In the Linux kernel, the following vulnerability has been resolved: cachestat: fix page cache statistics permission checking When the 'cachestat()' system call was added in commit cf264e1329fb ("cachestat: implement cachestat syscall"), it was meant to be a much more convenient (and performant) version of mincore() that didn't need mapping things into the user virtual address space in order to work. But it ended up missing the "check for writability or ownership" fix for mincore(), done in commit 134fca9063ad ("mm/mincore.c: make mincore() more conservative"). This just adds equivalent logic to 'cachestat()', modified for the file context (rather than vma).

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:20095 advisory.

    * kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466)     (CVE-2024-53241)
      * kernel: exfat: fix out-of-bounds access of directory entries (CVE-2024-53147)
      * kernel: zram: fix NULL pointer in comp_algorithm_show() (CVE-2024-53222)
      * kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216)
      * kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662)
      * kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675)
      * kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY     (CVE-2024-56690)
      * kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332)
      * kernel: af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK (CVE-2024-57901)
      * kernel: af_packet: fix vlan_get_tci() vs MSG_PEEK (CVE-2024-57902)
      * kernel: io_uring/sqpoll: zero sqd->thread on tctx errors (CVE-2025-21633)
      * kernel: ipvlan: Fix use-after-free in ipvlan_get_iflink(). (CVE-2025-21652)
      * kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647)
      * kernel: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period (CVE-2025-21655)
      * kernel: netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled (CVE-2024-57941)
      * kernel: netfs: Fix ceph copy to cache on write-begin (CVE-2024-57942)
      * kernel: zram: fix potential UAF of zram table (CVE-2025-21671)
      * kernel: pktgen: Avoid out-of-bounds access in get_imix_entries (CVE-2025-21680)
      * kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693)
      * kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691)
      * kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696)
      * kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702)
      * kernel: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (CVE-2025-21732)
      * kernel: NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795)
      * kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CVE-2024-54456)
      * kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() (CVE-2024-57987)
      * kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014)
      * kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() (CVE-2024-57988)
      * kernel: drm/xe/tracing: Fix a potential TP_printk UAF (CVE-2024-49570)
      * kernel: media: intel/ipu6: remove cpu latency qos request on error (CVE-2024-58004)
      * kernel: usbnet: ipheth: use static NDP16 location in URB (CVE-2025-21742)
      * kernel: usbnet: ipheth: fix possible overflow in DPE length check (CVE-2025-21743)
      * kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links (CVE-2024-57989)
      * kernel: wifi: ath12k: Fix for out-of bound access error (CVE-2024-58015)
      * kernel: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)
      * kernel: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796)
      * kernel: workqueue: Put the pwq after detaching the rescuer from the pool (CVE-2025-21786)
      * kernel: tpm: Change to kvalloc() in eventlog/acpi.c (CVE-2024-58005)
      * kernel: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (CVE-2024-58013)
      * kernel: ring-buffer: Validate the persistent meta data subbuf array (CVE-2025-21777)
      * kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVE-2025-21738)
      * kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections     (CVE-2024-57986)
      * kernel: padata: avoid UAF for reorder_work (CVE-2025-21726)
      * kernel: vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791)
      * kernel: HID: multitouch: Add NULL check in mt_input_configured (CVE-2024-58020)
      * kernel: i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition (CVE-2024-57984)
      * kernel: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() (CVE-2025-21761)
      * kernel: sched_ext: Fix incorrect autogroup migration detection (CVE-2025-21771)
      * kernel: usb: xhci: Fix NULL pointer dereference on certain command aborts (CVE-2024-57981)
      * kernel: memcg: fix soft lockup in the OOM process (CVE-2024-57977)
      * kernel: vxlan: check vxlan_vnigroup_init() return value (CVE-2025-21790)
      * kernel: usbnet: ipheth: fix DPE OoB read (CVE-2025-21741)
      * kernel: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CVE-2025-21785)
      * kernel: ipv6: use RCU protection in ip6_default_advmss() (CVE-2025-21765)
      * kernel: PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() (CVE-2024-58006)
      * kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (CVE-2024-58012)
      * kernel: wifi: brcmfmac: Check the return value of of_property_read_string_index() (CVE-2025-21750)
      * kernel: wifi: rtlwifi: remove unused check_buddy_priv (CVE-2024-58072)
      * kernel: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (CVE-2024-58069)
      * kernel: wifi: mac80211: prohibit deactivating all links (CVE-2024-58061)
      * kernel: idpf: convert workqueues to unbound (CVE-2024-58057)
      * kernel: wifi: mac80211: don't flush non-uploaded STAs (CVE-2025-21828)
      * kernel: netfilter: nf_tables: reject mismatching sum of field_len with set key length (CVE-2025-21826)
      * kernel: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback (CVE-2024-58077)
      * kernel: crypto: tegra - do not transfer req when tegra init fails (CVE-2024-58075)
      * kernel: io_uring/uring_cmd: unconditionally copy SQEs at prep time (CVE-2025-21837)
      * kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350)
      * kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357)
      * kernel: net/sched: cls_api: fix error handling causing NULL dereference (CVE-2025-21857)
      * kernel: bpf: Fix softlockup in arena_map_free on 64k page kernel (CVE-2025-21851)
      * kernel: ibmvnic: Don't reference skb after sending to VIOS (CVE-2025-21855)
      * kernel: smb: client: Add check for next_buffer in receive_encrypted_standard() (CVE-2025-21844)
      * kernel: bpf: avoid holding freeze_mutex during mmap operation (CVE-2025-21853)
      * kernel: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() (CVE-2025-21847)
      * kernel: tcp: drop secpath at the same time as we currently drop dst (CVE-2025-21864)
      * kernel: bpf: Fix deadlock when freeing cgroup storage (CVE-2024-58088)
      * kernel: acct: perform last write from workqueue (CVE-2025-21846)
      * kernel: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()     (CVE-2025-21861)
      * kernel: io_uring: prevent opcode speculation (CVE-2025-21863)
      * kernel: fbdev: hyperv_fb: Allow graceful removal of framebuffer (CVE-2025-21976)
      * kernel: netfilter: nft_tunnel: fix geneve_opt type confusion addition (CVE-2025-22056)
      * kernel: net: ppp: Add bound checking for skb data on ppp_sync_txmung (CVE-2025-37749)
      * microcode_ctl: From CVEorg collector (CVE-2024-28956)
      * kernel: usb: typec: ucsi: displayport: Fix NULL pointer access (CVE-2025-37994)
      * kernel: wifi: ath12k: fix uaf in ath12k_core_init() (CVE-2025-38116)
      * kernel: platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks     (CVE-2025-38412)
      * kernel: dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using     (CVE-2025-38369)
      * kernel: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (CVE-2025-38468)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-205180 advisory.

    - io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CKI Backport Bot) [RHEL-114336]     {CVE-2025-39698}
    - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113611]     {CVE-2025-39730}
    - eventpoll: Fix semi-unbounded recursion (CKI Backport Bot) [RHEL-111050] {CVE-2025-38614}
    - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114850]     {CVE-2025-39751}
    - wifi: ath12k: Decrement TID on RX peer frag setup error handling (CKI Backport Bot) [RHEL-114708]     {CVE-2025-39761}
    - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114691]     {CVE-2025-38729}
    - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CKI Backport Bot) [RHEL-114691]     {CVE-2025-39757}
    - selftests: tls: add tests for zero-length records (Sabrina Dubroca) [RHEL-114324] {CVE-2025-39682}
    - tls: fix handling of zero-length records on the rx_list (Sabrina Dubroca) [RHEL-114324] {CVE-2025-39682}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:20518 advisory.

    * kernel: can: isotp: fix potential CAN frame reception race in isotp_rcv() (CVE-2022-48830)
      * kernel: soc: qcom: cmd-db: Map shared memory as WC, not WB (CVE-2024-46689)
      * kernel: Squashfs: sanity check symbolic link size (CVE-2024-46744)
      * kernel: vfs: fix race between evice_inodes() and find_inode()&iput() (CVE-2024-47679)
      * kernel: x86/tdx: Fix in-kernel MMIO check (CVE-2024-47727)
      * kernel: rxrpc: Fix a race between socket set up and I/O thread creation (CVE-2024-49864)
      * kernel: io_uring: check if we need to reschedule during overflow flush (CVE-2024-50060)
      * kernel: can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods (CVE-2022-49024)
      * kernel: posix-clock: Fix missing timespec64 check in pc_clock_settime() (CVE-2024-50195)
      * kernel: rxrpc: Fix missing locking causing hanging calls (CVE-2024-50294)
      * kernel: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write (CVE-2024-53052)
      * kernel: afs: Fix lock recursion (CVE-2024-53090)
      * kernel: virtio/vsock: Fix accept_queue memory leak (CVE-2024-53119)
      * kernel: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (CVE-2024-53135)
      * kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466)     (CVE-2024-53241)
      * kernel: RDMA/rxe: Fix the qp flush warnings in req (CVE-2024-53229)
      * kernel: block: fix uaf for flush rq while iterating tags (CVE-2024-53170)
      * kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216)
      * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603)
      * kernel: blk-cgroup: Fix UAF in blkcg_unpin_online() (CVE-2024-56672)
      * kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662)
      * kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675)
      * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)
      * kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY     (CVE-2024-56690)
      * kernel: io_uring: check if iowq is killed before queuing (CVE-2024-56709)
      * kernel: rtc: check if __rtc_read_time was successful in rtc_timer_do_work() (CVE-2024-56739)
      * kernel: bpf: put bpf_link's program when link is safe to be deallocated (CVE-2024-56786)
      * kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332)
      * kernel: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (CVE-2024-53680)
      * kernel: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (CVE-2025-21648)
      * kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647)
      * kernel: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() (CVE-2025-21631)
      * kernel: zram: fix potential UAF of zram table (CVE-2025-21671)
      * kernel: afs: Fix merge preference rule failure condition (CVE-2025-21672)
      * kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693)
      * kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691)
      * kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696)
      * kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702)
      * kernel: usbnet: fix memory leak in error case (CVE-2022-49657)
      * kernel: powerpc/xics: fix refcount leak in icp_opal_init() (CVE-2022-49432)
      * kernel: net: tun: unlink NAPI from device on destruction (CVE-2022-49672)
      * kernel: powerpc/papr_scm: don't requests stats with '0' sized stats buffer (CVE-2022-49353)
      * kernel: powerpc/xive: Fix refcount leak in xive_spapr_init (CVE-2022-49437)
      * kernel: ima: Fix potential memory leak in ima_init_crypto() (CVE-2022-49627)
      * kernel: linux/dim: Fix divide by 0 in RDMA DIM (CVE-2022-49670)
      * kernel: can: isotp: sanitize CAN ID checks in isotp_bind() (CVE-2022-49269)
      * kernel: ima: Fix a potential integer overflow in ima_appraise_measurement (CVE-2022-49643)
      * kernel: powerpc/xive/spapr: correct bitmap allocation size (CVE-2022-49623)
      * kernel: efi: Do not import certificates from UEFI Secure Boot for T2 Macs (CVE-2022-49357)
      * kernel: list: fix a data-race around ep->rdllist (CVE-2022-49443)
      * kernel: tracing/histograms: Fix memory leak problem (CVE-2022-49648)
      * kernel: Input: synaptics - fix crash when enabling pass-through port (CVE-2025-21746)
      * kernel: NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795)
      * kernel: bpf: Send signals asynchronously if !preemptible (CVE-2025-21728)
      * kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CVE-2024-54456)
      * kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() (CVE-2024-57987)
      * kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014)
      * kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() (CVE-2024-57988)
      * kernel: RDMA/mlx5: Fix implicit ODP use after free (CVE-2025-21714)
      * kernel: drm/xe/tracing: Fix a potential TP_printk UAF (CVE-2024-49570)
      * kernel: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check     (CVE-2024-57993)
      * kernel: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (CVE-2025-21729)
      * kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links (CVE-2024-57989)
      * kernel: wifi: ath12k: Fix for out-of bound access error (CVE-2024-58015)
      * kernel: OPP: add index check to assert to avoid buffer overflow in _read_freq() (CVE-2024-57998)
      * kernel: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)
      * kernel: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796)
      * kernel: scsi: ufs: core: Fix use-after free in init error and remove paths (CVE-2025-21739)
      * kernel: workqueue: Put the pwq after detaching the rescuer from the pool (CVE-2025-21786)
      * kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVE-2025-21738)
      * kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections     (CVE-2024-57986)
      * kernel: padata: avoid UAF for reorder_work (CVE-2025-21726)
      * kernel: vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791)
      * kernel: team: better TEAM_OPTION_TYPE_STRING validation (CVE-2025-21787)
      * kernel: usb: xhci: Fix NULL pointer dereference on certain command aborts (CVE-2024-57981)
      * kernel: vxlan: check vxlan_vnigroup_init() return value (CVE-2025-21790)
      * kernel: wifi: mt76: mt7925: fix off by one in mt7925_load_clc() (CVE-2024-57990)
      * kernel: ipv6: use RCU protection in ip6_default_advmss() (CVE-2025-21765)
      * kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (CVE-2024-58012)
      * kernel: blk-cgroup: Fix class @block_class's subsystem refcount leakage (CVE-2025-21745)
      * kernel: net: let net.core.dev_weight always be non-zero (CVE-2025-21806)
      * kernel: wifi: rtlwifi: remove unused check_buddy_priv (CVE-2024-58072)
      * kernel: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (CVE-2024-58068)
      * kernel: wifi: iwlwifi: mvm: avoid NULL pointer dereference (CVE-2024-58062)
      * kernel: idpf: convert workqueues to unbound (CVE-2024-58057)
      * kernel: wifi: mac80211: don't flush non-uploaded STAs (CVE-2025-21828)
      * kernel: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (CVE-2024-58083)
      * kernel: netfilter: nf_tables: reject mismatching sum of field_len with set key length (CVE-2025-21826)
      * kernel: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback (CVE-2024-58077)
      * kernel: crypto: tegra - do not transfer req when tegra init fails (CVE-2024-58075)
      * kernel: RDMA/rxe: Fix the warning __rxe_cleanup+0x12c/0x170 [rdma_rxe] (CVE-2025-21829)
      * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839)
      * kernel: io_uring/uring_cmd: unconditionally copy SQEs at prep time (CVE-2025-21837)
      * kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350)
      * kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357)
      * kernel: bpf: Fix softlockup in arena_map_free on 64k page kernel (CVE-2025-21851)
      * kernel: ibmvnic: Don't reference skb after sending to VIOS (CVE-2025-21855)
      * kernel: smb: client: Add check for next_buffer in receive_encrypted_standard() (CVE-2025-21844)
      * kernel: bpf: avoid holding freeze_mutex during mmap operation (CVE-2025-21853)
      * kernel: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() (CVE-2025-21847)
      * kernel: tcp: drop secpath at the same time as we currently drop dst (CVE-2025-21864)
      * kernel: bpf: Fix deadlock when freeing cgroup storage (CVE-2024-58088)
      * kernel: acct: perform last write from workqueue (CVE-2025-21846)
      * kernel: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()     (CVE-2025-21861)
      * kernel: io_uring: prevent opcode speculation (CVE-2025-21863)
      * kernel: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() (CVE-2025-21848)
      * kernel: netfilter: nft_tunnel: fix geneve_opt type confusion addition (CVE-2025-22056)
      * kernel: can: j1939: j1939_send_one(): fix missing CAN header initialization (CVE-2022-49845)
      * kernel: usb: typec: ucsi: displayport: Fix NULL pointer access (CVE-2025-37994)
      * kernel: wifi: ath12k: fix uaf in ath12k_core_init() (CVE-2025-38116)
      * kernel: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (CVE-2025-38396)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20518 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: can: isotp: fix potential CAN frame reception race in isotp_rcv() (CVE-2022-48830)

    * kernel: soc: qcom: cmd-db: Map shared memory as WC, not WB (CVE-2024-46689)

    * kernel: Squashfs: sanity check symbolic link size (CVE-2024-46744)

    * kernel: vfs: fix race between evice_inodes() and find_inode()&iput() (CVE-2024-47679)

    * kernel: x86/tdx: Fix in-kernel MMIO check (CVE-2024-47727)

    * kernel: rxrpc: Fix a race between socket set up and I/O thread creation (CVE-2024-49864)

    * kernel: io_uring: check if we need to reschedule during overflow flush (CVE-2024-50060)

    * kernel: can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods (CVE-2022-49024)

    * kernel: posix-clock: Fix missing timespec64 check in pc_clock_settime() (CVE-2024-50195)

    * kernel: rxrpc: Fix missing locking causing hanging calls (CVE-2024-50294)

    * kernel: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write (CVE-2024-53052)

    * kernel: afs: Fix lock recursion (CVE-2024-53090)

    * kernel: virtio/vsock: Fix accept_queue memory leak (CVE-2024-53119)

    * kernel: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (CVE-2024-53135)

    * kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466)     (CVE-2024-53241)

    * kernel: RDMA/rxe: Fix the qp flush warnings in req (CVE-2024-53229)

    * kernel: block: fix uaf for flush rq while iterating tags (CVE-2024-53170)

    * kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216)

    * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603)

    * kernel: blk-cgroup: Fix UAF in blkcg_unpin_online() (CVE-2024-56672)

    * kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662)

    * kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675)

    * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)

    * kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY     (CVE-2024-56690)

    * kernel: io_uring: check if iowq is killed before queuing (CVE-2024-56709)

    * kernel: rtc: check if __rtc_read_time was successful in rtc_timer_do_work() (CVE-2024-56739)

    * kernel: bpf: put bpf_link's program when link is safe to be deallocated (CVE-2024-56786)

    * kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332)

    * kernel: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (CVE-2024-53680)

    * kernel: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (CVE-2025-21648)

    * kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647)

    * kernel: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() (CVE-2025-21631)

    * kernel: zram: fix potential UAF of zram table (CVE-2025-21671)

    * kernel: afs: Fix merge preference rule failure condition (CVE-2025-21672)

    * kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693)

    * kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691)

    * kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696)

    * kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702)

    * kernel: usbnet: fix memory leak in error case (CVE-2022-49657)

    * kernel: powerpc/xics: fix refcount leak in icp_opal_init() (CVE-2022-49432)

    * kernel: net: tun: unlink NAPI from device on destruction (CVE-2022-49672)

    * kernel: powerpc/papr_scm: don't requests stats with '0' sized stats buffer (CVE-2022-49353)

    * kernel: powerpc/xive: Fix refcount leak in xive_spapr_init (CVE-2022-49437)

    * kernel: ima: Fix potential memory leak in ima_init_crypto() (CVE-2022-49627)

    * kernel: linux/dim: Fix divide by 0 in RDMA DIM (CVE-2022-49670)

    * kernel: can: isotp: sanitize CAN ID checks in isotp_bind() (CVE-2022-49269)

    * kernel: ima: Fix a potential integer overflow in ima_appraise_measurement (CVE-2022-49643)

    * kernel: powerpc/xive/spapr: correct bitmap allocation size (CVE-2022-49623)

    * kernel: efi: Do not import certificates from UEFI Secure Boot for T2 Macs (CVE-2022-49357)

    * kernel: list: fix a data-race around ep->rdllist (CVE-2022-49443)

    * kernel: tracing/histograms: Fix memory leak problem (CVE-2022-49648)

    * kernel: Input: synaptics - fix crash when enabling pass-through port (CVE-2025-21746)

    * kernel: NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795)

    * kernel: bpf: Send signals asynchronously if !preemptible (CVE-2025-21728)

    * kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CVE-2024-54456)

    * kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() (CVE-2024-57987)

    * kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014)

    * kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() (CVE-2024-57988)

    * kernel: RDMA/mlx5: Fix implicit ODP use after free (CVE-2025-21714)

    * kernel: drm/xe/tracing: Fix a potential TP_printk UAF (CVE-2024-49570)

    * kernel: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check     (CVE-2024-57993)

    * kernel: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (CVE-2025-21729)

    * kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links (CVE-2024-57989)

    * kernel: wifi: ath12k: Fix for out-of bound access error (CVE-2024-58015)

    * kernel: OPP: add index check to assert to avoid buffer overflow in _read_freq() (CVE-2024-57998)

    * kernel: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)

    * kernel: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796)

    * kernel: scsi: ufs: core: Fix use-after free in init error and remove paths (CVE-2025-21739)

    * kernel: workqueue: Put the pwq after detaching the rescuer from the pool (CVE-2025-21786)

    * kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVE-2025-21738)

    * kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections     (CVE-2024-57986)

    * kernel: padata: avoid UAF for reorder_work (CVE-2025-21726)

    * kernel: vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791)

    * kernel: team: better TEAM_OPTION_TYPE_STRING validation (CVE-2025-21787)

    * kernel: usb: xhci: Fix NULL pointer dereference on certain command aborts (CVE-2024-57981)

    * kernel: vxlan: check vxlan_vnigroup_init() return value (CVE-2025-21790)

    * kernel: wifi: mt76: mt7925: fix off by one in mt7925_load_clc() (CVE-2024-57990)

    * kernel: ipv6: use RCU protection in ip6_default_advmss() (CVE-2025-21765)

    * kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (CVE-2024-58012)

    * kernel: blk-cgroup: Fix class @block_class's subsystem refcount leakage (CVE-2025-21745)

    * kernel: net: let net.core.dev_weight always be non-zero (CVE-2025-21806)

    * kernel: wifi: rtlwifi: remove unused check_buddy_priv (CVE-2024-58072)

    * kernel: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (CVE-2024-58068)

    * kernel: wifi: iwlwifi: mvm: avoid NULL pointer dereference (CVE-2024-58062)

    * kernel: idpf: convert workqueues to unbound (CVE-2024-58057)

    * kernel: wifi: mac80211: don't flush non-uploaded STAs (CVE-2025-21828)

    * kernel: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (CVE-2024-58083)

    * kernel: netfilter: nf_tables: reject mismatching sum of field_len with set key length (CVE-2025-21826)

    * kernel: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback (CVE-2024-58077)

    * kernel: crypto: tegra - do not transfer req when tegra init fails (CVE-2024-58075)

    * kernel: RDMA/rxe: Fix the warning __rxe_cleanup+0x12c/0x170 [rdma_rxe] (CVE-2025-21829)

    * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839)

    * kernel: io_uring/uring_cmd: unconditionally copy SQEs at prep time (CVE-2025-21837)

    * kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350)

    * kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357)

    * kernel: bpf: Fix softlockup in arena_map_free on 64k page kernel (CVE-2025-21851)

    * kernel: ibmvnic: Don't reference skb after sending to VIOS (CVE-2025-21855)

    * kernel: smb: client: Add check for next_buffer in receive_encrypted_standard() (CVE-2025-21844)

    * kernel: bpf: avoid holding freeze_mutex during mmap operation (CVE-2025-21853)

    * kernel: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() (CVE-2025-21847)

    * kernel: tcp: drop secpath at the same time as we currently drop dst (CVE-2025-21864)

    * kernel: bpf: Fix deadlock when freeing cgroup storage (CVE-2024-58088)

    * kernel: acct: perform last write from workqueue (CVE-2025-21846)

    * kernel: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()     (CVE-2025-21861)

    * kernel: io_uring: prevent opcode speculation (CVE-2025-21863)

    * kernel: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() (CVE-2025-21848)

    * kernel: netfilter: nft_tunnel: fix geneve_opt type confusion addition (CVE-2025-22056)

    * kernel: can: j1939: j1939_send_one(): fix missing CAN header initialization (CVE-2022-49845)

    * kernel: usb: typec: ucsi: displayport: Fix NULL pointer access (CVE-2025-37994)

    * kernel: wifi: ath12k: fix uaf in ath12k_core_init() (CVE-2025-38116)

    * kernel: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (CVE-2025-38396)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20095 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466)     (CVE-2024-53241)

    * kernel: exfat: fix out-of-bounds access of directory entries (CVE-2024-53147)

    * kernel: zram: fix NULL pointer in comp_algorithm_show() (CVE-2024-53222)

    * kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216)

    * kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662)

    * kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675)

    * kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY     (CVE-2024-56690)

    * kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332)

    * kernel: af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK (CVE-2024-57901)

    * kernel: af_packet: fix vlan_get_tci() vs MSG_PEEK (CVE-2024-57902)

    * kernel: io_uring/sqpoll: zero sqd->thread on tctx errors (CVE-2025-21633)

    * kernel: ipvlan: Fix use-after-free in ipvlan_get_iflink(). (CVE-2025-21652)

    * kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647)

    * kernel: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period (CVE-2025-21655)

    * kernel: netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled (CVE-2024-57941)

    * kernel: netfs: Fix ceph copy to cache on write-begin (CVE-2024-57942)

    * kernel: zram: fix potential UAF of zram table (CVE-2025-21671)

    * kernel: pktgen: Avoid out-of-bounds access in get_imix_entries (CVE-2025-21680)

    * kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693)

    * kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691)

    * kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696)

    * kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702)

    * kernel: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (CVE-2025-21732)

    * kernel: NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795)

    * kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CVE-2024-54456)

    * kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() (CVE-2024-57987)

    * kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014)

    * kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() (CVE-2024-57988)

    * kernel: drm/xe/tracing: Fix a potential TP_printk UAF (CVE-2024-49570)

    * kernel: media: intel/ipu6: remove cpu latency qos request on error (CVE-2024-58004)

    * kernel: usbnet: ipheth: use static NDP16 location in URB (CVE-2025-21742)

    * kernel: usbnet: ipheth: fix possible overflow in DPE length check (CVE-2025-21743)

    * kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links (CVE-2024-57989)

    * kernel: wifi: ath12k: Fix for out-of bound access error (CVE-2024-58015)

    * kernel: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)

    * kernel: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796)

    * kernel: workqueue: Put the pwq after detaching the rescuer from the pool (CVE-2025-21786)

    * kernel: tpm: Change to kvalloc() in eventlog/acpi.c (CVE-2024-58005)

    * kernel: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (CVE-2024-58013)

    * kernel: ring-buffer: Validate the persistent meta data subbuf array (CVE-2025-21777)

    * kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVE-2025-21738)

    * kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections     (CVE-2024-57986)

    * kernel: padata: avoid UAF for reorder_work (CVE-2025-21726)

    * kernel: vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791)

    * kernel: HID: multitouch: Add NULL check in mt_input_configured (CVE-2024-58020)

    * kernel: i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition (CVE-2024-57984)

    * kernel: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() (CVE-2025-21761)

    * kernel: sched_ext: Fix incorrect autogroup migration detection (CVE-2025-21771)

    * kernel: usb: xhci: Fix NULL pointer dereference on certain command aborts (CVE-2024-57981)

    * kernel: memcg: fix soft lockup in the OOM process (CVE-2024-57977)

    * kernel: vxlan: check vxlan_vnigroup_init() return value (CVE-2025-21790)

    * kernel: usbnet: ipheth: fix DPE OoB read (CVE-2025-21741)

    * kernel: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CVE-2025-21785)

    * kernel: ipv6: use RCU protection in ip6_default_advmss() (CVE-2025-21765)

    * kernel: PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() (CVE-2024-58006)

    * kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (CVE-2024-58012)

    * kernel: wifi: brcmfmac: Check the return value of of_property_read_string_index() (CVE-2025-21750)

    * kernel: wifi: rtlwifi: remove unused check_buddy_priv (CVE-2024-58072)

    * kernel: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (CVE-2024-58069)

    * kernel: wifi: mac80211: prohibit deactivating all links (CVE-2024-58061)

    * kernel: idpf: convert workqueues to unbound (CVE-2024-58057)

    * kernel: wifi: mac80211: don't flush non-uploaded STAs (CVE-2025-21828)

    * kernel: netfilter: nf_tables: reject mismatching sum of field_len with set key length (CVE-2025-21826)

    * kernel: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback (CVE-2024-58077)

    * kernel: crypto: tegra - do not transfer req when tegra init fails (CVE-2024-58075)

    * kernel: io_uring/uring_cmd: unconditionally copy SQEs at prep time (CVE-2025-21837)

    * kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350)

    * kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357)

    * kernel: net/sched: cls_api: fix error handling causing NULL dereference (CVE-2025-21857)

    * kernel: bpf: Fix softlockup in arena_map_free on 64k page kernel (CVE-2025-21851)

    * kernel: ibmvnic: Don't reference skb after sending to VIOS (CVE-2025-21855)

    * kernel: smb: client: Add check for next_buffer in receive_encrypted_standard() (CVE-2025-21844)

    * kernel: bpf: avoid holding freeze_mutex during mmap operation (CVE-2025-21853)

    * kernel: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() (CVE-2025-21847)

    * kernel: tcp: drop secpath at the same time as we currently drop dst (CVE-2025-21864)

    * kernel: bpf: Fix deadlock when freeing cgroup storage (CVE-2024-58088)

    * kernel: acct: perform last write from workqueue (CVE-2025-21846)

    * kernel: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()     (CVE-2025-21861)

    * kernel: io_uring: prevent opcode speculation (CVE-2025-21863)

    * kernel: fbdev: hyperv_fb: Allow graceful removal of framebuffer (CVE-2025-21976)

    * kernel: netfilter: nft_tunnel: fix geneve_opt type confusion addition (CVE-2025-22056)

    * kernel: net: ppp: Add bound checking for skb data on ppp_sync_txmung (CVE-2025-37749)

    * microcode_ctl: From CVEorg collector (CVE-2024-28956)

    * kernel: usb: typec: ucsi: displayport: Fix NULL pointer access (CVE-2025-37994)

    * kernel: wifi: ath12k: fix uaf in ath12k_core_init() (CVE-2025-38116)

    * kernel: platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (CVE-2025-38412)

    * kernel: dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using     (CVE-2025-38369)

    * kernel: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (CVE-2025-38468)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20530 advisory.

    - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38137447]     {CVE-2025-38089}
    - Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
    - x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38172252]     {CVE-2024-36350} {CVE-2024-36357}
    - Add normal counters (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
    - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38172252]     {CVE-2024-36350} {CVE-2024-36357}
    - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38172252]     {CVE-2024-36350} {CVE-2024-36357}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20480 advisory.

    - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38178286]     {CVE-2025-38089}
    - Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
    - x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38023239]     {CVE-2024-36350} {CVE-2024-36357}
    - Add normal counters (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
    - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38023239]     {CVE-2024-36350} {CVE-2024-36357}
    - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38023239]     {CVE-2024-36350} {CVE-2024-36357}
    - x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38023239]     {CVE-2024-36350} {CVE-2024-36357}
    - block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
    - f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
    - gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
    - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug:
    38049363] {CVE-2025-38001}
    - smb: client: Fix use-after-free in cifs_fill_dirent (Zhaolong Wang) [Orabug: 38094970] {CVE-2025-38051}
    - platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() (Vladimir Moskovkin)     [Orabug: 38095141] {CVE-2025-38077}
    - ALSA: pcm: Fix race of buffer access at PCM OSS layer (Takashi Iwai) [Orabug: 38095145] {CVE-2025-38078}
    - can: bcm: add missing rcu read protection for procfs content (Oliver Hartkopp) [Orabug: 38049369]     {CVE-2025-38003}
    - can: bcm: add locking for bcm_op runtime updates (Oliver Hartkopp) [Orabug: 38049374] {CVE-2025-38004}
    - padata: do not leak refcount in reorder_work (Dominik Grzegorzek) [Orabug: 38094842] {CVE-2025-38031}
    - crypto: algif_hash - fix double free in hash_accept (Ivan Pravdin) [Orabug: 38095153] {CVE-2025-38079}
    - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (Wang Liang) [Orabug: 38094978]     {CVE-2025-38052}
    - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Cong Wang) [Orabug: 38049357]     {CVE-2025-38000}
    - idpf: fix null-ptr-deref in idpf_features_check (Pavan Kumar Linga) [Orabug: 38094982] {CVE-2025-38053}
    - ptp: ocp: Limit signal/freq counts in summary output functions (Sagi Maimon) [Orabug: 38094984]     {CVE-2025-38054}
    - perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq (Adrian Hunter) [Orabug: 38094988]     {CVE-2025-38055}
    - ASoC: SOF: Intel: hda: Fix UAF when reloading module (Tavian Barnes) [Orabug: 38094991] {CVE-2025-38056}
    - espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094993] {CVE-2025-38057}
    - __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (Al Viro) [Orabug: 38095000]     {CVE-2025-38058}
    - x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88 (Pawel Anikiel) [Orabug: 38094847]     {CVE-2025-38033}
    - btrfs: avoid NULL pointer dereference if no valid csum tree (Qu Wenruo) [Orabug: 38095010]     {CVE-2025-38059}
    - btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (Goldwyn Rodrigues) [Orabug:
    38094856] {CVE-2025-38034}
    - nvmet-tcp: don't restore null sk_state_change (Alistair Francis) [Orabug: 38094863] {CVE-2025-38035}
    - vxlan: Annotate FDB data races (Ido Schimmel) [Orabug: 38094879] {CVE-2025-38037}
    - cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (Dhananjay Ugwekar) [Orabug: 38094888]     {CVE-2025-38038}
    - drm/amd/display: Increase block_sequence array size (Joshua Aberback) [Orabug: 38095164]     {CVE-2025-38080}
    - bpf: copy_verifier_state() should copy 'loop_entry' field (Eduard Zingerman) [Orabug: 38095018]     {CVE-2025-38060}
    - serial: mctrl_gpio: split disable_ms into sync and no_sync APIs (Alexis Lothore) [Orabug: 38094901]     {CVE-2025-38040}
    - net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (Peter Seiderer) [Orabug:
    38095024] {CVE-2025-38061}
    - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie (Jason Gunthorpe) [Orabug:
    38095031] {CVE-2025-38062}
    - dm: fix unconditional IO throttle caused by REQ_PREFLUSH (Jinliang Zheng) [Orabug: 38095038]     {CVE-2025-38063}
    - firmware: arm_ffa: Set dma_mask for ffa devices (Viresh Kumar) [Orabug: 38094925] {CVE-2025-38043}
    - media: cx231xx: set device_caps for 417 (Hans Verkuil) [Orabug: 38094934] {CVE-2025-38044}
    - orangefs: Do not truncate file size (Matthew Wilcox) [Orabug: 38095056] {CVE-2025-38065}
    - dm cache: prevent BUG_ON by blocking retries on failed device resumes (Ming-Hung Tsai) [Orabug:
    38095063] {CVE-2025-38066}
    - crypto: lzo - Fix compression buffer overrun (Herbert Xu) [Orabug: 38095079] {CVE-2025-38068}
    - PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops (Christian Bruel) [Orabug:
    38095087] {CVE-2025-38069}
    - wifi: iwlwifi: fix debug actions order (Johannes Berg) [Orabug: 38094942] {CVE-2025-38045}
    - x86/mm: Check return value from memblock_phys_alloc_range() (Philip Redkin) [Orabug: 38095101]     {CVE-2025-38071}
    - libnvdimm/labels: Fix divide error in nd_label_data_init() (Robert Richter) [Orabug: 38095109]     {CVE-2025-38072}
    - spi-rockchip: Fix register out of bounds access (Luis de Arquer) [Orabug: 38095173] {CVE-2025-38081}
    - x86/fred: Fix system hang during S4 resume with FRED enabled (Xin Li) [Orabug: 38094951]     {CVE-2025-38047}
    - block: fix race between set_blocksize and read paths (Darrick J. Wong) [Orabug: 38095117]     {CVE-2025-38073}
    - virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN (Zhongqiu Han) [Orabug:
    38094958] {CVE-2025-38048}
    - scsi: target: iscsi: Fix timeout on deleted connection (Dmitry Bogdanov) [Orabug: 38095134]     {CVE-2025-38075}
    - usb: typec: ucsi: displayport: Fix deadlock (Andrei Kuchynski) [Orabug: 37977018] {CVE-2025-37967}
    - Bluetooth: btnxpuart: Fix kernel panic during FW release (Neeraj Sanjay Kale) [Orabug: 37844459]     {CVE-2025-22102}
    - iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977026]     {CVE-2025-37968}
    - mm/page_alloc: fix race condition in unaccepted memory handling (Kirill A. Shutemov) [Orabug: 38094767]     {CVE-2025-38008}
    - dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (Shuai Xue) [Orabug: 38094790]     {CVE-2025-38014}
    - dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094793]     {CVE-2025-38015}
    - dmaengine: ti: k3-udma: Add missing locking (Ronald Wahl) [Orabug: 38094756] {CVE-2025-38005}
    - wifi: mt76: disable napi on driver removal (Fedor Pchelkin) [Orabug: 38094770] {CVE-2025-38009}
    - phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking (Wayne Chang) [Orabug: 38094777]     {CVE-2025-38010}
    - drm/amdgpu: csa unmap use uninterruptible lock (Philip Yang) [Orabug: 38094779] {CVE-2025-38011}
    - HID: bpf: abort dispatch if device destroyed (Rongrong) [Orabug: 38094796] {CVE-2025-38016}
    - sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator (Tejun Heo) [Orabug: 38094786]     {CVE-2025-38012}
    - net/tls: fix kernel panic when alloc_page failed (Pengtao He) [Orabug: 38094802] {CVE-2025-38018}
    - mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (Ido Schimmel) [Orabug:
    38094804] {CVE-2025-38019}
    - wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request (Kees Cook) [Orabug:
    38094788] {CVE-2025-38013}
    - regulator: max20086: fix invalid memory access (Cosmin Tanislav) [Orabug: 38094833] {CVE-2025-38027}
    - net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094808]     {CVE-2025-38020}
    - net_sched: Flush gso_skb list too during ->change() (Cong Wang) [Orabug: 37998128] {CVE-2025-37992}
    - RDMA/core: Fix 'KASAN: slab-use-after-free Read in ib_register_device' problem (Zhu Yanjun) [Orabug:
    38094813] {CVE-2025-38022}
    - nfs: handle failure of nfs_get_lock_context in unlock path (Li Lingfeng) [Orabug: 38094818]     {CVE-2025-38023}
    - HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 38094764]     {CVE-2025-38007}
    - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (Zhu Yanjun) [Orabug: 38094827]     {CVE-2025-38024}
    - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977004]     {CVE-2025-37963}
    - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976926]     {CVE-2025-37948}
    - usb: typec: ucsi: displayport: Fix NULL pointer access (Andrei Kuchynski) [Orabug: 38015126]     {CVE-2025-37994}
    - module: ensure that kobject_put() is safe for module type kobjects (Dmitry Antipov) [Orabug: 38015131]     {CVE-2025-37995}
    - memblock: Accept allocated memory before use in memblock_double_array() (Tom Lendacky) [Orabug:
    37976994] {CVE-2025-37960}
    - xenbus: Use kref to track req lifetime (Jason Andryuk) [Orabug: 37976934] {CVE-2025-37949}
    - smb: client: Avoid race in open_cached_dir with lease breaks (Paul Aurich) [Orabug: 37976959]     {CVE-2025-37954}
    - drm/amd/display: Fix invalid context error in dml helper (Roman Li) [Orabug: 37977185] {CVE-2025-37965}
    - drm/v3d: Add job to pending list if the reset was skipped (Maira Canal) [Orabug: 37976942]     {CVE-2025-37951}
    - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo (Silvano Seva) [Orabug:
    37977031] {CVE-2025-37969}
    - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (Silvano Seva) [Orabug: 37977037]     {CVE-2025-37970}
    - KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (Mikhail Lobanov) [Orabug: 37976977]     {CVE-2025-37957}
    - mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976982]     {CVE-2025-37958}
    - x86/mm: Eliminate window where TLB flushes may be inadvertently skipped (Dave Hansen) [Orabug: 37977013]     {CVE-2025-37964}
    - staging: bcm2835-camera: Initialise dev in v4l2_dev (Dave Stevenson) [Orabug: 37977042] {CVE-2025-37971}
    - Input: mtk-pmic-keys - fix possible null pointer dereference (Gary Bisson) [Orabug: 37977044]     {CVE-2025-37972}
    - bpf: Scrub packet on bpf_redirect_peer (Paul Chaignon) [Orabug: 37976990] {CVE-2025-37959}
    - netfilter: ipset: fix region locking in hash types (Jozsef Kadlecsik) [Orabug: 38015141]     {CVE-2025-37997}
    - ipvs: fix uninit-value for saddr in do_output_route4 (Julian Anastasov) [Orabug: 37976996]     {CVE-2025-37961}
    - can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe (Antonios Salios) [Orabug:
    38015123] {CVE-2025-37993}
    - virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() (Jakub Kicinski) [Orabug: 37976969]     {CVE-2025-37955}
    - sch_htb: make htb_deactivate() idempotent (Cong Wang) [Orabug: 37977176] {CVE-2025-37953}
    - ksmbd: fix memory leak in parse_lease_state() (Zhaolong Wang) [Orabug: 37977180] {CVE-2025-37962}
    - openvswitch: Fix unsafe attribute parsing in output_userspace() (Eelco Chaudron) [Orabug: 38015148]     {CVE-2025-37998}
    - ksmbd: Fix UAF in __close_file_table_ids (Sean Heelan) [Orabug: 37976951] {CVE-2025-37952}
    - ksmbd: prevent out-of-bounds stream writes by validating *pos (Norbert Szetei) [Orabug: 37976923]     {CVE-2025-37947}
    - ksmbd: prevent rename with empty string (Namjae Jeon) [Orabug: 37976972] {CVE-2025-37956}
    - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Niklas Schnelle) [Orabug:
    37976920] {CVE-2025-37946}
    - wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation (Veerendranath     Jakkam) [Orabug: 37977046] {CVE-2025-37973}
    - s390/pci: Fix missing check for zpci_create_device() error return (Niklas Schnelle) [Orabug: 37977050]     {CVE-2025-37974}
    - fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() (Max Kellermann) [Orabug:
    38015155] {CVE-2025-37999}
    - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (David Thompson) [Orabug:
    37964051,38037120] {CVE-2025-37866}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7653-1 advisory.

    It was discovered that the CIFS network file system implementation in the Linux kernel did not properly     verify the target namespace when handling upcalls. An attacker could use this to expose sensitive     information. (CVE-2025-2312)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - PowerPC architecture;

    - S390 architecture;

    - Block layer subsystem;

    - Serial ATA and Parallel ATA drivers;

    - Drivers core;

    - Network block device driver;

    - Character device driver;

    - TPM device driver;

    - Clock framework and drivers;

    - FireWire subsystem;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - I3C subsystem;

    - InfiniBand drivers;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - Media drivers;

    - NVIDIA Tegra memory controller driver;

    - Fastrpc Driver;

    - Network drivers;

    - Mellanox network drivers;

    - Operating Performance Points (OPP) driver;

    - PCI subsystem;

    - x86 platform drivers;

    - i.MX PM domains;

    - PPS (Pulse Per Second) driver;

    - PTP clock framework;

    - Remote Processor subsystem;

    - Real Time Clock drivers;

    - SCSI subsystem;

    - QCOM SoC drivers;

    - Media staging drivers;

    - TTY drivers;

    - UFS subsystem;

    - USB Gadget drivers;

    - USB Host Controller drivers;

    - USB Serial drivers;

    - AFS file system;

    - File systems infrastructure;

    - BTRFS file system;

    - F2FS file system;

    - GFS2 file system;

    - NILFS2 file system;

    - File system notification infrastructure;

    - Overlay file system;

    - Proc file system;

    - SMB network file system;

    - UBI file system;

    - Timer subsystem;

    - KVM subsystem;

    - Networking core;

    - ptr_ring data structure definitions;

    - Networking subsytem;

    - Amateur Radio drivers;

    - XFRM subsystem;

    - Tracing infrastructure;

    - BPF subsystem;

    - Kernel CPU control infrastructure;

    - Padata parallel execution mechanism;

    - printk logging mechanism;

    - Memory management;

    - Bluetooth subsystem;

    - DCCP (Datagram Congestion Control Protocol);

    - IPv4 networking;

    - IPv6 networking;

    - MAC80211 subsystem;

    - IEEE 802.15.4 subsystem;

    - Multipath TCP;

    - Netfilter;

    - NFC subsystem;

    - Open vSwitch;

    - Rose network layer;

    - RxRPC session sockets;

    - Network traffic control;

    - VMware vSockets driver;

    - Landlock security;

    - Linux Security Modules (LSM) Framework;

    - Tomoyo security module;

    - SoC audio core drivers; (CVE-2025-21830, CVE-2025-21678, CVE-2025-21815, CVE-2024-57974, CVE-2025-21725,     CVE-2025-21718, CVE-2025-21748, CVE-2025-21732, CVE-2024-57953, CVE-2025-21727, CVE-2025-21816,     CVE-2025-21719, CVE-2024-53124, CVE-2024-58019, CVE-2025-38001, CVE-2025-21720, CVE-2025-21734,     CVE-2025-21672, CVE-2025-21692, CVE-2024-58076, CVE-2025-21694, CVE-2024-58061, CVE-2025-21714,     CVE-2025-21689, CVE-2024-49887, CVE-2024-57949, CVE-2025-38177, CVE-2025-21683, CVE-2025-21669,     CVE-2025-21722, CVE-2024-57980, CVE-2025-38000, CVE-2025-37932, CVE-2024-58034, CVE-2024-58081,     CVE-2025-21733, CVE-2025-21682, CVE-2024-57924, CVE-2025-21743, CVE-2024-57975, CVE-2025-37798,     CVE-2024-58058, CVE-2025-21809, CVE-2025-21676, CVE-2024-57993, CVE-2025-21699, CVE-2024-58016,     CVE-2025-21832, CVE-2025-21804, CVE-2024-58011, CVE-2024-58007, CVE-2025-21826, CVE-2024-58055,     CVE-2025-21668, CVE-2025-21715, CVE-2024-58078, CVE-2025-21829, CVE-2025-21811, CVE-2025-21814,     CVE-2024-58053, CVE-2025-21726, CVE-2025-21943, CVE-2025-37750, CVE-2025-21673, CVE-2024-57984,     CVE-2025-37997, CVE-2025-21684, CVE-2025-21750, CVE-2024-58013, CVE-2025-21799, CVE-2024-58083,     CVE-2025-21798, CVE-2025-21731, CVE-2025-21708, CVE-2024-57986, CVE-2025-21744, CVE-2024-58014,     CVE-2025-21721, CVE-2024-58063, CVE-2024-57979, CVE-2024-58005, CVE-2025-21728, CVE-2025-21681,     CVE-2025-21806, CVE-2024-57982, CVE-2024-58002, CVE-2024-58082, CVE-2025-21812, CVE-2025-21745,     CVE-2024-58017, CVE-2025-21665, CVE-2025-21828, CVE-2025-37890, CVE-2024-57952, CVE-2024-57997,     CVE-2025-21825, CVE-2025-21716, CVE-2024-57948, CVE-2025-21710, CVE-2025-21674, CVE-2025-21675,     CVE-2024-50157, CVE-2025-21738, CVE-2025-22088, CVE-2024-58071, CVE-2024-58085, CVE-2025-21723,     CVE-2025-21690, CVE-2025-21670, CVE-2025-21741, CVE-2024-57999, CVE-2025-21691, CVE-2024-58068,     CVE-2024-58057, CVE-2024-57994, CVE-2024-58072, CVE-2025-21742, CVE-2024-58006, CVE-2024-58077,     CVE-2024-58003, CVE-2025-21753, CVE-2024-57981, CVE-2024-57973, CVE-2024-58001, CVE-2025-21666,     CVE-2025-21810, CVE-2025-21808, CVE-2024-57996, CVE-2024-58054, CVE-2024-57998, CVE-2025-21707,     CVE-2025-21736, CVE-2025-21820, CVE-2025-21739, CVE-2024-57951, CVE-2025-21667, CVE-2024-58070,     CVE-2025-21801, CVE-2024-58051, CVE-2024-58079, CVE-2025-21754, CVE-2024-58069, CVE-2025-37974,     CVE-2025-21802, CVE-2025-21749, CVE-2024-57990, CVE-2024-58080, CVE-2025-21705, CVE-2025-21697,     CVE-2024-58052, CVE-2025-21711, CVE-2024-58056, CVE-2025-21724, CVE-2024-58018, CVE-2025-21735,     CVE-2024-58010, CVE-2025-21680)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7595-1 advisory.

    It was discovered that the CIFS network file system implementation in the Linux kernel did not properly     verify the target namespace when handling upcalls. An attacker could use this to expose sensitive     information. (CVE-2025-2312)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - GPIO subsystem;

    - GPU drivers;

    - InfiniBand drivers;

    - IRQ chip drivers;

    - Network drivers;

    - Mellanox network drivers;

    - i.MX PM domains;

    - SCSI subsystem;

    - USB Serial drivers;

    - AFS file system;

    - GFS2 file system;

    - File systems infrastructure;

    - File system notification infrastructure;

    - Overlay file system;

    - Proc file system;

    - SMB network file system;

    - Timer subsystem;

    - Kernel CPU control infrastructure;

    - Memory management;

    - Networking core;

    - DCCP (Datagram Congestion Control Protocol);

    - IPv6 networking;

    - IEEE 802.15.4 subsystem;

    - Open vSwitch;

    - Network traffic control;

    - VMware vSockets driver; (CVE-2025-21943, CVE-2025-21672, CVE-2024-57952, CVE-2024-57949, CVE-2025-21683,     CVE-2025-21690, CVE-2025-21699, CVE-2025-21676, CVE-2024-57924, CVE-2025-21694, CVE-2024-57948,     CVE-2025-21675, CVE-2024-57951, CVE-2025-21692, CVE-2025-21684, CVE-2025-21668, CVE-2025-21665,     CVE-2025-21667, CVE-2025-21670, CVE-2025-21674, CVE-2025-21697, CVE-2024-53124, CVE-2025-21666,     CVE-2025-21682, CVE-2025-21680, CVE-2025-21681, CVE-2025-21691, CVE-2025-21669, CVE-2025-21673,     CVE-2024-50157, CVE-2025-21689, CVE-2025-21678)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7596-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - GPIO subsystem;

    - GPU drivers;

    - InfiniBand drivers;

    - IRQ chip drivers;

    - Network drivers;

    - Mellanox network drivers;

    - i.MX PM domains;

    - SCSI subsystem;

    - USB Serial drivers;

    - AFS file system;

    - GFS2 file system;

    - File systems infrastructure;

    - File system notification infrastructure;

    - Overlay file system;

    - Proc file system;

    - SMB network file system;

    - Timer subsystem;

    - Kernel CPU control infrastructure;

    - Memory management;

    - Networking core;

    - DCCP (Datagram Congestion Control Protocol);

    - IPv6 networking;

    - IEEE 802.15.4 subsystem;

    - Open vSwitch;

    - Network traffic control;

    - VMware vSockets driver; (CVE-2025-21675, CVE-2025-21697, CVE-2025-21668, CVE-2024-57951, CVE-2025-21680,     CVE-2024-50157, CVE-2025-21699, CVE-2025-21669, CVE-2025-21678, CVE-2025-21665, CVE-2024-57924,     CVE-2024-57949, CVE-2024-53124, CVE-2025-21684, CVE-2025-21676, CVE-2025-21672, CVE-2025-21682,     CVE-2025-21670, CVE-2025-21690, CVE-2025-21673, CVE-2025-21691, CVE-2024-57952, CVE-2025-21674,     CVE-2025-21689, CVE-2025-21943, CVE-2025-21692, CVE-2025-21667, CVE-2025-21666, CVE-2024-57948,     CVE-2025-21694, CVE-2025-21683, CVE-2025-21681)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 24.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7448-1 advisory.

    It was discovered that the CIFS network file system implementation in the Linux kernel did not properly     verify the target namespace when handling upcalls. An attacker could use this to expose sensitive     information. (CVE-2025-2312)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - GPIO subsystem;

    - GPU drivers;

    - IRQ chip drivers;

    - Network drivers;

    - Mellanox network drivers;

    - x86 platform drivers;

    - i.MX PM domains;

    - SCSI subsystem;

    - USB Serial drivers;

    - AFS file system;

    - GFS2 file system;

    - File systems infrastructure;

    - Proc file system;

    - SMB network file system;

    - Timer subsystem;

    - Kernel CPU control infrastructure;

    - Memory management;

    - Networking core;

    - Ethtool driver;

    - IEEE 802.15.4 subsystem;

    - Open vSwitch;

    - Network traffic control;

    - VMware vSockets driver; (CVE-2025-21694, CVE-2025-21993, CVE-2025-21684, CVE-2025-21681, CVE-2025-21675,     CVE-2025-21672, CVE-2025-21696, CVE-2025-21691, CVE-2025-21683, CVE-2025-21666, CVE-2025-21682,     CVE-2025-21697, CVE-2025-21668, CVE-2025-21701, CVE-2025-21670, CVE-2025-21676, CVE-2025-21695,     CVE-2025-21692, CVE-2025-21674, CVE-2025-21699, CVE-2024-57948, CVE-2025-21677, CVE-2024-57951,     CVE-2025-21702, CVE-2025-21700, CVE-2024-57949, CVE-2025-21669, CVE-2025-21703, CVE-2025-21756,     CVE-2025-21667, CVE-2024-57952, CVE-2024-57950, CVE-2025-21685, CVE-2025-21693, CVE-2025-21678,     CVE-2025-21665, CVE-2025-21680, CVE-2025-21689, CVE-2025-21690, CVE-2025-21673)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 24.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7445-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - GPIO subsystem;

    - GPU drivers;

    - IRQ chip drivers;

    - Network drivers;

    - Mellanox network drivers;

    - x86 platform drivers;

    - i.MX PM domains;

    - SCSI subsystem;

    - USB Serial drivers;

    - AFS file system;

    - GFS2 file system;

    - File systems infrastructure;

    - Proc file system;

    - SMB network file system;

    - Timer subsystem;

    - Kernel CPU control infrastructure;

    - Memory management;

    - Networking core;

    - Ethtool driver;

    - IEEE 802.15.4 subsystem;

    - Open vSwitch;

    - Network traffic control;

    - VMware vSockets driver; (CVE-2025-21685, CVE-2025-21684, CVE-2025-21756, CVE-2025-21670, CVE-2024-57949,     CVE-2025-21677, CVE-2025-21680, CVE-2025-21703, CVE-2024-57952, CVE-2025-21674, CVE-2025-21701,     CVE-2025-21691, CVE-2025-21689, CVE-2025-21668, CVE-2025-21665, CVE-2025-21683, CVE-2025-21675,     CVE-2025-21672, CVE-2024-57948, CVE-2025-21669, CVE-2025-21673, CVE-2025-21692, CVE-2025-21699,     CVE-2025-21702, CVE-2025-21682, CVE-2025-21690, CVE-2025-21681, CVE-2025-21695, CVE-2025-21696,     CVE-2025-21700, CVE-2025-21678, CVE-2025-21676, CVE-2024-57950, CVE-2025-21666, CVE-2025-21694,     CVE-2025-21693, CVE-2025-21993, CVE-2024-57951, CVE-2025-21697, CVE-2025-21667)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: cachestat: fix page cache statistics     permission checking When the 'cachestat()' system call was added in commit cf264e1329fb (cachestat:
    implement cachestat syscall), it was meant to be a much more convenient (and performant) version of     mincore() that didn't need mapping things into the user virtual address space in order to work. But it     ended up missing the check for writability or ownership fix for mincore(), done in commit 134fca9063ad     (mm/mincore.c: make mincore() more conservative). This just adds equivalent logic to 'cachestat()',     modified for the file context (rather than vma). (CVE-2025-21691)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
276749	AlmaLinux 10 : kernel (ALSA-2025:20095)	Nessus	Alma Linux Local Security Checks	medium
276689	Oracle Linux 9 : ELSA-2025-20518-0: / kernel (ELSA-2025-205180)	Nessus	Oracle Linux Local Security Checks	high
275824	AlmaLinux 9 : kernel (ALSA-2025:20518)	Nessus	Alma Linux Local Security Checks	high
274839	RHEL 9 : kernel (RHSA-2025:20518)	Nessus	Red Hat Local Security Checks	high
274759	RHEL 10 : kernel (RHSA-2025:20095)	Nessus	Red Hat Local Security Checks	medium
252244	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20530)	Nessus	Oracle Linux Local Security Checks	medium
242347	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20480)	Nessus	Oracle Linux Local Security Checks	medium
242344	Ubuntu 22.04 LTS : Linux kernel (HWE) vulnerabilities (USN-7653-1)	Nessus	Ubuntu Local Security Checks	high
240566	Ubuntu 22.04 LTS / 24.04 LTS : Linux kernel vulnerabilities (USN-7595-1)	Nessus	Ubuntu Local Security Checks	high
240564	Ubuntu 22.04 LTS / 24.04 LTS : Linux kernel (Azure) vulnerabilities (USN-7596-1)	Nessus	Ubuntu Local Security Checks	high
238893	TencentOS Server 4: kernel (TSSA-2025:0345)	Nessus	Tencent Local Security Checks	high
234778	Ubuntu 24.04 LTS / 24.10 : Linux kernel vulnerabilities (USN-7448-1)	Nessus	Ubuntu Local Security Checks	high
234757	Ubuntu 24.04 LTS / 24.10 : Linux kernel vulnerabilities (USN-7445-1)	Nessus	Ubuntu Local Security Checks	high
230468	Linux Distros Unpatched Vulnerability : CVE-2025-21691	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-21691

medium

Tenable Plugins

medium

high

high

high

medium

medium

medium

high

high

high

high

high

high

medium