In the Linux kernel, the following vulnerability has been resolved: pds_core: make wait_context part of q_info Make the wait_context a full part of the q_info struct rather than a stack variable that goes away after pdsc_adminq_post() is done so that the context is still available after the wait loop has given up. There was a case where a slow development firmware caused the adminq request to time out, but then later the FW finally finished the request and sent the interrupt. The handler tried to complete_all() the completion context that had been created on the stack in pdsc_adminq_post() but no longer existed. This caused bad pointer usage, kernel crashes, and much wailing and gnashing of teeth.

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-37886 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: pds_core: make wait_context part of     q_info Make the wait_context a full part of the q_info struct rather than a stack variable that goes away     after pdsc_adminq_post() is done so that the context is still available after the wait loop has given up.
    There was a case where a slow development firmware caused the adminq request to time out, but then later     the FW finally finished the request and sent the interrupt. The handler tried to complete_all() the     completion context that had been created on the stack in pdsc_adminq_post() but no longer existed. This     caused bad pointer usage, kernel crashes, and much wailing and gnashing of teeth. (CVE-2025-37886)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-25757 advisory.

    - i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38607608]  {CVE-2025-39973}
    - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38575804]     {CVE-2025-39964}
    - i2c: tegra: check msg length in SMBUS block read (Akhil R) [Orabug: 38254038,38471683] {CVE-2025-38425}
    - device-dax: correct pgoff align in dax_set_mapping() (Kun(Llfl)) [Orabug: 37206403] {CVE-2024-50022}
    - vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (Yishai Hadas) [Orabug: 37434467]     {CVE-2024-56742}
    - af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38528187]     {CVE-2025-38236}
    - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494760]     {CVE-2025-39902}
    - dma-buf: insert memory barrier before updating num_fences (Hyejeong Choi) [Orabug: 38152833]     {CVE-2025-38095}
    - iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977027]     {CVE-2025-37968}
    - e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494739] {CVE-2025-39898}
    - scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456753]     {CVE-2025-39841}
    - wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494722]     {CVE-2025-39891}
    - mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456763] {CVE-2025-39844}
    - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug:
    38456766] {CVE-2025-39845}
    - net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153076]     {CVE-2025-38148}
    - ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456780] {CVE-2025-39847}
    - i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456813] {CVE-2025-39853}
    - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456833]     {CVE-2025-39860}
    - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang)     [Orabug: 38494730] {CVE-2025-39894}
    - wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456858] {CVE-2025-39864}
    - tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456865] {CVE-2025-39865}
    - fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456870,38528183]     {CVE-2025-39866}
    - bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324117] {CVE-2025-38502}
    - xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440385]     {CVE-2025-39835}
    - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug:
    38440227] {CVE-2025-39808}
    - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440223]     {CVE-2025-39806}
    - HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440309] {CVE-2025-39824}
    - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440276] {CVE-2025-39817}
    - sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440249] {CVE-2025-39812}
    - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440345]     {CVE-2025-39828}
    - NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401609] {CVE-2025-39697}
    - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440258]     {CVE-2025-39813}
    - netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401481]     {CVE-2025-38732}
    - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423456]     {CVE-2025-39766}
    - net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug:
    38516727] {CVE-2025-38736}
    - ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401500] {CVE-2025-39673}
    - drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423473] {CVE-2025-39772}
    - iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360925]     {CVE-2025-38676}
    - scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401513]     {CVE-2025-39676}
    - net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423478]     {CVE-2025-39773}
    - x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401541]     {CVE-2025-39681}
    - tracing: Limit access to parser->buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401546]     {CVE-2025-39683}
    - soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423523]     {CVE-2025-39787}
    - usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan) [Orabug: 38435009]     {CVE-2025-39801}
    - ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401580]     {CVE-2025-39689}
    - fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401586] {CVE-2025-39691}
    - drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401596]     {CVE-2025-39693}
    - sch_htb: make htb_deactivate() idempotent (Cong Wang) [Orabug: 38516621] {CVE-2025-37953}
    - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang) [Orabug: 37908491]     {CVE-2025-37798}
    - net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394836]     {CVE-2025-38684}
    - bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423539]     {CVE-2025-39790}
    - NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug:
    38429210] {CVE-2025-39798}
    - hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394830]     {CVE-2025-38683}
    - arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351990]     {CVE-2025-38670}
    - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351929]     {CVE-2025-38664}
    - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang) [Orabug: 38158395] {CVE-2025-38177}
    - sch_htb: make htb_qlen_notify() idempotent (Cong Wang) [Orabug: 37976859] {CVE-2025-37932}
    - net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401632] {CVE-2025-39703}
    - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401676]     {CVE-2025-39713}
    - media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401683] {CVE-2025-39714}
    - jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423508] {CVE-2025-39782}
    - serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401728] {CVE-2025-39724}
    - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394815]     {CVE-2025-38680}
    - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394843]     {CVE-2025-38685}
    - btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423271]     {CVE-2025-39738}
    - usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423420]     {CVE-2025-39760}
    - pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394865] {CVE-2025-38691}
    - block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug:
    38429192] {CVE-2025-39795}
    - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and     w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394879] {CVE-2025-38693}
    - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394886]     {CVE-2025-38694}
    - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug:
    38394893] {CVE-2025-38695}
    - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423285]     {CVE-2025-39742}
    - scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394923] {CVE-2025-38699}
    - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [Orabug:
    38394930] {CVE-2025-38700}
    - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394936]     {CVE-2025-38701}
    - rcu: Protect ->defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423340] {CVE-2025-39749}
    - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394977]     {CVE-2025-38706}
    - drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394994] {CVE-2025-38708}
    - sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395058] {CVE-2025-38718}
    - netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395066]     {CVE-2025-38721}
    - eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335161] {CVE-2025-38614}
    - fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423396]     {CVE-2025-39756}
    - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395080]     {CVE-2025-38724}
    - net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395088] {CVE-2025-38725}
    - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423406]     {CVE-2025-39757}
    - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395100]     {CVE-2025-38729}
    - usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334897] {CVE-2025-38555}
    - net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351763]     {CVE-2025-38617}
    - perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334947] {CVE-2025-38563}
    - perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334957] {CVE-2025-38565}
    - net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351785] {CVE-2025-38622}
    - ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334987] {CVE-2025-38572}
    - pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335003] {CVE-2025-38574}
    - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401744]     {CVE-2025-39730}
    - netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351853]     {CVE-2025-38639}
    - net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug:
    38331465] {CVE-2025-38553}
    - net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351877] {CVE-2025-38645}
    - wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335105]     {CVE-2025-38601}
    - iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335109]     {CVE-2025-38602}
    - wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335118]     {CVE-2025-38604}
    - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335130]     {CVE-2025-38608}
    - PM / devfreq: Check governor before using governor->name (Lifeng Zheng) [Orabug: 38335134]     {CVE-2025-38609}
    - i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351993] {CVE-2025-38671}
    - regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati)     [Orabug: 38351977] {CVE-2025-38668}
    - Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180692]     {CVE-2025-38335}
    - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254213]     {CVE-2025-38468}
    - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug:
    38254224] {CVE-2025-38470}
    - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324326] {CVE-2025-38550}
    - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254240]     {CVE-2025-38473}
    - usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254248] {CVE-2025-38474}
    - net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254265] {CVE-2025-38477}
    - bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324226]     {CVE-2025-38528}
    - tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324269]     {CVE-2025-38539}
    - usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254357]     {CVE-2025-38497}
    - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324257]     {CVE-2025-38535}
    - pds_core: remove write-after-free of client_id (Shannon Nelson) [Orabug: 37976798,38467344]     {CVE-2025-37916}
    - pds_core: make wait_context part of q_info (Shannon Nelson) [Orabug: 37937540,38467344] {CVE-2025-37886}
    - pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley) [Orabug: 37937543,38467344]     {CVE-2025-37887}
    - pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley) [Orabug: 37977106,38467344]     {CVE-2025-37987}
    - pds_core: Fix pdsc_check_pci_health function to use work thread (Brett Creeley) [Orabug:
    38467344,38498854] {CVE-2024-35968}
    - net: pds_core: Fix possible double free in error handling path (Yongzhi Liu) [Orabug: 36530186]     {CVE-2024-26652}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20530 advisory.

    - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38137447]     {CVE-2025-38089}
    - Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
    - x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38172252]     {CVE-2024-36350} {CVE-2024-36357}
    - Add normal counters (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
    - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38172252]     {CVE-2024-36350} {CVE-2024-36357}
    - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38172252]     {CVE-2024-36350} {CVE-2024-36357}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pds_core: make wait_context part of q_info Make the wait_context a full part of the q_info struct rather     than a stack variable that goes away after pdsc_adminq_post() is done so that the context is still     available after the wait loop has given up. There was a case where a slow development firmware caused the     adminq request to time out, but then later the FW finally finished the request and sent the interrupt. The     handler tried to complete_all() the completion context that had been created on the stack in     pdsc_adminq_post() but no longer existed. This caused bad pointer usage, kernel crashes, and much wailing     and gnashing of teeth. (CVE-2025-37886)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20480 advisory.

    - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38178286]     {CVE-2025-38089}
    - Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
    - x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38023239]     {CVE-2024-36350} {CVE-2024-36357}
    - Add normal counters (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
    - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38023239]     {CVE-2024-36350} {CVE-2024-36357}
    - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38023239]     {CVE-2024-36350} {CVE-2024-36357}
    - x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38023239]     {CVE-2024-36350} {CVE-2024-36357}
    - block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
    - f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
    - gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
    - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug:
    38049363] {CVE-2025-38001}
    - smb: client: Fix use-after-free in cifs_fill_dirent (Zhaolong Wang) [Orabug: 38094970] {CVE-2025-38051}
    - platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() (Vladimir Moskovkin)     [Orabug: 38095141] {CVE-2025-38077}
    - ALSA: pcm: Fix race of buffer access at PCM OSS layer (Takashi Iwai) [Orabug: 38095145] {CVE-2025-38078}
    - can: bcm: add missing rcu read protection for procfs content (Oliver Hartkopp) [Orabug: 38049369]     {CVE-2025-38003}
    - can: bcm: add locking for bcm_op runtime updates (Oliver Hartkopp) [Orabug: 38049374] {CVE-2025-38004}
    - padata: do not leak refcount in reorder_work (Dominik Grzegorzek) [Orabug: 38094842] {CVE-2025-38031}
    - crypto: algif_hash - fix double free in hash_accept (Ivan Pravdin) [Orabug: 38095153] {CVE-2025-38079}
    - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (Wang Liang) [Orabug: 38094978]     {CVE-2025-38052}
    - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Cong Wang) [Orabug: 38049357]     {CVE-2025-38000}
    - idpf: fix null-ptr-deref in idpf_features_check (Pavan Kumar Linga) [Orabug: 38094982] {CVE-2025-38053}
    - ptp: ocp: Limit signal/freq counts in summary output functions (Sagi Maimon) [Orabug: 38094984]     {CVE-2025-38054}
    - perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq (Adrian Hunter) [Orabug: 38094988]     {CVE-2025-38055}
    - ASoC: SOF: Intel: hda: Fix UAF when reloading module (Tavian Barnes) [Orabug: 38094991] {CVE-2025-38056}
    - espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094993] {CVE-2025-38057}
    - __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (Al Viro) [Orabug: 38095000]     {CVE-2025-38058}
    - x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88 (Pawel Anikiel) [Orabug: 38094847]     {CVE-2025-38033}
    - btrfs: avoid NULL pointer dereference if no valid csum tree (Qu Wenruo) [Orabug: 38095010]     {CVE-2025-38059}
    - btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (Goldwyn Rodrigues) [Orabug:
    38094856] {CVE-2025-38034}
    - nvmet-tcp: don't restore null sk_state_change (Alistair Francis) [Orabug: 38094863] {CVE-2025-38035}
    - vxlan: Annotate FDB data races (Ido Schimmel) [Orabug: 38094879] {CVE-2025-38037}
    - cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (Dhananjay Ugwekar) [Orabug: 38094888]     {CVE-2025-38038}
    - drm/amd/display: Increase block_sequence array size (Joshua Aberback) [Orabug: 38095164]     {CVE-2025-38080}
    - bpf: copy_verifier_state() should copy 'loop_entry' field (Eduard Zingerman) [Orabug: 38095018]     {CVE-2025-38060}
    - serial: mctrl_gpio: split disable_ms into sync and no_sync APIs (Alexis Lothore) [Orabug: 38094901]     {CVE-2025-38040}
    - net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (Peter Seiderer) [Orabug:
    38095024] {CVE-2025-38061}
    - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie (Jason Gunthorpe) [Orabug:
    38095031] {CVE-2025-38062}
    - dm: fix unconditional IO throttle caused by REQ_PREFLUSH (Jinliang Zheng) [Orabug: 38095038]     {CVE-2025-38063}
    - firmware: arm_ffa: Set dma_mask for ffa devices (Viresh Kumar) [Orabug: 38094925] {CVE-2025-38043}
    - media: cx231xx: set device_caps for 417 (Hans Verkuil) [Orabug: 38094934] {CVE-2025-38044}
    - orangefs: Do not truncate file size (Matthew Wilcox) [Orabug: 38095056] {CVE-2025-38065}
    - dm cache: prevent BUG_ON by blocking retries on failed device resumes (Ming-Hung Tsai) [Orabug:
    38095063] {CVE-2025-38066}
    - crypto: lzo - Fix compression buffer overrun (Herbert Xu) [Orabug: 38095079] {CVE-2025-38068}
    - PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops (Christian Bruel) [Orabug:
    38095087] {CVE-2025-38069}
    - wifi: iwlwifi: fix debug actions order (Johannes Berg) [Orabug: 38094942] {CVE-2025-38045}
    - x86/mm: Check return value from memblock_phys_alloc_range() (Philip Redkin) [Orabug: 38095101]     {CVE-2025-38071}
    - libnvdimm/labels: Fix divide error in nd_label_data_init() (Robert Richter) [Orabug: 38095109]     {CVE-2025-38072}
    - spi-rockchip: Fix register out of bounds access (Luis de Arquer) [Orabug: 38095173] {CVE-2025-38081}
    - x86/fred: Fix system hang during S4 resume with FRED enabled (Xin Li) [Orabug: 38094951]     {CVE-2025-38047}
    - block: fix race between set_blocksize and read paths (Darrick J. Wong) [Orabug: 38095117]     {CVE-2025-38073}
    - virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN (Zhongqiu Han) [Orabug:
    38094958] {CVE-2025-38048}
    - scsi: target: iscsi: Fix timeout on deleted connection (Dmitry Bogdanov) [Orabug: 38095134]     {CVE-2025-38075}
    - usb: typec: ucsi: displayport: Fix deadlock (Andrei Kuchynski) [Orabug: 37977018] {CVE-2025-37967}
    - Bluetooth: btnxpuart: Fix kernel panic during FW release (Neeraj Sanjay Kale) [Orabug: 37844459]     {CVE-2025-22102}
    - iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977026]     {CVE-2025-37968}
    - mm/page_alloc: fix race condition in unaccepted memory handling (Kirill A. Shutemov) [Orabug: 38094767]     {CVE-2025-38008}
    - dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (Shuai Xue) [Orabug: 38094790]     {CVE-2025-38014}
    - dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094793]     {CVE-2025-38015}
    - dmaengine: ti: k3-udma: Add missing locking (Ronald Wahl) [Orabug: 38094756] {CVE-2025-38005}
    - wifi: mt76: disable napi on driver removal (Fedor Pchelkin) [Orabug: 38094770] {CVE-2025-38009}
    - phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking (Wayne Chang) [Orabug: 38094777]     {CVE-2025-38010}
    - drm/amdgpu: csa unmap use uninterruptible lock (Philip Yang) [Orabug: 38094779] {CVE-2025-38011}
    - HID: bpf: abort dispatch if device destroyed (Rongrong) [Orabug: 38094796] {CVE-2025-38016}
    - sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator (Tejun Heo) [Orabug: 38094786]     {CVE-2025-38012}
    - net/tls: fix kernel panic when alloc_page failed (Pengtao He) [Orabug: 38094802] {CVE-2025-38018}
    - mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (Ido Schimmel) [Orabug:
    38094804] {CVE-2025-38019}
    - wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request (Kees Cook) [Orabug:
    38094788] {CVE-2025-38013}
    - regulator: max20086: fix invalid memory access (Cosmin Tanislav) [Orabug: 38094833] {CVE-2025-38027}
    - net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094808]     {CVE-2025-38020}
    - net_sched: Flush gso_skb list too during ->change() (Cong Wang) [Orabug: 37998128] {CVE-2025-37992}
    - RDMA/core: Fix 'KASAN: slab-use-after-free Read in ib_register_device' problem (Zhu Yanjun) [Orabug:
    38094813] {CVE-2025-38022}
    - nfs: handle failure of nfs_get_lock_context in unlock path (Li Lingfeng) [Orabug: 38094818]     {CVE-2025-38023}
    - HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 38094764]     {CVE-2025-38007}
    - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (Zhu Yanjun) [Orabug: 38094827]     {CVE-2025-38024}
    - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977004]     {CVE-2025-37963}
    - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976926]     {CVE-2025-37948}
    - usb: typec: ucsi: displayport: Fix NULL pointer access (Andrei Kuchynski) [Orabug: 38015126]     {CVE-2025-37994}
    - module: ensure that kobject_put() is safe for module type kobjects (Dmitry Antipov) [Orabug: 38015131]     {CVE-2025-37995}
    - memblock: Accept allocated memory before use in memblock_double_array() (Tom Lendacky) [Orabug:
    37976994] {CVE-2025-37960}
    - xenbus: Use kref to track req lifetime (Jason Andryuk) [Orabug: 37976934] {CVE-2025-37949}
    - smb: client: Avoid race in open_cached_dir with lease breaks (Paul Aurich) [Orabug: 37976959]     {CVE-2025-37954}
    - drm/amd/display: Fix invalid context error in dml helper (Roman Li) [Orabug: 37977185] {CVE-2025-37965}
    - drm/v3d: Add job to pending list if the reset was skipped (Maira Canal) [Orabug: 37976942]     {CVE-2025-37951}
    - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo (Silvano Seva) [Orabug:
    37977031] {CVE-2025-37969}
    - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (Silvano Seva) [Orabug: 37977037]     {CVE-2025-37970}
    - KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (Mikhail Lobanov) [Orabug: 37976977]     {CVE-2025-37957}
    - mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976982]     {CVE-2025-37958}
    - x86/mm: Eliminate window where TLB flushes may be inadvertently skipped (Dave Hansen) [Orabug: 37977013]     {CVE-2025-37964}
    - staging: bcm2835-camera: Initialise dev in v4l2_dev (Dave Stevenson) [Orabug: 37977042] {CVE-2025-37971}
    - Input: mtk-pmic-keys - fix possible null pointer dereference (Gary Bisson) [Orabug: 37977044]     {CVE-2025-37972}
    - bpf: Scrub packet on bpf_redirect_peer (Paul Chaignon) [Orabug: 37976990] {CVE-2025-37959}
    - netfilter: ipset: fix region locking in hash types (Jozsef Kadlecsik) [Orabug: 38015141]     {CVE-2025-37997}
    - ipvs: fix uninit-value for saddr in do_output_route4 (Julian Anastasov) [Orabug: 37976996]     {CVE-2025-37961}
    - can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe (Antonios Salios) [Orabug:
    38015123] {CVE-2025-37993}
    - virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() (Jakub Kicinski) [Orabug: 37976969]     {CVE-2025-37955}
    - sch_htb: make htb_deactivate() idempotent (Cong Wang) [Orabug: 37977176] {CVE-2025-37953}
    - ksmbd: fix memory leak in parse_lease_state() (Zhaolong Wang) [Orabug: 37977180] {CVE-2025-37962}
    - openvswitch: Fix unsafe attribute parsing in output_userspace() (Eelco Chaudron) [Orabug: 38015148]     {CVE-2025-37998}
    - ksmbd: Fix UAF in __close_file_table_ids (Sean Heelan) [Orabug: 37976951] {CVE-2025-37952}
    - ksmbd: prevent out-of-bounds stream writes by validating *pos (Norbert Szetei) [Orabug: 37976923]     {CVE-2025-37947}
    - ksmbd: prevent rename with empty string (Namjae Jeon) [Orabug: 37976972] {CVE-2025-37956}
    - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Niklas Schnelle) [Orabug:
    37976920] {CVE-2025-37946}
    - wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation (Veerendranath     Jakkam) [Orabug: 37977046] {CVE-2025-37973}
    - s390/pci: Fix missing check for zpci_create_device() error return (Niklas Schnelle) [Orabug: 37977050]     {CVE-2025-37974}
    - fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() (Max Kellermann) [Orabug:
    38015155] {CVE-2025-37999}
    - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (David Thompson) [Orabug:
    37964051,38037120] {CVE-2025-37866}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01965-1 advisory.

    The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
    - CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
    - CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
    - CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN     (bsc#1234154).
    - CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
    - CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
    - CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
    - CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
    - CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
    - CVE-2025-21919: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (bsc#1240593).
    - CVE-2025-22021: netfilter: socket: Lookup orig tuple for IPv6 SNAT (bsc#1241282).
    - CVE-2025-22030: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (bsc#1241376).
    - CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
    - CVE-2025-22057: net: decrease cached dst counters in dst_release (bsc#1241533).
    - CVE-2025-22063: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (bsc#1241351).
    - CVE-2025-22070: fs/9p: fix NULL pointer dereference on mkdir (bsc#1241305).
    - CVE-2025-22103: net: fix NULL pointer dereference in l3mdev_l3_rcv (bsc#1241448).
    - CVE-2025-23140: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error     (bsc#1242763).
    - CVE-2025-23150: ext4: fix off-by-one error in do_split (bsc#1242513).
    - CVE-2025-23160: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW     initialization (bsc#1242507).
    - CVE-2025-37748: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (bsc#1242523).
    - CVE-2025-37749: net: ppp: Add bound checking for skb data on ppp_sync_txmung (bsc#1242859).
    - CVE-2025-37750: smb: client: fix UAF in decryption with multichannel (bsc#1242510).
    - CVE-2025-37755: net: libwx: handle page_pool_dev_alloc_pages error (bsc#1242506).
    - CVE-2025-37773: virtiofs: add filesystem context source name check (bsc#1242502).
    - CVE-2025-37780: isofs: Prevent the use of too small fid (bsc#1242786).
    - CVE-2025-37787: net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered     (bsc#1242585).
    - CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
    - CVE-2025-37790: net: mctp: Set SOCK_RCU_FREE (bsc#1242509).
    - CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
    - CVE-2025-37803: udmabuf: fix a buf size overflow issue during udmabuf creation (bsc#1242852).
    - CVE-2025-37804: io_uring: always do atomic put from iowq (bsc#1242854).
    - CVE-2025-37809: usb: typec: class: Unlocked on error in typec_register_partner() (bsc#1242856).
    - CVE-2025-37820: xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (bsc#1242866).
    - CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
    - CVE-2025-37824: tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (bsc#1242867).
    - CVE-2025-37829: cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (bsc#1242875).
    - CVE-2025-37830: cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (bsc#1242860).
    - CVE-2025-37831: cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (bsc#1242861).
    - CVE-2025-37833: net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (bsc#1242868).
    - CVE-2025-37842: spi: fsl-qspi: Fix double cleanup in probe error path (bsc#1242951).
    - CVE-2025-37870: drm/amd/display: prevent hang on link training fail (bsc#1243056).
    - CVE-2025-37879: 9p/net: fix improper handling of bogus negative read/write replies (bsc#1243077).
    - CVE-2025-37886: pds_core: make wait_context part of q_info (bsc#1242944).
    - CVE-2025-37887: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (bsc#1242962).
    - CVE-2025-37949: xenbus: Use kref to track req lifetime (bsc#1243541).
    - CVE-2025-37954: smb: client: Avoid race in open_cached_dir with lease breaks (bsc#1243664).
    - CVE-2025-37957: KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (bsc#1243513).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-37960: memblock: Accept allocated memory before use in memblock_double_array() (bsc#1243519).
    - CVE-2025-37974: s390/pci: Fix missing check for zpci_create_device() error return (bsc#1243547).
    - CVE-2025-38152: remoteproc: core: Clear table_sz when rproc_shutdown (bsc#1241627).
    - CVE-2025-38637: net_sched: skbprio: Remove overly strict queue assertions (bsc#1241657).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01972-1 advisory.

    The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
    - CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
    - CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
    - CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
    - CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
    - CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
    - CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
    - CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
    - CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
    - CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
    - CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
    - CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
    - CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
    - CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
    - CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
    - CVE-2025-21919: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (bsc#1240593).
    - CVE-2025-21962: cifs: Fix integer overflow while processing closetimeo mount option (bsc#1240655).
    - CVE-2025-21963: cifs: Fix integer overflow while processing acdirmax mount option (bsc#1240717).
    - CVE-2025-21964: cifs: Fix integer overflow while processing acregmax mount option (bsc#1240740).
    - CVE-2025-22018: atm: Fix NULL pointer dereference (bsc#1241266).
    - CVE-2025-22021: netfilter: socket: Lookup orig tuple for IPv6 SNAT (bsc#1241282).
    - CVE-2025-22030: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (bsc#1241376).
    - CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
    - CVE-2025-22057: net: decrease cached dst counters in dst_release (bsc#1241533).
    - CVE-2025-22058: udp: Fix memory accounting leak (bsc#1241332).
    - CVE-2025-22063: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (bsc#1241351).
    - CVE-2025-22064: netfilter: nf_tables: do not unregister hook when table is dormant (bsc#1241413).
    - CVE-2025-22070: fs/9p: fix NULL pointer dereference on mkdir (bsc#1241305).
    - CVE-2025-22094: powerpc/perf: Fix ref-counting on the PMU 'vpa_pmu' (bsc#1241512).
    - CVE-2025-22102: Bluetooth: btnxpuart: Fix kernel panic during FW release (bsc#1241456).
    - CVE-2025-22103: net: fix NULL pointer dereference in l3mdev_l3_rcv (bsc#1241448).
    - CVE-2025-22104: ibmvnic: Use kernel helpers for hex dumps (bsc#1241550).
    - CVE-2025-22107: net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry()     (bsc#1241575).
    - CVE-2025-22109: ax25: Remove broken autobind (bsc#1241573).
    - CVE-2025-23138: watch_queue: fix pipe accounting mismatch (bsc#1241648).
    - CVE-2025-23140: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error     (bsc#1242763).
    - CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
    - CVE-2025-23150: ext4: fix off-by-one error in do_split (bsc#1242513).
    - CVE-2025-23154: io_uring/net: fix io_req_post_cqe abuse by send bundle (bsc#1242533).
    - CVE-2025-23160: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW     initialization (bsc#1242507).
    - CVE-2025-37747: kABI workaround for perf-Fix-hang-while-freeing-sigtrap-event (References: bsc#1242520).
    - CVE-2025-37748: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (bsc#1242523).
    - CVE-2025-37749: net: ppp: Add bound checking for skb data on ppp_sync_txmung (bsc#1242859).
    - CVE-2025-37750: smb: client: fix UAF in decryption with multichannel (bsc#1242510).
    - CVE-2025-37755: net: libwx: handle page_pool_dev_alloc_pages error (bsc#1242506).
    - CVE-2025-37773: virtiofs: add filesystem context source name check (bsc#1242502).
    - CVE-2025-37780: isofs: Prevent the use of too small fid (bsc#1242786).
    - CVE-2025-37787: net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered     (bsc#1242585).
    - CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
    - CVE-2025-37790: net: mctp: Set SOCK_RCU_FREE (bsc#1242509).
    - CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
    - CVE-2025-37798: codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (bsc#1242414).
    - CVE-2025-37799: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (bsc#1242283).
    - CVE-2025-37803: udmabuf: fix a buf size overflow issue during udmabuf creation (bsc#1242852).
    - CVE-2025-37804: io_uring: always do atomic put from iowq (bsc#1242854).
    - CVE-2025-37809: usb: typec: class: Unlocked on error in typec_register_partner() (bsc#1242856).
    - CVE-2025-37820: xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (bsc#1242866).
    - CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
    - CVE-2025-37824: tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (bsc#1242867).
    - CVE-2025-37829: cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (bsc#1242875).
    - CVE-2025-37830: cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (bsc#1242860).
    - CVE-2025-37831: cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (bsc#1242861).
    - CVE-2025-37833: net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (bsc#1242868).
    - CVE-2025-37842: spi: fsl-qspi: Fix double cleanup in probe error path (bsc#1242951).
    - CVE-2025-37870: drm/amd/display: prevent hang on link training fail (bsc#1243056).
    - CVE-2025-37879: 9p/net: fix improper handling of bogus negative read/write replies (bsc#1243077).
    - CVE-2025-37886: pds_core: make wait_context part of q_info (bsc#1242944).
    - CVE-2025-37887: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (bsc#1242962).
    - CVE-2025-37949: xenbus: Use kref to track req lifetime (bsc#1243541).
    - CVE-2025-37957: KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (bsc#1243513).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-37960: memblock: Accept allocated memory before use in memblock_double_array() (bsc#1243519).
    - CVE-2025-37974: s390/pci: Fix missing check for zpci_create_device() error return (bsc#1243547).
    - CVE-2025-38152: remoteproc: core: Clear table_sz when rproc_shutdown (bsc#1241627).
    - CVE-2025-38637: net_sched: skbprio: Remove overly strict queue assertions (bsc#1241657).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01951-1 advisory.

    The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
    - CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
    - CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
    - CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
    - CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
    - CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
    - CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
    - CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
    - CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround     (bsc#1235712).
    - CVE-2024-49570: drm/xe/tracing: Fix a potential TP_printk UAF (bsc#1238782).
    - CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg     (bsc#1235733).
    - CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
    - CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
    - CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
    - CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
    - CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
    - CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
    - CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
    - CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
    - CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
    - CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq'     (bsc#1235524).
    - CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
    - CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
    - CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
    - CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
    - CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
    - CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
    - CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
    - CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
    - CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
    - CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
    - CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
    - CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
    - CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
    - CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
    - CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
    - CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
    - CVE-2024-58074: drm/i915: Grab intel_display from the encoder to avoid potential (bsc#1238972).
    - CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
    - CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
    - CVE-2024-58091: drm/fbdev-dma: Add shadow buffering for deferred I/O (bsc#1240174).
    - CVE-2025-21635: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy (bsc#1236111).
    - CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
    - CVE-2025-21659: netdev: prevent accessing NAPI instances from another namespace (bsc#1236206).
    - CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
    - CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
    - CVE-2025-21701: net: avoid race between device unregistration and ethnl ops (bsc#1237164).
    - CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
    - CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
    - CVE-2025-21706: mptcp: pm: only set fullmesh for subflow endp (bsc#1238528).
    - CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
    - CVE-2025-21717: net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq     (bsc#1238866).
    - CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
    - CVE-2025-21739: kABI: ufshcd: add ufshcd_dealloc_host back (bsc#1238506).
    - CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875).
    - CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
    - CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
    - CVE-2025-21759: ipv6: mcast: extend RCU protection in igmp6_send() (bsc#1238738).
    - CVE-2025-21760: ndisc: extend RCU protection in ndisc_send_skb() (bsc#1238763).
    - CVE-2025-21761: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() (bsc#1238775).
    - CVE-2025-21762: arp: use RCU protection in arp_xmit() (bsc#1238780).
    - CVE-2025-21763: neighbour: use RCU protection in __neigh_notify() (bsc#1237897).
    - CVE-2025-21765: ipv6: use RCU protection in ip6_default_advmss() (bsc#1237906).
    - CVE-2025-21766: ipv4: use RCU protection in __ip_rt_update_pmtu() (bsc#1238754).
    - CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
    - CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
    - CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
    - CVE-2025-21800: net/mlx5: HWS, fix definer's HWS_SET32 macro for negative offset (bsc#1238743).
    - CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
    - CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
    - CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
    - CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
    - CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
    - CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
    - CVE-2025-21837: io_uring/uring_cmd: unconditionally copy SQEs at prep time (bsc#1239064).
    - CVE-2025-21844: smb: client: Add check for next_buffer in receive_encrypted_standard() (bsc#1239512).
    - CVE-2025-21848: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() (bsc#1239479).
    - CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
    - CVE-2025-21856: s390/ism: add release function for struct device (bsc#1239486).
    - CVE-2025-21857: net/sched: cls_api: fix error handling causing NULL dereference (bsc#1239478).
    - CVE-2025-21861: mm/migrate_device: do not add folio to be freed to LRU in migrate_device_finalize()     (bsc#1239483).
    - CVE-2025-21862: drop_monitor: fix incorrect initialization order (bsc#1239474).
    - CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
    - CVE-2025-21864: kABI fix for tcp: drop secpath at the same time as we currently drop (bsc#1239482).
    - CVE-2025-21865: gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl() (bsc#1239481).
    - CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
    - CVE-2025-21870: ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers (bsc#1240191).
    - CVE-2025-21871: tee: optee: Fix supplicant wait loop (bsc#1240183).
    - CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
    - CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
    - CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
    - CVE-2025-21882: net/mlx5: Fix vport QoS cleanup on error (bsc#1240187).
    - CVE-2025-21883: ice: Fix deinitializing VF in error path (bsc#1240189).
    - CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
    - CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
    - CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
    - CVE-2025-21890: idpf: fix checksums set in idpf_rx_rsc() (bsc#1240173).
    - CVE-2025-21891: ipvlan: ensure network headers are in skb linear part (bsc#1240186).
    - CVE-2025-21894: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC (bsc#1240581).
    - CVE-2025-21895: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list (bsc#1240585).
    - CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
    - CVE-2025-21906: wifi: iwlwifi: mvm: clean up ROC on failure (bsc#1240587).
    - CVE-2025-21908: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback (bsc#1240600).
    - CVE-2025-21913: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (bsc#1240591).
    - CVE-2025-21919: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (bsc#1240593).
    - CVE-2025-21922: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639).
    - CVE-2025-21924: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an     error (bsc#1240720).
    - CVE-2025-21925: llc: do not use skb_get() before dev_queue_xmit() (bsc#1240713).
    - CVE-2025-21926: net: gso: fix ownership in __udp_gso_segment (bsc#1240712).
    - CVE-2025-21931: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio (bsc#1240709).
    - CVE-2025-21957: scsi: qla1280: Fix kernel oops when debug level > 2 (bsc#1240742).
    - CVE-2025-21960: eth: bnxt: do not update checksum in bnxt_xdp_build_skb() (bsc#1240815).
    - CVE-2025-21961: eth: bnxt: fix truesize for mb-xdp-pass case (bsc#1240816).
    - CVE-2025-21962: cifs: Fix integer overflow while processing closetimeo mount option (bsc#1240655).
    - CVE-2025-21963: cifs: Fix integer overflow while processing acdirmax mount option (bsc#1240717).
    - CVE-2025-21964: cifs: Fix integer overflow while processing acregmax mount option (bsc#1240740).
    - CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784).
    - CVE-2025-21970: net/mlx5: Bridge, fix the crash caused by LAG state check (bsc#1240819).
    - CVE-2025-21972: net: mctp: unshare packets when reassembling (bsc#1240813).
    - CVE-2025-21973: eth: bnxt: fix kernel panic in the bnxt_get_queue_stats{rx | tx} (bsc#1240803).
    - CVE-2025-21974: eth: bnxt: return fail if interface is down in bnxt_queue_mem_alloc() (bsc#1240800).
    - CVE-2025-21975: net/mlx5: handle errors in mlx5_chains_create_table() (bsc#1240812).
    - CVE-2025-21980: sched: address a potential NULL pointer dereference in the GRED scheduler (bsc#1240809).
    - CVE-2025-21981: ice: fix memory leak in aRFS after reset (bsc#1240612).
    - CVE-2025-21985: drm/amd/display: Fix out-of-bound accesses (bsc#1240811).
    - CVE-2025-21991: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (bsc#1240795).
    - CVE-2025-21993: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (bsc#1240797).
    - CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
    - CVE-2025-22015: mm/migrate: fix shmem xarray update during migration (bsc#1240944).
    - CVE-2025-22016: dpll: fix xa_alloc_cyclic() error handling (bsc#1240934).
    - CVE-2025-22017: devlink: fix xa_alloc_cyclic() error handling (bsc#1240936).
    - CVE-2025-22018: atm: Fix NULL pointer dereference (bsc#1241266).
    - CVE-2025-22021: netfilter: socket: Lookup orig tuple for IPv6 SNAT (bsc#1241282).
    - CVE-2025-22030: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (bsc#1241376).
    - CVE-2025-22036: exfat: fix random stack corruption after get_block (bsc#1241426).
    - CVE-2025-22045: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (bsc#1241433).
    - CVE-2025-22053: net: ibmveth: make veth_pool_store stop hanging (bsc#1241373).
    - CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
    - CVE-2025-22057: net: decrease cached dst counters in dst_release (bsc#1241533).
    - CVE-2025-22058: udp: Fix memory accounting leak (bsc#1241332).
    - CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
    - CVE-2025-22063: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (bsc#1241351).
    - CVE-2025-22064: netfilter: nf_tables: do not unregister hook when table is dormant (bsc#1241413).
    - CVE-2025-22070: fs/9p: fix NULL pointer dereference on mkdir (bsc#1241305).
    - CVE-2025-22080: fs/ntfs3: Prevent integer overflow in hdr_first_de() (bsc#1241416).
    - CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
    - CVE-2025-22094: powerpc/perf: Fix ref-counting on the PMU 'vpa_pmu' (bsc#1241512).
    - CVE-2025-22102: Bluetooth: btnxpuart: Fix kernel panic during FW release (bsc#1241456).
    - CVE-2025-22103: net: fix NULL pointer dereference in l3mdev_l3_rcv (bsc#1241448).
    - CVE-2025-22104: ibmvnic: Use kernel helpers for hex dumps (bsc#1241550).
    - CVE-2025-22105, CVE-2025-37860: Add missing bugzilla references (bsc#1241452 bsc#1241548).
    - CVE-2025-22107: net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry()     (bsc#1241575).
    - CVE-2025-22109: ax25: Remove broken autobind (bsc#1241573).
    - CVE-2025-22121: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (bsc#1241593).
    - CVE-2025-2312: CIFS: New mount option for cifs.upcall namespace resolution (bsc#1239684).
    - CVE-2025-23133: wifi: ath11k: update channel list in reg notifier instead reg worker (bsc#1241451).
    - CVE-2025-23138: watch_queue: fix pipe accounting mismatch (bsc#1241648).
    - CVE-2025-23140: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error     (bsc#1242763).
    - CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
    - CVE-2025-23150: ext4: fix off-by-one error in do_split (bsc#1242513).
    - CVE-2025-23154: io_uring/net: fix io_req_post_cqe abuse by send bundle (bsc#1242533).
    - CVE-2025-23160: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW     initialization (bsc#1242507).
    - CVE-2025-37747: kABI workaround for perf-Fix-hang-while-freeing-sigtrap-event (References: bsc#1242520).
    - CVE-2025-37748: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (bsc#1242523).
    - CVE-2025-37749: net: ppp: Add bound checking for skb data on ppp_sync_txmung (bsc#1242859).
    - CVE-2025-37750: smb: client: fix UAF in decryption with multichannel (bsc#1242510).
    - CVE-2025-37755: net: libwx: handle page_pool_dev_alloc_pages error (bsc#1242506).
    - CVE-2025-37773: virtiofs: add filesystem context source name check (bsc#1242502).
    - CVE-2025-37780: isofs: Prevent the use of too small fid (bsc#1242786).
    - CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).
    - CVE-2025-37787: net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered     (bsc#1242585).
    - CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
    - CVE-2025-37790: net: mctp: Set SOCK_RCU_FREE (bsc#1242509).
    - CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
    - CVE-2025-37798: codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (bsc#1242414).
    - CVE-2025-37799: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (bsc#1242283).
    - CVE-2025-37803: udmabuf: fix a buf size overflow issue during udmabuf creation (bsc#1242852).
    - CVE-2025-37804: io_uring: always do atomic put from iowq (bsc#1242854).
    - CVE-2025-37809: usb: typec: class: Unlocked on error in typec_register_partner() (bsc#1242856).
    - CVE-2025-37820: xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (bsc#1242866).
    - CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
    - CVE-2025-37824: tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (bsc#1242867).
    - CVE-2025-37829: cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (bsc#1242875).
    - CVE-2025-37830: cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (bsc#1242860).
    - CVE-2025-37831: cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (bsc#1242861).
    - CVE-2025-37833: net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (bsc#1242868).
    - CVE-2025-37842: spi: fsl-qspi: Fix double cleanup in probe error path (bsc#1242951).
    - CVE-2025-37870: drm/amd/display: prevent hang on link training fail (bsc#1243056).
    - CVE-2025-37879: 9p/net: fix improper handling of bogus negative read/write replies (bsc#1243077).
    - CVE-2025-37886: pds_core: make wait_context part of q_info (bsc#1242944).
    - CVE-2025-37887: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (bsc#1242962).
    - CVE-2025-37949: xenbus: Use kref to track req lifetime (bsc#1243541).
    - CVE-2025-37957: KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (bsc#1243513).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-37960: memblock: Accept allocated memory before use in memblock_double_array() (bsc#1243519).
    - CVE-2025-37974: s390/pci: Fix missing check for zpci_create_device() error return (bsc#1243547).
    - CVE-2025-38152: remoteproc: core: Clear table_sz when rproc_shutdown (bsc#1241627).
    - CVE-2025-38637: net_sched: skbprio: Remove overly strict queue assertions (bsc#1241657).
    - CVE-2025-39728: clk: samsung: Fix UBSAN panic in samsung_clk_init() (bsc#1241626).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01964-1 advisory.

    The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
    - CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
    - CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
    - CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
    - CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
    - CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
    - CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN     (bsc#1234154).
    - CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
    - CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
    - CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
    - CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
    - CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
    - CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
    - CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
    - CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
    - CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
    - CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
    - CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
    - CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
    - CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
    - CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
    - CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
    - CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
    - CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
    - CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
    - CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
    - CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
    - CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
    - CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
    - CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
    - CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
    - CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
    - CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
    - CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
    - CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
    - CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
    - CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
    - CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
    - CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
    - CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
    - CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
    - CVE-2025-21894: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC (bsc#1240581).
    - CVE-2025-21895: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list (bsc#1240585).
    - CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
    - CVE-2025-21906: wifi: iwlwifi: mvm: clean up ROC on failure (bsc#1240587).
    - CVE-2025-21908: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback (bsc#1240600).
    - CVE-2025-21913: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (bsc#1240591).
    - CVE-2025-21919: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (bsc#1240593).
    - CVE-2025-21922: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639).
    - CVE-2025-21924: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an     error (bsc#1240720).
    - CVE-2025-21925: llc: do not use skb_get() before dev_queue_xmit() (bsc#1240713).
    - CVE-2025-21926: net: gso: fix ownership in __udp_gso_segment (bsc#1240712).
    - CVE-2025-21931: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio (bsc#1240709).
    - CVE-2025-21957: scsi: qla1280: Fix kernel oops when debug level > 2 (bsc#1240742).
    - CVE-2025-21960: eth: bnxt: do not update checksum in bnxt_xdp_build_skb() (bsc#1240815).
    - CVE-2025-21961: eth: bnxt: fix truesize for mb-xdp-pass case (bsc#1240816).
    - CVE-2025-21962: cifs: Fix integer overflow while processing closetimeo mount option (bsc#1240655).
    - CVE-2025-21963: cifs: Fix integer overflow while processing acdirmax mount option (bsc#1240717).
    - CVE-2025-21964: cifs: Fix integer overflow while processing acregmax mount option (bsc#1240740).
    - CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784).
    - CVE-2025-21970: net/mlx5: Bridge, fix the crash caused by LAG state check (bsc#1240819).
    - CVE-2025-21972: net: mctp: unshare packets when reassembling (bsc#1240813).
    - CVE-2025-21975: net/mlx5: handle errors in mlx5_chains_create_table() (bsc#1240812).
    - CVE-2025-21980: sched: address a potential NULL pointer dereference in the GRED scheduler (bsc#1240809).
    - CVE-2025-21981: ice: fix memory leak in aRFS after reset (bsc#1240612).
    - CVE-2025-21985: drm/amd/display: Fix out-of-bound accesses (bsc#1240811).
    - CVE-2025-21991: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (bsc#1240795).
    - CVE-2025-21993: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (bsc#1240797).
    - CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
    - CVE-2025-22004: net: atm: fix use after free in lec_send() (bsc#1240835).
    - CVE-2025-22015: mm/migrate: fix shmem xarray update during migration (bsc#1240944).
    - CVE-2025-22016: dpll: fix xa_alloc_cyclic() error handling (bsc#1240934).
    - CVE-2025-22017: devlink: fix xa_alloc_cyclic() error handling (bsc#1240936).
    - CVE-2025-22018: atm: Fix NULL pointer dereference (bsc#1241266).
    - CVE-2025-22021: netfilter: socket: Lookup orig tuple for IPv6 SNAT (bsc#1241282).
    - CVE-2025-22029: exec: fix the racy usage of fs_struct->in_exec (bsc#1241378).
    - CVE-2025-22030: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (bsc#1241376).
    - CVE-2025-22036: exfat: fix random stack corruption after get_block (bsc#1241426).
    - CVE-2025-22045: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (bsc#1241433).
    - CVE-2025-22053: net: ibmveth: make veth_pool_store stop hanging (bsc#1241373).
    - CVE-2025-22055: net: fix geneve_opt length integer overflow (bsc#1241371).
    - CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
    - CVE-2025-22057: net: decrease cached dst counters in dst_release (bsc#1241533).
    - CVE-2025-22058: udp: Fix memory accounting leak (bsc#1241332).
    - CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
    - CVE-2025-22063: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (bsc#1241351).
    - CVE-2025-22064: netfilter: nf_tables: do not unregister hook when table is dormant (bsc#1241413).
    - CVE-2025-22070: fs/9p: fix NULL pointer dereference on mkdir (bsc#1241305).
    - CVE-2025-22080: fs/ntfs3: Prevent integer overflow in hdr_first_de() (bsc#1241416).
    - CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
    - CVE-2025-22102: Bluetooth: btnxpuart: Fix kernel panic during FW release (bsc#1241456).
    - CVE-2025-22103: net: fix NULL pointer dereference in l3mdev_l3_rcv (bsc#1241448).
    - CVE-2025-22104: ibmvnic: Use kernel helpers for hex dumps (bsc#1241550).
    - CVE-2025-22105, CVE-2025-37860: Add missing bugzilla references (bsc#1241452 bsc#1241548).
    - CVE-2025-22107: net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry()     (bsc#1241575).
    - CVE-2025-22109: ax25: Remove broken autobind (bsc#1241573).
    - CVE-2025-22115: btrfs: fix block group refcount race in btrfs_create_pending_block_groups()     (bsc#1241578).
    - CVE-2025-22121: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (bsc#1241593).
    - CVE-2025-2312: CIFS: New mount option for cifs.upcall namespace resolution (bsc#1239684).
    - CVE-2025-23133: wifi: ath11k: update channel list in reg notifier instead reg worker (bsc#1241451).
    - CVE-2025-23138: watch_queue: fix pipe accounting mismatch (bsc#1241648).
    - CVE-2025-23140: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error     (bsc#1242763).
    - CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
    - CVE-2025-23150: ext4: fix off-by-one error in do_split (bsc#1242513).
    - CVE-2025-23160: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW     initialization (bsc#1242507).
    - CVE-2025-37748: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (bsc#1242523).
    - CVE-2025-37749: net: ppp: Add bound checking for skb data on ppp_sync_txmung (bsc#1242859).
    - CVE-2025-37750: smb: client: fix UAF in decryption with multichannel (bsc#1242510).
    - CVE-2025-37755: net: libwx: handle page_pool_dev_alloc_pages error (bsc#1242506).
    - CVE-2025-37773: virtiofs: add filesystem context source name check (bsc#1242502).
    - CVE-2025-37780: isofs: Prevent the use of too small fid (bsc#1242786).
    - CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).
    - CVE-2025-37787: net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered     (bsc#1242585).
    - CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
    - CVE-2025-37790: net: mctp: Set SOCK_RCU_FREE (bsc#1242509).
    - CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
    - CVE-2025-37799: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (bsc#1242283).
    - CVE-2025-37803: udmabuf: fix a buf size overflow issue during udmabuf creation (bsc#1242852).
    - CVE-2025-37804: io_uring: always do atomic put from iowq (bsc#1242854).
    - CVE-2025-37809: usb: typec: class: Unlocked on error in typec_register_partner() (bsc#1242856).
    - CVE-2025-37820: xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (bsc#1242866).
    - CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
    - CVE-2025-37824: tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (bsc#1242867).
    - CVE-2025-37829: cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (bsc#1242875).
    - CVE-2025-37830: cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (bsc#1242860).
    - CVE-2025-37831: cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (bsc#1242861).
    - CVE-2025-37833: net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (bsc#1242868).
    - CVE-2025-37842: spi: fsl-qspi: Fix double cleanup in probe error path (bsc#1242951).
    - CVE-2025-37870: drm/amd/display: prevent hang on link training fail (bsc#1243056).
    - CVE-2025-37879: 9p/net: fix improper handling of bogus negative read/write replies (bsc#1243077).
    - CVE-2025-37886: pds_core: make wait_context part of q_info (bsc#1242944).
    - CVE-2025-37887: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (bsc#1242962).
    - CVE-2025-37949: xenbus: Use kref to track req lifetime (bsc#1243541).
    - CVE-2025-37954: smb: client: Avoid race in open_cached_dir with lease breaks (bsc#1243664).
    - CVE-2025-37957: KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (bsc#1243513).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-37960: memblock: Accept allocated memory before use in memblock_double_array() (bsc#1243519).
    - CVE-2025-37974: s390/pci: Fix missing check for zpci_create_device() error return (bsc#1243547).
    - CVE-2025-38152: remoteproc: core: Clear table_sz when rproc_shutdown (bsc#1241627).
    - CVE-2025-38637: net_sched: skbprio: Remove overly strict queue assertions (bsc#1241657).
    - CVE-2025-39728: clk: samsung: Fix UBSAN panic in samsung_clk_init() (bsc#1241626).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02000-1 advisory.

    The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
    - CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
    - CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
    - CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN     (bsc#1234154).
    - CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
    - CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
    - CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
    - CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
    - CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
    - CVE-2025-21919: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (bsc#1240593).
    - CVE-2025-22021: netfilter: socket: Lookup orig tuple for IPv6 SNAT (bsc#1241282).
    - CVE-2025-22030: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (bsc#1241376).
    - CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
    - CVE-2025-22057: net: decrease cached dst counters in dst_release (bsc#1241533).
    - CVE-2025-22063: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (bsc#1241351).
    - CVE-2025-22070: fs/9p: fix NULL pointer dereference on mkdir (bsc#1241305).
    - CVE-2025-22103: net: fix NULL pointer dereference in l3mdev_l3_rcv (bsc#1241448).
    - CVE-2025-23140: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error     (bsc#1242763).
    - CVE-2025-23150: ext4: fix off-by-one error in do_split (bsc#1242513).
    - CVE-2025-23160: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW     initialization (bsc#1242507).
    - CVE-2025-37748: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (bsc#1242523).
    - CVE-2025-37749: net: ppp: Add bound checking for skb data on ppp_sync_txmung (bsc#1242859).
    - CVE-2025-37750: smb: client: fix UAF in decryption with multichannel (bsc#1242510).
    - CVE-2025-37755: net: libwx: handle page_pool_dev_alloc_pages error (bsc#1242506).
    - CVE-2025-37773: virtiofs: add filesystem context source name check (bsc#1242502).
    - CVE-2025-37780: isofs: Prevent the use of too small fid (bsc#1242786).
    - CVE-2025-37787: net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered     (bsc#1242585).
    - CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
    - CVE-2025-37790: net: mctp: Set SOCK_RCU_FREE (bsc#1242509).
    - CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
    - CVE-2025-37803: udmabuf: fix a buf size overflow issue during udmabuf creation (bsc#1242852).
    - CVE-2025-37804: io_uring: always do atomic put from iowq (bsc#1242854).
    - CVE-2025-37809: usb: typec: class: Unlocked on error in typec_register_partner() (bsc#1242856).
    - CVE-2025-37820: xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (bsc#1242866).
    - CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
    - CVE-2025-37824: tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (bsc#1242867).
    - CVE-2025-37829: cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (bsc#1242875).
    - CVE-2025-37830: cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (bsc#1242860).
    - CVE-2025-37831: cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (bsc#1242861).
    - CVE-2025-37833: net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (bsc#1242868).
    - CVE-2025-37842: spi: fsl-qspi: Fix double cleanup in probe error path (bsc#1242951).
    - CVE-2025-37870: drm/amd/display: prevent hang on link training fail (bsc#1243056).
    - CVE-2025-37879: 9p/net: fix improper handling of bogus negative read/write replies (bsc#1243077).
    - CVE-2025-37886: pds_core: make wait_context part of q_info (bsc#1242944).
    - CVE-2025-37887: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (bsc#1242962).
    - CVE-2025-37949: xenbus: Use kref to track req lifetime (bsc#1243541).
    - CVE-2025-37954: smb: client: Avoid race in open_cached_dir with lease breaks (bsc#1243664).
    - CVE-2025-37957: KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (bsc#1243513).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-37960: memblock: Accept allocated memory before use in memblock_double_array() (bsc#1243519).
    - CVE-2025-37974: s390/pci: Fix missing check for zpci_create_device() error return (bsc#1243547).
    - CVE-2025-38152: remoteproc: core: Clear table_sz when rproc_shutdown (bsc#1241627).
    - CVE-2025-38637: net_sched: skbprio: Remove overly strict queue assertions (bsc#1241657).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 25.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7594-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM32 architecture;

    - ARM64 architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - User-Mode Linux (UML);

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Compute Acceleration Framework;

    - ACPI drivers;

    - Serial ATA and Parallel ATA drivers;

    - Drivers core;

    - Ublk userspace block driver;

    - Bluetooth drivers;

    - Bus devices;

    - TPM device driver;

    - Clock framework and drivers;

    - CPU frequency scaling framework;

    - Buffer Sharing and Synchronization framework;

    - DMA engine subsystem;

    - GPU drivers;

    - HID subsystem;

    - HSI subsystem;

    - I2C subsystem;

    - I3C subsystem;

    - IIO subsystem;

    - InfiniBand drivers;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - MCB driver;

    - Multiple devices driver;

    - Media drivers;

    - MemoryStick subsystem;

    - Multifunction device drivers;

    - Microchip PCI driver;

    - Intel Management Engine Interface driver;

    - PCI Endpoint Test driver;

    - MTD block device drivers;

    - Network drivers;

    - Ethernet bonding driver;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - NTB driver;

    - NVME drivers;

    - PCI subsystem;

    - Synopsys DesignWare PCIe PMU;

    - Mellanox platform drivers;

    - PWM drivers;

    - Remote Processor subsystem;

    - S/390 drivers;

    - SCSI subsystem;

    - Samsung SoC drivers;

    - SPI subsystem;

    - GPIB drivers;

    - VideoCore services drivers;

    - Thermal drivers;

    - TTY drivers;

    - UFS subsystem;

    - Cadence USB3 driver;

    - ChipIdea USB driver;

    - USB Device Class drivers;

    - DesignWare USB3 driver;

    - USB Gadget drivers;

    - USB Host Controller drivers;

    - USB Type-C support driver;

    - Virtio Host (VHOST) subsystem;

    - Backlight driver;

    - Framebuffer layer;

    - W1 Dallas's 1-wire bus driver;

    - 9P distributed file system;

    - File systems infrastructure;

    - BTRFS file system;

    - Ext4 file system;

    - F2FS file system;

    - JFS file system;

    - Network file systems library;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - Overlay file system;

    - SMB network file system;

    - Ethernet bridge;

    - io_uring subsystem;

    - Perf events;

    - Memory management;

    - UProbes tracing;

    - Amateur Radio drivers;

    - SCTP protocol;

    - Network sockets;

    - RDMA verbs API;

    - BPF subsystem;

    - Kernel fork() syscall;

    - Hibernation control;

    - Scheduler infrastructure;

    - Tracing infrastructure;

    - Watch queue notification mechanism;

    - Vector I/O iterator library;

    - 802.1Q VLAN protocol;

    - 9P file system network protocol;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - Networking core;

    - Distributed Switch Architecture;

    - Ethtool driver;

    - IPv4 networking;

    - IPv6 networking;

    - MAC80211 subsystem;

    - Management Component Transport Protocol (MCTP);

    - Multipath TCP;

    - Netfilter;

    - Open vSwitch;

    - Network traffic control;

    - TIPC protocol;

    - TLS protocol;

    - Wireless networking;

    - ALSA framework;

    - WCD audio codecs;

    - SoC Audio for Freescale CPUs drivers;

    - SoC Audio generic drivers;

    - Intel ASoC drivers;

    - QCOM ASoC drivers;

    - Virtio sound driver;

    - CPU Power monitoring subsystem; (CVE-2025-37806, CVE-2025-22084, CVE-2025-39688, CVE-2025-22030,     CVE-2025-37754, CVE-2025-37783, CVE-2025-37825, CVE-2025-37752, CVE-2025-22104, CVE-2025-40014,     CVE-2025-22103, CVE-2025-37874, CVE-2025-37773, CVE-2025-37741, CVE-2025-37763, CVE-2025-37859,     CVE-2025-37779, CVE-2025-23155, CVE-2025-23143, CVE-2025-37788, CVE-2025-22028, CVE-2024-58096,     CVE-2025-37842, CVE-2025-37854, CVE-2025-38637, CVE-2024-58097, CVE-2023-53034, CVE-2025-37797,     CVE-2025-37851, CVE-2025-37941, CVE-2025-37942, CVE-2025-37748, CVE-2025-37982, CVE-2025-22058,     CVE-2025-37781, CVE-2025-23130, CVE-2025-23149, CVE-2025-23146, CVE-2025-37809, CVE-2025-37801,     CVE-2025-22080, CVE-2025-23160, CVE-2025-37823, CVE-2025-37827, CVE-2025-39755, CVE-2025-22124,     CVE-2025-22033, CVE-2025-22075, CVE-2025-37850, CVE-2025-37757, CVE-2025-22060, CVE-2025-37979,     CVE-2025-22098, CVE-2025-39989, CVE-2025-37989, CVE-2025-37790, CVE-2025-37885, CVE-2025-37875,     CVE-2025-22066, CVE-2025-37975, CVE-2025-37819, CVE-2025-37755, CVE-2025-37794, CVE-2025-23148,     CVE-2025-22067, CVE-2025-22061, CVE-2025-22109, CVE-2025-37884, CVE-2025-37852, CVE-2025-37866,     CVE-2025-37872, CVE-2025-37751, CVE-2025-23156, CVE-2025-22065, CVE-2025-37837, CVE-2025-22069,     CVE-2025-37822, CVE-2025-22128, CVE-2025-22087, CVE-2025-22023, CVE-2025-22038, CVE-2025-22096,     CVE-2025-22076, CVE-2025-22045, CVE-2025-38049, CVE-2025-37870, CVE-2025-37939, CVE-2025-37865,     CVE-2025-37860, CVE-2025-37771, CVE-2025-23144, CVE-2025-22081, CVE-2025-39778, CVE-2025-23153,     CVE-2025-22036, CVE-2025-23154, CVE-2025-22101, CVE-2025-37808, CVE-2025-37772, CVE-2025-22070,     CVE-2025-37789, CVE-2025-22025, CVE-2025-22019, CVE-2025-37868, CVE-2025-22083, CVE-2025-22095,     CVE-2025-23161, CVE-2025-22027, CVE-2025-37843, CVE-2025-37985, CVE-2025-23132, CVE-2025-22073,     CVE-2025-37940, CVE-2025-23140, CVE-2025-37828, CVE-2025-22063, CVE-2025-22053, CVE-2025-37787,     CVE-2025-23152, CVE-2025-37840, CVE-2025-22118, CVE-2025-37981, CVE-2025-22111, CVE-2025-22091,     CVE-2025-37841, CVE-2025-23142, CVE-2025-37838, CVE-2025-37775, CVE-2025-23147, CVE-2025-22022,     CVE-2025-37745, CVE-2025-37785, CVE-2025-37821, CVE-2025-37988, CVE-2025-37986, CVE-2025-23138,     CVE-2025-37836, CVE-2025-37792, CVE-2025-23141, CVE-2025-23159, CVE-2025-38240, CVE-2025-37764,     CVE-2025-22120, CVE-2025-37881, CVE-2025-37777, CVE-2025-37987, CVE-2025-37811, CVE-2025-22032,     CVE-2025-22044, CVE-2025-37943, CVE-2025-37802, CVE-2025-37829, CVE-2025-37862, CVE-2025-38575,     CVE-2025-37799, CVE-2025-37882, CVE-2025-37812, CVE-2025-37765, CVE-2025-37813, CVE-2025-37980,     CVE-2025-37873, CVE-2025-37766, CVE-2025-37761, CVE-2025-37892, CVE-2025-22094, CVE-2025-22035,     CVE-2025-22055, CVE-2025-22100, CVE-2025-37816, CVE-2025-22062, CVE-2025-22110, CVE-2025-22088,     CVE-2025-23129, CVE-2025-38479, CVE-2025-37740, CVE-2025-23136, CVE-2025-37846, CVE-2025-23163,     CVE-2025-37977, CVE-2025-37879, CVE-2025-22082, CVE-2025-22046, CVE-2025-22050, CVE-2025-22126,     CVE-2025-37796, CVE-2025-37815, CVE-2025-22127, CVE-2025-22105, CVE-2025-22068, CVE-2025-22119,     CVE-2025-22089, CVE-2025-37858, CVE-2025-37826, CVE-2025-37945, CVE-2025-23157, CVE-2025-22054,     CVE-2025-37805, CVE-2025-37856, CVE-2025-37878, CVE-2025-37768, CVE-2025-22040, CVE-2025-37944,     CVE-2025-37774, CVE-2025-22117, CVE-2025-37888, CVE-2025-37857, CVE-2025-37791, CVE-2025-37817,     CVE-2025-22041, CVE-2025-37983, CVE-2025-22039, CVE-2025-37749, CVE-2025-22097, CVE-2025-37747,     CVE-2025-37762, CVE-2025-22114, CVE-2025-37831, CVE-2025-23133, CVE-2025-22020, CVE-2025-22085,     CVE-2025-37807, CVE-2025-22059, CVE-2025-22042, CVE-2025-22123, CVE-2025-22107, CVE-2025-37759,     CVE-2024-58094, CVE-2025-40114, CVE-2025-37810, CVE-2025-37833, CVE-2025-23134, CVE-2025-23151,     CVE-2025-37743, CVE-2025-22034, CVE-2025-37739, CVE-2025-37863, CVE-2025-39735, CVE-2025-39930,     CVE-2025-37847, CVE-2025-37803, CVE-2025-37786, CVE-2025-22112, CVE-2025-37830, CVE-2025-22108,     CVE-2025-37767, CVE-2025-37814, CVE-2025-37798, CVE-2025-22086, CVE-2025-37778, CVE-2024-58093,     CVE-2025-37848, CVE-2025-22024, CVE-2025-37776, CVE-2025-38104, CVE-2025-37938, CVE-2025-37861,     CVE-2025-23150, CVE-2025-22021, CVE-2025-22018, CVE-2025-23137, CVE-2025-37756, CVE-2025-37784,     CVE-2025-37769, CVE-2025-37820, CVE-2025-37758, CVE-2025-22047, CVE-2025-37844, CVE-2025-22093,     CVE-2025-23162, CVE-2025-22051, CVE-2025-22115, CVE-2025-37845, CVE-2025-22074, CVE-2025-37883,     CVE-2025-22116, CVE-2025-37824, CVE-2025-22052, CVE-2025-22090, CVE-2025-37750, CVE-2025-39728,     CVE-2025-23145, CVE-2025-22125, CVE-2025-37834, CVE-2025-37738, CVE-2025-37760, CVE-2025-22079,     CVE-2025-37877, CVE-2025-37849, CVE-2025-22026, CVE-2025-37886, CVE-2025-22043, CVE-2025-22122,     CVE-2025-37937, CVE-2025-22071, CVE-2025-37742, CVE-2025-37744, CVE-2025-22106, CVE-2025-38152,     CVE-2025-37869, CVE-2025-23135, CVE-2025-22056, CVE-2024-58095, CVE-2025-37853, CVE-2025-37770,     CVE-2025-22031, CVE-2025-23158, CVE-2025-22072, CVE-2025-22102, CVE-2025-40325, CVE-2025-22037,     CVE-2025-37876, CVE-2025-37864, CVE-2025-37867, CVE-2025-37855, CVE-2025-37984, CVE-2025-37839,     CVE-2025-23131, CVE-2025-22121, CVE-2025-22078, CVE-2025-37800, CVE-2025-37880, CVE-2025-37925,     CVE-2025-22113, CVE-2025-22064, CVE-2025-22057, CVE-2025-22092, CVE-2025-37780, CVE-2025-37887,     CVE-2025-22099, CVE-2025-37793, CVE-2025-37978, CVE-2025-37746)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
295617	Azure Linux 3.0 Security Update: kernel (CVE-2025-37886)	Nessus	Azure Linux Local Security Checks	medium
276115	TencentOS Server 4: kernel (TSSA-2025:0438)	Nessus	Tencent Local Security Checks	critical
275178	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2025-25757)	Nessus	Oracle Linux Local Security Checks	high
252244	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20530)	Nessus	Oracle Linux Local Security Checks	medium
245787	Linux Distros Unpatched Vulnerability : CVE-2025-37886	Nessus	Misc.	medium
242347	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20480)	Nessus	Oracle Linux Local Security Checks	medium
240824	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:01965-1)	Nessus	SuSE Local Security Checks	medium
240815	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:01972-1)	Nessus	SuSE Local Security Checks	medium
240805	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2025:01951-1)	Nessus	SuSE Local Security Checks	medium
240801	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:01967-1)	Nessus	SuSE Local Security Checks	medium
240781	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:01964-1)	Nessus	SuSE Local Security Checks	medium
240769	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:01919-1)	Nessus	SuSE Local Security Checks	medium
240762	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:02000-1)	Nessus	SuSE Local Security Checks	medium
240657	Ubuntu 25.04 : Linux kernel vulnerabilities (USN-7594-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2025-37886

medium

Tenable Plugins

medium

critical

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high