duplicate SPI Handling (bsc#1249608).
    - CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
    - CVE-2025-39967: fbcon: fix integer overflow in fbcon_do_set_font (bsc#1252033).
    - CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
    - CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
    - CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).
    - CVE-2025-39981: Bluetooth: MGMT: Fix possible UAFs (bsc#1252060).
    - CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
    - CVE-2025-40044: fs: udf: fix OOB read in lengthAllocDescs handling (bsc#1252785).

    The following non security issues were fixed:

    - NFS: remove revoked delegation from server's delegation list (bsc#1246211).
    - NFSv4: Allow FREE_STATEID to clean up delegations (bsc#1246211).
    - fbcon: Fix OOB access in font allocation (bsc#1252033)
    - kabi fix for NFSv4: Allow FREE_STATEID to clean up delegations (bsc#1246211).
    - kernel-subpackage-spec: Do not doubly-sign modules (bsc#1251930).
    - mm: avoid unnecessary page fault retires on shared memory types (bsc#1251823).
    - net: hv_netvsc: fix loss of early receive events from host during channel open (bsc#1252265).
    - net: mana: Switch to page pool for jumbo frames (bsc#1248754).
    - net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency     (bsc#1248754).
    - netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237).
    - rpm/check-for-config-changes: ignore CONFIG_SCHED_PROXY_EXEC, too (bsc#1250946)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix deadlock in tc route     query code Cited commit causes ABBA deadlock[0] when peer flows are created while holding the devcom rw     semaphore. Due to peer flows offload implementation the lock is taken much higher up the call chain and     there is no obvious way to easily fix the deadlock. Instead, since tc route query code needs the peer     eswitch structure only to perform a lookup in xarray and doesn't perform any sleeping operations with it,     refactor the code for lockless execution in following ways: - RCUify the devcom 'data' pointer. When     resetting the pointer synchronously wait for RCU grace period before returning. This is fine since devcom     is currently only used for synchronization of pairing/unpairing of eswitches which is rare and already     expensive as-is. - Wrap all usages of 'paired' boolean in {READ|WRITE}_ONCE(). The flag has already been     used in some unlocked contexts without proper annotations (e.g. users of mlx5_devcom_is_paired()     function), but it wasn't an issue since all relevant code paths checked it again after obtaining the     devcom semaphore. Now it is also used by mlx5_devcom_get_peer_data_rcu() as best effort check to return     NULL when devcom is being unpaired. Note that while RCU read lock doesn't prevent the unpaired flag from     being changed concurrently it still guarantees that reader can continue to use 'data'. - Refactor     mlx5e_tc_query_route_vport() function to use new mlx5_devcom_get_peer_data_rcu() API which fixes the     deadlock. [0]: [ 164.599612] ====================================================== [ 164.600142] WARNING:
    possible circular locking dependency detected [ 164.600667] 6.3.0-rc3+ #1 Not tainted [ 164.601021]
    ------------------------------------------------------ [ 164.601557] handler1/3456 is trying to acquire     lock: [ 164.601998] ffff88811f1714b0 (&esw->offloads.encap_tbl_lock){+.+.}-{3:3}, at:
    mlx5e_attach_encap+0xd8/0x8b0 [mlx5_core] [ 164.603078] but task is already holding lock: [ 164.603617]     ffff88810137fc98 (&comp->sem){++++}-{3:3}, at: mlx5_devcom_get_peer_data+0x37/0x80 [mlx5_core] [     164.604459] which lock already depends on the new lock. [ 164.605190] the existing dependency chain (in     reverse order) is: [ 164.605848] -> #1 (&comp->sem){++++}-{3:3}: [ 164.606380] down_read+0x39/0x50 [     164.606772] mlx5_devcom_get_peer_data+0x37/0x80 [mlx5_core] [ 164.607336]     mlx5e_tc_query_route_vport+0x86/0xc0 [mlx5_core] [ 164.607914] mlx5e_tc_tun_route_lookup+0x1a4/0x1d0     [mlx5_core] [ 164.608495] mlx5e_attach_decap_route+0xc6/0x1e0 [mlx5_core] [ 164.609063]     mlx5e_tc_add_fdb_flow+0x1ea/0x360 [mlx5_core] [ 164.609627] __mlx5e_add_fdb_flow+0x2d2/0x430 [mlx5_core] [     164.610175] mlx5e_configure_flower+0x952/0x1a20 [mlx5_core] [ 164.610741] tc_setup_cb_add+0xd4/0x200 [     164.611146] fl_hw_replace_filter+0x14c/0x1f0 [cls_flower] [ 164.611661] fl_change+0xc95/0x18a0     [cls_flower] [ 164.612116] tc_new_tfilter+0x3fc/0xd20 [ 164.612516] rtnetlink_rcv_msg+0x418/0x5b0 [     164.612936] netlink_rcv_skb+0x54/0x100 [ 164.613339] netlink_unicast+0x190/0x250 [ 164.613746]     netlink_sendmsg+0x245/0x4a0 [ 164.614150] sock_sendmsg+0x38/0x60 [ 164.614522] ____sys_sendmsg+0x1d0/0x1e0     [ 164.614934] ___sys_sendmsg+0x80/0xc0 [ 164.615320] __sys_sendmsg+0x51/0x90 [ 164.615701]     do_syscall_64+0x3d/0x90 [ 164.616083] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 164.616568] -> #0     (&esw->offloads.encap_tbl_lock){+.+.}-{3:3}: [ 164.617210] __lock_acquire+0x159e/0x26e0 [ 164.617638]     lock_acquire+0xc2/0x2a0 [ 164.618018] __mutex_lock+0x92/0xcd0 [ 164.618401] mlx5e_attach_encap+0xd8/0x8b0     [mlx5_core] [ 164.618943] post_process_attr+0x153/0x2d0 [ ---truncated--- (CVE-2023-53591)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.15.117-72.142. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-021 advisory.

    In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT     flags before replaying logs. (CVE-2022-48425)

    In the Linux kernel, the following vulnerability has been resolved:

    binder: fix UAF of alloc->vma in race with munmap() (CVE-2022-50240)

    In the Linux kernel, the following vulnerability has been resolved:

    binder: fix UAF of alloc->vma in race with munmap() (CVE-2022-50338)

    There is a potential deadlock in the eBPF subsystem in the Linux kernel.

    The default sysctl configuration kernel.unprivileged_bpf_disabled on Amazon Linux does not allow     unprivileged users to use eBPF. (CVE-2023-0160)

    A flaw was found in the Linux kernel's networking subsystem within the RPL protocol's handling. This issue     results from the improper handling of user-supplied data, which can lead to an assertion failure. This     flaw allows an unauthenticated, remote attacker to create a denial of service condition on the system.
    (CVE-2023-2156)

    A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to     achieve local privilege escalation.

    The out-of-bounds write is caused by missing skb->cb  initialization in the ipvlan network driver. The     vulnerability is reachable if CONFIG_IPVLAN is enabled.

    We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. (CVE-2023-3090)

    A flaw in the Linux Kernel found in the GFS2 file system. On corrupted gfs2 file systems the evict code     can try to reference the journal descriptor structure, jdesc, after it has been freed and set to NULL. It     can lead to null pointer dereference when gfs2_trans_begin being called and then fail     ingfs2_evict_inode(). (CVE-2023-3212)

    An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

    An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in     lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an     offset. (CVE-2023-34256)

    A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux     Kernel. In this flaw an attacker with local user access may lead to a system crash or a leak of internal     kernel information. (CVE-2023-3567)

    An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
    It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
    This may result in denial of service or privilege escalation. (CVE-2023-35788)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: Reinit port->pm on port specific driver unbind (CVE-2023-53176)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Avoid undefined behavior: applying zero offset to null pointer (CVE-2023-53182)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Add length check in indx_get_root (CVE-2023-53194)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix i_disksize exceeding i_size problem in paritally written case (CVE-2023-53270)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add bounds checking in get_max_inline_xattr_value_size() (CVE-2023-53285)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup() (CVE-2023-53294)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix leak of 'r10bio->remaining' for recovery (CVE-2023-53299)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix WARNING in mb_find_extent (CVE-2023-53317)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access (CVE-2023-53419)

    In the Linux kernel, the following vulnerability has been resolved:

    net: add vlan_get_protocol_and_depth() helper (CVE-2023-53433)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: remove a BUG_ON in ext4_mb_release_group_pa() (CVE-2023-53450)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: improve error handling from ext4_dirhash() (CVE-2023-53473)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/MCE/AMD: Use an u64 for bank_map (CVE-2023-53474)

    In the Linux kernel, the following vulnerability has been resolved:

    lib: cpu_rmap: Avoid use after free on rmap->obj array entries (CVE-2023-53484)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Enhance the attribute size check (CVE-2023-53486)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. (CVE-2023-53489)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio_net: Fix error unwinding of XDP initialization (CVE-2023-53499)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: allow ext4_get_group_info() to fail (CVE-2023-53503)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: fix incomplete validation of ioctl arg (CVE-2023-53513)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-crypto: make blk_crypto_evict_key() more robust (CVE-2023-53536)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: fix null deref on element insertion (CVE-2023-53566)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: Make intel_get_crtc_new_encoder() less oopsy (CVE-2023-53571)

    In the Linux kernel, the following vulnerability has been resolved:

    null_blk: Always check queue mode setting from configfs (CVE-2023-53576)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: Fix multiple LUN_RESET handling (CVE-2023-53586)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Sync IRQ works before buffer destruction (CVE-2023-53587)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix deadlock in tc route query code (CVE-2023-53591)

    In the Linux kernel, the following vulnerability has been resolved:

    dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (CVE-2023-53604)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_fq: fix integer overflow of credit (CVE-2023-53624)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed (CVE-2023-53655)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline (CVE-2023-53692)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix out-of-bounds access in ipv6_find_tlv() (CVE-2023-53705)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix NULL dereference in ni_write_inode (CVE-2023-53732)

    A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This     flaw allows a local user to cause an information leak problem while freeing the old quota file names     before a potential failure, leading to a use-after-free. (CVE-2024-0775)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
280691	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:4320-1)	Nessus	SuSE Local Security Checks	high
269339	Linux Distros Unpatched Vulnerability : CVE-2023-53591	Nessus	Misc.	high
177781	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-021 (ALASKERNEL-5.15-2023-021)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2023-53591

medium

Tenable Plugins

high

high

high