In the Linux kernel, the following vulnerability has been resolved: net: ch9200: fix uninitialised access during mii_nway_restart In mii_nway_restart() the code attempts to call mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read() utilises a local buffer called "buff", which is initialised with control_read(). However "buff" is conditionally initialised inside control_read(): if (err == size) { memcpy(data, buf, size); } If the condition of "err == size" is not met, then "buff" remains uninitialised. Once this happens the uninitialised "buff" is accessed and returned during ch9200_mdio_read(): return (buff[0] | buff[1] << 8); The problem stems from the fact that ch9200_mdio_read() ignores the return value of control_read(), leading to uinit-access of "buff". To fix this we should check the return value of control_read() and return early on error.

redhat RHSA-2025:13633: RHSA-2025:13633: kernel-rt security update (Moderate)

oracle_linux ELSA-2025-12662: ELSA-2025-12662:  kernel security update (IMPORTANT)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: ch9200: fix uninitialised access during mii_nway_restart In mii_nway_restart() the code attempts to     call mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read() utilises a local buffer called buff,     which is initialised with control_read(). However buff is conditionally initialised inside     control_read(): if (err == size) { memcpy(data, buf, size); } If the condition of err == size is not     met, then buff remains uninitialised. Once this happens the uninitialised buff is accessed and     returned during ch9200_mdio_read(): return (buff[0] | buff[1] << 8); The problem stems from the fact that     ch9200_mdio_read() ignores the return value of control_read(), leading to uinit-access of buff. To fix     this we should check the return value of control_read() and return early on error. (CVE-2025-38086)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:11455 advisory.

    * kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)
      * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:12662 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

    * kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CVE-2025-21928)

    * kernel: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() (CVE-2025-21929)

    * kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CVE-2025-22020)

    * kernel: ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113)

    * kernel: RDMA/core: Fix use-after-free when rename device name (CVE-2025-22085)

    * kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CVE-2025-37890)

    * kernel: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CVE-2025-38052)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    * kernel: net/sched: fix use-after-free in taprio_dev_notifier (CVE-2025-38087)

    * kernel: nvme-tcp: sanitize request list handling (CVE-2025-38264)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.239-236.958. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-098 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: flowtable: fix stuck flows on cleanup due to pending work (CVE-2022-50000)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_socket: fix sk refcount leaks (CVE-2024-46855)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: hugetlb: independent PMD page table shared count (CVE-2024-57883)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: sch_sfq: don't allow 1 packet limit (CVE-2024-57996)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (CVE-2025-37963)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: prio: fix a race in prio_tune() (CVE-2025-38083)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/hugetlb: unshare page tables during VMA split, not before (CVE-2025-38084)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/iopl: Cure TIF_IO_BITMAP inconsistencies (CVE-2025-38100)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: ets: fix a race in ets_qdisc_change() (CVE-2025-38107)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: red: fix a race in __red_change() (CVE-2025-38108)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mdiobus: Fix potential out-of-bounds read/write access (CVE-2025-38111)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Fix TOCTOU issue in sk_is_readable() (CVE-2025-38112)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: sch_sfq: fix a potential crash on gso_skb handling (CVE-2025-38115)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: Fix the dead loop of MPLS parse (CVE-2025-38146)

    In the Linux kernel, the following vulnerability has been resolved:

    calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (CVE-2025-38161)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: fix double free in delayed_free (CVE-2025-38206)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (CVE-2025-38231)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix WARN() in get_bpf_raw_tp_regs (CVE-2025-38285)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (CVE-2025-38312)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (CVE-2025-38320)

    In the Linux kernel, the following vulnerability has been resolved:

    mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (CVE-2025-38324)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:11861 advisory.

    * kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980)
      * kernel: wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905)
      * kernel: RDMA/mlx5: Fix page_size variable overflow (CVE-2025-22091)
      * kernel: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CVE-2025-22121)
      * kernel: ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113)
      * kernel: RDMA/core: Fix use-after-free when rename device name (CVE-2025-22085)
      * kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)
      * kernel: mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958)
      * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)
      * kernel: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CVE-2025-38110)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:11456 advisory.

    * kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:11455 advisory.

    * kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-11861 advisory.

    - net_sched: hfsc: Fix a UAF vulnerability in class handling (Davide Caratti) [RHEL-95853]     {CVE-2025-37797}
    - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CKI Backport Bot) [RHEL-93555]     {CVE-2025-22121}
    - ext4: introduce ITAIL helper (CKI Backport Bot) [RHEL-93555] {CVE-2025-22121}
    - ext4: avoid journaling sb update on error if journal is destroying (Brian Foster) [RHEL-93591]     {CVE-2025-22113}
    - net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CKI Backport Bot) [RHEL-102093]     {CVE-2025-38110}
    - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101212]     {CVE-2025-38086}
    - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98795] {CVE-2024-57980}
    - RDMA/mlx5: Fix page_size variable overflow (CKI Backport Bot) [RHEL-99320] {CVE-2025-22091}
    - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99384] {CVE-2025-21905}
    - RDMA/core: Fix use-after-free when rename device name (CKI Backport Bot) [RHEL-99048] {CVE-2025-22085}
    - mm/huge_memory: fix dereferencing invalid pmd migration entry (Rafael Aquini) [RHEL-96368]     {CVE-2025-37958}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:11861 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980)

    * kernel: wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905)

    * kernel: RDMA/mlx5: Fix page_size variable overflow (CVE-2025-22091)

    * kernel: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CVE-2025-22121)

    * kernel: ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113)

    * kernel: RDMA/core: Fix use-after-free when rename device name (CVE-2025-22085)

    * kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)

    * kernel: mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    * kernel: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CVE-2025-38110)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:11456 advisory.

    * kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)
      * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-11455 advisory.

    - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324]     {CVE-2024-50154}
    - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200]     {CVE-2025-38086}
    - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:11456 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:11455 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.295-216.421. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2025-104 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Fix ia_size underflow (CVE-2022-48828)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_socket: fix sk refcount leaks (CVE-2024-46855)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix geneve_opt length integer overflow (CVE-2025-22055)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: prio: fix a race in prio_tune() (CVE-2025-38083)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: red: fix a race in __red_change() (CVE-2025-38108)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: sch_sfq: fix a potential crash on gso_skb handling (CVE-2025-38115)

    In the Linux kernel, the following vulnerability has been resolved:

    calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix WARN() in get_bpf_raw_tp_regs (CVE-2025-38285)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (CVE-2025-38312)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (CVE-2025-38320)

    In the Linux kernel, the following vulnerability has been resolved:

    mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (CVE-2025-38324)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
245033	Linux Distros Unpatched Vulnerability : CVE-2025-38086	Nessus	Misc.	high
244047	AlmaLinux 8 : kernel (ALSA-2025:11455)	Nessus	Alma Linux Local Security Checks	high
243457	RHEL 10 : kernel (RHSA-2025:12662)	Nessus	Red Hat Local Security Checks	high
243421	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2025-098)	Nessus	Amazon Linux Local Security Checks	medium
243289	AlmaLinux 9 : kernel (ALSA-2025:11861)	Nessus	Alma Linux Local Security Checks	high
243118	RockyLinux 8 : kernel-rt (RLSA-2025:11456)	Nessus	Rocky Linux Local Security Checks	high
243097	RockyLinux 8 : kernel (RLSA-2025:11455)	Nessus	Rocky Linux Local Security Checks	high
243007	Oracle Linux 9 : kernel (ELSA-2025-11861)	Nessus	Oracle Linux Local Security Checks	high
242907	RHEL 9 : kernel (RHSA-2025:11861)	Nessus	Red Hat Local Security Checks	high
242621	AlmaLinux 8 : kernel-rt (ALSA-2025:11456)	Nessus	Alma Linux Local Security Checks	high
242550	Oracle Linux 8 : kernel (ELSA-2025-11455)	Nessus	Oracle Linux Local Security Checks	high
242437	RHEL 8 : kernel-rt (RHSA-2025:11456)	Nessus	Red Hat Local Security Checks	high
242432	RHEL 8 : kernel (RHSA-2025:11455)	Nessus	Red Hat Local Security Checks	high
241743	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2025-104)	Nessus	Amazon Linux Local Security Checks	medium

Detections

Analytics

CVE-2025-38086

high

Tenable Plugins

Coming Soon

high

high

high

medium

high

high

high

high

high

high

high

high

high

medium