In the Linux kernel, the following vulnerability has been resolved: net: ch9200: fix uninitialised access during mii_nway_restart In mii_nway_restart() the code attempts to call mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read() utilises a local buffer called "buff", which is initialised with control_read(). However "buff" is conditionally initialised inside control_read(): if (err == size) { memcpy(data, buf, size); } If the condition of "err == size" is not met, then "buff" remains uninitialised. Once this happens the uninitialised "buff" is accessed and returned during ch9200_mdio_read(): return (buff[0] | buff[1] << 8); The problem stems from the fact that ch9200_mdio_read() ignores the return value of control_read(), leading to uinit-access of "buff". To fix this we should check the return value of control_read() and return early on error.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14418 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CVE-2025-21919)

    * kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CVE-2025-22020)

    * kernel: ext4: avoid resizing to a partial cluster size (CVE-2022-50020)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    * kernel: i2c/designware: Fix an initialization issue (CVE-2025-38380)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14136 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980)

    * kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CVE-2025-21928)

    * kernel: can: peak_usb: fix use after free bugs (CVE-2021-47670)

    * kernel: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CVE-2022-49788)

    * kernel: ext4: avoid resizing to a partial cluster size (CVE-2022-50020)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.355-280.672. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2968 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    dma-buf/dma-resv: check if the new fence is really later (CVE-2022-49935)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Add cond_resched() to ftrace_graph_set_hash() (CVE-2025-37940)

    In the Linux kernel, the following vulnerability has been resolved:

    net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (CVE-2025-38061)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (CVE-2025-38161)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14094 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

    * kernel: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CVE-2025-21991)

    * kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CVE-2025-22020)

    * kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)

    * kernel: selinux: Add boundary check in put_entry() (CVE-2022-50200)

    * kernel: ext4: avoid resizing to a partial cluster size (CVE-2022-50020)

    * kernel: drivers:md:fix a potential use-after-free bug (CVE-2022-50022)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14054 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

    * kernel: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CVE-2025-21991)

    * kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CVE-2025-22020)

    * kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)

    * kernel: selinux: Add boundary check in put_entry() (CVE-2022-50200)

    * kernel: ext4: avoid resizing to a partial cluster size (CVE-2022-50020)

    * kernel: drivers:md:fix a potential use-after-free bug (CVE-2022-50022)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    * kernel: i2c/designware: Fix an initialization issue (CVE-2025-38380)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:13946 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: quota: Fix potential NULL pointer dereference (CVE-2024-26878)

    * kernel: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor     (CVE-2024-41035)

    * kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CVE-2025-22020)

    * kernel: nfsd: don't ignore the return code of svc_proc_register() (CVE-2025-22026)

    * kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:13805 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ext4: fix off-by-one error in do_split (CVE-2025-23150)

    * kernel: ext4: avoid resizing to a partial cluster size (CVE-2022-50020)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:13776 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: media: uvcvideo: Remove dangling pointers (CVE-2024-58002)

    * kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

    * kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980)

    * kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CVE-2025-21928)

    * kernel: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CVE-2025-21919)

    * kernel: ext4: fix off-by-one error in do_split (CVE-2025-23150)

    * kernel: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CVE-2022-49788)

    * kernel: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CVE-2025-38052)

    * kernel: ext4: avoid resizing to a partial cluster size (CVE-2022-50020)

    * kernel: drivers:md:fix a potential use-after-free bug (CVE-2022-50022)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    * kernel: i2c/designware: Fix an initialization issue (CVE-2025-38380)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5973 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5973-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     August 12, 2025                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2024-36350 CVE-2024-36357 CVE-2024-36913 CVE-2024-41013                      CVE-2024-56758 CVE-2024-57883 CVE-2025-21816 CVE-2025-22119                      CVE-2025-27558 CVE-2025-37958 CVE-2025-38000 CVE-2025-38001                      CVE-2025-38003 CVE-2025-38004 CVE-2025-38031 CVE-2025-38034                      CVE-2025-38035 CVE-2025-38037 CVE-2025-38040 CVE-2025-38043                      CVE-2025-38044 CVE-2025-38048 CVE-2025-38051 CVE-2025-38052                      CVE-2025-38058 CVE-2025-38061 CVE-2025-38062 CVE-2025-38063                      CVE-2025-38065 CVE-2025-38066 CVE-2025-38067 CVE-2025-38068                      CVE-2025-38071 CVE-2025-38072 CVE-2025-38074 CVE-2025-38075                      CVE-2025-38077 CVE-2025-38078 CVE-2025-38079 CVE-2025-38083                      CVE-2025-38084 CVE-2025-38085 CVE-2025-38086 CVE-2025-38088                      CVE-2025-38090 CVE-2025-38097 CVE-2025-38100 CVE-2025-38102                      CVE-2025-38103 CVE-2025-38107 CVE-2025-38108 CVE-2025-38111                      CVE-2025-38112 CVE-2025-38113 CVE-2025-38115 CVE-2025-38118                      CVE-2025-38119 CVE-2025-38120 CVE-2025-38122 CVE-2025-38124                      CVE-2025-38126 CVE-2025-38131 CVE-2025-38135 CVE-2025-38136                      CVE-2025-38138 CVE-2025-38142 CVE-2025-38143 CVE-2025-38145                      CVE-2025-38146 CVE-2025-38147 CVE-2025-38148 CVE-2025-38151                      CVE-2025-38153 CVE-2025-38154 CVE-2025-38157 CVE-2025-38158                      CVE-2025-38159 CVE-2025-38160 CVE-2025-38161 CVE-2025-38163                      CVE-2025-38165 CVE-2025-38166 CVE-2025-38167 CVE-2025-38170                      CVE-2025-38173 CVE-2025-38174 CVE-2025-38180 CVE-2025-38181                      CVE-2025-38183 CVE-2025-38184 CVE-2025-38185 CVE-2025-38190                      CVE-2025-38191 CVE-2025-38193 CVE-2025-38194 CVE-2025-38197                      CVE-2025-38198 CVE-2025-38200 CVE-2025-38202 CVE-2025-38211                      CVE-2025-38212 CVE-2025-38214 CVE-2025-38215 CVE-2025-38218                      CVE-2025-38219 CVE-2025-38222 CVE-2025-38225 CVE-2025-38226                      CVE-2025-38227 CVE-2025-38229 CVE-2025-38230 CVE-2025-38231                      CVE-2025-38236 CVE-2025-38239 CVE-2025-38245 CVE-2025-38249                      CVE-2025-38251 CVE-2025-38257 CVE-2025-38259 CVE-2025-38260                      CVE-2025-38262 CVE-2025-38263 CVE-2025-38273 CVE-2025-38275                      CVE-2025-38277 CVE-2025-38280 CVE-2025-38282 CVE-2025-38285                      CVE-2025-38286 CVE-2025-38293 CVE-2025-38298 CVE-2025-38300                      CVE-2025-38304 CVE-2025-38305 CVE-2025-38310 CVE-2025-38312                      CVE-2025-38313 CVE-2025-38319 CVE-2025-38320 CVE-2025-38323                      CVE-2025-38324 CVE-2025-38326 CVE-2025-38328 CVE-2025-38331                      CVE-2025-38332 CVE-2025-38334 CVE-2025-38336 CVE-2025-38337                      CVE-2025-38342 CVE-2025-38344 CVE-2025-38345 CVE-2025-38346                      CVE-2025-38348 CVE-2025-38350 CVE-2025-38352 CVE-2025-38354                      CVE-2025-38362 CVE-2025-38363 CVE-2025-38364 CVE-2025-38365                      CVE-2025-38371 CVE-2025-38375 CVE-2025-38377 CVE-2025-38380                      CVE-2025-38382 CVE-2025-38384 CVE-2025-38385 CVE-2025-38386                      CVE-2025-38387 CVE-2025-38389 CVE-2025-38391 CVE-2025-38393                      CVE-2025-38395 CVE-2025-38396 CVE-2025-38399 CVE-2025-38400                      CVE-2025-38401 CVE-2025-38403 CVE-2025-38404 CVE-2025-38406                      CVE-2025-38409 CVE-2025-38410 CVE-2025-38412 CVE-2025-38415                      CVE-2025-38416 CVE-2025-38418 CVE-2025-38419 CVE-2025-38420                      CVE-2025-38422 CVE-2025-38424 CVE-2025-38425 CVE-2025-38428                      CVE-2025-38430 CVE-2025-38437 CVE-2025-38439 CVE-2025-38441                      CVE-2025-38443 CVE-2025-38444 CVE-2025-38445 CVE-2025-38448                      CVE-2025-38451 CVE-2025-38455 CVE-2025-38456 CVE-2025-38457                      CVE-2025-38458 CVE-2025-38459 CVE-2025-38460 CVE-2025-38461                      CVE-2025-38462 CVE-2025-38464 CVE-2025-38465 CVE-2025-38466                      CVE-2025-38467 CVE-2025-38468 CVE-2025-38470 CVE-2025-38471                      CVE-2025-38472 CVE-2025-38473 CVE-2025-38474 CVE-2025-38476                      CVE-2025-38477 CVE-2025-38478 CVE-2025-38480 CVE-2025-38481                      CVE-2025-38482 CVE-2025-38483 CVE-2025-38485 CVE-2025-38487                      CVE-2025-38488 CVE-2025-38494 CVE-2025-38495 CVE-2025-38497                      CVE-2025-38498 CVE-2025-38499

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 6.1.147-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-12662 advisory.

    - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice - CVE-2025-38001
    - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() - CVE-2025-38000
    - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc - CVE-2025-37890
    - RDMA/core: Fix 'KASAN: slab-use-after-free Read in ib_register_device' problem - CVE-2025-38022
    - RDMA/core: Fix use-after-free when rename device name - CVE-2025-22085
    - nvme-tcp: sanitize request list handling - CVE-2025-38264
    - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done - CVE-2025-38052
    - ext4: avoid journaling sb update on error if journal is destroying - CVE-2025-22113
    - ext4: define ext4_journal_destroy wrapper - CVE-2025-22113
    - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() - CVE-2025-21928
    - HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() - CVE-2025-21929
    - net/sched: fix use-after-free in taprio_dev_notifier - CVE-2025-38087
    - net: ch9200: fix uninitialised access during mii_nway_restart - CVE-2025-38086
    - padata: avoid UAF for reorder_work - CVE-2025-21726
    - padata: fix UAF in padata_reorder - CVE-2025-21727

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: ch9200: fix uninitialised access during mii_nway_restart In mii_nway_restart() the code attempts to     call mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read() utilises a local buffer called buff,     which is initialised with control_read(). However buff is conditionally initialised inside     control_read(): if (err == size) { memcpy(data, buf, size); } If the condition of err == size is not     met, then buff remains uninitialised. Once this happens the uninitialised buff is accessed and     returned during ch9200_mdio_read(): return (buff[0] | buff[1] << 8); The problem stems from the fact that     ch9200_mdio_read() ignores the return value of control_read(), leading to uinit-access of buff. To fix     this we should check the return value of control_read() and return early on error. (CVE-2025-38086)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:11455 advisory.

    * kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)
      * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:12662 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

    * kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CVE-2025-21928)

    * kernel: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() (CVE-2025-21929)

    * kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CVE-2025-22020)

    * kernel: ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113)

    * kernel: RDMA/core: Fix use-after-free when rename device name (CVE-2025-22085)

    * kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CVE-2025-37890)

    * kernel: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CVE-2025-38052)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    * kernel: net/sched: fix use-after-free in taprio_dev_notifier (CVE-2025-38087)

    * kernel: nvme-tcp: sanitize request list handling (CVE-2025-38264)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.239-236.958. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-098 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: flowtable: fix stuck flows on cleanup due to pending work (CVE-2022-50000)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_socket: fix sk refcount leaks (CVE-2024-46855)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: hugetlb: independent PMD page table shared count (CVE-2024-57883)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: sch_sfq: don't allow 1 packet limit (CVE-2024-57996)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (CVE-2025-37963)

    In the Linux kernel, the following vulnerability has been resolved:

    genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie (CVE-2025-38062)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: prio: fix a race in prio_tune() (CVE-2025-38083)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/hugetlb: unshare page tables during VMA split, not before (CVE-2025-38084)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/iopl: Cure TIF_IO_BITMAP inconsistencies (CVE-2025-38100)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (CVE-2025-38103)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: ets: fix a race in ets_qdisc_change() (CVE-2025-38107)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: red: fix a race in __red_change() (CVE-2025-38108)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mdiobus: Fix potential out-of-bounds read/write access (CVE-2025-38111)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Fix TOCTOU issue in sk_is_readable() (CVE-2025-38112)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: sch_sfq: fix a potential crash on gso_skb handling (CVE-2025-38115)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: Fix the dead loop of MPLS parse (CVE-2025-38146)

    In the Linux kernel, the following vulnerability has been resolved:

    calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (CVE-2025-38161)

    In the Linux kernel, the following vulnerability has been resolved:

    calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (CVE-2025-38181)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (CVE-2025-38184)

    In the Linux kernel, the following vulnerability has been resolved:

    platform/x86: dell_rbu: Fix list usage (CVE-2025-38197)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CVE-2025-38200)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: fix double free in delayed_free (CVE-2025-38206)

    In the Linux kernel, the following vulnerability has been resolved:

    ipc: fix to protect IPCS lookups using RCU (CVE-2025-38212)

    In the Linux kernel, the following vulnerability has been resolved:

    vgacon: Add check for vc_origin address range in vgacon_scroll() (CVE-2025-38213)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (CVE-2025-38214)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: inline: fix len overflow in ext4_prepare_inline_data (CVE-2025-38222)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (CVE-2025-38231)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tipc: fix refcount warning in tipc_aead_encrypt (CVE-2025-38273)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix WARN() in get_bpf_raw_tp_regs (CVE-2025-38285)

    In the Linux kernel, the following vulnerability has been resolved:

    EDAC/skx_common: Fix general protection fault (CVE-2025-38298)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (CVE-2025-38312)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (CVE-2025-38320)

    In the Linux kernel, the following vulnerability has been resolved:

    mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (CVE-2025-38324)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (CVE-2025-38337)

    In the Linux kernel, the following vulnerability has been resolved:

    software node: Correct a OOB check in software_node_get_reference_args() (CVE-2025-38342)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: fix acpi parse and parseext cache leaks (CVE-2025-38344)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346)

    In the Linux kernel, the following vulnerability has been resolved:

    posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:11861 advisory.

    * kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980)
      * kernel: wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905)
      * kernel: RDMA/mlx5: Fix page_size variable overflow (CVE-2025-22091)
      * kernel: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CVE-2025-22121)
      * kernel: ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113)
      * kernel: RDMA/core: Fix use-after-free when rename device name (CVE-2025-22085)
      * kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)
      * kernel: mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958)
      * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)
      * kernel: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CVE-2025-38110)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:11456 advisory.

    * kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:11455 advisory.

    * kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-11861 advisory.

    - net_sched: hfsc: Fix a UAF vulnerability in class handling (Davide Caratti) [RHEL-95853]     {CVE-2025-37797}
    - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CKI Backport Bot) [RHEL-93555]     {CVE-2025-22121}
    - ext4: introduce ITAIL helper (CKI Backport Bot) [RHEL-93555] {CVE-2025-22121}
    - ext4: avoid journaling sb update on error if journal is destroying (Brian Foster) [RHEL-93591]     {CVE-2025-22113}
    - net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CKI Backport Bot) [RHEL-102093]     {CVE-2025-38110}
    - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101212]     {CVE-2025-38086}
    - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98795] {CVE-2024-57980}
    - RDMA/mlx5: Fix page_size variable overflow (CKI Backport Bot) [RHEL-99320] {CVE-2025-22091}
    - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99384] {CVE-2025-21905}
    - RDMA/core: Fix use-after-free when rename device name (CKI Backport Bot) [RHEL-99048] {CVE-2025-22085}
    - mm/huge_memory: fix dereferencing invalid pmd migration entry (Rafael Aquini) [RHEL-96368]     {CVE-2025-37958}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:11861 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980)

    * kernel: wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905)

    * kernel: RDMA/mlx5: Fix page_size variable overflow (CVE-2025-22091)

    * kernel: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CVE-2025-22121)

    * kernel: ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113)

    * kernel: RDMA/core: Fix use-after-free when rename device name (CVE-2025-22085)

    * kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)

    * kernel: mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    * kernel: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CVE-2025-38110)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:11456 advisory.

    * kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)
      * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-11455 advisory.

    - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324]     {CVE-2024-50154}
    - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200]     {CVE-2025-38086}
    - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:11456 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:11455 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.295-216.421. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2025-104 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Fix ia_size underflow (CVE-2022-48828)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_socket: fix sk refcount leaks (CVE-2024-46855)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix geneve_opt length integer overflow (CVE-2025-22055)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (CVE-2025-37942)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: prio: fix a race in prio_tune() (CVE-2025-38083)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (CVE-2025-38103)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: red: fix a race in __red_change() (CVE-2025-38108)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: sch_sfq: fix a potential crash on gso_skb handling (CVE-2025-38115)

    In the Linux kernel, the following vulnerability has been resolved:

    calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)

    In the Linux kernel, the following vulnerability has been resolved:

    calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (CVE-2025-38181)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (CVE-2025-38184)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CVE-2025-38200)

    In the Linux kernel, the following vulnerability has been resolved:

    ipc: fix to protect IPCS lookups using RCU (CVE-2025-38212)

    In the Linux kernel, the following vulnerability has been resolved:

    vgacon: Add check for vc_origin address range in vgacon_scroll() (CVE-2025-38213)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (CVE-2025-38214)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: inline: fix len overflow in ext4_prepare_inline_data (CVE-2025-38222)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix WARN() in get_bpf_raw_tp_regs (CVE-2025-38285)

    In the Linux kernel, the following vulnerability has been resolved:

    EDAC/skx_common: Fix general protection fault (CVE-2025-38298)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (CVE-2025-38312)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (CVE-2025-38320)

    In the Linux kernel, the following vulnerability has been resolved:

    mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (CVE-2025-38324)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (CVE-2025-38337)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: fix acpi parse and parseext cache leaks (CVE-2025-38344)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346)

    In the Linux kernel, the following vulnerability has been resolved:

    posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
254412	RHEL 8 : kernel (RHSA-2025:14418)	Nessus	Red Hat Local Security Checks	high
252956	RHEL 8 : kernel (RHSA-2025:14136)	Nessus	Red Hat Local Security Checks	high
252291	Amazon Linux 2 : kernel, --advisory ALAS2-2025-2968 (ALAS-2025-2968)	Nessus	Amazon Linux Local Security Checks	high
252289	RHEL 9 : kernel-rt (RHSA-2025:14094)	Nessus	Red Hat Local Security Checks	high
252264	RHEL 9 : kernel (RHSA-2025:14054)	Nessus	Red Hat Local Security Checks	high
251026	RHEL 9 : kernel (RHSA-2025:13946)	Nessus	Red Hat Local Security Checks	high
249342	RHEL 8 : kernel (RHSA-2025:13805)	Nessus	Red Hat Local Security Checks	high
249259	RHEL 9 : kernel (RHSA-2025:13781)	Nessus	Red Hat Local Security Checks	high
249209	RHEL 8 : kernel (RHSA-2025:13776)	Nessus	Red Hat Local Security Checks	high
249177	Debian dsa-5973 : affs-modules-6.1.0-37-4kc-malta-di - security update	Nessus	Debian Local Security Checks	medium
248475	Oracle Linux 10 : kernel (ELSA-2025-12662)	Nessus	Oracle Linux Local Security Checks	high
248469	RHEL 9 : kernel-rt (RHSA-2025:13633)	Nessus	Red Hat Local Security Checks	high
245033	Linux Distros Unpatched Vulnerability : CVE-2025-38086	Nessus	Misc.	high
244047	AlmaLinux 8 : kernel (ALSA-2025:11455)	Nessus	Alma Linux Local Security Checks	high
243457	RHEL 10 : kernel (RHSA-2025:12662)	Nessus	Red Hat Local Security Checks	high
243421	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2025-098 (ALASKERNEL-5.10-2025-098)	Nessus	Amazon Linux Local Security Checks	medium
243289	AlmaLinux 9 : kernel (ALSA-2025:11861)	Nessus	Alma Linux Local Security Checks	high
243118	RockyLinux 8 : kernel-rt (RLSA-2025:11456)	Nessus	Rocky Linux Local Security Checks	high
243097	RockyLinux 8 : kernel (RLSA-2025:11455)	Nessus	Rocky Linux Local Security Checks	high
243007	Oracle Linux 9 : kernel (ELSA-2025-11861)	Nessus	Oracle Linux Local Security Checks	high
242907	RHEL 9 : kernel (RHSA-2025:11861)	Nessus	Red Hat Local Security Checks	high
242621	AlmaLinux 8 : kernel-rt (ALSA-2025:11456)	Nessus	Alma Linux Local Security Checks	high
242550	Oracle Linux 8 : kernel (ELSA-2025-11455)	Nessus	Oracle Linux Local Security Checks	high
242437	RHEL 8 : kernel-rt (RHSA-2025:11456)	Nessus	Red Hat Local Security Checks	high
242432	RHEL 8 : kernel (RHSA-2025:11455)	Nessus	Red Hat Local Security Checks	high
241743	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2025-104 (ALASKERNEL-5.4-2025-104)	Nessus	Amazon Linux Local Security Checks	medium

Detections

Analytics

CVE-2025-38086

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

medium

high

high

high

high

high

medium

high

high

high

high

high

high

high

high

high

medium