In the Linux kernel, the following vulnerability has been resolved: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() Honour the user given buffer size for the strn_len() calls (otherwise strn_len() will access memory outside of the user given buffer).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: pktgen: fix access outside of user given buffer in pktgen_thread_write() Honour the user given buffer     size for the strn_len() calls (otherwise strn_len() will access memory outside of the user given buffer).
    (CVE-2025-38061)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20480 advisory.

    - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38178286]     {CVE-2025-38089}
    - Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
    - x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38023239]     {CVE-2024-36350} {CVE-2024-36357}
    - Add normal counters (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
    - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38023239]     {CVE-2024-36350} {CVE-2024-36357}
    - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38023239]     {CVE-2024-36350} {CVE-2024-36357}
    - x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38023239]     {CVE-2024-36350} {CVE-2024-36357}
    - block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
    - f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
    - gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
    - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug:
    38049363] {CVE-2025-38001}
    - smb: client: Fix use-after-free in cifs_fill_dirent (Zhaolong Wang) [Orabug: 38094970] {CVE-2025-38051}
    - platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() (Vladimir Moskovkin)     [Orabug: 38095141] {CVE-2025-38077}
    - ALSA: pcm: Fix race of buffer access at PCM OSS layer (Takashi Iwai) [Orabug: 38095145] {CVE-2025-38078}
    - can: bcm: add missing rcu read protection for procfs content (Oliver Hartkopp) [Orabug: 38049369]     {CVE-2025-38003}
    - can: bcm: add locking for bcm_op runtime updates (Oliver Hartkopp) [Orabug: 38049374] {CVE-2025-38004}
    - padata: do not leak refcount in reorder_work (Dominik Grzegorzek) [Orabug: 38094842] {CVE-2025-38031}
    - crypto: algif_hash - fix double free in hash_accept (Ivan Pravdin) [Orabug: 38095153] {CVE-2025-38079}
    - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (Wang Liang) [Orabug: 38094978]     {CVE-2025-38052}
    - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Cong Wang) [Orabug: 38049357]     {CVE-2025-38000}
    - idpf: fix null-ptr-deref in idpf_features_check (Pavan Kumar Linga) [Orabug: 38094982] {CVE-2025-38053}
    - ptp: ocp: Limit signal/freq counts in summary output functions (Sagi Maimon) [Orabug: 38094984]     {CVE-2025-38054}
    - perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq (Adrian Hunter) [Orabug: 38094988]     {CVE-2025-38055}
    - ASoC: SOF: Intel: hda: Fix UAF when reloading module (Tavian Barnes) [Orabug: 38094991] {CVE-2025-38056}
    - espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094993] {CVE-2025-38057}
    - __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (Al Viro) [Orabug: 38095000]     {CVE-2025-38058}
    - x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88 (Pawel Anikiel) [Orabug: 38094847]     {CVE-2025-38033}
    - btrfs: avoid NULL pointer dereference if no valid csum tree (Qu Wenruo) [Orabug: 38095010]     {CVE-2025-38059}
    - btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (Goldwyn Rodrigues) [Orabug:
    38094856] {CVE-2025-38034}
    - nvmet-tcp: don't restore null sk_state_change (Alistair Francis) [Orabug: 38094863] {CVE-2025-38035}
    - vxlan: Annotate FDB data races (Ido Schimmel) [Orabug: 38094879] {CVE-2025-38037}
    - cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (Dhananjay Ugwekar) [Orabug: 38094888]     {CVE-2025-38038}
    - drm/amd/display: Increase block_sequence array size (Joshua Aberback) [Orabug: 38095164]     {CVE-2025-38080}
    - bpf: copy_verifier_state() should copy 'loop_entry' field (Eduard Zingerman) [Orabug: 38095018]     {CVE-2025-38060}
    - serial: mctrl_gpio: split disable_ms into sync and no_sync APIs (Alexis Lothore) [Orabug: 38094901]     {CVE-2025-38040}
    - net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (Peter Seiderer) [Orabug:
    38095024] {CVE-2025-38061}
    - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie (Jason Gunthorpe) [Orabug:
    38095031] {CVE-2025-38062}
    - dm: fix unconditional IO throttle caused by REQ_PREFLUSH (Jinliang Zheng) [Orabug: 38095038]     {CVE-2025-38063}
    - firmware: arm_ffa: Set dma_mask for ffa devices (Viresh Kumar) [Orabug: 38094925] {CVE-2025-38043}
    - media: cx231xx: set device_caps for 417 (Hans Verkuil) [Orabug: 38094934] {CVE-2025-38044}
    - orangefs: Do not truncate file size (Matthew Wilcox) [Orabug: 38095056] {CVE-2025-38065}
    - dm cache: prevent BUG_ON by blocking retries on failed device resumes (Ming-Hung Tsai) [Orabug:
    38095063] {CVE-2025-38066}
    - crypto: lzo - Fix compression buffer overrun (Herbert Xu) [Orabug: 38095079] {CVE-2025-38068}
    - PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops (Christian Bruel) [Orabug:
    38095087] {CVE-2025-38069}
    - wifi: iwlwifi: fix debug actions order (Johannes Berg) [Orabug: 38094942] {CVE-2025-38045}
    - x86/mm: Check return value from memblock_phys_alloc_range() (Philip Redkin) [Orabug: 38095101]     {CVE-2025-38071}
    - libnvdimm/labels: Fix divide error in nd_label_data_init() (Robert Richter) [Orabug: 38095109]     {CVE-2025-38072}
    - spi-rockchip: Fix register out of bounds access (Luis de Arquer) [Orabug: 38095173] {CVE-2025-38081}
    - x86/fred: Fix system hang during S4 resume with FRED enabled (Xin Li) [Orabug: 38094951]     {CVE-2025-38047}
    - block: fix race between set_blocksize and read paths (Darrick J. Wong) [Orabug: 38095117]     {CVE-2025-38073}
    - virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN (Zhongqiu Han) [Orabug:
    38094958] {CVE-2025-38048}
    - scsi: target: iscsi: Fix timeout on deleted connection (Dmitry Bogdanov) [Orabug: 38095134]     {CVE-2025-38075}
    - usb: typec: ucsi: displayport: Fix deadlock (Andrei Kuchynski) [Orabug: 37977018] {CVE-2025-37967}
    - Bluetooth: btnxpuart: Fix kernel panic during FW release (Neeraj Sanjay Kale) [Orabug: 37844459]     {CVE-2025-22102}
    - iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977026]     {CVE-2025-37968}
    - mm/page_alloc: fix race condition in unaccepted memory handling (Kirill A. Shutemov) [Orabug: 38094767]     {CVE-2025-38008}
    - dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (Shuai Xue) [Orabug: 38094790]     {CVE-2025-38014}
    - dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094793]     {CVE-2025-38015}
    - dmaengine: ti: k3-udma: Add missing locking (Ronald Wahl) [Orabug: 38094756] {CVE-2025-38005}
    - wifi: mt76: disable napi on driver removal (Fedor Pchelkin) [Orabug: 38094770] {CVE-2025-38009}
    - phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking (Wayne Chang) [Orabug: 38094777]     {CVE-2025-38010}
    - drm/amdgpu: csa unmap use uninterruptible lock (Philip Yang) [Orabug: 38094779] {CVE-2025-38011}
    - HID: bpf: abort dispatch if device destroyed (Rongrong) [Orabug: 38094796] {CVE-2025-38016}
    - sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator (Tejun Heo) [Orabug: 38094786]     {CVE-2025-38012}
    - net/tls: fix kernel panic when alloc_page failed (Pengtao He) [Orabug: 38094802] {CVE-2025-38018}
    - mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (Ido Schimmel) [Orabug:
    38094804] {CVE-2025-38019}
    - wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request (Kees Cook) [Orabug:
    38094788] {CVE-2025-38013}
    - regulator: max20086: fix invalid memory access (Cosmin Tanislav) [Orabug: 38094833] {CVE-2025-38027}
    - net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094808]     {CVE-2025-38020}
    - net_sched: Flush gso_skb list too during ->change() (Cong Wang) [Orabug: 37998128] {CVE-2025-37992}
    - RDMA/core: Fix 'KASAN: slab-use-after-free Read in ib_register_device' problem (Zhu Yanjun) [Orabug:
    38094813] {CVE-2025-38022}
    - nfs: handle failure of nfs_get_lock_context in unlock path (Li Lingfeng) [Orabug: 38094818]     {CVE-2025-38023}
    - HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 38094764]     {CVE-2025-38007}
    - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (Zhu Yanjun) [Orabug: 38094827]     {CVE-2025-38024}
    - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977004]     {CVE-2025-37963}
    - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976926]     {CVE-2025-37948}
    - usb: typec: ucsi: displayport: Fix NULL pointer access (Andrei Kuchynski) [Orabug: 38015126]     {CVE-2025-37994}
    - module: ensure that kobject_put() is safe for module type kobjects (Dmitry Antipov) [Orabug: 38015131]     {CVE-2025-37995}
    - memblock: Accept allocated memory before use in memblock_double_array() (Tom Lendacky) [Orabug:
    37976994] {CVE-2025-37960}
    - xenbus: Use kref to track req lifetime (Jason Andryuk) [Orabug: 37976934] {CVE-2025-37949}
    - smb: client: Avoid race in open_cached_dir with lease breaks (Paul Aurich) [Orabug: 37976959]     {CVE-2025-37954}
    - drm/amd/display: Fix invalid context error in dml helper (Roman Li) [Orabug: 37977185] {CVE-2025-37965}
    - drm/v3d: Add job to pending list if the reset was skipped (Maira Canal) [Orabug: 37976942]     {CVE-2025-37951}
    - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo (Silvano Seva) [Orabug:
    37977031] {CVE-2025-37969}
    - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (Silvano Seva) [Orabug: 37977037]     {CVE-2025-37970}
    - KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (Mikhail Lobanov) [Orabug: 37976977]     {CVE-2025-37957}
    - mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976982]     {CVE-2025-37958}
    - x86/mm: Eliminate window where TLB flushes may be inadvertently skipped (Dave Hansen) [Orabug: 37977013]     {CVE-2025-37964}
    - staging: bcm2835-camera: Initialise dev in v4l2_dev (Dave Stevenson) [Orabug: 37977042] {CVE-2025-37971}
    - Input: mtk-pmic-keys - fix possible null pointer dereference (Gary Bisson) [Orabug: 37977044]     {CVE-2025-37972}
    - bpf: Scrub packet on bpf_redirect_peer (Paul Chaignon) [Orabug: 37976990] {CVE-2025-37959}
    - netfilter: ipset: fix region locking in hash types (Jozsef Kadlecsik) [Orabug: 38015141]     {CVE-2025-37997}
    - ipvs: fix uninit-value for saddr in do_output_route4 (Julian Anastasov) [Orabug: 37976996]     {CVE-2025-37961}
    - can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe (Antonios Salios) [Orabug:
    38015123] {CVE-2025-37993}
    - virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() (Jakub Kicinski) [Orabug: 37976969]     {CVE-2025-37955}
    - sch_htb: make htb_deactivate() idempotent (Cong Wang) [Orabug: 37977176] {CVE-2025-37953}
    - ksmbd: fix memory leak in parse_lease_state() (Zhaolong Wang) [Orabug: 37977180] {CVE-2025-37962}
    - openvswitch: Fix unsafe attribute parsing in output_userspace() (Eelco Chaudron) [Orabug: 38015148]     {CVE-2025-37998}
    - ksmbd: Fix UAF in __close_file_table_ids (Sean Heelan) [Orabug: 37976951] {CVE-2025-37952}
    - ksmbd: prevent out-of-bounds stream writes by validating *pos (Norbert Szetei) [Orabug: 37976923]     {CVE-2025-37947}
    - ksmbd: prevent rename with empty string (Namjae Jeon) [Orabug: 37976972] {CVE-2025-37956}
    - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Niklas Schnelle) [Orabug:
    37976920] {CVE-2025-37946}
    - wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation (Veerendranath     Jakkam) [Orabug: 37977046] {CVE-2025-37973}
    - s390/pci: Fix missing check for zpci_create_device() error return (Niklas Schnelle) [Orabug: 37977050]     {CVE-2025-37974}
    - fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() (Max Kellermann) [Orabug:
    38015155] {CVE-2025-37999}
    - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (David Thompson) [Orabug:
    37964051,38037120] {CVE-2025-37866}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02334-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-47212: net/mlx5: Update error handler for UCTX and UMEM (bsc#1222709).
    - CVE-2021-47455: ptp: Fix possible memory leak in ptp_clock_register() (bsc#1225254).
    - CVE-2021-47527: serial: core: fix transmit-buffer reset and memleak (bsc#1227768).
    - CVE-2022-21546: scsi: target: Fix WRITE_SAME No Data Buffer crash (bsc#1242243).
    - CVE-2022-49154: KVM: SVM: fix panic on out-of-bounds guest IRQ (bsc#1238167).
    - CVE-2022-49622: netfilter: nf_tables: fix crash when nf_trace is enabled (bsc#1239042).
    - CVE-2022-49731: ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (bsc#1239071).
    - CVE-2022-49764: kABI: workaround 'bpf: Prevent bpf program recursion for raw tracepoint probes' changes     (bsc#1242301).
    - CVE-2022-49780: scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()     (bsc#1242262).
    - CVE-2022-49814: kcm: close race conditions on sk_receive_queue (bsc#1242498).
    - CVE-2022-49879: ext4: fix BUG_ON() when directory entry has invalid rec_len (bsc#1242733).
    - CVE-2022-49881: wifi: cfg80211: fix memory leak in query_regdb_file() (bsc#1242481).
    - CVE-2022-49917: ipvs: fix WARNING in ip_vs_app_net_cleanup() (bsc#1242406).
    - CVE-2022-49921: net: sched: Fix use after free in red_enqueue() (bsc#1242359).
    - CVE-2022-50055: iavf: Fix adminq error handling (bsc#1245039).
    - CVE-2022-50087: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (bsc#1245119).
    - CVE-2022-50134: RDMA/hfi1: fix potential memory leak in setup_base_ctxt() (bsc#1244802).
    - CVE-2022-50200: selinux: Add boundary check in put_entry() (bsc#1245149).
    - CVE-2023-52500: Fixed information leaking when processing OPC_INB_SET_CONTROLLER_CONFIG command     (bsc#1220883).
    - CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
    - CVE-2023-53020: l2tp: fix lockdep splat (bsc#1240224).
    - CVE-2023-53090: drm/amdkfd: Fix an illegal memory access (bsc#1242753).
    - CVE-2023-53091: ext4: update s_journal_inum if it changes after journal replay (bsc#1242767).
    - CVE-2023-53133: bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()     (bsc#1242423).
    - CVE-2024-26586: mlxsw: spectrum_acl_tcam: Fix stack corruption (bsc#1220243).
    - CVE-2024-26825: nfc: nci: free rx_data_reassembly skb on NCI device cleanup (bsc#1223065).
    - CVE-2024-26872: RDMA/srpt: Do not register event handler until srpt device is fully setup (bsc#1223115).
    - CVE-2024-26875: media: pvrusb2: fix uaf in pvr2_context_set_notify (bsc#1223118).
    - CVE-2024-35790: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device     attribute group (bsc#1224712).
    - CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info     (bsc#1224726).
    - CVE-2024-38588: ftrace: Fix possible use-after-free issue in ftrace_location() (bsc#1226837).
    - CVE-2024-57982: xfrm: state: fix out-of-bounds read during lookup (bsc#1237913).
    - CVE-2025-21898: ftrace: Avoid potential division by zero in function_stat_show() (bsc#1240610).
    - CVE-2025-21920: vlan: enforce underlying device type (bsc#1240686).
    - CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1240799).
    - CVE-2025-22035: tracing: Fix use-after-free in print_graph_function_flags during tracer switching     (bsc#1241544).
    - CVE-2025-23149: tpm: do not start chip while suspended (bsc#1242758).
    - CVE-2025-37756: net: tls: explicitly disallow disconnect (bsc#1242515).
    - CVE-2025-37757: tipc: fix memory leak in tipc_link_xmit (bsc#1242521).
    - CVE-2025-37781: i2c: cros-ec-tunnel: defer probe if parent EC is not present (bsc#1242575).
    - CVE-2025-37800: driver core: fix potential NULL pointer dereference in dev_uevent() (bsc#1242849).
    - CVE-2025-37810: usb: dwc3: gadget: check that event count does not exceed event buffer length     (bsc#1242906).
    - CVE-2025-37836: PCI: Fix reference leak in pci_register_host_bridge() (bsc#1242957).
    - CVE-2025-37844: cifs: avoid NULL pointer dereference in dbg call (bsc#1242946).
    - CVE-2025-37862: HID: pidff: Fix null pointer dereference in pidff_find_fields (bsc#1242982).
    - CVE-2025-37892: mtd: inftlcore: Add error check for inftl_read_oob() (bsc#1243536).
    - CVE-2025-37911: bnxt_en: Fix out-of-bound memcpy() during ethtool -w (bsc#1243469).
    - CVE-2025-37923: tracing: Fix oob write in trace_seq_to_buffer() (bsc#1243551).
    - CVE-2025-37927: iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (bsc#1243620).
    - CVE-2025-37928: dm-bufio: do not schedule in atomic context (bsc#1243621).
    - CVE-2025-37961: ipvs: fix uninit-value for saddr in do_output_route4 (bsc#1243523).
    - CVE-2025-37980: block: fix resource leak in blk_register_queue() error path (bsc#1243522).
    - CVE-2025-37982: wifi: wl1251: fix memory leak in wl1251_tx_work (bsc#1243524).
    - CVE-2025-37992: net_sched: Flush gso_skb list too during ->change() (bsc#1243698).
    - CVE-2025-37995: module: ensure that kobject_put() is safe for module type kobjects (bsc#1243827).
    - CVE-2025-37998: openvswitch: Fix unsafe attribute parsing in output_userspace() (bsc#1243836).
    - CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
    - CVE-2025-38004: can: bcm: add locking for bcm_op runtime updates (bsc#1244274).
    - CVE-2025-38023: nfs: handle failure of nfs_get_lock_context in unlock path (bsc#1245004).
    - CVE-2025-38024: RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (bsc#1245025).
    - CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write()     (bsc#1245440).
    - CVE-2025-38072: libnvdimm/labels: Fix divide error in nd_label_data_init() (bsc#1244743).
    - CVE-2025-38078: ALSA: pcm: Fix race of buffer access at PCM OSS layer (bsc#1244737).
    - CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.294-212.419. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2025-103 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: Fix WRITE_SAME No Data Buffer crash

    In newer version of the SBC specs, we have a NDOB bit that indicates thereis no data buffer that gets     written out. If this bit is set using commandslike sg_write_same --ndob we will crash in     target_core_iblock/file'sexecute_write_same handlers when we go to access the se_cmd->t_data_sgbecause its     NULL.

    This patch adds a check for the NDOB bit in the common WRITE SAME codebecause we don't support it. And, it     adds a check for zero SG elements ineach handler in case the initiator tries to send a normal WRITE SAME     withno data buffer. (CVE-2022-21546)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/khugepaged: fix ->anon_vma race (CVE-2023-52935)

    In the Linux kernel, the following vulnerability has been resolved:

    of: module: add buffer overflow check in of_modalias() (CVE-2024-38541)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (CVE-2025-37819)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CVE-2025-37890)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: qfq: Fix double list add in class with netem as child qdisc (CVE-2025-37913)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: drr: Fix double list add in class with netem as child qdisc (CVE-2025-37915)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix oob write in trace_seq_to_buffer() (CVE-2025-37923)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (CVE-2025-37927)

    In the Linux kernel, the following vulnerability has been resolved:

    sch_htb: make htb_qlen_notify() idempotent (CVE-2025-37932)

    In the Linux kernel, the following vulnerability has been resolved:

    xenbus: Use kref to track req lifetime (CVE-2025-37949)

    In the Linux kernel, the following vulnerability has been resolved:

    module: ensure that kobject_put() is safe for module type kobjects (CVE-2025-37995)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: fix region locking in hash types (CVE-2025-37997)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: Fix unsafe attribute parsing in output_userspace() (CVE-2025-37998)

    In the Linux kernel, the following vulnerability has been resolved:

    sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (CVE-2025-38000)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (CVE-2025-38001)

    In the Linux kernel, the following vulnerability has been resolved:

    can: bcm: add missing rcu read protection for procfs content (CVE-2025-38003)

    In the Linux kernel, the following vulnerability has been resolved:

    can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)

    In the Linux kernel, the following vulnerability has been resolved:

    nfs: handle failure of nfs_get_lock_context in unlock path (CVE-2025-38023)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (CVE-2025-38034)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: Annotate FDB data races (CVE-2025-38037)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: Fix use-after-free in cifs_fill_dirent (CVE-2025-38051)

    In the Linux kernel, the following vulnerability has been resolved:

    __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (CVE-2025-38058)

    In the Linux kernel, the following vulnerability has been resolved:

    net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (CVE-2025-38061)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache: prevent BUG_ON by blocking retries on failed device resumes (CVE-2025-38066)

    In the Linux kernel, the following vulnerability has been resolved:

    libnvdimm/labels: Fix divide error in nd_label_data_init() (CVE-2025-38072)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix timeout on deleted connection (CVE-2025-38075)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: algif_hash - fix double free in hash_accept (CVE-2025-38079)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.238-231.953. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-095 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: act_mirred: don't override retval if we already lost the skb (CVE-2024-26739)

    In the Linux kernel, the following vulnerability has been resolved:

    of: module: add buffer overflow check in of_modalias() (CVE-2024-38541)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info() (CVE-2024-46751)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix helper writes to read-only maps (CVE-2024-49861)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (CVE-2025-37819)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CVE-2025-37890)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: qfq: Fix double list add in class with netem as child qdisc (CVE-2025-37913)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: drr: Fix double list add in class with netem as child qdisc (CVE-2025-37915)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix oob write in trace_seq_to_buffer() (CVE-2025-37923)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (CVE-2025-37927)

    In the Linux kernel, the following vulnerability has been resolved:

    xenbus: Use kref to track req lifetime (CVE-2025-37949)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: Flush gso_skb list too during ->change() (CVE-2025-37992)

    In the Linux kernel, the following vulnerability has been resolved:

    module: ensure that kobject_put() is safe for module type kobjects (CVE-2025-37995)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: fix region locking in hash types (CVE-2025-37997)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: Fix unsafe attribute parsing in output_userspace() (CVE-2025-37998)

    In the Linux kernel, the following vulnerability has been resolved:

    sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (CVE-2025-38000)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (CVE-2025-38001)

    In the Linux kernel, the following vulnerability has been resolved:

    can: bcm: add missing rcu read protection for procfs content (CVE-2025-38003)

    In the Linux kernel, the following vulnerability has been resolved:

    can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)

    In the Linux kernel, the following vulnerability has been resolved:

    nfs: handle failure of nfs_get_lock_context in unlock path (CVE-2025-38023)

    In the Linux kernel, the following vulnerability has been resolved:

    padata: do not leak refcount in reorder_work (CVE-2025-38031)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (CVE-2025-38034)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: Annotate FDB data races (CVE-2025-38037)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: Fix use-after-free in cifs_fill_dirent (CVE-2025-38051)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CVE-2025-38052)

    In the Linux kernel, the following vulnerability has been resolved:

    __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (CVE-2025-38058)

    In the Linux kernel, the following vulnerability has been resolved:

    net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (CVE-2025-38061)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache: prevent BUG_ON by blocking retries on failed device resumes (CVE-2025-38066)

    In the Linux kernel, the following vulnerability has been resolved:

    libnvdimm/labels: Fix divide error in nd_label_data_init() (CVE-2025-38072)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix timeout on deleted connection (CVE-2025-38075)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: algif_hash - fix double free in hash_accept (CVE-2025-38079)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
244857	Linux Distros Unpatched Vulnerability : CVE-2025-38061	Nessus	Misc.	high
242347	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20480)	Nessus	Oracle Linux Local Security Checks	medium
242218	SUSE SLES12 Security Update : kernel (SUSE-SU-2025:02334-1)	Nessus	SuSE Local Security Checks	critical
240323	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2025-103)	Nessus	Amazon Linux Local Security Checks	critical
240309	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2025-095)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2025-38061

medium

Tenable Plugins

high

medium

critical

critical

high