In the Linux kernel, the following vulnerability has been resolved: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access When using publicly available tools like 'mdio-tools' to read/write data from/to network interface and its PHY via C45 (clause 45) mdiobus, there is no verification of parameters passed to the ioctl and it accepts any mdio address. Currently there is support for 32 addresses in kernel via PHY_MAX_ADDR define, but it is possible to pass higher value than that via ioctl. While read/write operation should generally fail in this case, mdiobus provides stats array, where wrong address may allow out-of-bounds read/write. Fix that by adding address verification before C45 read/write operation. While this excludes this access from any statistics, it improves security of read/write operation.

vendor_unpatched cve-2025-38110: Unpatched CVEs for Red Hat Enterprise Linux, Ubuntu Linux (cve-2025-38110)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:11861 advisory.

    * kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980)
      * kernel: wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905)
      * kernel: RDMA/mlx5: Fix page_size variable overflow (CVE-2025-22091)
      * kernel: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CVE-2025-22121)
      * kernel: ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113)
      * kernel: RDMA/core: Fix use-after-free when rename device name (CVE-2025-22085)
      * kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)
      * kernel: mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958)
      * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)
      * kernel: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CVE-2025-38110)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-11855 advisory.

    [6.12.0-55.24.1.0.1_0.OL10]
    - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650]
    - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
    - Disable UKI signing [Orabug: 36571828]
    - Update Oracle Linux certificates (Kevin Lyons)
    - Disable signing for aarch64 (Ilya Okomin)
    - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem)     [Orabug: 29539237]
    - Update x509.genkey [Orabug: 24817676]
    - Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
    - Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
    - Add Oracle Linux IMA certificates
    - Update module name for cryptographic module [Orabug: 37400433]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-11861 advisory.

    - net_sched: hfsc: Fix a UAF vulnerability in class handling (Davide Caratti) [RHEL-95853]     {CVE-2025-37797}
    - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CKI Backport Bot) [RHEL-93555]     {CVE-2025-22121}
    - ext4: introduce ITAIL helper (CKI Backport Bot) [RHEL-93555] {CVE-2025-22121}
    - ext4: avoid journaling sb update on error if journal is destroying (Brian Foster) [RHEL-93591]     {CVE-2025-22113}
    - net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CKI Backport Bot) [RHEL-102093]     {CVE-2025-38110}
    - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101212]     {CVE-2025-38086}
    - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98795] {CVE-2024-57980}
    - RDMA/mlx5: Fix page_size variable overflow (CKI Backport Bot) [RHEL-99320] {CVE-2025-22091}
    - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99384] {CVE-2025-21905}
    - RDMA/core: Fix use-after-free when rename device name (CKI Backport Bot) [RHEL-99048] {CVE-2025-22085}
    - mm/huge_memory: fix dereferencing invalid pmd migration entry (Rafael Aquini) [RHEL-96368]     {CVE-2025-37958}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:11861 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980)

    * kernel: wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905)

    * kernel: RDMA/mlx5: Fix page_size variable overflow (CVE-2025-22091)

    * kernel: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CVE-2025-22121)

    * kernel: ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113)

    * kernel: RDMA/core: Fix use-after-free when rename device name (CVE-2025-22085)

    * kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)

    * kernel: mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958)

    * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

    * kernel: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CVE-2025-38110)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:11855 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: RDMA/mlx5: Fix page_size variable overflow (CVE-2025-22091)

    * kernel: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CVE-2025-22121)

    * kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)

    * kernel: powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (CVE-2025-38088)

    * kernel: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CVE-2025-38110)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:11245 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)

    * kernel: Squashfs: fix handling and sanity checking of xattr_ids count (CVE-2023-52933)

    * kernel: net: atm: fix use after free in lec_send() (CVE-2025-22004)

    * kernel: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CVE-2025-22121)

    * kernel: ext4: fix off-by-one error in do_split (CVE-2025-23150)

    * kernel: ext4: ignore xattrs past end (CVE-2025-37738)

    * kernel: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CVE-2025-38110)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
243289	AlmaLinux 9 : kernel (ALSA-2025:11861)	Nessus	Alma Linux Local Security Checks	high
243192	Oracle Linux 10 : kernel (ELSA-2025-11855)	Nessus	Oracle Linux Local Security Checks	high
243007	Oracle Linux 9 : kernel (ELSA-2025-11861)	Nessus	Oracle Linux Local Security Checks	high
242907	RHEL 9 : kernel (RHSA-2025:11861)	Nessus	Red Hat Local Security Checks	high
242891	RHEL 10 : kernel (RHSA-2025:11855)	Nessus	Red Hat Local Security Checks	high
242143	RHEL 9 : kernel (RHSA-2025:11245)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2025-38110

medium

Tenable Plugins

Coming Soon

high

high

high

high

high

high