In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Cancel outstanding rescan work when unregistering It's possible to trigger use-after-free here by: (a) forcing rescan_work_func() to take a long time and (b) utilizing a pwrctrl driver that may be unloaded for some reason Cancel outstanding work to ensure it is finished before we allow our data structures to be cleaned up. [bhelgaas: tidy commit log]

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-13598 advisory.

    - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds - CVE-2025-38159
    - Revert 'smb: client: fix TCP timers deadlock after rmmod' - CVE-2025-22077
    - wifi: ath12k: fix invalid access to memory - CVE-2025-38292
    - x86/CPU/AMD: Terminate the erratum_1386_microcode array - CVE-2024-56721
    - crypto: algif_hash - fix double free in hash_accept - CVE-2025-38079
    - net/sched: Always pass notifications when child class becomes empty - CVE-2025-38350
    - sch_htb: make htb_deactivate() idempotent - CVE-2025-38350
    - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() - CVE-2025-38350
    - sch_qfq: make qfq_qlen_notify() idempotent - CVE-2025-38350
    - sch_drr: make drr_qlen_notify() idempotent - CVE-2025-38350
    - sch_htb: make htb_qlen_notify() idempotent - CVE-2025-38350
    - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race - CVE-2025-38085
    - mm/hugetlb: unshare page tables during VMA split, not before - CVE-2025-38084
    - PCI/pwrctrl: Cancel outstanding rescan work when unregistering - CVE-2025-38137

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PCI/pwrctrl: Cancel outstanding rescan work when unregistering It's possible to trigger use-after-free     here by: (a) forcing rescan_work_func() to take a long time and (b) utilizing a pwrctrl driver that may be     unloaded for some reason Cancel outstanding work to ensure it is finished before we allow our data     structures to be cleaned up. [bhelgaas: tidy commit log] (CVE-2025-38137)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
250291	Oracle Linux 10 : kernel (ELSA-2025-13598)	Nessus	Oracle Linux Local Security Checks	high
247832	RHEL 10 : kernel (RHSA-2025:13598)	Nessus	Red Hat Local Security Checks	high
247808	Linux Distros Unpatched Vulnerability : CVE-2025-38137	Nessus	Misc.	high

Detections

Analytics

CVE-2025-38137

high

Tenable Plugins

high

high

high