In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in taprio_dev_notifier Since taprio’s taprio_dev_notifier() isn’t protected by an RCU read-side critical section, a race with advance_sched() can lead to a use-after-free. Adding rcu_read_lock() inside taprio_dev_notifier() prevents this.

alma_linux ALSA-2025:12746: ALSA-2025:12746: kernel security update (High)

vendor_unpatched cve-2025-38087: Unpatched CVEs for Ubuntu Linux (cve-2025-38087)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-12746 advisory.

    - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Davide Caratti) [RHEL-97522]     {CVE-2025-38001 CVE-2025-37890}
    - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Davide Caratti) [RHEL-97522]     {CVE-2025-38000}
    - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Davide Caratti)     [RHEL-97522] {CVE-2025-37890}
    - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98847]     {CVE-2025-21928}
    - HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() (CKI Backport Bot) [RHEL-98871]     {CVE-2025-21929}
    - Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (David Marlin) [RHEL-95324]     {CVE-2025-37918}
    - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Desnes Nunes) [RHEL-99029]     {CVE-2025-22020}
    - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (John W. Linville) [RHEL-97499]     {CVE-2022-49788}
    - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103087]     {CVE-2025-38052}
    - net/sched: fix use-after-free in taprio_dev_notifier (CKI Backport Bot) [RHEL-101317] {CVE-2025-38087}
    - padata: avoid UAF for reorder_work (Rafael Aquini) [RHEL-97031] {CVE-2025-21727 CVE-2025-21726}
    - padata: fix UAF in padata_reorder (Rafael Aquini) [RHEL-97031] {CVE-2025-21727}
    - padata: add pd get/put refcnt helper (Rafael Aquini) [RHEL-97031] {CVE-2025-21727}
    - padata: fix sysfs store callback check (Rafael Aquini) [RHEL-97031] {CVE-2025-21727}
    - padata: Clean up in padata_do_multithreaded() (Rafael Aquini) [RHEL-97031] {CVE-2025-21727}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:12662 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

    * kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CVE-2025-21928)

    * kernel: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() (CVE-2025-21929)

    * kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CVE-2025-22020)

    * kernel: ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113)

    * kernel: RDMA/core: Fix use-after-free when rename device name (CVE-2025-22085)

    * kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CVE-2025-37890)

    * kernel: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CVE-2025-38052)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    * kernel: net/sched: fix use-after-free in taprio_dev_notifier (CVE-2025-38087)

    * kernel: nvme-tcp: sanitize request list handling (CVE-2025-38264)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:12746 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

    * kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CVE-2025-21928)

    * kernel: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() (CVE-2025-21929)

    * kernel: cifs: Fix integer overflow while processing closetimeo mount option (CVE-2025-21962)

    * kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CVE-2025-22020)

    * kernel: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CVE-2022-49788)

    * kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CVE-2025-37890)

    * kernel: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CVE-2025-38052)

    * kernel: net/sched: fix use-after-free in taprio_dev_notifier (CVE-2025-38087)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:11810 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (CVE-2024-26660)

    * kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (CVE-2021-47185)

    * kernel: nbd: null check for nla_nest_start (CVE-2024-27025)

    * kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

    * kernel: firmware: cs_dsp: Fix overflow checking of wmfw header (CVE-2024-41039)

    * kernel: powerpc/pseries: Whitelist dtl slub object for copying to userspace (CVE-2024-41065)

    * kernel: usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB     (CVE-2024-42226)

    * kernel: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (CVE-2024-50082)

    * kernel: parport: Proper fix for array out-of-bounds access (CVE-2024-50074)

    * kernel: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (CVE-2025-21887)

    * kernel: wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905)

    * kernel: ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113)

    * kernel: ibmvnic: Use kernel helpers for hex dumps (CVE-2025-22104)

    * kernel: udmabuf: fix a buf size overflow issue during udmabuf creation (CVE-2025-37803)

    * kernel: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (CVE-2025-38089)

    * kernel: net/sched: fix use-after-free in taprio_dev_notifier (CVE-2025-38087)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
244361	Oracle Linux 9 : kernel (ELSA-2025-12746)	Nessus	Oracle Linux Local Security Checks	high
243457	RHEL 10 : kernel (RHSA-2025:12662)	Nessus	Red Hat Local Security Checks	high
243400	RHEL 9 : kernel (RHSA-2025:12746)	Nessus	Red Hat Local Security Checks	high
242887	RHEL 9 : kernel (RHSA-2025:11810)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2025-38087

high

Tenable Plugins

Coming Soon

high

high

high

high