In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix slab-use-after-free in decode_session6 When ipv6_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ipv6_vti device sends IPv6 packets. The stack information is as follows: BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890 Read of size 1 at addr ffff88802e08edc2 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-next-20230707-00001-g84e2cad7f979 #410 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0xd9/0x150 print_address_description.constprop.0+0x2c/0x3c0 kasan_report+0x11d/0x130 decode_session6+0x103f/0x1890 __xfrm_decode_session+0x54/0xb0 vti6_tnl_xmit+0x3e6/0x1ee0 dev_hard_start_xmit+0x187/0x700 sch_direct_xmit+0x1a3/0xc30 __qdisc_run+0x510/0x17a0 __dev_queue_xmit+0x2215/0x3b10 neigh_connected_output+0x3c2/0x550 ip6_finish_output2+0x55a/0x1550 ip6_finish_output+0x6b9/0x1270 ip6_output+0x1f1/0x540 ndisc_send_skb+0xa63/0x1890 ndisc_send_rs+0x132/0x6f0 addrconf_rs_timer+0x3f1/0x870 call_timer_fn+0x1a0/0x580 expire_timers+0x29b/0x4b0 run_timer_softirq+0x326/0x910 __do_softirq+0x1d4/0x905 irq_exit_rcu+0xb7/0x120 sysvec_apic_timer_interrupt+0x97/0xc0 </IRQ> Allocated by task 9176: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x7f/0x90 kmem_cache_alloc_node+0x1cd/0x410 kmalloc_reserve+0x165/0x270 __alloc_skb+0x129/0x330 netlink_sendmsg+0x9b1/0xe30 sock_sendmsg+0xde/0x190 ____sys_sendmsg+0x739/0x920 ___sys_sendmsg+0x110/0x1b0 __sys_sendmsg+0xf7/0x1c0 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 9176: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x40 ____kasan_slab_free+0x160/0x1c0 slab_free_freelist_hook+0x11b/0x220 kmem_cache_free+0xf0/0x490 skb_free_head+0x17f/0x1b0 skb_release_data+0x59c/0x850 consume_skb+0xd2/0x170 netlink_unicast+0x54f/0x7f0 netlink_sendmsg+0x926/0xe30 sock_sendmsg+0xde/0x190 ____sys_sendmsg+0x739/0x920 ___sys_sendmsg+0x110/0x1b0 __sys_sendmsg+0xf7/0x1c0 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff88802e08ed00 which belongs to the cache skbuff_small_head of size 640 The buggy address is located 194 bytes inside of freed 640-byte region [ffff88802e08ed00, ffff88802e08ef80) As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    media: v4l2-mem2mem: add lock to protect parameter num_rdy(CVE-2023-53519)

    md: Replace snprintf with scnprintf(CVE-2022-50299)

    mm/vmscan: don't try to reclaim hwpoison folio(CVE-2025-37834)

    ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()(CVE-2023-53271)

    md/raid10: fix wrong setting of max_corr_read_errors(CVE-2023-53313)

    scsi: target: target_core_configfs: Add length check to avoid buffer overflow(CVE-2025-39998)

    loop: Avoid updating block size under exclusive owner(CVE-2025-38709)

    mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory(CVE-2025-39883)

    scsi: qla4xxx: Prevent a potential error pointer dereference(CVE-2025-39676)

    NFS: Fix a race when updating an existing write(CVE-2025-39697)

    scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses(CVE-2023-7324)

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare(CVE-2025-39817)

    dm raid: fix address sanitizer warning in raid_resume(CVE-2022-50085)

    usb-storage: alauda: Fix uninit-value in alauda_check_media()(CVE-2023-53847)

    mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list(CVE-2025-39725)

    md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request(CVE-2023-53380)

    md/raid10: check slab-out-of-bounds in md_bitmap_get_counter(CVE-2023-53357)

    net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode(CVE-2023-53733)

    fs: quota: create dedicated workqueue for quota_release_work(CVE-2025-40196)

    partitions: mac: fix handling of bogus partition table(CVE-2025-21772)

    HID: hidraw: fix memory leak in hidraw_release()(CVE-2022-49981)

    pid: Add a judgment for ns null in pid_nr_ns(CVE-2025-40178)

    libceph: fix potential use-after-free in have_mon_and_osd_map()(CVE-2025-68285)

    watchdog: Fix kmemleak in watchdog_cdev_register(CVE-2023-53234)

    drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()(CVE-2022-50402)

    PNP: fix name memory leak in pnp_alloc_dev()(CVE-2022-50278)

    ipvs: Defer ip_vs_ftp unregister during netns cleanup(CVE-2025-40018)

    nbd: Fix hung when signal interrupts nbd_start_device_ioctl()(CVE-2022-50314)

    igb: Do not free q_vector unless new one was allocated(CVE-2022-50252)

    ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed(CVE-2023-53481)

    cacheinfo: Fix shared_cpu_map to handle shared caches at different levels(CVE-2023-53254)

    scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()(CVE-2025-40115)

    scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()(CVE-2023-53676)

    NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid(CVE-2025-68349)

    net: hns: fix possible memory leak in hnae_ae_register()(CVE-2022-50352)

    md: call __md_stop_writes in md_stop(CVE-2022-49987)

    net/packet: fix a race in packet_set_ring() and packet_notifier()(CVE-2025-38617)

    regulator: of: Fix refcount leak bug in of_get_regulation_constraints()(CVE-2022-50191)

    ubi: Fix use-after-free when volume resizing failed(CVE-2023-53800)

    HID: multitouch: Correct devm device reference for hidinput input_dev name(CVE-2023-53454)

    ipv6: reject malicious packets in ipv6_gso_segment()(CVE-2025-38572)

    md/raid10: fix leak of 'r10bio-remaining' for recovery(CVE-2023-53299)

    scsi: qla2xxx: Wait for io return on terminate rport(CVE-2023-53322)

    udf: Detect system inodes linked into directory hierarchy(CVE-2023-53695)

    igb: Fix igb_down hung on surprise removal(CVE-2023-53148)

    cifs: Fix warning and UAF when destroy the MR list(CVE-2023-53427)

    scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()(CVE-2023-53803)

    ubi: ensure that VID header offset + VID header size = alloc, size(CVE-2023-53265)

    fs/proc: fix uaf in proc_readdir_de()(CVE-2025-40271)

    firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails(CVE-2022-50087)

    md-raid10: fix KASAN warning(CVE-2022-50211)

    scsi: ses: Fix possible desc_ptr out-of-bounds accesses(CVE-2023-53675)

    mmc: core: Fix kernel panic when remove non-standard SDIO card(CVE-2022-50640)

    nfs: handle failure of nfs_get_lock_context in unlock path(CVE-2025-38023)

    udf: Do not update file length for failed writes to inline files(CVE-2023-53295)

    RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug(CVE-2025-38024)

    sctp: check send stream number after wait_for_sndbuf(CVE-2023-53296)

    net/sched: sch_qfq: Fix race condition on qfq_aggregate(CVE-2025-38477)

    RDMA/rxe: Fix 'kernel NULL pointer dereference' error(CVE-2022-50671)

    i40e: add validation for ring_len param(CVE-2025-39973)

    md/raid1: Fix stack memory use after return in raid1_reshape(CVE-2025-38445)

    Squashfs: check return result of sb_min_blocksize(CVE-2025-38415)

    net/tunnel: wait until all sk_user_data reader finish before releasing the sock(CVE-2022-50405)

    ip6_vti: fix slab-use-after-free in decode_session6(CVE-2023-53821)

    af_unix: Fix data-races around user-unix_inflight.(CVE-2023-53204)

    RDMA/rxe: Fix error unwind in rxe_create_qp()(CVE-2022-50127)

    __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock(CVE-2025-38058)

    NFSD: Protect against send buffer overflow in NFSv2 READ(CVE-2022-50410)

    scsi: hpsa: Fix possible memory leak in hpsa_init_one()(CVE-2022-50646)

    sctp: handle the error returned from sctp_auth_asoc_init_active_key(CVE-2022-50243)

    vsock: Do not allow binding to VMADDR_PORT_ANY(CVE-2025-38618)

    smb: client: Fix use-after-free in cifs_fill_dirent(CVE-2025-38051)

    scsi: libiscsi: Initialize iscsi_conn-dd_data only if memory is allocated(CVE-2025-38700)

    sctp: fix a potential overflow in sctp_ifwdtsn_skip(CVE-2023-53372)

    pstore/ram: Check start of empty przs during init(CVE-2023-53331)

    clk: samsung: Fix memory leak in _samsung_clk_register_pll()(CVE-2022-50449)

    md/raid10: prevent soft lockup while flush writes(CVE-2023-53151)

    nfsd: call op_release, even when op_func returns an error(CVE-2023-53241)

    cifs: Release folio lock on fscache read hit.(CVE-2023-53593)

    net: bridge: fix soft lockup in br_multicast_query_expired()(CVE-2025-39773)

    cifs: fix small mempool leak in SMB2_negotiate()(CVE-2022-49938)

    dm raid: fix address sanitizer warning in raid_status(CVE-2022-50084)

    nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()(CVE-2025-38724)

    scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()(CVE-2023-54014)

    block: fix resource leak in blk_register_queue() error path(CVE-2025-37980)

    drm/client: Fix memory leak in drm_client_target_cloned(CVE-2023-54091)

    dm flakey: fix a crash with invalid table line(CVE-2023-53786)

    crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()(CVE-2023-53817)

    hwrng: virtio - Fix race on data_avail and actual data(CVE-2023-53998)

    sched/fair: Don't balance task to its current running CPU(CVE-2023-53215)

    ppp: associate skb with a device at tx(CVE-2022-50655)

    fbdev: bitblit: bound-check glyph index in bit_putcs*(CVE-2025-40322)

    acct: fix potential integer overflow in encode_comp_t()(CVE-2022-50749)

    udf: Avoid double brelse() in udf_rename()(CVE-2022-50755)

    tee: add overflow check in register_shm_helper()(CVE-2022-50080)

    drm: Prevent drm_copy_field() to attempt copying a NULL pointer(CVE-2022-50884)

    crypto: api - Use work queue in crypto_destroy_instance(CVE-2023-53799)

    mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()(CVE-2023-53623)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()(CVE-2025-40115)

    scsi: target: Fix WRITE_SAME No Data Buffer crash(CVE-2022-21546)

    NFSD: Fix crash in nfsd4_read_release()(CVE-2025-40324)

    scsi: qla4xxx: Prevent a potential error pointer dereference(CVE-2025-39676)

    loop: Avoid updating block size under exclusive owner(CVE-2025-38709)

     media: v4l2-mem2mem: add lock to protect parameter num_rdy(CVE-2023-53519)

    mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()(CVE-2022-50347)

    net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb(CVE-2023-53548)

    platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()(CVE-2022-50521)

    tipc: fix an information leak in tipc_topsrv_kern_subscr(CVE-2022-50531)

    scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()(CVE-2023-54014)

    ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()(CVE-2023-53271)

    dma-buf: insert memory barrier before updating num_fences(CVE-2025-38095)

    md/raid10: fix wrong setting of max_corr_read_errors(CVE-2023-53313)

    scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses(CVE-2023-7324)

    scsi: storvsc: Fix handling of virtual Fibre Channel timeouts(CVE-2023-53245)

    md/raid10: prevent soft lockup while flush writes(CVE-2023-53151)

    clk: samsung: Fix memory leak in _samsung_clk_register_pll()(CVE-2022-50449)

    sctp: fix a potential overflow in sctp_ifwdtsn_skip(CVE-2023-53372)

    crypto: api - Use work queue in crypto_destroy_instance(CVE-2023-53799)

    drm: Prevent drm_copy_field() to attempt copying a NULL pointer(CVE-2022-50884)

    dm raid: fix address sanitizer warning in raid_status(CVE-2022-50084)

    cifs: fix small mempool leak in SMB2_negotiate()(CVE-2022-49938)

    net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device(CVE-2023-54015)

    ipv6: reject malicious packets in ipv6_gso_segment()(CVE-2025-38572)

    fs/proc: fix uaf in proc_readdir_de()(CVE-2025-40271)

    scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()(CVE-2023-53803)

    macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse(CVE-2025-68367)

    ubi: Fix use-after-free when volume resizing failed(CVE-2023-53800)

    crypto: qat - fix DMA transfer direction(CVE-2022-50774)

    scsi: hpsa: Fix possible memory leak in hpsa_init_one()(CVE-2022-50646)

    mmc: core: Fix kernel panic when remove non-standard SDIO card(CVE-2022-50640)

    usb: host: ohci-ppc-of: Fix refcount leak bug(CVE-2022-50033)

    PNP: fix name memory leak in pnp_alloc_dev()(CVE-2022-50278)

    media: dvb-frontends: fix leak of memory fw(CVE-2022-50664)

    fs: quota: create dedicated workqueue for quota_release_work(CVE-2025-40196)

    acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl(CVE-2024-56662)

    scsi: ses: Handle enclosure with just a primary component gracefully(CVE-2023-53431)

    pid: Add a judgment for ns null in pid_nr_ns(CVE-2025-40178)

    NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid(CVE-2025-68349)

    hwrng: virtio - Fix race on data_avail and actual data(CVE-2023-53998)

    usb-storage: alauda: Fix uninit-value in alauda_check_media()(CVE-2023-53847)

    netlink: do not hard code device address lenth in fdb dumps(CVE-2023-53863)

    drm/client: Fix memory leak in drm_client_target_cloned(CVE-2023-54091)

    ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe(CVE-2025-68241)

    md/raid10: fix null-ptr-deref in raid10_sync_request(CVE-2023-53832)

    iommu/amd: Fix pci device refcount leak in ppr_notifier()(CVE-2022-50505)

    net: read sk-sk_family once in sk_mc_loop()(CVE-2023-53831)

    fbdev: bitblit: bound-check glyph index in bit_putcs*(CVE-2025-40322)

    bpf: make sure skb-len != 0 when redirecting to a tunneling device(CVE-2022-50253)

    ppp: associate skb with a device at tx(CVE-2022-50655)

    ip6_vti: fix slab-use-after-free in decode_session6(CVE-2023-53821)

    hwrng: amd - Fix PCI device refcount leak(CVE-2022-50868)

    netlink: annotate accesses to nlk-cb_running(CVE-2023-53853)

    acct: fix potential integer overflow in encode_comp_t()(CVE-2022-50749)

    RDMA/rxe: Fix 'kernel NULL pointer dereference' error(CVE-2022-50671)

    udf: Avoid double brelse() in udf_rename()(CVE-2022-50755)

    dm flakey: fix a crash with invalid table line(CVE-2023-53786)

    libceph: fix potential use-after-free in have_mon_and_osd_map()(CVE-2025-68285)

    crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()(CVE-2023-53817)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    media: v4l2-mem2mem: add lock to protect parameter num_rdy(CVE-2023-53519)

    md: Replace snprintf with scnprintf(CVE-2022-50299)

    mm/vmscan: don't try to reclaim hwpoison folio(CVE-2025-37834)

    ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()(CVE-2023-53271)

    md/raid10: fix wrong setting of max_corr_read_errors(CVE-2023-53313)

    scsi: target: target_core_configfs: Add length check to avoid buffer overflow(CVE-2025-39998)

    loop: Avoid updating block size under exclusive owner(CVE-2025-38709)

    mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory(CVE-2025-39883)

    scsi: qla4xxx: Prevent a potential error pointer dereference(CVE-2025-39676)

    NFS: Fix a race when updating an existing write(CVE-2025-39697)

    scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses(CVE-2023-7324)

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare(CVE-2025-39817)

    dm raid: fix address sanitizer warning in raid_resume(CVE-2022-50085)

    usb-storage: alauda: Fix uninit-value in alauda_check_media()(CVE-2023-53847)

    mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list(CVE-2025-39725)

    md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request(CVE-2023-53380)

    md/raid10: check slab-out-of-bounds in md_bitmap_get_counter(CVE-2023-53357)

    net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode(CVE-2023-53733)

    fs: quota: create dedicated workqueue for quota_release_work(CVE-2025-40196)

    partitions: mac: fix handling of bogus partition table(CVE-2025-21772)

    HID: hidraw: fix memory leak in hidraw_release()(CVE-2022-49981)

    pid: Add a judgment for ns null in pid_nr_ns(CVE-2025-40178)

    libceph: fix potential use-after-free in have_mon_and_osd_map()(CVE-2025-68285)

    watchdog: Fix kmemleak in watchdog_cdev_register(CVE-2023-53234)

    drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()(CVE-2022-50402)

    PNP: fix name memory leak in pnp_alloc_dev()(CVE-2022-50278)

    ipvs: Defer ip_vs_ftp unregister during netns cleanup(CVE-2025-40018)

    nbd: Fix hung when signal interrupts nbd_start_device_ioctl()(CVE-2022-50314)

    igb: Do not free q_vector unless new one was allocated(CVE-2022-50252)

    ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed(CVE-2023-53481)

    cacheinfo: Fix shared_cpu_map to handle shared caches at different levels(CVE-2023-53254)

    scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()(CVE-2025-40115)

    scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()(CVE-2023-53676)

    NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid(CVE-2025-68349)

    net: hns: fix possible memory leak in hnae_ae_register()(CVE-2022-50352)

    md: call __md_stop_writes in md_stop(CVE-2022-49987)

    net/packet: fix a race in packet_set_ring() and packet_notifier()(CVE-2025-38617)

    regulator: of: Fix refcount leak bug in of_get_regulation_constraints()(CVE-2022-50191)

    ubi: Fix use-after-free when volume resizing failed(CVE-2023-53800)

    HID: multitouch: Correct devm device reference for hidinput input_dev name(CVE-2023-53454)

    ipv6: reject malicious packets in ipv6_gso_segment()(CVE-2025-38572)

    md/raid10: fix leak of 'r10bio-remaining' for recovery(CVE-2023-53299)

    scsi: qla2xxx: Wait for io return on terminate rport(CVE-2023-53322)

    udf: Detect system inodes linked into directory hierarchy(CVE-2023-53695)

    igb: Fix igb_down hung on surprise removal(CVE-2023-53148)

    cifs: Fix warning and UAF when destroy the MR list(CVE-2023-53427)

    scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()(CVE-2023-53803)

    ubi: ensure that VID header offset + VID header size = alloc, size(CVE-2023-53265)

    fs/proc: fix uaf in proc_readdir_de()(CVE-2025-40271)

    firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails(CVE-2022-50087)

    md-raid10: fix KASAN warning(CVE-2022-50211)

    scsi: ses: Fix possible desc_ptr out-of-bounds accesses(CVE-2023-53675)

    mmc: core: Fix kernel panic when remove non-standard SDIO card(CVE-2022-50640)

    nfs: handle failure of nfs_get_lock_context in unlock path(CVE-2025-38023)

    udf: Do not update file length for failed writes to inline files(CVE-2023-53295)

    RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug(CVE-2025-38024)

    sctp: check send stream number after wait_for_sndbuf(CVE-2023-53296)

    net/sched: sch_qfq: Fix race condition on qfq_aggregate(CVE-2025-38477)

    RDMA/rxe: Fix 'kernel NULL pointer dereference' error(CVE-2022-50671)

    i40e: add validation for ring_len param(CVE-2025-39973)

    md/raid1: Fix stack memory use after return in raid1_reshape(CVE-2025-38445)

    Squashfs: check return result of sb_min_blocksize(CVE-2025-38415)

    net/tunnel: wait until all sk_user_data reader finish before releasing the sock(CVE-2022-50405)

    ip6_vti: fix slab-use-after-free in decode_session6(CVE-2023-53821)

    af_unix: Fix data-races around user-unix_inflight.(CVE-2023-53204)

    RDMA/rxe: Fix error unwind in rxe_create_qp()(CVE-2022-50127)

    __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock(CVE-2025-38058)

    NFSD: Protect against send buffer overflow in NFSv2 READ(CVE-2022-50410)

    scsi: hpsa: Fix possible memory leak in hpsa_init_one()(CVE-2022-50646)

    sctp: handle the error returned from sctp_auth_asoc_init_active_key(CVE-2022-50243)

    vsock: Do not allow binding to VMADDR_PORT_ANY(CVE-2025-38618)

    smb: client: Fix use-after-free in cifs_fill_dirent(CVE-2025-38051)

    scsi: libiscsi: Initialize iscsi_conn-dd_data only if memory is allocated(CVE-2025-38700)

    sctp: fix a potential overflow in sctp_ifwdtsn_skip(CVE-2023-53372)

    pstore/ram: Check start of empty przs during init(CVE-2023-53331)

    clk: samsung: Fix memory leak in _samsung_clk_register_pll()(CVE-2022-50449)

    md/raid10: prevent soft lockup while flush writes(CVE-2023-53151)

    nfsd: call op_release, even when op_func returns an error(CVE-2023-53241)

    cifs: Release folio lock on fscache read hit.(CVE-2023-53593)

    net: bridge: fix soft lockup in br_multicast_query_expired()(CVE-2025-39773)

    cifs: fix small mempool leak in SMB2_negotiate()(CVE-2022-49938)

    dm raid: fix address sanitizer warning in raid_status(CVE-2022-50084)

    nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()(CVE-2025-38724)

    scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()(CVE-2023-54014)

    block: fix resource leak in blk_register_queue() error path(CVE-2025-37980)

    drm/client: Fix memory leak in drm_client_target_cloned(CVE-2023-54091)

    dm flakey: fix a crash with invalid table line(CVE-2023-53786)

    crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()(CVE-2023-53817)

    hwrng: virtio - Fix race on data_avail and actual data(CVE-2023-53998)

    sched/fair: Don't balance task to its current running CPU(CVE-2023-53215)

    ppp: associate skb with a device at tx(CVE-2022-50655)

    fbdev: bitblit: bound-check glyph index in bit_putcs*(CVE-2025-40322)

    acct: fix potential integer overflow in encode_comp_t()(CVE-2022-50749)

    udf: Avoid double brelse() in udf_rename()(CVE-2022-50755)

    tee: add overflow check in register_shm_helper()(CVE-2022-50080)

    drm: Prevent drm_copy_field() to attempt copying a NULL pointer(CVE-2022-50884)

    crypto: api - Use work queue in crypto_destroy_instance(CVE-2023-53799)

    mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()(CVE-2023-53623)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3375 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: RDMA/core: Fix KASAN: slab-use-after-free Read in ib_register_device problem (CVE-2025-38022)

    * kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation     (CVE-2025-38415)

    * kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing     (CVE-2025-39760)

    * kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length     (CVE-2025-39933)

    * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of     service. (CVE-2025-40271)

    * kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial     of service (CVE-2025-40269)

    * kernel: ip6_vti: fix slab-use-after-free in decode_session6 (CVE-2023-53821)

    * kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3360 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: RDMA/core: Fix KASAN: slab-use-after-free Read in ib_register_device problem (CVE-2025-38022)

    * kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation     (CVE-2025-38415)

    * kernel: Linux kernel: Denial of Service in ATM CLIP module via infinite recursion (CVE-2025-38459)

    * kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing     (CVE-2025-39760)

    * kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length     (CVE-2025-39933)

    * kernel: RDMA/rxe: Fix incomplete state save in rxe_requester (CVE-2023-53539)

    * kernel: net/mlx5e: Check for NOT_READY flag state after locking (CVE-2023-53581)

    * kernel: Bluetooth: hci_event: call disconnect callback before deleting conn (CVE-2023-53673)

    * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of     service. (CVE-2025-40271)

    * kernel: Linux kernel: Out-of-bounds write in fbdev can lead to privilege escalation, information     disclosure, or denial of service. (CVE-2025-40304)

    * kernel: Linux kernel: Information disclosure and denial of service via out-of-bounds read in font glyph     handling (CVE-2025-40322)

    * kernel: ip6_vti: fix slab-use-after-free in decode_session6 (CVE-2023-53821)

    * kernel: ext4: fix use-after-free in ext4_orphan_cleanup (CVE-2022-50673)

    * kernel: drm/i915: Fix NULL ptr deref by checking new_crtc_state (CVE-2023-53833)

    * kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} (CVE-2023-53827)

    * kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349)

    * kernel: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (CVE-2022-50865)

    * kernel: Linux kernel: Use-after-free in teql queueing discipline can lead to privilege escalation     (CVE-2026-23074)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3277 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation     (CVE-2025-38415)

    * kernel: Linux kernel: Denial of Service in ATM CLIP module via infinite recursion (CVE-2025-38459)

    * kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing     (CVE-2025-39760)

    * kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length     (CVE-2025-39933)

    * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of     service. (CVE-2025-40271)

    * kernel: ip6_vti: fix slab-use-after-free in decode_session6 (CVE-2023-53821)

    * kernel: ext4: fix use-after-free in ext4_orphan_cleanup (CVE-2022-50673)

    * kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349)

    * kernel: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (CVE-2022-50865)

    * kernel: Linux kernel: Use-after-free in teql queueing discipline can lead to privilege escalation     (CVE-2026-23074)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3267 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel: xHCI driver isochronous event handling race condition leading to data loss or UAF     (CVE-2025-37882)

    * kernel: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (CVE-2025-37861)

    * kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation     (CVE-2025-38415)

    * kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing     (CVE-2025-39760)

    * kernel: Linux kernel: Out-of-bounds write in VXLAN due to incorrect nexthop hash size leading to denial     of service (CVE-2023-53192)

    * kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length     (CVE-2025-39933)

    * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of     service. (CVE-2025-40271)

    * kernel: Linux kernel Bluetooth: Denial of Service due to use-after-free in connection handling     (CVE-2023-53762)

    * kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial     of service (CVE-2025-40269)

    * kernel: ip6_vti: fix slab-use-after-free in decode_session6 (CVE-2023-53821)

    * kernel: ext4: fix use-after-free in ext4_orphan_cleanup (CVE-2022-50673)

    * kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3358 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Linux kernel: xHCI driver isochronous event handling race condition leading to data loss or UAF     (CVE-2025-37882)

    * kernel: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (CVE-2025-37861)

    * kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation     (CVE-2025-38415)

    * kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing     (CVE-2025-39760)

    * kernel: Linux kernel: Out-of-bounds write in VXLAN due to incorrect nexthop hash size leading to denial     of service (CVE-2023-53192)

    * kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length     (CVE-2025-39933)

    * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of     service. (CVE-2025-40271)

    * kernel: Linux kernel Bluetooth: Denial of Service due to use-after-free in connection handling     (CVE-2023-53762)

    * kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial     of service (CVE-2025-40269)

    * kernel: ip6_vti: fix slab-use-after-free in decode_session6 (CVE-2023-53821)

    * kernel: ext4: fix use-after-free in ext4_orphan_cleanup (CVE-2022-50673)

    * kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3388 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: RDMA/core: Fix KASAN: slab-use-after-free Read in ib_register_device problem (CVE-2025-38022)

    * kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation     (CVE-2025-38415)

    * kernel: Linux kernel: Denial of Service in ATM CLIP module via infinite recursion (CVE-2025-38459)

    * kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing     (CVE-2025-39760)

    * kernel: nbd: fix incomplete validation of ioctl arg (CVE-2023-53513)

    * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of     service. (CVE-2025-40271)

    * kernel: ip6_vti: fix slab-use-after-free in decode_session6 (CVE-2023-53821)

    * kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} (CVE-2023-53827)

    * kernel: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (CVE-2022-50865)

    * kernel: Linux kernel: Use-after-free in teql queueing discipline can lead to privilege escalation     (CVE-2026-23074)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3268 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: RDMA/core: Fix KASAN: slab-use-after-free Read in ib_register_device problem (CVE-2025-38022)

    * kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation     (CVE-2025-38415)

    * kernel: Linux kernel: Denial of Service in ATM CLIP module via infinite recursion (CVE-2025-38459)

    * kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing     (CVE-2025-39760)

    * kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length     (CVE-2025-39933)

    * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of     service. (CVE-2025-40271)

    * kernel: ip6_vti: fix slab-use-after-free in decode_session6 (CVE-2023-53821)

    * kernel: Linux kernel: Use-after-free in teql queueing discipline can lead to privilege escalation     (CVE-2026-23074)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3293 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: RDMA/core: Fix KASAN: slab-use-after-free Read in ib_register_device problem (CVE-2025-38022)

    * kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation     (CVE-2025-38415)

    * kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing     (CVE-2025-39760)

    * kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length     (CVE-2025-39933)

    * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of     service. (CVE-2025-40271)

    * kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial     of service (CVE-2025-40269)

    * kernel: ip6_vti: fix slab-use-after-free in decode_session6 (CVE-2023-53821)

    * kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ip6_vti: fix slab-use-after-free in decode_session6 When ipv6_vti device is set to the qdisc of the sfb     type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur     when ipv6_vti device sends IPv6 packets. The stack information is as follows: BUG: KASAN: slab-use-after-     free in decode_session6+0x103f/0x1890 Read of size 1 at addr ffff88802e08edc2 by task swapper/0/0 CPU: 0     PID: 0 Comm: swapper/0 Not tainted 6.4.0-next-20230707-00001-g84e2cad7f979 #410 Hardware name: QEMU     Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <IRQ>     dump_stack_lvl+0xd9/0x150 print_address_description.constprop.0+0x2c/0x3c0 kasan_report+0x11d/0x130     decode_session6+0x103f/0x1890 __xfrm_decode_session+0x54/0xb0 vti6_tnl_xmit+0x3e6/0x1ee0     dev_hard_start_xmit+0x187/0x700 sch_direct_xmit+0x1a3/0xc30 __qdisc_run+0x510/0x17a0
    __dev_queue_xmit+0x2215/0x3b10 neigh_connected_output+0x3c2/0x550 ip6_finish_output2+0x55a/0x1550     ip6_finish_output+0x6b9/0x1270 ip6_output+0x1f1/0x540 ndisc_send_skb+0xa63/0x1890     ndisc_send_rs+0x132/0x6f0 addrconf_rs_timer+0x3f1/0x870 call_timer_fn+0x1a0/0x580     expire_timers+0x29b/0x4b0 run_timer_softirq+0x326/0x910 __do_softirq+0x1d4/0x905 irq_exit_rcu+0xb7/0x120     sysvec_apic_timer_interrupt+0x97/0xc0 </IRQ> Allocated by task 9176: kasan_save_stack+0x22/0x40     kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x7f/0x90 kmem_cache_alloc_node+0x1cd/0x410     kmalloc_reserve+0x165/0x270 __alloc_skb+0x129/0x330 netlink_sendmsg+0x9b1/0xe30 sock_sendmsg+0xde/0x190
    ____sys_sendmsg+0x739/0x920 ___sys_sendmsg+0x110/0x1b0 __sys_sendmsg+0xf7/0x1c0 do_syscall_64+0x39/0xb0     entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 9176: kasan_save_stack+0x22/0x40     kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x40 ____kasan_slab_free+0x160/0x1c0     slab_free_freelist_hook+0x11b/0x220 kmem_cache_free+0xf0/0x490 skb_free_head+0x17f/0x1b0     skb_release_data+0x59c/0x850 consume_skb+0xd2/0x170 netlink_unicast+0x54f/0x7f0     netlink_sendmsg+0x926/0xe30 sock_sendmsg+0xde/0x190 ____sys_sendmsg+0x739/0x920 ___sys_sendmsg+0x110/0x1b0
    __sys_sendmsg+0xf7/0x1c0 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy     address belongs to the object at ffff88802e08ed00 which belongs to the cache skbuff_small_head of size 640     The buggy address is located 194 bytes inside of freed 640-byte region [ffff88802e08ed00,     ffff88802e08ef80) As commit f855691975bb (xfrm6: Fix the nexthdr offset in _decode_session6.) showed,     xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during     transmission. Therefore, set the cb field in the skb to 0 before sending packets. (CVE-2023-53821)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.4.257-170.359. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-053 advisory.

    A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)

    nftables out-of-bounds read in nf_osf_match_one() (CVE-2023-39189)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure. (CVE-2023-39192)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

    A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing     of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local     privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an     information disclosure. (CVE-2023-39194)

    The upstream commit describes this issue as follows:

    The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong     `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to     slab out-of-bound access. (CVE-2023-42753)

    A flaw was found in rsvp_change(). The root cause is an slab-out-of-bound access, but since the offset to     the original pointer is an `unsign int` fully controlled by users, the behavior is usually a wild pointer     access. (CVE-2023-42755)

    An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.

    The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without     locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that     is being released by garbage collection, resulting in use-after-free.

    We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation.

    If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing     curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in     update_vf(). This leaves a dangling pointer that can cause a use-after-free.

    We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation.

    When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free     in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in     agg_dequeue().

    We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

    In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has     a fence use-after-free. (CVE-2023-51042)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: add NULL check in xfrm_update_ae_params (CVE-2023-53147)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix uninitialized array access for some pathnames (CVE-2023-53165)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c     (CVE-2023-53179)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data-races around user->unix_inflight. (CVE-2023-53204)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: Fix integer overflow in radeon_cs_parser_init (CVE-2023-53309)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/msm/mdp5: Don't leak some plane state (CVE-2023-53324)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore/ram: Check start of empty przs during init (CVE-2023-53331)

    In the Linux kernel, the following vulnerability has been resolved:

    lwt: Fix return values of BPF xmit ops (CVE-2023-53338)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix BUG_ON condition in btrfs_cancel_balance (CVE-2023-53339)

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: skb_segment, Call zero copy functions before using skbuff frags (CVE-2023-53354)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix race issue between cpu buffer write and swap (CVE-2023-53368)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (CVE-2023-53395)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: Correct devm device reference for hidinput input_dev name (CVE-2023-53454)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla4xxx: Add length check when parsing nlattrs (CVE-2023-53456)

    In the Linux kernel, the following vulnerability has been resolved:

    FS: JFS: Fix null-ptr-deref Read in txBegin (CVE-2023-53457)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (CVE-2023-53469)

    In the Linux kernel, the following vulnerability has been resolved:

    kobject: Add sanity check for kset->kobj.ktype in kset_register() (CVE-2023-53480)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev (CVE-2023-53485)

    In the Linux kernel, the following vulnerability has been resolved:

    powerpc/rtas_flash: allow user copy to flash block cache objects (CVE-2023-53487)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix slab-use-after-free in decode_session6 (CVE-2023-53500)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-mmio: don't break lifecycle of vm_dev (CVE-2023-53515)

    In the Linux kernel, the following vulnerability has been resolved:

    PM / devfreq: Fix leak in devfreq_dev_release() (CVE-2023-53518)

    In the Linux kernel, the following vulnerability has been resolved:

    ip_vti: fix potential slab-use-after-free in decode_session6 (CVE-2023-53559)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Release folio lock on fscache read hit. (CVE-2023-53593)

    In the Linux kernel, the following vulnerability has been resolved:

    ipmi_si: fix a memleak in try_smi_init() (CVE-2023-53611)

    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount (CVE-2023-53616)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: Fix possible data races in gfs2_show_options() (CVE-2023-53622)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: output extra debug info if we failed to find an inline backref (CVE-2023-53672)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (CVE-2023-53676)

    In the Linux kernel, the following vulnerability has been resolved:

    md: raid1: fix potential OOB in raid1_remove_disk() (CVE-2023-53722)

    In the Linux kernel, the following vulnerability has been resolved:

    FS: JFS: Check for read-only mounted filesystem in txBegin (CVE-2023-53766)

    In the Linux kernel, the following vulnerability has been resolved:

    dccp: Fix out of bounds access in DCCP error handler (CVE-2023-53782)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (CVE-2023-53817)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_vti: fix slab-use-after-free in decode_session6 (CVE-2023-53821)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). (CVE-2023-53825)

    In the Linux kernel, the following vulnerability has been resolved:

    net: read sk->sk_family once in sk_mc_loop() (CVE-2023-53831)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: fix one memleak in __inet_del_ifa() (CVE-2023-53995)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data-race around unix_tot_inflight. (CVE-2023-54006)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: fix possible soft lockup in __audit_inode_child() (CVE-2023-54045)

    In the Linux kernel, the following vulnerability has been resolved:

    net: do not allow gso_size to be set to GSO_BY_FRAGS (CVE-2023-54051)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: Fix memory leak in error path of kcm_sendmsg() (CVE-2023-54112)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() (CVE-2023-54127)

    In the Linux kernel, the following vulnerability has been resolved:

    autofs: fix memory leak of waitqueues in autofs_catatonic_mode (CVE-2023-54134)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse (CVE-2023-54140)

    In the Linux kernel, the following vulnerability has been resolved:

    quota: fix warning in dqgrab() (CVE-2023-54177)

    In the Linux kernel, the following vulnerability has been resolved:

    of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() (CVE-2023-54178)

    In the Linux kernel, the following vulnerability has been resolved:

    Revert IB/isert: Fix incorrect release of isert connection (CVE-2023-54219)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: Fix oops for port->pm on uart_change_pm() (CVE-2023-54220)

    In the Linux kernel, the following vulnerability has been resolved:

    amba: bus: fix refcount leak (CVE-2023-54230)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: typec: bus: verify partner exists in typec_altmode_attention (CVE-2023-54299)

    A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm     scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific     socket configuration, which could allow a local user to crash the system or escalate their privileges on     the system. (CVE-2023-6176)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.326-245.539. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2264 advisory.

    A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure. (CVE-2023-39192)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

    A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing     of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local     privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an     information disclosure. (CVE-2023-39194)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation.

    When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the     new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec. (CVE-2023-4207)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    Due to a race condition between nf_tables netlink control plane transaction and nft_set element garbage     collection, it is possible to underflow the reference counter causing a use-after-free vulnerability.

    We recommend upgrading past commit 3e91b0ebd994635df2346353322ac51ce84ce6d8. (CVE-2023-4244)

    The upstream commit describes this issue as follows:

    The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong     `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to     slab out-of-bound access. (CVE-2023-42753)

    A flaw was found in rsvp_change(). The root cause is an slab-out-of-bound access, but since the offset to     the original pointer is an `unsign int` fully controlled by users, the behavior is usually a wild pointer     access. (CVE-2023-42755)

    An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.

    The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without     locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that     is being released by garbage collection, resulting in use-after-free.

    We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation.

    If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing     curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in     update_vf(). This leaves a dangling pointer that can cause a use-after-free.

    We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation.

    When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free     in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in     agg_dequeue().

    We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: add NULL check in xfrm_update_ae_params (CVE-2023-53147)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix uninitialized array access for some pathnames (CVE-2023-53165)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fix possible memory leak if device_add() fails (CVE-2023-53174)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c     (CVE-2023-53179)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data-races around user->unix_inflight. (CVE-2023-53204)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (CVE-2023-53245)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: Fix integer overflow in radeon_cs_parser_init (CVE-2023-53309)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (CVE-2023-53311)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore/ram: Check start of empty przs during init (CVE-2023-53331)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (CVE-2023-53395)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: Correct devm device reference for hidinput input_dev name (CVE-2023-53454)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla4xxx: Add length check when parsing nlattrs (CVE-2023-53456)

    In the Linux kernel, the following vulnerability has been resolved:

    FS: JFS: Fix null-ptr-deref Read in txBegin (CVE-2023-53457)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (CVE-2023-53469)

    In the Linux kernel, the following vulnerability has been resolved:

    kobject: Add sanity check for kset->kobj.ktype in kset_register() (CVE-2023-53480)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev (CVE-2023-53485)

    In the Linux kernel, the following vulnerability has been resolved:

    PM / devfreq: Fix leak in devfreq_dev_release() (CVE-2023-53518)

    In the Linux kernel, the following vulnerability has been resolved:

    ip_vti: fix potential slab-use-after-free in decode_session6 (CVE-2023-53559)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Release folio lock on fscache read hit. (CVE-2023-53593)

    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount (CVE-2023-53616)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: Fix possible data races in gfs2_show_options() (CVE-2023-53622)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: output extra debug info if we failed to find an inline backref (CVE-2023-53672)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (CVE-2023-53676)

    In the Linux kernel, the following vulnerability has been resolved:

    md: raid1: fix potential OOB in raid1_remove_disk() (CVE-2023-53722)

    In the Linux kernel, the following vulnerability has been resolved:

    FS: JFS: Check for read-only mounted filesystem in txBegin (CVE-2023-53766)

    In the Linux kernel, the following vulnerability has been resolved:

    dccp: Fix out of bounds access in DCCP error handler (CVE-2023-53782)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (CVE-2023-53817)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_vti: fix slab-use-after-free in decode_session6 (CVE-2023-53821)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). (CVE-2023-53825)

    In the Linux kernel, the following vulnerability has been resolved:

    net: read sk->sk_family once in sk_mc_loop() (CVE-2023-53831)

    In the Linux kernel, the following vulnerability has been resolved:

    dccp: fix data-race around dp->dccps_mss_cache (CVE-2023-53839)

    In the Linux kernel, the following vulnerability has been resolved:

    usb-storage: alauda: Fix uninit-value in alauda_check_media() (CVE-2023-53847)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data-race around unix_tot_inflight. (CVE-2023-54006)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: fix possible soft lockup in __audit_inode_child() (CVE-2023-54045)

    In the Linux kernel, the following vulnerability has been resolved:

    net: do not allow gso_size to be set to GSO_BY_FRAGS (CVE-2023-54051)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: Fix memory leak in error path of kcm_sendmsg() (CVE-2023-54112)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() (CVE-2023-54127)

    In the Linux kernel, the following vulnerability has been resolved:

    autofs: fix memory leak of waitqueues in autofs_catatonic_mode (CVE-2023-54134)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse (CVE-2023-54140)

    In the Linux kernel, the following vulnerability has been resolved:

    quota: fix warning in dqgrab() (CVE-2023-54177)

    In the Linux kernel, the following vulnerability has been resolved:

    of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() (CVE-2023-54178)

    In the Linux kernel, the following vulnerability has been resolved:

    Revert IB/isert: Fix incorrect release of isert connection (CVE-2023-54219)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: Fix oops for port->pm on uart_change_pm() (CVE-2023-54220)

    In the Linux kernel, the following vulnerability has been resolved:

    amba: bus: fix refcount leak (CVE-2023-54230)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-330 advisory.

    A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss     of confidentiality. (CVE-2023-20588)

    The fix for XSA-423 added logic to Linux'es netback driver to deal witha frontend splitting a packet in a     way such that not all of the headerswould come in one piece.  Unfortunately the logic introduced     theredidn't account for the extreme case of the entire packet being splitinto as many pieces as permitted     by the protocol, yet still beingsmaller than the area that's specially dealt with to keep all     (possible)headers together.  Such an unusual packet would therefore trigger abuffer overrun in the driver.
    (CVE-2023-34319)

    A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)

    A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of     XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data     to userspace. (CVE-2023-3773)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the     chain's owner rule can also release the objects in certain circumstances.

    We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8. (CVE-2023-3777)

    A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing     of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local     privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an     information disclosure. (CVE-2023-39194)

    A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    On an error when building a nftables rule, deactivating immediate expressions in     nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used.

    We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2. (CVE-2023-4015)

    A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in     the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to     incorrect handling of the existing filter, leading to a kernel information leak issue. (CVE-2023-4128)

    netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID (CVE-2023-4147)

    A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to     bypass network filters and gain unauthorized access to some resources. The original patches fixing     CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits -     a096ccca6e50 (tun: tun_chr_open(): correctly initialize socket uid), - 66b2c338adce (tap: tap_open():
    correctly initialize socket uid), pass inode->i_uid to sock_init_data_uid() as the last parameter and     that turns out to not be accurate. (CVE-2023-4194)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to     achieve local privilege escalation.

    When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into     the new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8. (CVE-2023-4206)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation.

    When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the     new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec. (CVE-2023-4207)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation.

    When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the     new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81. (CVE-2023-4208)

    A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation     of the file name reconstruction function, which is responsible for reading file name entries from a     directory index and merging file name parts belonging to one file into a single long file name. Since the     file name characters are copied into a stack variable, a local privileged attacker could use this flaw to     overflow the kernel stack. (CVE-2023-4273)

    A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux     Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which     can result in a memory leak. (CVE-2023-4569)

    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.

    The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without     locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that     is being released by garbage collection, resulting in use-after-free.

    We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: add NULL check in xfrm_update_ae_params (CVE-2023-53147)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: Fix igb_down hung on surprise removal (CVE-2023-53148)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix uninitialized array access for some pathnames (CVE-2023-53165)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fix possible memory leak if device_add() fails (CVE-2023-53174)

    In the Linux kernel, the following vulnerability has been resolved:

    dma-buf/dma-resv: Stop leaking on krealloc() failure (CVE-2023-53181)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: exit gracefully if reloc roots don't match (CVE-2023-53183)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: Fix nexthop hash size (CVE-2023-53192)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/fair: Don't balance task to its current running CPU (CVE-2023-53215)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix warning in cifs_smb3_do_mount() (CVE-2023-53230)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (CVE-2023-53245)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand (CVE-2023-53247)

    In the Linux kernel, the following vulnerability has been resolved:

    ovl: fix null pointer dereference in ovl_permission() (CVE-2023-53260)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/client: Fix memory leak in drm_client_modeset_probe (CVE-2023-53288)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: fix overlap expiration walk (CVE-2023-53304)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (CVE-2023-53311)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Enhance sanity check while generating attr_list (CVE-2023-53328)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix BUG_ON condition in btrfs_cancel_balance (CVE-2023-53339)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6mr: Fix skb_under_panic in ip6mr_cache_report() (CVE-2023-53365)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dcb: choose correct policy to parse DCB_ATTR_BCN (CVE-2023-53369)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (CVE-2023-53401)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/ttm: fix bulk_move corruption when adding a entry (CVE-2023-53444)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (CVE-2023-53469)

    In the Linux kernel, the following vulnerability has been resolved:

    powerpc/rtas_flash: allow user copy to flash block cache objects (CVE-2023-53487)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix disconnect vs accept race (CVE-2023-53490)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix slab-use-after-free in decode_session6 (CVE-2023-53500)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-mmio: don't break lifecycle of vm_dev (CVE-2023-53515)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic() (CVE-2023-53558)

    In the Linux kernel, the following vulnerability has been resolved:

    ip_vti: fix potential slab-use-after-free in decode_session6 (CVE-2023-53559)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, cpumap: Make sure kthread is running before map update returns (CVE-2023-53577)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Release folio lock on fscache read hit. (CVE-2023-53593)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix mid leak during reconnection after timeout threshold (CVE-2023-53597)

    In the Linux kernel, the following vulnerability has been resolved:

    tunnels: fix kasan splat when generating ipv4 pmtu error (CVE-2023-53600)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: reject invalid reloc tree root keys with stack dump (CVE-2023-53618)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, cpumap: Handle skb as well when clean up ptr_ring (CVE-2023-53660)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: fix refcount underflow in error path (CVE-2023-53698)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Do not swap cpu_buffer during resize process (CVE-2023-53718)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode (CVE-2023-53733)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix session state check in reconnect to avoid use-after-free issue (CVE-2023-53794)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_vti: fix slab-use-after-free in decode_session6 (CVE-2023-53821)

    In the Linux kernel, the following vulnerability has been resolved:

    dccp: fix data-race around dp->dccps_mss_cache (CVE-2023-53839)

    In the Linux kernel, the following vulnerability has been resolved:

    devlink: report devlink_port_type_warn source device (CVE-2023-53841)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: reject negative ifindex (CVE-2023-53843)

    In the Linux kernel, the following vulnerability has been resolved:

    usb-storage: alauda: Fix uninit-value in alauda_check_media() (CVE-2023-53847)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dsa: ocelot: call dsa_tag_8021q_unregister() under rtnl_lock() on driver remove (CVE-2023-53855)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix warning when putting transaction with qgroups enabled after abort (CVE-2023-53865)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/psi: use kernfs polling functions for PSI trigger polling (CVE-2023-54019)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix race between balance and cancel/pause (CVE-2023-54023)

    In the Linux kernel, the following vulnerability has been resolved:

    net: do not allow gso_size to be set to GSO_BY_FRAGS (CVE-2023-54051)

    In the Linux kernel, the following vulnerability has been resolved:

    xen: speed up grant-table reclaim (CVE-2023-54081)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/client: Fix memory leak in drm_client_target_cloned (CVE-2023-54091)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: Protect reconfiguration of sb read-write from racing writes (CVE-2023-54099)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix incorrect splitting in btrfs_drop_extent_map_range (CVE-2023-54121)

    In the Linux kernel, the following vulnerability has been resolved:

    net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() (CVE-2023-54155)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: Fix linking a duplicate key to a keyring's assoc_array (CVE-2023-54170)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction (CVE-2023-54172)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Disable preemption in bpf_event_output (CVE-2023-54173)

    In the Linux kernel, the following vulnerability has been resolved:

    quota: fix warning in dqgrab() (CVE-2023-54177)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: remove BUG_ON()'s in add_new_free_space() (CVE-2023-54185)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree (CVE-2023-54194)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix warning in trace_buffered_event_disable() (CVE-2023-54211)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: Fix oops for port->pm on uart_change_pm() (CVE-2023-54220)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX. (CVE-2023-54251)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/ttm: Don't leak a resource on eviction error (CVE-2023-54254)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix potential oops in cifs_oplock_break (CVE-2023-54258)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Address KCSAN report on bpf_lru_list (CVE-2023-54283)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: zoned: fix memory leak after finding block group with super blocks (CVE-2023-54297)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Disable preemption in bpf_perf_event_output (CVE-2023-54303)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.128-80.144. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-026 advisory.

    Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2022-40982)

    A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss     of confidentiality. (CVE-2023-20588)

    The fix for XSA-423 added logic to Linux'es netback driver to deal witha frontend splitting a packet in a     way such that not all of the headerswould come in one piece.  Unfortunately the logic introduced     theredidn't account for the extreme case of the entire packet being splitinto as many pieces as permitted     by the protocol, yet still beingsmaller than the area that's specially dealt with to keep all     (possible)headers together.  Such an unusual packet would therefore trigger abuffer overrun in the driver.
    (CVE-2023-34319)

    A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)

    A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of     XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data     to userspace. (CVE-2023-3773)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the     chain's owner rule can also release the objects in certain circumstances.

    We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8. (CVE-2023-3777)

    A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing     of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local     privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an     information disclosure. (CVE-2023-39194)

    A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    On an error when building a nftables rule, deactivating immediate expressions in     nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used.

    We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2. (CVE-2023-4015)

    A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in     the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to     incorrect handling of the existing filter, leading to a kernel information leak issue. (CVE-2023-4128)

    netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID (CVE-2023-4147)

    A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to     bypass network filters and gain unauthorized access to some resources. The original patches fixing     CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits -     a096ccca6e50 (tun: tun_chr_open(): correctly initialize socket uid), - 66b2c338adce (tap: tap_open():
    correctly initialize socket uid), pass inode->i_uid to sock_init_data_uid() as the last parameter and     that turns out to not be accurate. (CVE-2023-4194)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to     achieve local privilege escalation.

    When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into     the new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8. (CVE-2023-4206)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation.

    When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the     new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec. (CVE-2023-4207)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation.

    When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the     new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81. (CVE-2023-4208)

    A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation     of the file name reconstruction function, which is responsible for reading file name entries from a     directory index and merging file name parts belonging to one file into a single long file name. Since the     file name characters are copied into a stack variable, a local privileged attacker could use this flaw to     overflow the kernel stack. (CVE-2023-4273)

    A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux     Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which     can result in a memory leak. (CVE-2023-4569)

    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.

    The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without     locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that     is being released by garbage collection, resulting in use-after-free.

    We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: add NULL check in xfrm_update_ae_params (CVE-2023-53147)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix uninitialized array access for some pathnames (CVE-2023-53165)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fix possible memory leak if device_add() fails (CVE-2023-53174)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: exit gracefully if reloc roots don't match (CVE-2023-53183)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: Fix nexthop hash size (CVE-2023-53192)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix warning in cifs_smb3_do_mount() (CVE-2023-53230)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (CVE-2023-53245)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Return the firmware result upon destroying QP/RQ (CVE-2023-53286)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/client: Fix memory leak in drm_client_modeset_probe (CVE-2023-53288)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: fix overlap expiration walk (CVE-2023-53304)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (CVE-2023-53311)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Enhance sanity check while generating attr_list (CVE-2023-53328)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix BUG_ON condition in btrfs_cancel_balance (CVE-2023-53339)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6mr: Fix skb_under_panic in ip6mr_cache_report() (CVE-2023-53365)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dcb: choose correct policy to parse DCB_ATTR_BCN (CVE-2023-53369)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (CVE-2023-53469)

    In the Linux kernel, the following vulnerability has been resolved:

    powerpc/rtas_flash: allow user copy to flash block cache objects (CVE-2023-53487)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix slab-use-after-free in decode_session6 (CVE-2023-53500)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-mmio: don't break lifecycle of vm_dev (CVE-2023-53515)

    In the Linux kernel, the following vulnerability has been resolved:

    ip_vti: fix potential slab-use-after-free in decode_session6 (CVE-2023-53559)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, cpumap: Make sure kthread is running before map update returns (CVE-2023-53577)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Release folio lock on fscache read hit. (CVE-2023-53593)

    In the Linux kernel, the following vulnerability has been resolved:

    tunnels: fix kasan splat when generating ipv4 pmtu error (CVE-2023-53600)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: reject invalid reloc tree root keys with stack dump (CVE-2023-53618)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, cpumap: Handle skb as well when clean up ptr_ring (CVE-2023-53660)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: fix refcount underflow in error path (CVE-2023-53698)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Do not swap cpu_buffer during resize process (CVE-2023-53718)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_vti: fix slab-use-after-free in decode_session6 (CVE-2023-53821)

    In the Linux kernel, the following vulnerability has been resolved:

    dccp: fix data-race around dp->dccps_mss_cache (CVE-2023-53839)

    In the Linux kernel, the following vulnerability has been resolved:

    usb-storage: alauda: Fix uninit-value in alauda_check_media() (CVE-2023-53847)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix warning when putting transaction with qgroups enabled after abort (CVE-2023-53865)

    In the Linux kernel, the following vulnerability has been resolved:

    net: do not allow gso_size to be set to GSO_BY_FRAGS (CVE-2023-54051)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/client: Fix memory leak in drm_client_target_cloned (CVE-2023-54091)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: Protect reconfiguration of sb read-write from racing writes (CVE-2023-54099)

    In the Linux kernel, the following vulnerability has been resolved:

    net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() (CVE-2023-54155)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: Fix linking a duplicate key to a keyring's assoc_array (CVE-2023-54170)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Disable preemption in bpf_event_output (CVE-2023-54173)

    In the Linux kernel, the following vulnerability has been resolved:

    quota: fix warning in dqgrab() (CVE-2023-54177)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree (CVE-2023-54194)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix warning in trace_buffered_event_disable() (CVE-2023-54211)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: Fix oops for port->pm on uart_change_pm() (CVE-2023-54220)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX. (CVE-2023-54251)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/ttm: Don't leak a resource on eviction error (CVE-2023-54254)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix potential oops in cifs_oplock_break (CVE-2023-54258)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: zoned: fix memory leak after finding block group with super blocks (CVE-2023-54297)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
302607	EulerOS Virtualization 2.10.1 : kernel (EulerOS-SA-2026-1537)	Nessus	Huawei Local Security Checks	high
302543	EulerOS Virtualization 2.10.0 : kernel (EulerOS-SA-2026-1557)	Nessus	Huawei Local Security Checks	high
302405	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2026-1313)	Nessus	Huawei Local Security Checks	high
302380	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2026-1339)	Nessus	Huawei Local Security Checks	high
301628	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1280)	Nessus	Huawei Local Security Checks	high
301595	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1244)	Nessus	Huawei Local Security Checks	high
300395	RHEL 9 : kernel-rt (RHSA-2026:3375)	Nessus	Red Hat Local Security Checks	high
300215	RHEL 8 : kernel (RHSA-2026:3360)	Nessus	Red Hat Local Security Checks	high
300096	RHEL 8 : kernel (RHSA-2026:3277)	Nessus	Red Hat Local Security Checks	high
300052	RHEL 9 : kernel (RHSA-2026:3267)	Nessus	Red Hat Local Security Checks	high
300007	RHEL 9 : kernel-rt (RHSA-2026:3358)	Nessus	Red Hat Local Security Checks	high
300005	RHEL 8 : kernel (RHSA-2026:3388)	Nessus	Red Hat Local Security Checks	high
299992	RHEL 8 : kernel (RHSA-2026:3268)	Nessus	Red Hat Local Security Checks	high
299928	RHEL 9 : kernel (RHSA-2026:3293)	Nessus	Red Hat Local Security Checks	high
297194	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2026:0315-1)	Nessus	SuSE Local Security Checks	high
296680	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2026:0293-1)	Nessus	SuSE Local Security Checks	high
296676	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0281-1)	Nessus	SuSE Local Security Checks	high
296481	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0278-1)	Nessus	SuSE Local Security Checks	high
278011	Linux Distros Unpatched Vulnerability : CVE-2023-53821	Nessus	Misc.	high
182660	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2023-053 (ALASKERNEL-5.4-2023-053)	Nessus	Amazon Linux Local Security Checks	high
182628	Amazon Linux 2 : kernel, --advisory ALAS2-2023-2264 (ALAS-2023-2264)	Nessus	Amazon Linux Local Security Checks	high
181159	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-330)	Nessus	Amazon Linux Local Security Checks	high
180567	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-026 (ALASKERNEL-5.15-2023-026)	Nessus	Amazon Linux Local Security Checks	high
180566	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-039 (ALASKERNEL-5.10-2023-039)	Nessus	Amazon Linux Local Security Checks	high
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2023-53821

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high