In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix uaf in ath12k_core_init() When the execution of ath12k_core_hw_group_assign() or ath12k_core_hw_group_create() fails, the registered notifier chain is not unregistered properly. Its memory is freed after rmmod, which may trigger to a use-after-free (UAF) issue if there is a subsequent access to this notifier chain. Fixes the issue by calling ath12k_core_panic_notifier_unregister() in failure cases. Call trace: notifier_chain_register+0x4c/0x1f0 (P) atomic_notifier_chain_register+0x38/0x68 ath12k_core_init+0x50/0x4e8 [ath12k] ath12k_pci_probe+0x5f8/0xc28 [ath12k] pci_device_probe+0xbc/0x1a8 really_probe+0xc8/0x3a0 __driver_probe_device+0x84/0x1b0 driver_probe_device+0x44/0x130 __driver_attach+0xcc/0x208 bus_for_each_dev+0x84/0x100 driver_attach+0x2c/0x40 bus_add_driver+0x130/0x260 driver_register+0x70/0x138 __pci_register_driver+0x68/0x80 ath12k_pci_init+0x30/0x68 [ath12k] ath12k_init+0x28/0x78 [ath12k] Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-11493:94 advisory.

    * kernel: can: isotp: fix potential CAN frame reception race in isotp_rcv() (CVE-2022-48830)
      * kernel: soc: qcom: cmd-db: Map shared memory as WC, not WB (CVE-2024-46689)
      * kernel: Squashfs: sanity check symbolic link size (CVE-2024-46744)
      * kernel: vfs: fix race between evice_inodes() and find_inode()&iput() (CVE-2024-47679)
      * kernel: x86/tdx: Fix in-kernel MMIO check (CVE-2024-47727)
      * kernel: rxrpc: Fix a race between socket set up and I/O thread creation (CVE-2024-49864)
      * kernel: io_uring: check if we need to reschedule during overflow flush (CVE-2024-50060)
      * kernel: can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods (CVE-2022-49024)
      * kernel: posix-clock: Fix missing timespec64 check in pc_clock_settime() (CVE-2024-50195)
      * kernel: rxrpc: Fix missing locking causing hanging calls (CVE-2024-50294)
      * kernel: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write (CVE-2024-53052)
      * kernel: afs: Fix lock recursion (CVE-2024-53090)
      * kernel: virtio/vsock: Fix accept_queue memory leak (CVE-2024-53119)
      * kernel: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (CVE-2024-53135)
      * kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466)     (CVE-2024-53241)
      * kernel: RDMA/rxe: Fix the qp flush warnings in req (CVE-2024-53229)
      * kernel: block: fix uaf for flush rq while iterating tags (CVE-2024-53170)
      * kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216)
      * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603)
      * kernel: blk-cgroup: Fix UAF in blkcg_unpin_online() (CVE-2024-56672)
      * kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662)
      * kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675)
      * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)
      * kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY     (CVE-2024-56690)
      * kernel: io_uring: check if iowq is killed before queuing (CVE-2024-56709)
      * kernel: rtc: check if __rtc_read_time was successful in rtc_timer_do_work() (CVE-2024-56739)
      * kernel: bpf: put bpf_link's program when link is safe to be deallocated (CVE-2024-56786)
      * kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332)
      * kernel: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (CVE-2024-53680)
      * kernel: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (CVE-2025-21648)
      * kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647)
      * kernel: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() (CVE-2025-21631)
      * kernel: zram: fix potential UAF of zram table (CVE-2025-21671)
      * kernel: afs: Fix merge preference rule failure condition (CVE-2025-21672)
      * kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693)
      * kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691)
      * kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696)
      * kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702)
      * kernel: usbnet: fix memory leak in error case (CVE-2022-49657)
      * kernel: powerpc/xics: fix refcount leak in icp_opal_init() (CVE-2022-49432)
      * kernel: net: tun: unlink NAPI from device on destruction (CVE-2022-49672)
      * kernel: powerpc/papr_scm: don't requests stats with '0' sized stats buffer (CVE-2022-49353)
      * kernel: powerpc/xive: Fix refcount leak in xive_spapr_init (CVE-2022-49437)
      * kernel: ima: Fix potential memory leak in ima_init_crypto() (CVE-2022-49627)
      * kernel: linux/dim: Fix divide by 0 in RDMA DIM (CVE-2022-49670)
      * kernel: can: isotp: sanitize CAN ID checks in isotp_bind() (CVE-2022-49269)
      * kernel: ima: Fix a potential integer overflow in ima_appraise_measurement (CVE-2022-49643)
      * kernel: powerpc/xive/spapr: correct bitmap allocation size (CVE-2022-49623)
      * kernel: efi: Do not import certificates from UEFI Secure Boot for T2 Macs (CVE-2022-49357)
      * kernel: list: fix a data-race around ep->rdllist (CVE-2022-49443)
      * kernel: tracing/histograms: Fix memory leak problem (CVE-2022-49648)
      * kernel: Input: synaptics - fix crash when enabling pass-through port (CVE-2025-21746)
      * kernel: NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795)
      * kernel: bpf: Send signals asynchronously if !preemptible (CVE-2025-21728)
      * kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CVE-2024-54456)
      * kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() (CVE-2024-57987)
      * kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014)
      * kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() (CVE-2024-57988)
      * kernel: RDMA/mlx5: Fix implicit ODP use after free (CVE-2025-21714)
      * kernel: drm/xe/tracing: Fix a potential TP_printk UAF (CVE-2024-49570)
      * kernel: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check     (CVE-2024-57993)
      * kernel: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (CVE-2025-21729)
      * kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links (CVE-2024-57989)
      * kernel: wifi: ath12k: Fix for out-of bound access error (CVE-2024-58015)
      * kernel: OPP: add index check to assert to avoid buffer overflow in _read_freq() (CVE-2024-57998)
      * kernel: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)
      * kernel: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796)
      * kernel: scsi: ufs: core: Fix use-after free in init error and remove paths (CVE-2025-21739)
      * kernel: workqueue: Put the pwq after detaching the rescuer from the pool (CVE-2025-21786)
      * kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVE-2025-21738)
      * kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections     (CVE-2024-57986)
      * kernel: padata: avoid UAF for reorder_work (CVE-2025-21726)
      * kernel: vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791)
      * kernel: team: better TEAM_OPTION_TYPE_STRING validation (CVE-2025-21787)
      * kernel: usb: xhci: Fix NULL pointer dereference on certain command aborts (CVE-2024-57981)
      * kernel: vxlan: check vxlan_vnigroup_init() return value (CVE-2025-21790)
      * kernel: wifi: mt76: mt7925: fix off by one in mt7925_load_clc() (CVE-2024-57990)
      * kernel: ipv6: use RCU protection in ip6_default_advmss() (CVE-2025-21765)
      * kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (CVE-2024-58012)
      * kernel: blk-cgroup: Fix class @block_class's subsystem refcount leakage (CVE-2025-21745)
      * kernel: net: let net.core.dev_weight always be non-zero (CVE-2025-21806)
      * kernel: wifi: rtlwifi: remove unused check_buddy_priv (CVE-2024-58072)
      * kernel: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (CVE-2024-58068)
      * kernel: wifi: iwlwifi: mvm: avoid NULL pointer dereference (CVE-2024-58062)
      * kernel: idpf: convert workqueues to unbound (CVE-2024-58057)
      * kernel: wifi: mac80211: don't flush non-uploaded STAs (CVE-2025-21828)
      * kernel: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (CVE-2024-58083)
      * kernel: netfilter: nf_tables: reject mismatching sum of field_len with set key length (CVE-2025-21826)
      * kernel: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback (CVE-2024-58077)
      * kernel: crypto: tegra - do not transfer req when tegra init fails (CVE-2024-58075)
      * kernel: RDMA/rxe: Fix the warning __rxe_cleanup+0x12c/0x170 [rdma_rxe] (CVE-2025-21829)
      * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839)
      * kernel: io_uring/uring_cmd: unconditionally copy SQEs at prep time (CVE-2025-21837)
      * kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350)
      * kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357)
      * kernel: bpf: Fix softlockup in arena_map_free on 64k page kernel (CVE-2025-21851)
      * kernel: ibmvnic: Don't reference skb after sending to VIOS (CVE-2025-21855)
      * kernel: smb: client: Add check for next_buffer in receive_encrypted_standard() (CVE-2025-21844)
      * kernel: bpf: avoid holding freeze_mutex during mmap operation (CVE-2025-21853)
      * kernel: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() (CVE-2025-21847)
      * kernel: tcp: drop secpath at the same time as we currently drop dst (CVE-2025-21864)
      * kernel: bpf: Fix deadlock when freeing cgroup storage (CVE-2024-58088)
      * kernel: acct: perform last write from workqueue (CVE-2025-21846)
      * kernel: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()     (CVE-2025-21861)
      * kernel: io_uring: prevent opcode speculation (CVE-2025-21863)
      * kernel: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() (CVE-2025-21848)
      * kernel: netfilter: nft_tunnel: fix geneve_opt type confusion addition (CVE-2025-22056)
      * kernel: can: j1939: j1939_send_one(): fix missing CAN header initialization (CVE-2022-49845)
      * kernel: usb: typec: ucsi: displayport: Fix NULL pointer access (CVE-2025-37994)
      * kernel: wifi: ath12k: fix uaf in ath12k_core_init() (CVE-2025-38116)
      * kernel: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (CVE-2025-38396)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:20095 advisory.

    * kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466)     (CVE-2024-53241)

    * kernel: exfat: fix out-of-bounds access of directory entries (CVE-2024-53147)

    * kernel: zram: fix NULL pointer in comp_algorithm_show() (CVE-2024-53222)

    * kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216)

    * kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662)

    * kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675)

    * kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY     (CVE-2024-56690)

    * kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332)

    * kernel: af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK (CVE-2024-57901)

    * kernel: af_packet: fix vlan_get_tci() vs MSG_PEEK (CVE-2024-57902)

    * kernel: io_uring/sqpoll: zero sqd->thread on tctx errors (CVE-2025-21633)

    * kernel: ipvlan: Fix use-after-free in ipvlan_get_iflink(). (CVE-2025-21652)

    * kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647)

    * kernel: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period (CVE-2025-21655)

    * kernel: netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled (CVE-2024-57941)

    * kernel: netfs: Fix ceph copy to cache on write-begin (CVE-2024-57942)

    * kernel: zram: fix potential UAF of zram table (CVE-2025-21671)

    * kernel: pktgen: Avoid out-of-bounds access in get_imix_entries (CVE-2025-21680)

    * kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693)

    * kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691)

    * kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696)

    * kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702)

    * kernel: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (CVE-2025-21732)

    * kernel: NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795)

    * kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CVE-2024-54456)

    * kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() (CVE-2024-57987)

    * kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014)

    * kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() (CVE-2024-57988)

    * kernel: drm/xe/tracing: Fix a potential TP_printk UAF (CVE-2024-49570)

    * kernel: media: intel/ipu6: remove cpu latency qos request on error (CVE-2024-58004)

    * kernel: usbnet: ipheth: use static NDP16 location in URB (CVE-2025-21742)

    * kernel: usbnet: ipheth: fix possible overflow in DPE length check (CVE-2025-21743)

    * kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links (CVE-2024-57989)

    * kernel: wifi: ath12k: Fix for out-of bound access error (CVE-2024-58015)

    * kernel: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)

    * kernel: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796)

    * kernel: workqueue: Put the pwq after detaching the rescuer from the pool (CVE-2025-21786)

    * kernel: tpm: Change to kvalloc() in eventlog/acpi.c (CVE-2024-58005)

    * kernel: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (CVE-2024-58013)

    * kernel: ring-buffer: Validate the persistent meta data subbuf array (CVE-2025-21777)

    * kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVE-2025-21738)

    * kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections     (CVE-2024-57986)

    * kernel: padata: avoid UAF for reorder_work (CVE-2025-21726)

    * kernel: vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791)

    * kernel: HID: multitouch: Add NULL check in mt_input_configured (CVE-2024-58020)

    * kernel: i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition (CVE-2024-57984)

    * kernel: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() (CVE-2025-21761)

    * kernel: sched_ext: Fix incorrect autogroup migration detection (CVE-2025-21771)

    * kernel: usb: xhci: Fix NULL pointer dereference on certain command aborts (CVE-2024-57981)

    * kernel: memcg: fix soft lockup in the OOM process (CVE-2024-57977)

    * kernel: vxlan: check vxlan_vnigroup_init() return value (CVE-2025-21790)

    * kernel: usbnet: ipheth: fix DPE OoB read (CVE-2025-21741)

    * kernel: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CVE-2025-21785)

    * kernel: ipv6: use RCU protection in ip6_default_advmss() (CVE-2025-21765)

    * kernel: PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() (CVE-2024-58006)

    * kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (CVE-2024-58012)

    * kernel: wifi: brcmfmac: Check the return value of of_property_read_string_index() (CVE-2025-21750)

    * kernel: wifi: rtlwifi: remove unused check_buddy_priv (CVE-2024-58072)

    * kernel: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (CVE-2024-58069)

    * kernel: wifi: mac80211: prohibit deactivating all links (CVE-2024-58061)

    * kernel: idpf: convert workqueues to unbound (CVE-2024-58057)

    * kernel: wifi: mac80211: don't flush non-uploaded STAs (CVE-2025-21828)

    * kernel: netfilter: nf_tables: reject mismatching sum of field_len with set key length (CVE-2025-21826)

    * kernel: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback (CVE-2024-58077)

    * kernel: crypto: tegra - do not transfer req when tegra init fails (CVE-2024-58075)

    * kernel: io_uring/uring_cmd: unconditionally copy SQEs at prep time (CVE-2025-21837)

    * kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350)

    * kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357)

    * kernel: net/sched: cls_api: fix error handling causing NULL dereference (CVE-2025-21857)

    * kernel: bpf: Fix softlockup in arena_map_free on 64k page kernel (CVE-2025-21851)

    * kernel: ibmvnic: Don't reference skb after sending to VIOS (CVE-2025-21855)

    * kernel: smb: client: Add check for next_buffer in receive_encrypted_standard() (CVE-2025-21844)

    * kernel: bpf: avoid holding freeze_mutex during mmap operation (CVE-2025-21853)

    * kernel: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() (CVE-2025-21847)

    * kernel: tcp: drop secpath at the same time as we currently drop dst (CVE-2025-21864)

    * kernel: bpf: Fix deadlock when freeing cgroup storage (CVE-2024-58088)

    * kernel: acct: perform last write from workqueue (CVE-2025-21846)

    * kernel: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()     (CVE-2025-21861)

    * kernel: io_uring: prevent opcode speculation (CVE-2025-21863)

    * kernel: fbdev: hyperv_fb: Allow graceful removal of framebuffer (CVE-2025-21976)

    * kernel: netfilter: nft_tunnel: fix geneve_opt type confusion addition (CVE-2025-22056)

    * kernel: net: ppp: Add bound checking for skb data on ppp_sync_txmung (CVE-2025-37749)

    * microcode_ctl: From CVEorg collector (CVE-2024-28956)

    * kernel: usb: typec: ucsi: displayport: Fix NULL pointer access (CVE-2025-37994)

    * kernel: wifi: ath12k: fix uaf in ath12k_core_init() (CVE-2025-38116)

    * kernel: platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (CVE-2025-38412)

    * kernel: dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using     (CVE-2025-38369)

    * kernel: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (CVE-2025-38468)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:20518 advisory.

    * kernel: can: isotp: fix potential CAN frame reception race in isotp_rcv() (CVE-2022-48830)

    * kernel: soc: qcom: cmd-db: Map shared memory as WC, not WB (CVE-2024-46689)

    * kernel: Squashfs: sanity check symbolic link size (CVE-2024-46744)

    * kernel: vfs: fix race between evice_inodes() and find_inode()&iput() (CVE-2024-47679)

    * kernel: x86/tdx: Fix in-kernel MMIO check (CVE-2024-47727)

    * kernel: rxrpc: Fix a race between socket set up and I/O thread creation (CVE-2024-49864)

    * kernel: io_uring: check if we need to reschedule during overflow flush (CVE-2024-50060)

    * kernel: can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods (CVE-2022-49024)

    * kernel: posix-clock: Fix missing timespec64 check in pc_clock_settime() (CVE-2024-50195)

    * kernel: rxrpc: Fix missing locking causing hanging calls (CVE-2024-50294)

    * kernel: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write (CVE-2024-53052)

    * kernel: afs: Fix lock recursion (CVE-2024-53090)

    * kernel: virtio/vsock: Fix accept_queue memory leak (CVE-2024-53119)

    * kernel: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (CVE-2024-53135)

    * kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466)     (CVE-2024-53241)

    * kernel: RDMA/rxe: Fix the qp flush warnings in req (CVE-2024-53229)

    * kernel: block: fix uaf for flush rq while iterating tags (CVE-2024-53170)

    * kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216)

    * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603)

    * kernel: blk-cgroup: Fix UAF in blkcg_unpin_online() (CVE-2024-56672)

    * kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662)

    * kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675)

    * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)

    * kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY     (CVE-2024-56690)

    * kernel: io_uring: check if iowq is killed before queuing (CVE-2024-56709)

    * kernel: rtc: check if __rtc_read_time was successful in rtc_timer_do_work() (CVE-2024-56739)

    * kernel: bpf: put bpf_link's program when link is safe to be deallocated (CVE-2024-56786)

    * kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332)

    * kernel: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (CVE-2024-53680)

    * kernel: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (CVE-2025-21648)

    * kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647)

    * kernel: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() (CVE-2025-21631)

    * kernel: zram: fix potential UAF of zram table (CVE-2025-21671)

    * kernel: afs: Fix merge preference rule failure condition (CVE-2025-21672)

    * kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693)

    * kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691)

    * kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696)

    * kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702)

    * kernel: usbnet: fix memory leak in error case (CVE-2022-49657)

    * kernel: powerpc/xics: fix refcount leak in icp_opal_init() (CVE-2022-49432)

    * kernel: net: tun: unlink NAPI from device on destruction (CVE-2022-49672)

    * kernel: powerpc/papr_scm: don't requests stats with '0' sized stats buffer (CVE-2022-49353)

    * kernel: powerpc/xive: Fix refcount leak in xive_spapr_init (CVE-2022-49437)

    * kernel: ima: Fix potential memory leak in ima_init_crypto() (CVE-2022-49627)

    * kernel: linux/dim: Fix divide by 0 in RDMA DIM (CVE-2022-49670)

    * kernel: can: isotp: sanitize CAN ID checks in isotp_bind() (CVE-2022-49269)

    * kernel: ima: Fix a potential integer overflow in ima_appraise_measurement (CVE-2022-49643)

    * kernel: powerpc/xive/spapr: correct bitmap allocation size (CVE-2022-49623)

    * kernel: efi: Do not import certificates from UEFI Secure Boot for T2 Macs (CVE-2022-49357)

    * kernel: list: fix a data-race around ep->rdllist (CVE-2022-49443)

    * kernel: tracing/histograms: Fix memory leak problem (CVE-2022-49648)

    * kernel: Input: synaptics - fix crash when enabling pass-through port (CVE-2025-21746)

    * kernel: NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795)

    * kernel: bpf: Send signals asynchronously if !preemptible (CVE-2025-21728)

    * kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CVE-2024-54456)

    * kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() (CVE-2024-57987)

    * kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014)

    * kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() (CVE-2024-57988)

    * kernel: RDMA/mlx5: Fix implicit ODP use after free (CVE-2025-21714)

    * kernel: drm/xe/tracing: Fix a potential TP_printk UAF (CVE-2024-49570)

    * kernel: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check     (CVE-2024-57993)

    * kernel: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (CVE-2025-21729)

    * kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links (CVE-2024-57989)

    * kernel: wifi: ath12k: Fix for out-of bound access error (CVE-2024-58015)

    * kernel: OPP: add index check to assert to avoid buffer overflow in _read_freq() (CVE-2024-57998)

    * kernel: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)

    * kernel: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796)

    * kernel: scsi: ufs: core: Fix use-after free in init error and remove paths (CVE-2025-21739)

    * kernel: workqueue: Put the pwq after detaching the rescuer from the pool (CVE-2025-21786)

    * kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVE-2025-21738)

    * kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections     (CVE-2024-57986)

    * kernel: padata: avoid UAF for reorder_work (CVE-2025-21726)

    * kernel: vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791)

    * kernel: team: better TEAM_OPTION_TYPE_STRING validation (CVE-2025-21787)

    * kernel: usb: xhci: Fix NULL pointer dereference on certain command aborts (CVE-2024-57981)

    * kernel: vxlan: check vxlan_vnigroup_init() return value (CVE-2025-21790)

    * kernel: wifi: mt76: mt7925: fix off by one in mt7925_load_clc() (CVE-2024-57990)

    * kernel: ipv6: use RCU protection in ip6_default_advmss() (CVE-2025-21765)

    * kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (CVE-2024-58012)

    * kernel: blk-cgroup: Fix class @block_class's subsystem refcount leakage (CVE-2025-21745)

    * kernel: net: let net.core.dev_weight always be non-zero (CVE-2025-21806)

    * kernel: wifi: rtlwifi: remove unused check_buddy_priv (CVE-2024-58072)

    * kernel: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (CVE-2024-58068)

    * kernel: wifi: iwlwifi: mvm: avoid NULL pointer dereference (CVE-2024-58062)

    * kernel: idpf: convert workqueues to unbound (CVE-2024-58057)

    * kernel: wifi: mac80211: don't flush non-uploaded STAs (CVE-2025-21828)

    * kernel: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (CVE-2024-58083)

    * kernel: netfilter: nf_tables: reject mismatching sum of field_len with set key length (CVE-2025-21826)

    * kernel: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback (CVE-2024-58077)

    * kernel: crypto: tegra - do not transfer req when tegra init fails (CVE-2024-58075)

    * kernel: RDMA/rxe: Fix the warning __rxe_cleanup+0x12c/0x170 [rdma_rxe] (CVE-2025-21829)

    * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839)

    * kernel: io_uring/uring_cmd: unconditionally copy SQEs at prep time (CVE-2025-21837)

    * kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350)

    * kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357)

    * kernel: bpf: Fix softlockup in arena_map_free on 64k page kernel (CVE-2025-21851)

    * kernel: ibmvnic: Don't reference skb after sending to VIOS (CVE-2025-21855)

    * kernel: smb: client: Add check for next_buffer in receive_encrypted_standard() (CVE-2025-21844)

    * kernel: bpf: avoid holding freeze_mutex during mmap operation (CVE-2025-21853)

    * kernel: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() (CVE-2025-21847)

    * kernel: tcp: drop secpath at the same time as we currently drop dst (CVE-2025-21864)

    * kernel: bpf: Fix deadlock when freeing cgroup storage (CVE-2024-58088)

    * kernel: acct: perform last write from workqueue (CVE-2025-21846)

    * kernel: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()     (CVE-2025-21861)

    * kernel: io_uring: prevent opcode speculation (CVE-2025-21863)

    * kernel: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() (CVE-2025-21848)

    * kernel: netfilter: nft_tunnel: fix geneve_opt type confusion addition (CVE-2025-22056)

    * kernel: can: j1939: j1939_send_one(): fix missing CAN header initialization (CVE-2022-49845)

    * kernel: usb: typec: ucsi: displayport: Fix NULL pointer access (CVE-2025-37994)

    * kernel: wifi: ath12k: fix uaf in ath12k_core_init() (CVE-2025-38116)

    * kernel: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (CVE-2025-38396)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-200950 advisory.

    - selftests: tls: add tests for zero-length records (CKI Backport Bot) [RHEL-114328] {CVE-2025-39682}
    - tls: fix handling of zero-length records on the rx_list (CKI Backport Bot) [RHEL-114328]     {CVE-2025-39682}
    - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113338] {CVE-2025-38718}
    - ipv6: reject malicious packets in ipv6_gso_segment() (CKI Backport Bot) [RHEL-113251] {CVE-2025-38572}
    - wifi: ath12k: Decrement TID on RX peer frag setup error handling (CKI Backport Bot) [RHEL-114710]     {CVE-2025-39761}
    - xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CKI Backport Bot)     [RHEL-109531] {CVE-2025-38500}
    - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (Hangbin Liu) [RHEL-111156] {CVE-2025-38550}
    - tcp: Correct signedness in skb remaining space calculation (Florian Westphal) [RHEL-107843]     {CVE-2025-38463}
    - io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CKI Backport Bot) [RHEL-114338]     {CVE-2025-39698}
    - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (CKI Backport Bot) [RHEL-106587]     {CVE-2025-38468}
    - dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Audra     Mitchell) [RHEL-106609] {CVE-2025-38369}
    - HID: core: Harden s32ton() against conversion to 0 bits (Benjamin Tissoires) [RHEL-111038]     {CVE-2025-38556}
    - fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Audra Mitchell) [RHEL-106613]     {CVE-2025-38396}
    - s390/sclp: Fix SCCB present check (CKI Backport Bot) [RHEL-113560] {CVE-2025-39694}
    - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106059] {CVE-2025-38392}
    - x86/process: Move the buffer clearing before MONITOR (Waiman Long) [RHEL-83893 RHEL-83903]     {CVE-2024-36357 CVE-2024-36350}
    - x86/microcode/AMD: Add TSA microcode SHAs (Waiman Long) [RHEL-83893 RHEL-83903] {CVE-2024-36357     CVE-2024-36350}
    - KVM: SVM: Advertise TSA CPUID bits to guests (Waiman Long) [RHEL-83893 RHEL-83903] {CVE-2024-36357     CVE-2024-36350}
    - x86/bugs: Add a Transient Scheduler Attacks mitigation (Waiman Long) [RHEL-83893 RHEL-83903]     {CVE-2024-36357 CVE-2024-36350}
    - x86/bugs: Rename MDS machinery to something more generic (Waiman Long) [RHEL-83893 RHEL-83903]     {CVE-2024-36357 CVE-2024-36350}
    - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-83893]     {CVE-2025-22047}
    - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CKI Backport     Bot) [RHEL-112787] {CVE-2025-38352}
    - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal)     [RHEL-106441] {CVE-2025-38472}
    - sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [RHEL-111072] {CVE-2025-38566}
    - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [RHEL-110814] {CVE-2025-38571}
    - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106663] {CVE-2025-38464}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:20095 advisory.

    * kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466)     (CVE-2024-53241)
      * kernel: exfat: fix out-of-bounds access of directory entries (CVE-2024-53147)
      * kernel: zram: fix NULL pointer in comp_algorithm_show() (CVE-2024-53222)
      * kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216)
      * kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662)
      * kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675)
      * kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY     (CVE-2024-56690)
      * kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332)
      * kernel: af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK (CVE-2024-57901)
      * kernel: af_packet: fix vlan_get_tci() vs MSG_PEEK (CVE-2024-57902)
      * kernel: io_uring/sqpoll: zero sqd->thread on tctx errors (CVE-2025-21633)
      * kernel: ipvlan: Fix use-after-free in ipvlan_get_iflink(). (CVE-2025-21652)
      * kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647)
      * kernel: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period (CVE-2025-21655)
      * kernel: netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled (CVE-2024-57941)
      * kernel: netfs: Fix ceph copy to cache on write-begin (CVE-2024-57942)
      * kernel: zram: fix potential UAF of zram table (CVE-2025-21671)
      * kernel: pktgen: Avoid out-of-bounds access in get_imix_entries (CVE-2025-21680)
      * kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693)
      * kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691)
      * kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696)
      * kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702)
      * kernel: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (CVE-2025-21732)
      * kernel: NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795)
      * kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CVE-2024-54456)
      * kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() (CVE-2024-57987)
      * kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014)
      * kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() (CVE-2024-57988)
      * kernel: drm/xe/tracing: Fix a potential TP_printk UAF (CVE-2024-49570)
      * kernel: media: intel/ipu6: remove cpu latency qos request on error (CVE-2024-58004)
      * kernel: usbnet: ipheth: use static NDP16 location in URB (CVE-2025-21742)
      * kernel: usbnet: ipheth: fix possible overflow in DPE length check (CVE-2025-21743)
      * kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links (CVE-2024-57989)
      * kernel: wifi: ath12k: Fix for out-of bound access error (CVE-2024-58015)
      * kernel: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)
      * kernel: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796)
      * kernel: workqueue: Put the pwq after detaching the rescuer from the pool (CVE-2025-21786)
      * kernel: tpm: Change to kvalloc() in eventlog/acpi.c (CVE-2024-58005)
      * kernel: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (CVE-2024-58013)
      * kernel: ring-buffer: Validate the persistent meta data subbuf array (CVE-2025-21777)
      * kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVE-2025-21738)
      * kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections     (CVE-2024-57986)
      * kernel: padata: avoid UAF for reorder_work (CVE-2025-21726)
      * kernel: vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791)
      * kernel: HID: multitouch: Add NULL check in mt_input_configured (CVE-2024-58020)
      * kernel: i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition (CVE-2024-57984)
      * kernel: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() (CVE-2025-21761)
      * kernel: sched_ext: Fix incorrect autogroup migration detection (CVE-2025-21771)
      * kernel: usb: xhci: Fix NULL pointer dereference on certain command aborts (CVE-2024-57981)
      * kernel: memcg: fix soft lockup in the OOM process (CVE-2024-57977)
      * kernel: vxlan: check vxlan_vnigroup_init() return value (CVE-2025-21790)
      * kernel: usbnet: ipheth: fix DPE OoB read (CVE-2025-21741)
      * kernel: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CVE-2025-21785)
      * kernel: ipv6: use RCU protection in ip6_default_advmss() (CVE-2025-21765)
      * kernel: PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() (CVE-2024-58006)
      * kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (CVE-2024-58012)
      * kernel: wifi: brcmfmac: Check the return value of of_property_read_string_index() (CVE-2025-21750)
      * kernel: wifi: rtlwifi: remove unused check_buddy_priv (CVE-2024-58072)
      * kernel: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (CVE-2024-58069)
      * kernel: wifi: mac80211: prohibit deactivating all links (CVE-2024-58061)
      * kernel: idpf: convert workqueues to unbound (CVE-2024-58057)
      * kernel: wifi: mac80211: don't flush non-uploaded STAs (CVE-2025-21828)
      * kernel: netfilter: nf_tables: reject mismatching sum of field_len with set key length (CVE-2025-21826)
      * kernel: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback (CVE-2024-58077)
      * kernel: crypto: tegra - do not transfer req when tegra init fails (CVE-2024-58075)
      * kernel: io_uring/uring_cmd: unconditionally copy SQEs at prep time (CVE-2025-21837)
      * kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350)
      * kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357)
      * kernel: net/sched: cls_api: fix error handling causing NULL dereference (CVE-2025-21857)
      * kernel: bpf: Fix softlockup in arena_map_free on 64k page kernel (CVE-2025-21851)
      * kernel: ibmvnic: Don't reference skb after sending to VIOS (CVE-2025-21855)
      * kernel: smb: client: Add check for next_buffer in receive_encrypted_standard() (CVE-2025-21844)
      * kernel: bpf: avoid holding freeze_mutex during mmap operation (CVE-2025-21853)
      * kernel: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() (CVE-2025-21847)
      * kernel: tcp: drop secpath at the same time as we currently drop dst (CVE-2025-21864)
      * kernel: bpf: Fix deadlock when freeing cgroup storage (CVE-2024-58088)
      * kernel: acct: perform last write from workqueue (CVE-2025-21846)
      * kernel: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()     (CVE-2025-21861)
      * kernel: io_uring: prevent opcode speculation (CVE-2025-21863)
      * kernel: fbdev: hyperv_fb: Allow graceful removal of framebuffer (CVE-2025-21976)
      * kernel: netfilter: nft_tunnel: fix geneve_opt type confusion addition (CVE-2025-22056)
      * kernel: net: ppp: Add bound checking for skb data on ppp_sync_txmung (CVE-2025-37749)
      * microcode_ctl: From CVEorg collector (CVE-2024-28956)
      * kernel: usb: typec: ucsi: displayport: Fix NULL pointer access (CVE-2025-37994)
      * kernel: wifi: ath12k: fix uaf in ath12k_core_init() (CVE-2025-38116)
      * kernel: platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks     (CVE-2025-38412)
      * kernel: dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using     (CVE-2025-38369)
      * kernel: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (CVE-2025-38468)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-205180 advisory.

    - io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CKI Backport Bot) [RHEL-114336]     {CVE-2025-39698}
    - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113611]     {CVE-2025-39730}
    - eventpoll: Fix semi-unbounded recursion (CKI Backport Bot) [RHEL-111050] {CVE-2025-38614}
    - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114850]     {CVE-2025-39751}
    - wifi: ath12k: Decrement TID on RX peer frag setup error handling (CKI Backport Bot) [RHEL-114708]     {CVE-2025-39761}
    - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114691]     {CVE-2025-38729}
    - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CKI Backport Bot) [RHEL-114691]     {CVE-2025-39757}
    - selftests: tls: add tests for zero-length records (Sabrina Dubroca) [RHEL-114324] {CVE-2025-39682}
    - tls: fix handling of zero-length records on the rx_list (Sabrina Dubroca) [RHEL-114324] {CVE-2025-39682}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:20518 advisory.

    * kernel: can: isotp: fix potential CAN frame reception race in isotp_rcv() (CVE-2022-48830)
      * kernel: soc: qcom: cmd-db: Map shared memory as WC, not WB (CVE-2024-46689)
      * kernel: Squashfs: sanity check symbolic link size (CVE-2024-46744)
      * kernel: vfs: fix race between evice_inodes() and find_inode()&iput() (CVE-2024-47679)
      * kernel: x86/tdx: Fix in-kernel MMIO check (CVE-2024-47727)
      * kernel: rxrpc: Fix a race between socket set up and I/O thread creation (CVE-2024-49864)
      * kernel: io_uring: check if we need to reschedule during overflow flush (CVE-2024-50060)
      * kernel: can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods (CVE-2022-49024)
      * kernel: posix-clock: Fix missing timespec64 check in pc_clock_settime() (CVE-2024-50195)
      * kernel: rxrpc: Fix missing locking causing hanging calls (CVE-2024-50294)
      * kernel: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write (CVE-2024-53052)
      * kernel: afs: Fix lock recursion (CVE-2024-53090)
      * kernel: virtio/vsock: Fix accept_queue memory leak (CVE-2024-53119)
      * kernel: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (CVE-2024-53135)
      * kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466)     (CVE-2024-53241)
      * kernel: RDMA/rxe: Fix the qp flush warnings in req (CVE-2024-53229)
      * kernel: block: fix uaf for flush rq while iterating tags (CVE-2024-53170)
      * kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216)
      * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603)
      * kernel: blk-cgroup: Fix UAF in blkcg_unpin_online() (CVE-2024-56672)
      * kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662)
      * kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675)
      * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)
      * kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY     (CVE-2024-56690)
      * kernel: io_uring: check if iowq is killed before queuing (CVE-2024-56709)
      * kernel: rtc: check if __rtc_read_time was successful in rtc_timer_do_work() (CVE-2024-56739)
      * kernel: bpf: put bpf_link's program when link is safe to be deallocated (CVE-2024-56786)
      * kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332)
      * kernel: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (CVE-2024-53680)
      * kernel: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (CVE-2025-21648)
      * kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647)
      * kernel: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() (CVE-2025-21631)
      * kernel: zram: fix potential UAF of zram table (CVE-2025-21671)
      * kernel: afs: Fix merge preference rule failure condition (CVE-2025-21672)
      * kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693)
      * kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691)
      * kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696)
      * kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702)
      * kernel: usbnet: fix memory leak in error case (CVE-2022-49657)
      * kernel: powerpc/xics: fix refcount leak in icp_opal_init() (CVE-2022-49432)
      * kernel: net: tun: unlink NAPI from device on destruction (CVE-2022-49672)
      * kernel: powerpc/papr_scm: don't requests stats with '0' sized stats buffer (CVE-2022-49353)
      * kernel: powerpc/xive: Fix refcount leak in xive_spapr_init (CVE-2022-49437)
      * kernel: ima: Fix potential memory leak in ima_init_crypto() (CVE-2022-49627)
      * kernel: linux/dim: Fix divide by 0 in RDMA DIM (CVE-2022-49670)
      * kernel: can: isotp: sanitize CAN ID checks in isotp_bind() (CVE-2022-49269)
      * kernel: ima: Fix a potential integer overflow in ima_appraise_measurement (CVE-2022-49643)
      * kernel: powerpc/xive/spapr: correct bitmap allocation size (CVE-2022-49623)
      * kernel: efi: Do not import certificates from UEFI Secure Boot for T2 Macs (CVE-2022-49357)
      * kernel: list: fix a data-race around ep->rdllist (CVE-2022-49443)
      * kernel: tracing/histograms: Fix memory leak problem (CVE-2022-49648)
      * kernel: Input: synaptics - fix crash when enabling pass-through port (CVE-2025-21746)
      * kernel: NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795)
      * kernel: bpf: Send signals asynchronously if !preemptible (CVE-2025-21728)
      * kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CVE-2024-54456)
      * kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() (CVE-2024-57987)
      * kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014)
      * kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() (CVE-2024-57988)
      * kernel: RDMA/mlx5: Fix implicit ODP use after free (CVE-2025-21714)
      * kernel: drm/xe/tracing: Fix a potential TP_printk UAF (CVE-2024-49570)
      * kernel: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check     (CVE-2024-57993)
      * kernel: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (CVE-2025-21729)
      * kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links (CVE-2024-57989)
      * kernel: wifi: ath12k: Fix for out-of bound access error (CVE-2024-58015)
      * kernel: OPP: add index check to assert to avoid buffer overflow in _read_freq() (CVE-2024-57998)
      * kernel: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)
      * kernel: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796)
      * kernel: scsi: ufs: core: Fix use-after free in init error and remove paths (CVE-2025-21739)
      * kernel: workqueue: Put the pwq after detaching the rescuer from the pool (CVE-2025-21786)
      * kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVE-2025-21738)
      * kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections     (CVE-2024-57986)
      * kernel: padata: avoid UAF for reorder_work (CVE-2025-21726)
      * kernel: vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791)
      * kernel: team: better TEAM_OPTION_TYPE_STRING validation (CVE-2025-21787)
      * kernel: usb: xhci: Fix NULL pointer dereference on certain command aborts (CVE-2024-57981)
      * kernel: vxlan: check vxlan_vnigroup_init() return value (CVE-2025-21790)
      * kernel: wifi: mt76: mt7925: fix off by one in mt7925_load_clc() (CVE-2024-57990)
      * kernel: ipv6: use RCU protection in ip6_default_advmss() (CVE-2025-21765)
      * kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (CVE-2024-58012)
      * kernel: blk-cgroup: Fix class @block_class's subsystem refcount leakage (CVE-2025-21745)
      * kernel: net: let net.core.dev_weight always be non-zero (CVE-2025-21806)
      * kernel: wifi: rtlwifi: remove unused check_buddy_priv (CVE-2024-58072)
      * kernel: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (CVE-2024-58068)
      * kernel: wifi: iwlwifi: mvm: avoid NULL pointer dereference (CVE-2024-58062)
      * kernel: idpf: convert workqueues to unbound (CVE-2024-58057)
      * kernel: wifi: mac80211: don't flush non-uploaded STAs (CVE-2025-21828)
      * kernel: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (CVE-2024-58083)
      * kernel: netfilter: nf_tables: reject mismatching sum of field_len with set key length (CVE-2025-21826)
      * kernel: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback (CVE-2024-58077)
      * kernel: crypto: tegra - do not transfer req when tegra init fails (CVE-2024-58075)
      * kernel: RDMA/rxe: Fix the warning __rxe_cleanup+0x12c/0x170 [rdma_rxe] (CVE-2025-21829)
      * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839)
      * kernel: io_uring/uring_cmd: unconditionally copy SQEs at prep time (CVE-2025-21837)
      * kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350)
      * kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357)
      * kernel: bpf: Fix softlockup in arena_map_free on 64k page kernel (CVE-2025-21851)
      * kernel: ibmvnic: Don't reference skb after sending to VIOS (CVE-2025-21855)
      * kernel: smb: client: Add check for next_buffer in receive_encrypted_standard() (CVE-2025-21844)
      * kernel: bpf: avoid holding freeze_mutex during mmap operation (CVE-2025-21853)
      * kernel: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() (CVE-2025-21847)
      * kernel: tcp: drop secpath at the same time as we currently drop dst (CVE-2025-21864)
      * kernel: bpf: Fix deadlock when freeing cgroup storage (CVE-2024-58088)
      * kernel: acct: perform last write from workqueue (CVE-2025-21846)
      * kernel: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()     (CVE-2025-21861)
      * kernel: io_uring: prevent opcode speculation (CVE-2025-21863)
      * kernel: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() (CVE-2025-21848)
      * kernel: netfilter: nft_tunnel: fix geneve_opt type confusion addition (CVE-2025-22056)
      * kernel: can: j1939: j1939_send_one(): fix missing CAN header initialization (CVE-2022-49845)
      * kernel: usb: typec: ucsi: displayport: Fix NULL pointer access (CVE-2025-37994)
      * kernel: wifi: ath12k: fix uaf in ath12k_core_init() (CVE-2025-38116)
      * kernel: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (CVE-2025-38396)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20518 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: can: isotp: fix potential CAN frame reception race in isotp_rcv() (CVE-2022-48830)

    * kernel: soc: qcom: cmd-db: Map shared memory as WC, not WB (CVE-2024-46689)

    * kernel: Squashfs: sanity check symbolic link size (CVE-2024-46744)

    * kernel: vfs: fix race between evice_inodes() and find_inode()&iput() (CVE-2024-47679)

    * kernel: x86/tdx: Fix in-kernel MMIO check (CVE-2024-47727)

    * kernel: rxrpc: Fix a race between socket set up and I/O thread creation (CVE-2024-49864)

    * kernel: io_uring: check if we need to reschedule during overflow flush (CVE-2024-50060)

    * kernel: can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods (CVE-2022-49024)

    * kernel: posix-clock: Fix missing timespec64 check in pc_clock_settime() (CVE-2024-50195)

    * kernel: rxrpc: Fix missing locking causing hanging calls (CVE-2024-50294)

    * kernel: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write (CVE-2024-53052)

    * kernel: afs: Fix lock recursion (CVE-2024-53090)

    * kernel: virtio/vsock: Fix accept_queue memory leak (CVE-2024-53119)

    * kernel: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (CVE-2024-53135)

    * kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466)     (CVE-2024-53241)

    * kernel: RDMA/rxe: Fix the qp flush warnings in req (CVE-2024-53229)

    * kernel: block: fix uaf for flush rq while iterating tags (CVE-2024-53170)

    * kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216)

    * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603)

    * kernel: blk-cgroup: Fix UAF in blkcg_unpin_online() (CVE-2024-56672)

    * kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662)

    * kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675)

    * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)

    * kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY     (CVE-2024-56690)

    * kernel: io_uring: check if iowq is killed before queuing (CVE-2024-56709)

    * kernel: rtc: check if __rtc_read_time was successful in rtc_timer_do_work() (CVE-2024-56739)

    * kernel: bpf: put bpf_link's program when link is safe to be deallocated (CVE-2024-56786)

    * kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332)

    * kernel: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (CVE-2024-53680)

    * kernel: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (CVE-2025-21648)

    * kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647)

    * kernel: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() (CVE-2025-21631)

    * kernel: zram: fix potential UAF of zram table (CVE-2025-21671)

    * kernel: afs: Fix merge preference rule failure condition (CVE-2025-21672)

    * kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693)

    * kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691)

    * kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696)

    * kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702)

    * kernel: usbnet: fix memory leak in error case (CVE-2022-49657)

    * kernel: powerpc/xics: fix refcount leak in icp_opal_init() (CVE-2022-49432)

    * kernel: net: tun: unlink NAPI from device on destruction (CVE-2022-49672)

    * kernel: powerpc/papr_scm: don't requests stats with '0' sized stats buffer (CVE-2022-49353)

    * kernel: powerpc/xive: Fix refcount leak in xive_spapr_init (CVE-2022-49437)

    * kernel: ima: Fix potential memory leak in ima_init_crypto() (CVE-2022-49627)

    * kernel: linux/dim: Fix divide by 0 in RDMA DIM (CVE-2022-49670)

    * kernel: can: isotp: sanitize CAN ID checks in isotp_bind() (CVE-2022-49269)

    * kernel: ima: Fix a potential integer overflow in ima_appraise_measurement (CVE-2022-49643)

    * kernel: powerpc/xive/spapr: correct bitmap allocation size (CVE-2022-49623)

    * kernel: efi: Do not import certificates from UEFI Secure Boot for T2 Macs (CVE-2022-49357)

    * kernel: list: fix a data-race around ep->rdllist (CVE-2022-49443)

    * kernel: tracing/histograms: Fix memory leak problem (CVE-2022-49648)

    * kernel: Input: synaptics - fix crash when enabling pass-through port (CVE-2025-21746)

    * kernel: NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795)

    * kernel: bpf: Send signals asynchronously if !preemptible (CVE-2025-21728)

    * kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CVE-2024-54456)

    * kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() (CVE-2024-57987)

    * kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014)

    * kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() (CVE-2024-57988)

    * kernel: RDMA/mlx5: Fix implicit ODP use after free (CVE-2025-21714)

    * kernel: drm/xe/tracing: Fix a potential TP_printk UAF (CVE-2024-49570)

    * kernel: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check     (CVE-2024-57993)

    * kernel: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (CVE-2025-21729)

    * kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links (CVE-2024-57989)

    * kernel: wifi: ath12k: Fix for out-of bound access error (CVE-2024-58015)

    * kernel: OPP: add index check to assert to avoid buffer overflow in _read_freq() (CVE-2024-57998)

    * kernel: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)

    * kernel: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796)

    * kernel: scsi: ufs: core: Fix use-after free in init error and remove paths (CVE-2025-21739)

    * kernel: workqueue: Put the pwq after detaching the rescuer from the pool (CVE-2025-21786)

    * kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVE-2025-21738)

    * kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections     (CVE-2024-57986)

    * kernel: padata: avoid UAF for reorder_work (CVE-2025-21726)

    * kernel: vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791)

    * kernel: team: better TEAM_OPTION_TYPE_STRING validation (CVE-2025-21787)

    * kernel: usb: xhci: Fix NULL pointer dereference on certain command aborts (CVE-2024-57981)

    * kernel: vxlan: check vxlan_vnigroup_init() return value (CVE-2025-21790)

    * kernel: wifi: mt76: mt7925: fix off by one in mt7925_load_clc() (CVE-2024-57990)

    * kernel: ipv6: use RCU protection in ip6_default_advmss() (CVE-2025-21765)

    * kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (CVE-2024-58012)

    * kernel: blk-cgroup: Fix class @block_class's subsystem refcount leakage (CVE-2025-21745)

    * kernel: net: let net.core.dev_weight always be non-zero (CVE-2025-21806)

    * kernel: wifi: rtlwifi: remove unused check_buddy_priv (CVE-2024-58072)

    * kernel: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (CVE-2024-58068)

    * kernel: wifi: iwlwifi: mvm: avoid NULL pointer dereference (CVE-2024-58062)

    * kernel: idpf: convert workqueues to unbound (CVE-2024-58057)

    * kernel: wifi: mac80211: don't flush non-uploaded STAs (CVE-2025-21828)

    * kernel: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (CVE-2024-58083)

    * kernel: netfilter: nf_tables: reject mismatching sum of field_len with set key length (CVE-2025-21826)

    * kernel: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback (CVE-2024-58077)

    * kernel: crypto: tegra - do not transfer req when tegra init fails (CVE-2024-58075)

    * kernel: RDMA/rxe: Fix the warning __rxe_cleanup+0x12c/0x170 [rdma_rxe] (CVE-2025-21829)

    * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839)

    * kernel: io_uring/uring_cmd: unconditionally copy SQEs at prep time (CVE-2025-21837)

    * kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350)

    * kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357)

    * kernel: bpf: Fix softlockup in arena_map_free on 64k page kernel (CVE-2025-21851)

    * kernel: ibmvnic: Don't reference skb after sending to VIOS (CVE-2025-21855)

    * kernel: smb: client: Add check for next_buffer in receive_encrypted_standard() (CVE-2025-21844)

    * kernel: bpf: avoid holding freeze_mutex during mmap operation (CVE-2025-21853)

    * kernel: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() (CVE-2025-21847)

    * kernel: tcp: drop secpath at the same time as we currently drop dst (CVE-2025-21864)

    * kernel: bpf: Fix deadlock when freeing cgroup storage (CVE-2024-58088)

    * kernel: acct: perform last write from workqueue (CVE-2025-21846)

    * kernel: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()     (CVE-2025-21861)

    * kernel: io_uring: prevent opcode speculation (CVE-2025-21863)

    * kernel: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() (CVE-2025-21848)

    * kernel: netfilter: nft_tunnel: fix geneve_opt type confusion addition (CVE-2025-22056)

    * kernel: can: j1939: j1939_send_one(): fix missing CAN header initialization (CVE-2022-49845)

    * kernel: usb: typec: ucsi: displayport: Fix NULL pointer access (CVE-2025-37994)

    * kernel: wifi: ath12k: fix uaf in ath12k_core_init() (CVE-2025-38116)

    * kernel: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (CVE-2025-38396)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20095 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466)     (CVE-2024-53241)

    * kernel: exfat: fix out-of-bounds access of directory entries (CVE-2024-53147)

    * kernel: zram: fix NULL pointer in comp_algorithm_show() (CVE-2024-53222)

    * kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216)

    * kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662)

    * kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675)

    * kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY     (CVE-2024-56690)

    * kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332)

    * kernel: af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK (CVE-2024-57901)

    * kernel: af_packet: fix vlan_get_tci() vs MSG_PEEK (CVE-2024-57902)

    * kernel: io_uring/sqpoll: zero sqd->thread on tctx errors (CVE-2025-21633)

    * kernel: ipvlan: Fix use-after-free in ipvlan_get_iflink(). (CVE-2025-21652)

    * kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647)

    * kernel: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period (CVE-2025-21655)

    * kernel: netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled (CVE-2024-57941)

    * kernel: netfs: Fix ceph copy to cache on write-begin (CVE-2024-57942)

    * kernel: zram: fix potential UAF of zram table (CVE-2025-21671)

    * kernel: pktgen: Avoid out-of-bounds access in get_imix_entries (CVE-2025-21680)

    * kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693)

    * kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691)

    * kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696)

    * kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702)

    * kernel: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (CVE-2025-21732)

    * kernel: NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795)

    * kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CVE-2024-54456)

    * kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() (CVE-2024-57987)

    * kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014)

    * kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() (CVE-2024-57988)

    * kernel: drm/xe/tracing: Fix a potential TP_printk UAF (CVE-2024-49570)

    * kernel: media: intel/ipu6: remove cpu latency qos request on error (CVE-2024-58004)

    * kernel: usbnet: ipheth: use static NDP16 location in URB (CVE-2025-21742)

    * kernel: usbnet: ipheth: fix possible overflow in DPE length check (CVE-2025-21743)

    * kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links (CVE-2024-57989)

    * kernel: wifi: ath12k: Fix for out-of bound access error (CVE-2024-58015)

    * kernel: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)

    * kernel: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796)

    * kernel: workqueue: Put the pwq after detaching the rescuer from the pool (CVE-2025-21786)

    * kernel: tpm: Change to kvalloc() in eventlog/acpi.c (CVE-2024-58005)

    * kernel: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (CVE-2024-58013)

    * kernel: ring-buffer: Validate the persistent meta data subbuf array (CVE-2025-21777)

    * kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVE-2025-21738)

    * kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections     (CVE-2024-57986)

    * kernel: padata: avoid UAF for reorder_work (CVE-2025-21726)

    * kernel: vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791)

    * kernel: HID: multitouch: Add NULL check in mt_input_configured (CVE-2024-58020)

    * kernel: i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition (CVE-2024-57984)

    * kernel: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() (CVE-2025-21761)

    * kernel: sched_ext: Fix incorrect autogroup migration detection (CVE-2025-21771)

    * kernel: usb: xhci: Fix NULL pointer dereference on certain command aborts (CVE-2024-57981)

    * kernel: memcg: fix soft lockup in the OOM process (CVE-2024-57977)

    * kernel: vxlan: check vxlan_vnigroup_init() return value (CVE-2025-21790)

    * kernel: usbnet: ipheth: fix DPE OoB read (CVE-2025-21741)

    * kernel: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CVE-2025-21785)

    * kernel: ipv6: use RCU protection in ip6_default_advmss() (CVE-2025-21765)

    * kernel: PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() (CVE-2024-58006)

    * kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (CVE-2024-58012)

    * kernel: wifi: brcmfmac: Check the return value of of_property_read_string_index() (CVE-2025-21750)

    * kernel: wifi: rtlwifi: remove unused check_buddy_priv (CVE-2024-58072)

    * kernel: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (CVE-2024-58069)

    * kernel: wifi: mac80211: prohibit deactivating all links (CVE-2024-58061)

    * kernel: idpf: convert workqueues to unbound (CVE-2024-58057)

    * kernel: wifi: mac80211: don't flush non-uploaded STAs (CVE-2025-21828)

    * kernel: netfilter: nf_tables: reject mismatching sum of field_len with set key length (CVE-2025-21826)

    * kernel: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback (CVE-2024-58077)

    * kernel: crypto: tegra - do not transfer req when tegra init fails (CVE-2024-58075)

    * kernel: io_uring/uring_cmd: unconditionally copy SQEs at prep time (CVE-2025-21837)

    * kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350)

    * kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357)

    * kernel: net/sched: cls_api: fix error handling causing NULL dereference (CVE-2025-21857)

    * kernel: bpf: Fix softlockup in arena_map_free on 64k page kernel (CVE-2025-21851)

    * kernel: ibmvnic: Don't reference skb after sending to VIOS (CVE-2025-21855)

    * kernel: smb: client: Add check for next_buffer in receive_encrypted_standard() (CVE-2025-21844)

    * kernel: bpf: avoid holding freeze_mutex during mmap operation (CVE-2025-21853)

    * kernel: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() (CVE-2025-21847)

    * kernel: tcp: drop secpath at the same time as we currently drop dst (CVE-2025-21864)

    * kernel: bpf: Fix deadlock when freeing cgroup storage (CVE-2024-58088)

    * kernel: acct: perform last write from workqueue (CVE-2025-21846)

    * kernel: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()     (CVE-2025-21861)

    * kernel: io_uring: prevent opcode speculation (CVE-2025-21863)

    * kernel: fbdev: hyperv_fb: Allow graceful removal of framebuffer (CVE-2025-21976)

    * kernel: netfilter: nft_tunnel: fix geneve_opt type confusion addition (CVE-2025-22056)

    * kernel: net: ppp: Add bound checking for skb data on ppp_sync_txmung (CVE-2025-37749)

    * microcode_ctl: From CVEorg collector (CVE-2024-28956)

    * kernel: usb: typec: ucsi: displayport: Fix NULL pointer access (CVE-2025-37994)

    * kernel: wifi: ath12k: fix uaf in ath12k_core_init() (CVE-2025-38116)

    * kernel: platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (CVE-2025-38412)

    * kernel: dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using     (CVE-2025-38369)

    * kernel: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (CVE-2025-38468)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7789-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - PowerPC architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - ACPI drivers;

    - Android drivers;

    - Bluetooth drivers;

    - Bus devices;

    - Clock framework and drivers;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - DMA engine subsystem;

    - EDAC drivers;

    - Arm Firmware Framework for ARMv8-A(FFA);

    - FPGA Framework;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - HW tracing;

    - InfiniBand drivers;

    - IOMMU subsystem;

    - Multiple devices driver;

    - Media drivers;

    - VMware VMCI Driver;

    - MTD block device drivers;

    - Network drivers;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - NVDIMM (Non-Volatile Memory Device) drivers;

    - NVME drivers;

    - NVMEM (Non Volatile Memory) drivers;

    - PCI subsystem;

    - Amlogic Meson DDR PMU;

    - NI-700 PMU driver;

    - PHY drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - PTP clock framework;

    - SCSI subsystem;

    - ASPEED SoC drivers;

    - SPI subsystem;

    - TCM subsystem;

    - Thunderbolt and USB4 drivers;

    - TTY drivers;

    - UFS subsystem;

    - USB core drivers;

    - USB Gadget drivers;

    - Renesas USBHS Controller drivers;

    - USB Type-C Port Controller Manager driver;

    - VFIO drivers;

    - Virtio Host (VHOST) subsystem;

    - Backlight driver;

    - Framebuffer layer;

    - Virtio drivers;

    - BTRFS file system;

    - EROFS file system;

    - F2FS file system;

    - File systems infrastructure;

    - Network file systems library;

    - NTFS3 file system;

    - SMB network file system;

    - Codetag library;

    - BPF subsystem;

    - LZO compression library;

    - Mellanox drivers;

    - IPv4 networking;

    - Bluetooth subsystem;

    - Network sockets;

    - XFRM subsystem;

    - Digital Audio (PCM) driver;

    - Tracing infrastructure;

    - io_uring subsystem;

    - Padata parallel execution mechanism;

    - DVFS energy model driver;

    - Restartable seuqences system call mechanism;

    - Timer subsystem;

    - Memory management;

    - KASAN memory debugging framework;

    - CAN network layer;

    - Networking core;

    - IPv6 networking;

    - Netfilter;

    - NetLabel subsystem;

    - Open vSwitch;

    - Network traffic control;

    - TIPC protocol;

    - TLS protocol;

    - ALSA framework;

    - sma1307 audio codecs;

    - Intel ASoC drivers;

    - MediaTek ASoC drivers;

    - USB sound devices; (CVE-2025-38137, CVE-2025-38141, CVE-2025-38035, CVE-2025-38298, CVE-2025-38042,     CVE-2025-38140, CVE-2025-38138, CVE-2025-38316, CVE-2025-38304, CVE-2025-38165, CVE-2025-38306,     CVE-2025-38082, CVE-2025-38132, CVE-2025-38498, CVE-2025-38158, CVE-2025-38154, CVE-2025-38064,     CVE-2025-38129, CVE-2025-38096, CVE-2025-38352, CVE-2025-38303, CVE-2025-38122, CVE-2025-38048,     CVE-2025-38296, CVE-2025-38149, CVE-2025-38319, CVE-2025-38078, CVE-2025-38066, CVE-2025-38099,     CVE-2025-38291, CVE-2025-38267, CVE-2025-38268, CVE-2025-38126, CVE-2025-38076, CVE-2025-38077,     CVE-2025-38101, CVE-2025-38071, CVE-2025-38163, CVE-2025-38285, CVE-2025-38265, CVE-2025-38125,     CVE-2025-38302, CVE-2025-38172, CVE-2025-38292, CVE-2025-38279, CVE-2025-38170, CVE-2025-38062,     CVE-2025-38074, CVE-2025-38050, CVE-2025-38116, CVE-2025-38414, CVE-2025-38173, CVE-2025-38033,     CVE-2025-38112, CVE-2025-38091, CVE-2025-38290, CVE-2025-39890, CVE-2025-38156, CVE-2025-38289,     CVE-2025-38275, CVE-2025-38295, CVE-2025-38123, CVE-2025-38300, CVE-2025-38067, CVE-2025-38131,     CVE-2025-38294, CVE-2025-38105, CVE-2025-38107, CVE-2025-38106, CVE-2025-38069, CVE-2025-38041,     CVE-2025-38111, CVE-2025-38312, CVE-2025-38092, CVE-2025-38054, CVE-2025-38166, CVE-2025-38044,     CVE-2025-38159, CVE-2025-38061, CVE-2025-38115, CVE-2025-38058, CVE-2025-38036, CVE-2025-38100,     CVE-2025-38075, CVE-2025-38160, CVE-2025-38102, CVE-2025-38269, CVE-2025-38108, CVE-2025-38119,     CVE-2025-38052, CVE-2025-38175, CVE-2025-38103, CVE-2025-38286, CVE-2025-38051, CVE-2025-38004,     CVE-2025-38283, CVE-2025-38118, CVE-2025-38139, CVE-2025-38079, CVE-2025-38315, CVE-2025-38145,     CVE-2025-38072, CVE-2025-38045, CVE-2025-38117, CVE-2025-38143, CVE-2025-38068, CVE-2025-38053,     CVE-2025-38081, CVE-2025-38032, CVE-2025-38134, CVE-2025-38063, CVE-2025-38128, CVE-2025-38278,     CVE-2025-38270, CVE-2025-38060, CVE-2025-38161, CVE-2025-38073, CVE-2025-38065, CVE-2025-38313,     CVE-2025-38148, CVE-2025-38124, CVE-2025-38305, CVE-2025-38146, CVE-2025-38047, CVE-2025-38055,     CVE-2025-38169, CVE-2025-38120, CVE-2025-38164, CVE-2025-38070, CVE-2025-38176, CVE-2025-38282,     CVE-2025-38288, CVE-2025-38274, CVE-2025-38113, CVE-2025-38174, CVE-2025-38301, CVE-2025-38293,     CVE-2025-38136, CVE-2025-38311, CVE-2025-38039, CVE-2025-38297, CVE-2025-38155, CVE-2025-38307,     CVE-2025-38147, CVE-2025-38043, CVE-2025-38109, CVE-2025-38281, CVE-2025-38280, CVE-2025-38127,     CVE-2025-38057, CVE-2025-38029, CVE-2025-38038, CVE-2025-38167, CVE-2025-38151, CVE-2025-38415,     CVE-2025-38317, CVE-2025-38031, CVE-2025-38162, CVE-2025-38098, CVE-2025-38130, CVE-2025-38114,     CVE-2025-38142, CVE-2025-38135, CVE-2025-38299, CVE-2025-38272, CVE-2025-38277, CVE-2025-38037,     CVE-2025-38088, CVE-2025-38287, CVE-2025-38168, CVE-2025-38003, CVE-2025-38284, CVE-2025-38499,     CVE-2025-38097, CVE-2025-38318, CVE-2025-38059, CVE-2025-38040, CVE-2025-38314, CVE-2025-38110,     CVE-2025-38157, CVE-2025-38153, CVE-2025-38080, CVE-2025-38034, CVE-2025-38310)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 25.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7769-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - PowerPC architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - ACPI drivers;

    - Android drivers;

    - Bluetooth drivers;

    - Bus devices;

    - Clock framework and drivers;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - DMA engine subsystem;

    - EDAC drivers;

    - Arm Firmware Framework for ARMv8-A(FFA);

    - FPGA Framework;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - HW tracing;

    - InfiniBand drivers;

    - IOMMU subsystem;

    - Multiple devices driver;

    - Media drivers;

    - VMware VMCI Driver;

    - MTD block device drivers;

    - Network drivers;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - NVDIMM (Non-Volatile Memory Device) drivers;

    - NVME drivers;

    - NVMEM (Non Volatile Memory) drivers;

    - PCI subsystem;

    - Amlogic Meson DDR PMU;

    - NI-700 PMU driver;

    - PHY drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - PTP clock framework;

    - SCSI subsystem;

    - ASPEED SoC drivers;

    - SPI subsystem;

    - TCM subsystem;

    - Thunderbolt and USB4 drivers;

    - TTY drivers;

    - UFS subsystem;

    - USB core drivers;

    - USB Gadget drivers;

    - Renesas USBHS Controller drivers;

    - USB Type-C Port Controller Manager driver;

    - VFIO drivers;

    - Virtio Host (VHOST) subsystem;

    - Backlight driver;

    - Framebuffer layer;

    - Virtio drivers;

    - BTRFS file system;

    - EROFS file system;

    - F2FS file system;

    - File systems infrastructure;

    - Network file systems library;

    - NTFS3 file system;

    - SMB network file system;

    - Codetag library;

    - BPF subsystem;

    - LZO compression library;

    - Mellanox drivers;

    - IPv4 networking;

    - Bluetooth subsystem;

    - Network sockets;

    - XFRM subsystem;

    - Digital Audio (PCM) driver;

    - Tracing infrastructure;

    - io_uring subsystem;

    - Padata parallel execution mechanism;

    - DVFS energy model driver;

    - Restartable seuqences system call mechanism;

    - Timer subsystem;

    - Memory management;

    - KASAN memory debugging framework;

    - CAN network layer;

    - Networking core;

    - IPv6 networking;

    - Netfilter;

    - NetLabel subsystem;

    - Open vSwitch;

    - Network traffic control;

    - TIPC protocol;

    - TLS protocol;

    - ALSA framework;

    - sma1307 audio codecs;

    - Intel ASoC drivers;

    - MediaTek ASoC drivers;

    - USB sound devices; (CVE-2025-38122, CVE-2025-38119, CVE-2025-38071, CVE-2025-38310, CVE-2025-38166,     CVE-2025-38055, CVE-2025-38292, CVE-2025-38078, CVE-2025-38134, CVE-2025-38063, CVE-2025-38282,     CVE-2025-38059, CVE-2025-38112, CVE-2025-38082, CVE-2025-38296, CVE-2025-38126, CVE-2025-38136,     CVE-2025-38075, CVE-2025-38042, CVE-2025-38113, CVE-2025-38003, CVE-2025-38318, CVE-2025-38156,     CVE-2025-38290, CVE-2025-38102, CVE-2025-38076, CVE-2025-38097, CVE-2025-38313, CVE-2025-38298,     CVE-2025-38300, CVE-2025-38169, CVE-2025-38131, CVE-2025-38301, CVE-2025-38050, CVE-2025-38139,     CVE-2025-38305, CVE-2025-38317, CVE-2025-38045, CVE-2025-38040, CVE-2025-38279, CVE-2025-38123,     CVE-2025-38074, CVE-2025-38111, CVE-2025-38117, CVE-2025-38069, CVE-2025-38035, CVE-2025-38128,     CVE-2025-38277, CVE-2025-38061, CVE-2025-38306, CVE-2025-38051, CVE-2025-38124, CVE-2025-38291,     CVE-2025-38130, CVE-2025-38319, CVE-2025-38272, CVE-2025-38175, CVE-2025-38176, CVE-2025-38070,     CVE-2025-38032, CVE-2025-38151, CVE-2025-38107, CVE-2025-38103, CVE-2025-38274, CVE-2025-38163,     CVE-2025-38293, CVE-2025-38064, CVE-2025-38498, CVE-2025-38039, CVE-2025-38173, CVE-2025-38038,     CVE-2025-38135, CVE-2025-38149, CVE-2025-38142, CVE-2025-38414, CVE-2025-38120, CVE-2025-38106,     CVE-2025-38092, CVE-2025-38091, CVE-2025-38415, CVE-2025-38294, CVE-2025-38043, CVE-2025-38147,     CVE-2025-38037, CVE-2025-38108, CVE-2025-38088, CVE-2025-38316, CVE-2025-38312, CVE-2025-38352,     CVE-2025-38115, CVE-2025-38161, CVE-2025-38036, CVE-2025-38275, CVE-2025-38098, CVE-2025-38132,     CVE-2025-38146, CVE-2025-38288, CVE-2025-38143, CVE-2025-38278, CVE-2025-38155, CVE-2025-38047,     CVE-2025-38160, CVE-2025-38053, CVE-2025-38072, CVE-2025-38140, CVE-2025-38141, CVE-2025-38068,     CVE-2025-38058, CVE-2025-38062, CVE-2025-38303, CVE-2025-38164, CVE-2025-38101, CVE-2025-38145,     CVE-2025-38105, CVE-2025-38295, CVE-2025-38284, CVE-2025-38137, CVE-2025-38073, CVE-2025-38269,     CVE-2025-38118, CVE-2025-38165, CVE-2025-38162, CVE-2025-38170, CVE-2025-38114, CVE-2025-38066,     CVE-2025-38116, CVE-2025-38315, CVE-2025-38153, CVE-2025-38031, CVE-2025-38041, CVE-2025-38168,     CVE-2025-38499, CVE-2025-38048, CVE-2025-38158, CVE-2025-38060, CVE-2025-38299, CVE-2025-38286,     CVE-2025-38125, CVE-2025-38297, CVE-2025-38270, CVE-2025-38044, CVE-2025-38080, CVE-2025-38096,     CVE-2025-38314, CVE-2025-38307, CVE-2025-38174, CVE-2025-38267, CVE-2025-38304, CVE-2025-38057,     CVE-2025-38065, CVE-2025-38311, CVE-2025-38302, CVE-2025-38138, CVE-2025-38033, CVE-2025-38079,     CVE-2025-38280, CVE-2025-38109, CVE-2025-38287, CVE-2025-38159, CVE-2025-38289, CVE-2025-38283,     CVE-2025-38081, CVE-2025-38172, CVE-2025-38148, CVE-2025-38285, CVE-2025-38034, CVE-2025-38154,     CVE-2025-38077, CVE-2025-38054, CVE-2025-38029, CVE-2025-38127, CVE-2025-38281, CVE-2025-38100,     CVE-2025-38129, CVE-2025-38004, CVE-2025-38099, CVE-2025-38157, CVE-2025-38067, CVE-2025-38265,     CVE-2025-38052, CVE-2025-38110, CVE-2025-38268, CVE-2025-38167)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 25.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7770-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - PowerPC architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - ACPI drivers;

    - Android drivers;

    - Bluetooth drivers;

    - Bus devices;

    - Clock framework and drivers;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - DMA engine subsystem;

    - EDAC drivers;

    - Arm Firmware Framework for ARMv8-A(FFA);

    - FPGA Framework;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - HW tracing;

    - InfiniBand drivers;

    - IOMMU subsystem;

    - Multiple devices driver;

    - Media drivers;

    - VMware VMCI Driver;

    - MTD block device drivers;

    - Network drivers;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - NVDIMM (Non-Volatile Memory Device) drivers;

    - NVME drivers;

    - NVMEM (Non Volatile Memory) drivers;

    - PCI subsystem;

    - Amlogic Meson DDR PMU;

    - NI-700 PMU driver;

    - PHY drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - PTP clock framework;

    - SCSI subsystem;

    - ASPEED SoC drivers;

    - SPI subsystem;

    - TCM subsystem;

    - Thunderbolt and USB4 drivers;

    - TTY drivers;

    - UFS subsystem;

    - USB core drivers;

    - USB Gadget drivers;

    - Renesas USBHS Controller drivers;

    - USB Type-C Port Controller Manager driver;

    - VFIO drivers;

    - Virtio Host (VHOST) subsystem;

    - Backlight driver;

    - Framebuffer layer;

    - Virtio drivers;

    - BTRFS file system;

    - EROFS file system;

    - F2FS file system;

    - File systems infrastructure;

    - Network file systems library;

    - NTFS3 file system;

    - SMB network file system;

    - Codetag library;

    - BPF subsystem;

    - LZO compression library;

    - Mellanox drivers;

    - IPv4 networking;

    - Bluetooth subsystem;

    - Network sockets;

    - XFRM subsystem;

    - Digital Audio (PCM) driver;

    - Tracing infrastructure;

    - io_uring subsystem;

    - Padata parallel execution mechanism;

    - DVFS energy model driver;

    - Restartable seuqences system call mechanism;

    - Timer subsystem;

    - Memory management;

    - KASAN memory debugging framework;

    - CAN network layer;

    - Networking core;

    - IPv6 networking;

    - Netfilter;

    - NetLabel subsystem;

    - Open vSwitch;

    - Network traffic control;

    - TIPC protocol;

    - TLS protocol;

    - ALSA framework;

    - sma1307 audio codecs;

    - Intel ASoC drivers;

    - MediaTek ASoC drivers;

    - USB sound devices; (CVE-2025-38155, CVE-2025-38145, CVE-2025-38072, CVE-2025-38306, CVE-2025-38004,     CVE-2025-38053, CVE-2025-38293, CVE-2025-38045, CVE-2025-38105, CVE-2025-38079, CVE-2025-38161,     CVE-2025-38031, CVE-2025-38114, CVE-2025-38033, CVE-2025-38274, CVE-2025-38265, CVE-2025-38135,     CVE-2025-38075, CVE-2025-38313, CVE-2025-38064, CVE-2025-38118, CVE-2025-38299, CVE-2025-38123,     CVE-2025-38112, CVE-2025-38073, CVE-2025-38070, CVE-2025-38138, CVE-2025-38303, CVE-2025-38148,     CVE-2025-38035, CVE-2025-38157, CVE-2025-38131, CVE-2025-38107, CVE-2025-38108, CVE-2025-38071,     CVE-2025-38081, CVE-2025-38301, CVE-2025-38415, CVE-2025-38034, CVE-2025-38294, CVE-2025-38314,     CVE-2025-38285, CVE-2025-38147, CVE-2025-38113, CVE-2025-38352, CVE-2025-38170, CVE-2025-38103,     CVE-2025-38282, CVE-2025-38290, CVE-2025-38117, CVE-2025-38078, CVE-2025-38122, CVE-2025-38176,     CVE-2025-38082, CVE-2025-38289, CVE-2025-38124, CVE-2025-38039, CVE-2025-38281, CVE-2025-38126,     CVE-2025-38111, CVE-2025-38080, CVE-2025-38088, CVE-2025-38048, CVE-2025-38269, CVE-2025-38003,     CVE-2025-38102, CVE-2025-38140, CVE-2025-38316, CVE-2025-38268, CVE-2025-38132, CVE-2025-38286,     CVE-2025-38159, CVE-2025-38120, CVE-2025-38295, CVE-2025-38077, CVE-2025-38297, CVE-2025-38174,     CVE-2025-38160, CVE-2025-38119, CVE-2025-38099, CVE-2025-38134, CVE-2025-38051, CVE-2025-38061,     CVE-2025-38317, CVE-2025-38142, CVE-2025-38175, CVE-2025-38091, CVE-2025-38311, CVE-2025-38066,     CVE-2025-38062, CVE-2025-38169, CVE-2025-38065, CVE-2025-38098, CVE-2025-38146, CVE-2025-38292,     CVE-2025-38040, CVE-2025-38096, CVE-2025-38115, CVE-2025-38047, CVE-2025-38067, CVE-2025-38270,     CVE-2025-38074, CVE-2025-38129, CVE-2025-38143, CVE-2025-38498, CVE-2025-38125, CVE-2025-38092,     CVE-2025-38149, CVE-2025-38287, CVE-2025-38057, CVE-2025-38307, CVE-2025-38037, CVE-2025-38162,     CVE-2025-38141, CVE-2025-38068, CVE-2025-38029, CVE-2025-38101, CVE-2025-38059, CVE-2025-38300,     CVE-2025-38283, CVE-2025-38272, CVE-2025-38042, CVE-2025-38100, CVE-2025-38044, CVE-2025-38284,     CVE-2025-38063, CVE-2025-38043, CVE-2025-38151, CVE-2025-38158, CVE-2025-38168, CVE-2025-38278,     CVE-2025-38166, CVE-2025-38499, CVE-2025-38116, CVE-2025-38128, CVE-2025-38060, CVE-2025-38291,     CVE-2025-38304, CVE-2025-38172, CVE-2025-38052, CVE-2025-38312, CVE-2025-38319, CVE-2025-38136,     CVE-2025-38267, CVE-2025-38154, CVE-2025-38296, CVE-2025-38130, CVE-2025-38097, CVE-2025-38275,     CVE-2025-38106, CVE-2025-38156, CVE-2025-38137, CVE-2025-38153, CVE-2025-38167, CVE-2025-38315,     CVE-2025-38032, CVE-2025-38350, CVE-2025-38173, CVE-2025-38139, CVE-2025-38110, CVE-2025-38318,     CVE-2025-38163, CVE-2025-38058, CVE-2025-38280, CVE-2025-38036, CVE-2025-38041, CVE-2025-38302,     CVE-2025-38038, CVE-2025-38310, CVE-2025-38076, CVE-2025-38164, CVE-2025-38414, CVE-2025-38277,     CVE-2025-38069, CVE-2025-38288, CVE-2025-38165, CVE-2025-38279, CVE-2025-38305, CVE-2025-38054,     CVE-2025-38127, CVE-2025-38055, CVE-2025-38050, CVE-2025-38298, CVE-2025-38109)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7771-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - PowerPC architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - ACPI drivers;

    - Android drivers;

    - Bluetooth drivers;

    - Bus devices;

    - Clock framework and drivers;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - DMA engine subsystem;

    - EDAC drivers;

    - Arm Firmware Framework for ARMv8-A(FFA);

    - FPGA Framework;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - HW tracing;

    - InfiniBand drivers;

    - IOMMU subsystem;

    - Multiple devices driver;

    - Media drivers;

    - VMware VMCI Driver;

    - MTD block device drivers;

    - Network drivers;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - NVDIMM (Non-Volatile Memory Device) drivers;

    - NVME drivers;

    - NVMEM (Non Volatile Memory) drivers;

    - PCI subsystem;

    - Amlogic Meson DDR PMU;

    - NI-700 PMU driver;

    - PHY drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - PTP clock framework;

    - SCSI subsystem;

    - ASPEED SoC drivers;

    - SPI subsystem;

    - TCM subsystem;

    - TTY drivers;

    - UFS subsystem;

    - USB core drivers;

    - USB Gadget drivers;

    - Renesas USBHS Controller drivers;

    - USB Type-C Port Controller Manager driver;

    - VFIO drivers;

    - Virtio Host (VHOST) subsystem;

    - Backlight driver;

    - Framebuffer layer;

    - Virtio drivers;

    - BTRFS file system;

    - EROFS file system;

    - F2FS file system;

    - File systems infrastructure;

    - Network file systems library;

    - NTFS3 file system;

    - SMB network file system;

    - Codetag library;

    - BPF subsystem;

    - LZO compression library;

    - Mellanox drivers;

    - IPv4 networking;

    - Bluetooth subsystem;

    - Network sockets;

    - XFRM subsystem;

    - Digital Audio (PCM) driver;

    - Tracing infrastructure;

    - io_uring subsystem;

    - Padata parallel execution mechanism;

    - DVFS energy model driver;

    - Restartable seuqences system call mechanism;

    - Timer subsystem;

    - Memory management;

    - KASAN memory debugging framework;

    - CAN network layer;

    - Networking core;

    - IPv6 networking;

    - Netfilter;

    - NetLabel subsystem;

    - Open vSwitch;

    - Network traffic control;

    - TIPC protocol;

    - TLS protocol;

    - ALSA framework;

    - sma1307 audio codecs;

    - Intel ASoC drivers;

    - MediaTek ASoC drivers;

    - USB sound devices; (CVE-2025-38141, CVE-2025-38039, CVE-2025-38283, CVE-2025-38272, CVE-2025-38290,     CVE-2025-38168, CVE-2025-38134, CVE-2025-38158, CVE-2025-38097, CVE-2025-38078, CVE-2025-38161,     CVE-2025-38116, CVE-2025-38312, CVE-2025-38067, CVE-2025-38129, CVE-2025-38119, CVE-2025-38061,     CVE-2025-38352, CVE-2025-38269, CVE-2025-38163, CVE-2025-38315, CVE-2025-38301, CVE-2025-38115,     CVE-2025-38032, CVE-2025-38127, CVE-2025-38029, CVE-2025-38277, CVE-2025-38075, CVE-2025-38300,     CVE-2025-38059, CVE-2025-38047, CVE-2025-38118, CVE-2025-38038, CVE-2025-38278, CVE-2025-38169,     CVE-2025-38074, CVE-2025-38292, CVE-2025-38295, CVE-2025-38294, CVE-2025-38154, CVE-2025-38165,     CVE-2025-38069, CVE-2025-38120, CVE-2025-38098, CVE-2025-38050, CVE-2025-38068, CVE-2025-38063,     CVE-2025-38034, CVE-2025-38123, CVE-2025-38092, CVE-2025-38103, CVE-2025-38170, CVE-2025-38313,     CVE-2025-38062, CVE-2025-38159, CVE-2025-38147, CVE-2025-38415, CVE-2025-38045, CVE-2025-38279,     CVE-2025-38302, CVE-2025-38162, CVE-2025-38414, CVE-2025-38146, CVE-2025-38035, CVE-2025-38040,     CVE-2025-38073, CVE-2025-38054, CVE-2025-38099, CVE-2025-38291, CVE-2025-38126, CVE-2025-38088,     CVE-2025-38310, CVE-2025-38176, CVE-2025-38102, CVE-2025-38149, CVE-2025-38124, CVE-2025-38003,     CVE-2025-38140, CVE-2025-38100, CVE-2025-38081, CVE-2025-38319, CVE-2025-38142, CVE-2025-38303,     CVE-2025-38155, CVE-2025-38044, CVE-2025-38316, CVE-2025-38052, CVE-2025-38317, CVE-2025-38151,     CVE-2025-38164, CVE-2025-38148, CVE-2025-38082, CVE-2025-38267, CVE-2025-38031, CVE-2025-38132,     CVE-2025-38138, CVE-2025-38125, CVE-2025-38111, CVE-2025-38106, CVE-2025-38287, CVE-2025-38137,     CVE-2025-38117, CVE-2025-38130, CVE-2025-38122, CVE-2025-38058, CVE-2025-38110, CVE-2025-38101,     CVE-2025-38048, CVE-2025-38080, CVE-2025-38304, CVE-2025-38128, CVE-2025-38072, CVE-2025-38265,     CVE-2025-38166, CVE-2025-38131, CVE-2025-38105, CVE-2025-38096, CVE-2025-38275, CVE-2025-38305,     CVE-2025-38156, CVE-2025-38139, CVE-2025-38318, CVE-2025-38136, CVE-2025-38107, CVE-2025-38041,     CVE-2025-38288, CVE-2025-38055, CVE-2025-38033, CVE-2025-38064, CVE-2025-38036, CVE-2025-38077,     CVE-2025-38053, CVE-2025-38112, CVE-2025-38070, CVE-2025-38109, CVE-2025-38143, CVE-2025-38299,     CVE-2025-38051, CVE-2025-38167, CVE-2025-38172, CVE-2025-38057, CVE-2025-38311, CVE-2025-38285,     CVE-2025-38076, CVE-2025-38280, CVE-2025-38157, CVE-2025-38043, CVE-2025-38065, CVE-2025-38289,     CVE-2025-38060, CVE-2025-38274, CVE-2025-38004, CVE-2025-38037, CVE-2025-38282, CVE-2025-38298,     CVE-2025-38293, CVE-2025-38499, CVE-2025-38135, CVE-2025-38173, CVE-2025-38079, CVE-2025-38296,     CVE-2025-38108, CVE-2025-38175, CVE-2025-38066, CVE-2025-38286, CVE-2025-38160, CVE-2025-38498,     CVE-2025-38281, CVE-2025-38268, CVE-2025-38270, CVE-2025-38153, CVE-2025-38042, CVE-2025-38114,     CVE-2025-38284, CVE-2025-38297, CVE-2025-38306, CVE-2025-38071, CVE-2025-38307, CVE-2025-38091,     CVE-2025-38314, CVE-2025-38145, CVE-2025-38113)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix uaf in     ath12k_core_init() When the execution of ath12k_core_hw_group_assign() or ath12k_core_hw_group_create()     fails, the registered notifier chain is not unregistered properly. Its memory is freed after rmmod, which     may trigger to a use-after-free (UAF) issue if there is a subsequent access to this notifier chain. Fixes     the issue by calling ath12k_core_panic_notifier_unregister() in failure cases. Call trace:
    notifier_chain_register+0x4c/0x1f0 (P) atomic_notifier_chain_register+0x38/0x68     ath12k_core_init+0x50/0x4e8 [ath12k] ath12k_pci_probe+0x5f8/0xc28 [ath12k] pci_device_probe+0xbc/0x1a8     really_probe+0xc8/0x3a0 __driver_probe_device+0x84/0x1b0 driver_probe_device+0x44/0x130
    __driver_attach+0xcc/0x208 bus_for_each_dev+0x84/0x100 driver_attach+0x2c/0x40 bus_add_driver+0x130/0x260     driver_register+0x70/0x138 __pci_register_driver+0x68/0x80 ath12k_pci_init+0x30/0x68 [ath12k]     ath12k_init+0x28/0x78 [ath12k] Tested-on: WCN7850 hw2.0 PCI     WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 (CVE-2025-38116)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
282807	MiracleLinux 9 : kernel-5.14.0-611.5.1.el9_7 (AXSA:2025-11493:94)	Nessus	Miracle Linux Local Security Checks	high
277182	RockyLinux 10 : kernel (RLSA-2025:20095)	Nessus	Rocky Linux Local Security Checks	medium
277164	RockyLinux 9 : kernel (RLSA-2025:20518)	Nessus	Rocky Linux Local Security Checks	high
277130	Oracle Linux 10 : ELSA-2025-20095-0: / kernel (ELSA-2025-200950)	Nessus	Oracle Linux Local Security Checks	medium
276749	AlmaLinux 10 : kernel (ALSA-2025:20095)	Nessus	Alma Linux Local Security Checks	medium
276689	Oracle Linux 9 : ELSA-2025-20518-0: / kernel (ELSA-2025-205180)	Nessus	Oracle Linux Local Security Checks	high
275824	AlmaLinux 9 : kernel (ALSA-2025:20518)	Nessus	Alma Linux Local Security Checks	high
274839	RHEL 9 : kernel (RHSA-2025:20518)	Nessus	Red Hat Local Security Checks	high
274759	RHEL 10 : kernel (RHSA-2025:20095)	Nessus	Red Hat Local Security Checks	medium
266397	Ubuntu 24.04 LTS : Linux kernel (Oracle) vulnerabilities (USN-7789-1)	Nessus	Ubuntu Local Security Checks	high
265934	Ubuntu 24.04 LTS / 25.04 : Linux kernel vulnerabilities (USN-7769-1)	Nessus	Ubuntu Local Security Checks	high
265928	Ubuntu 25.04 : Linux kernel (Azure) vulnerabilities (USN-7770-1)	Nessus	Ubuntu Local Security Checks	high
265926	Ubuntu 24.04 LTS : Linux kernel (OEM) vulnerabilities (USN-7771-1)	Nessus	Ubuntu Local Security Checks	high
249631	Linux Distros Unpatched Vulnerability : CVE-2025-38116	Nessus	Misc.	high

Detections

Analytics

CVE-2025-38116

high

Tenable Plugins

high

medium

high

medium

medium

high

high

high

medium

high

high

high

high

high