In the Linux kernel, the following vulnerability has been resolved: btrfs: handle csum tree error with rescue=ibadroots correctly [BUG] There is syzbot based reproducer that can crash the kernel, with the following call trace: (With some debug output added) DEBUG: rescue=ibadroots parsed BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop0 (7:0) scanned by repro (1010) BTRFS info (device loop0): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 BTRFS info (device loop0): using blake2b (blake2b-256-generic) checksum algorithm BTRFS info (device loop0): using free-space-tree BTRFS warning (device loop0): checksum verify failed on logical 5312512 mirror 1 wanted 0xb043382657aede36608fd3386d6b001692ff406164733d94e2d9a180412c6003 found 0x810ceb2bacb7f0f9eb2bf3b2b15c02af867cb35ad450898169f3b1f0bd818651 level 0 DEBUG: read tree root path failed for tree csum, ret=-5 BTRFS warning (device loop0): checksum verify failed on logical 5328896 mirror 1 wanted 0x51be4e8b303da58e6340226815b70e3a93592dac3f30dd510c7517454de8567a found 0x51be4e8b303da58e634022a315b70e3a93592dac3f30dd510c7517454de8567a level 0 BTRFS warning (device loop0): checksum verify failed on logical 5292032 mirror 1 wanted 0x1924ccd683be9efc2fa98582ef58760e3848e9043db8649ee382681e220cdee4 found 0x0cb6184f6e8799d9f8cb335dccd1d1832da1071d12290dab3b85b587ecacca6e level 0 process 'repro' launched './file2' with NULL argv: empty string added DEBUG: no csum root, idatacsums=0 ibadroots=134217728 Oops: general protection fault, probably for non-canonical address 0xdffffc0000000041: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000208-0x000000000000020f] CPU: 5 UID: 0 PID: 1010 Comm: repro Tainted: G OE 6.15.0-custom+ #249 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:btrfs_lookup_csum+0x93/0x3d0 [btrfs] Call Trace: <TASK> btrfs_lookup_bio_sums+0x47a/0xdf0 [btrfs] btrfs_submit_bbio+0x43e/0x1a80 [btrfs] submit_one_bio+0xde/0x160 [btrfs] btrfs_readahead+0x498/0x6a0 [btrfs] read_pages+0x1c3/0xb20 page_cache_ra_order+0x4b5/0xc20 filemap_get_pages+0x2d3/0x19e0 filemap_read+0x314/0xde0 __kernel_read+0x35b/0x900 bprm_execve+0x62e/0x1140 do_execveat_common.isra.0+0x3fc/0x520 __x64_sys_execveat+0xdc/0x130 do_syscall_64+0x54/0x1d0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ---[ end trace 0000000000000000 ]--- [CAUSE] Firstly the fs has a corrupted csum tree root, thus to mount the fs we have to go "ro,rescue=ibadroots" mount option. Normally with that mount option, a bad csum tree root should set BTRFS_FS_STATE_NO_DATA_CSUMS flag, so that any future data read will ignore csum search. But in this particular case, we have the following call trace that caused NULL csum root, but not setting BTRFS_FS_STATE_NO_DATA_CSUMS: load_global_roots_objectid(): ret = btrfs_search_slot(); /* Succeeded */ btrfs_item_key_to_cpu() found = true; /* We found the root item for csum tree. */ root = read_tree_root_path(); if (IS_ERR(root)) { if (!btrfs_test_opt(fs_info, IGNOREBADROOTS)) /* * Since we have rescue=ibadroots mount option, * @ret is still 0. */ break; if (!found || ret) { /* @found is true, @ret is 0, error handling for csum * tree is skipped. */ } This means we completely skipped to set BTRFS_FS_STATE_NO_DATA_CSUMS if the csum tree is corrupted, which results unexpected later csum lookup. [FIX] If read_tree_root_path() failed, always populate @ret to the error number. As at the end of the function, we need @ret to determine if we need to do the extra error handling for csum tree.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7856-1 advisory.

    Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Kpf, Stavros Volos, and Flavien Solt discovered     that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting     in the leakage of privileged information. A local attacker could possibly use this to expose sensitive     information. (CVE-2024-36350, CVE-2024-36357)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - x86 architecture;

    - ACPI drivers;

    - Serial ATA and Parallel ATA drivers;

    - ATM drivers;

    - Drivers core;

    - ATA over ethernet (AOE) driver;

    - Ublk userspace block driver;

    - Bus devices;

    - DMA engine subsystem;

    - Arm Firmware Framework for ARMv8-A(FFA);

    - Cirrus firmware drivers;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - InfiniBand drivers;

    - Input Device (Miscellaneous) drivers;

    - Multiple devices driver;

    - Media drivers;

    - TI TPS6594 PFSM driver;

    - MMC subsystem;

    - MTD block device drivers;

    - Network drivers;

    - NVME drivers;

    - x86 platform drivers;

    - RapidIO drivers;

    - Voltage and Current Regulator drivers;

    - Remote Processor subsystem;

    - S/390 drivers;

    - SCSI subsystem;

    - TCM subsystem;

    - Trusted Execution Environment drivers;

    - TTY drivers;

    - ChipIdea USB driver;

    - USB Type-C support driver;

    - Framebuffer layer;

    - TSM Common Guest driver;

    - File systems infrastructure;

    - BTRFS file system;

    - Ceph distributed file system;

    - Ext4 file system;

    - F2FS file system;

    - JFFS2 file system;

    - JFS file system;

    - Network file systems library;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - SMB network file system;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - Memory Management;

    - Bluetooth subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - IPC subsystem;

    - BPF subsystem;

    - Perf events;

    - Kernel exit() syscall;

    - IRQ subsystem;

    - Scheduler infrastructure;

    - Maple Tree data structure library;

    - Memory management;

    - Ethernet bridge;

    - Networking core;

    - IPv6 networking;

    - MultiProtocol Label Switching driver;

    - Netfilter;

    - NFC subsystem;

    - Rose network layer;

    - Network traffic control;

    - Sun RPC protocol;

    - TIPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - WCD audio codecs;

    - USB sound devices; (CVE-2025-38084, CVE-2025-38085, CVE-2025-38086, CVE-2025-38087, CVE-2025-38089,     CVE-2025-38090, CVE-2025-38179, CVE-2025-38180, CVE-2025-38181, CVE-2025-38182, CVE-2025-38183,     CVE-2025-38184, CVE-2025-38185, CVE-2025-38186, CVE-2025-38188, CVE-2025-38189, CVE-2025-38190,     CVE-2025-38191, CVE-2025-38192, CVE-2025-38193, CVE-2025-38194, CVE-2025-38196, CVE-2025-38197,     CVE-2025-38198, CVE-2025-38199, CVE-2025-38200, CVE-2025-38201, CVE-2025-38202, CVE-2025-38203,     CVE-2025-38204, CVE-2025-38205, CVE-2025-38206, CVE-2025-38208, CVE-2025-38210, CVE-2025-38211,     CVE-2025-38212, CVE-2025-38214, CVE-2025-38215, CVE-2025-38217, CVE-2025-38218, CVE-2025-38219,     CVE-2025-38220, CVE-2025-38222, CVE-2025-38223, CVE-2025-38224, CVE-2025-38225, CVE-2025-38226,     CVE-2025-38227, CVE-2025-38228, CVE-2025-38229, CVE-2025-38230, CVE-2025-38231, CVE-2025-38232,     CVE-2025-38233, CVE-2025-38234, CVE-2025-38236, CVE-2025-38237, CVE-2025-38238, CVE-2025-38239,     CVE-2025-38241, CVE-2025-38242, CVE-2025-38244, CVE-2025-38245, CVE-2025-38246, CVE-2025-38248,     CVE-2025-38249, CVE-2025-38250, CVE-2025-38251, CVE-2025-38253, CVE-2025-38254, CVE-2025-38255,     CVE-2025-38256, CVE-2025-38257, CVE-2025-38258, CVE-2025-38259, CVE-2025-38260, CVE-2025-38261,     CVE-2025-38262, CVE-2025-38263, CVE-2025-38264, CVE-2025-38320, CVE-2025-38321, CVE-2025-38322,     CVE-2025-38323, CVE-2025-38324, CVE-2025-38325, CVE-2025-38326, CVE-2025-38328, CVE-2025-38329,     CVE-2025-38330, CVE-2025-38331, CVE-2025-38332, CVE-2025-38333, CVE-2025-38334, CVE-2025-38336,     CVE-2025-38337, CVE-2025-38338, CVE-2025-38339, CVE-2025-38340, CVE-2025-38341, CVE-2025-38342,     CVE-2025-38343, CVE-2025-38344, CVE-2025-38345, CVE-2025-38346, CVE-2025-38347, CVE-2025-38348,     CVE-2025-38353, CVE-2025-38354, CVE-2025-38355, CVE-2025-38356, CVE-2025-38359, CVE-2025-38360,     CVE-2025-38361, CVE-2025-38362, CVE-2025-38363, CVE-2025-38364, CVE-2025-38365, CVE-2025-38368,     CVE-2025-38369, CVE-2025-38370, CVE-2025-38371, CVE-2025-38372, CVE-2025-38373, CVE-2025-38374,     CVE-2025-38375, CVE-2025-38376, CVE-2025-38377, CVE-2025-38381, CVE-2025-38382, CVE-2025-38383,     CVE-2025-38384, CVE-2025-38385, CVE-2025-38386, CVE-2025-38387, CVE-2025-38388, CVE-2025-38389,     CVE-2025-38390, CVE-2025-38391, CVE-2025-38392, CVE-2025-38393, CVE-2025-38395, CVE-2025-38396,     CVE-2025-38399, CVE-2025-38400, CVE-2025-38401, CVE-2025-38402, CVE-2025-38403, CVE-2025-38405,     CVE-2025-38406, CVE-2025-38407, CVE-2025-38408, CVE-2025-38409, CVE-2025-38410, CVE-2025-38411,     CVE-2025-38412, CVE-2025-38413, CVE-2025-38416, CVE-2025-38417, CVE-2025-38418, CVE-2025-38419,     CVE-2025-38420, CVE-2025-38421, CVE-2025-38422, CVE-2025-38423, CVE-2025-38424, CVE-2025-38425,     CVE-2025-38426, CVE-2025-38427, CVE-2025-38428, CVE-2025-38429, CVE-2025-38430, CVE-2025-38431,     CVE-2025-38434, CVE-2025-38435, CVE-2025-38436, CVE-2025-38523, CVE-2025-38541, CVE-2025-39682)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 25.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7834-1 advisory.

    Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Kpf, Stavros Volos, and Flavien Solt discovered     that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting     in the leakage of privileged information. A local attacker could possibly use this to expose sensitive     information. (CVE-2024-36350, CVE-2024-36357)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - x86 architecture;

    - ACPI drivers;

    - Serial ATA and Parallel ATA drivers;

    - Drivers core;

    - ATA over ethernet (AOE) driver;

    - Ublk userspace block driver;

    - Bus devices;

    - DMA engine subsystem;

    - Arm Firmware Framework for ARMv8-A(FFA);

    - Cirrus firmware drivers;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - InfiniBand drivers;

    - Input Device (Miscellaneous) drivers;

    - Multiple devices driver;

    - Media drivers;

    - TI TPS6594 PFSM driver;

    - MMC subsystem;

    - MTD block device drivers;

    - Network drivers;

    - NVME drivers;

    - x86 platform drivers;

    - RapidIO drivers;

    - Voltage and Current Regulator drivers;

    - Remote Processor subsystem;

    - S/390 drivers;

    - SCSI subsystem;

    - TCM subsystem;

    - Trusted Execution Environment drivers;

    - TTY drivers;

    - ChipIdea USB driver;

    - USB Type-C support driver;

    - Framebuffer layer;

    - TSM Common Guest driver;

    - File systems infrastructure;

    - BTRFS file system;

    - Ceph distributed file system;

    - Ext4 file system;

    - F2FS file system;

    - JFFS2 file system;

    - JFS file system;

    - Network file systems library;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - SMB network file system;

    - Memory Management;

    - Bluetooth subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - IPC subsystem;

    - BPF subsystem;

    - Perf events;

    - Kernel exit() syscall;

    - IRQ subsystem;

    - Scheduler infrastructure;

    - Maple Tree data structure library;

    - Memory management;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - Ethernet bridge;

    - Networking core;

    - IPv6 networking;

    - MultiProtocol Label Switching driver;

    - Netfilter;

    - NFC subsystem;

    - Rose network layer;

    - Network traffic control;

    - Sun RPC protocol;

    - TIPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - WCD audio codecs;

    - USB sound devices; (CVE-2025-38217, CVE-2025-38259, CVE-2025-38257, CVE-2025-38388, CVE-2025-38258,     CVE-2025-38086, CVE-2025-38416, CVE-2025-38428, CVE-2025-38368, CVE-2025-38233, CVE-2025-38391,     CVE-2025-38364, CVE-2025-38328, CVE-2025-38417, CVE-2025-38228, CVE-2025-38413, CVE-2025-38360,     CVE-2025-38248, CVE-2025-38346, CVE-2025-38197, CVE-2025-38179, CVE-2025-38186, CVE-2025-38356,     CVE-2025-38371, CVE-2025-38231, CVE-2025-38249, CVE-2025-38334, CVE-2025-38325, CVE-2025-38353,     CVE-2025-38422, CVE-2025-38387, CVE-2025-38225, CVE-2025-38224, CVE-2025-38400, CVE-2025-38245,     CVE-2025-38411, CVE-2025-38205, CVE-2025-38362, CVE-2025-38200, CVE-2025-38250, CVE-2025-38541,     CVE-2025-38326, CVE-2025-38342, CVE-2025-38208, CVE-2025-38261, CVE-2025-38407, CVE-2025-38202,     CVE-2025-38331, CVE-2025-38189, CVE-2025-38090, CVE-2025-38184, CVE-2025-38255, CVE-2025-38419,     CVE-2025-38340, CVE-2025-38383, CVE-2025-38423, CVE-2025-38332, CVE-2025-38246, CVE-2025-38429,     CVE-2025-38410, CVE-2025-38396, CVE-2025-38262, CVE-2025-38191, CVE-2025-38420, CVE-2025-38226,     CVE-2025-38341, CVE-2025-38199, CVE-2025-38085, CVE-2025-38188, CVE-2025-38253, CVE-2025-38182,     CVE-2025-38087, CVE-2025-38203, CVE-2025-38194, CVE-2025-38227, CVE-2025-38365, CVE-2025-38238,     CVE-2025-38201, CVE-2025-38196, CVE-2025-38232, CVE-2025-38361, CVE-2025-38392, CVE-2025-38254,     CVE-2025-38370, CVE-2025-38192, CVE-2025-38229, CVE-2025-38241, CVE-2025-38222, CVE-2025-38337,     CVE-2025-38343, CVE-2025-38321, CVE-2025-38183, CVE-2025-38381, CVE-2025-38354, CVE-2025-38234,     CVE-2025-38385, CVE-2025-38239, CVE-2025-38218, CVE-2025-38426, CVE-2025-38330, CVE-2025-38427,     CVE-2025-38523, CVE-2025-38260, CVE-2025-38425, CVE-2025-38320, CVE-2025-38424, CVE-2025-38372,     CVE-2025-38412, CVE-2025-38434, CVE-2025-38089, CVE-2025-38322, CVE-2025-38236, CVE-2025-38339,     CVE-2025-38237, CVE-2025-38386, CVE-2025-38395, CVE-2025-38431, CVE-2025-38329, CVE-2025-38436,     CVE-2025-38369, CVE-2025-38405, CVE-2025-38204, CVE-2025-38374, CVE-2025-38263, CVE-2025-38181,     CVE-2025-38363, CVE-2025-38084, CVE-2025-38206, CVE-2025-38359, CVE-2025-38347, CVE-2025-38421,     CVE-2025-38418, CVE-2025-38375, CVE-2025-38389, CVE-2025-38373, CVE-2025-38403, CVE-2025-38348,     CVE-2025-38399, CVE-2025-38242, CVE-2025-38393, CVE-2025-38336, CVE-2025-38264, CVE-2025-38408,     CVE-2025-38384, CVE-2025-38406, CVE-2025-38382, CVE-2025-38211, CVE-2025-38220, CVE-2025-38376,     CVE-2025-38401, CVE-2025-38344, CVE-2025-38223, CVE-2025-38251, CVE-2025-38324, CVE-2025-38402,     CVE-2025-38198, CVE-2025-38210, CVE-2025-38377, CVE-2025-38345, CVE-2025-38219, CVE-2025-39682,     CVE-2025-38355, CVE-2025-38333, CVE-2025-38338, CVE-2025-38256, CVE-2025-38390, CVE-2025-38435,     CVE-2025-38430, CVE-2025-38409, CVE-2025-38212)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 25.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7833-1 advisory.

    Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Kpf, Stavros Volos, and Flavien Solt discovered     that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting     in the leakage of privileged information. A local attacker could possibly use this to expose sensitive     information. (CVE-2024-36350, CVE-2024-36357)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - x86 architecture;

    - ACPI drivers;

    - Serial ATA and Parallel ATA drivers;

    - Drivers core;

    - ATA over ethernet (AOE) driver;

    - Ublk userspace block driver;

    - Bus devices;

    - DMA engine subsystem;

    - Arm Firmware Framework for ARMv8-A(FFA);

    - Cirrus firmware drivers;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - InfiniBand drivers;

    - Input Device (Miscellaneous) drivers;

    - Multiple devices driver;

    - Media drivers;

    - TI TPS6594 PFSM driver;

    - MMC subsystem;

    - MTD block device drivers;

    - Network drivers;

    - NVME drivers;

    - x86 platform drivers;

    - RapidIO drivers;

    - Voltage and Current Regulator drivers;

    - Remote Processor subsystem;

    - S/390 drivers;

    - SCSI subsystem;

    - TCM subsystem;

    - Trusted Execution Environment drivers;

    - TTY drivers;

    - ChipIdea USB driver;

    - USB Type-C support driver;

    - Framebuffer layer;

    - TSM Common Guest driver;

    - File systems infrastructure;

    - BTRFS file system;

    - Ceph distributed file system;

    - Ext4 file system;

    - F2FS file system;

    - JFFS2 file system;

    - JFS file system;

    - Network file systems library;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - SMB network file system;

    - Memory Management;

    - Bluetooth subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - IPC subsystem;

    - BPF subsystem;

    - Perf events;

    - Kernel exit() syscall;

    - IRQ subsystem;

    - Scheduler infrastructure;

    - Maple Tree data structure library;

    - Memory management;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - Ethernet bridge;

    - Networking core;

    - IPv6 networking;

    - MultiProtocol Label Switching driver;

    - Netfilter;

    - NFC subsystem;

    - Rose network layer;

    - Network traffic control;

    - Sun RPC protocol;

    - TIPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - WCD audio codecs;

    - USB sound devices; (CVE-2025-38339, CVE-2025-38391, CVE-2025-38262, CVE-2025-38345, CVE-2025-38387,     CVE-2025-38373, CVE-2025-38395, CVE-2025-38330, CVE-2025-38425, CVE-2025-38210, CVE-2025-38206,     CVE-2025-38219, CVE-2025-38245, CVE-2025-38253, CVE-2025-38401, CVE-2025-38410, CVE-2025-38086,     CVE-2025-38340, CVE-2025-38368, CVE-2025-38385, CVE-2025-38384, CVE-2025-38326, CVE-2025-38224,     CVE-2025-38338, CVE-2025-38191, CVE-2025-39682, CVE-2025-38343, CVE-2025-38090, CVE-2025-38228,     CVE-2025-38182, CVE-2025-38231, CVE-2025-38183, CVE-2025-38184, CVE-2025-38237, CVE-2025-38413,     CVE-2025-38356, CVE-2025-38246, CVE-2025-38202, CVE-2025-38248, CVE-2025-38254, CVE-2025-38426,     CVE-2025-38429, CVE-2025-38364, CVE-2025-38388, CVE-2025-38435, CVE-2025-38403, CVE-2025-38186,     CVE-2025-38199, CVE-2025-38402, CVE-2025-38181, CVE-2025-38264, CVE-2025-38362, CVE-2025-38341,     CVE-2025-38422, CVE-2025-38331, CVE-2025-38423, CVE-2025-38233, CVE-2025-38337, CVE-2025-38328,     CVE-2025-38196, CVE-2025-38412, CVE-2025-38205, CVE-2025-38242, CVE-2025-38324, CVE-2025-38354,     CVE-2025-38347, CVE-2025-38217, CVE-2025-38393, CVE-2025-38392, CVE-2025-38390, CVE-2025-38321,     CVE-2025-38541, CVE-2025-38363, CVE-2025-38203, CVE-2025-38250, CVE-2025-38418, CVE-2025-38336,     CVE-2025-38333, CVE-2025-38194, CVE-2025-38372, CVE-2025-38348, CVE-2025-38370, CVE-2025-38411,     CVE-2025-38188, CVE-2025-38365, CVE-2025-38241, CVE-2025-38201, CVE-2025-38259, CVE-2025-38355,     CVE-2025-38227, CVE-2025-38225, CVE-2025-38405, CVE-2025-38329, CVE-2025-38232, CVE-2025-38344,     CVE-2025-38238, CVE-2025-38239, CVE-2025-38260, CVE-2025-38257, CVE-2025-38399, CVE-2025-38419,     CVE-2025-38430, CVE-2025-38251, CVE-2025-38332, CVE-2025-38220, CVE-2025-38417, CVE-2025-38396,     CVE-2025-38234, CVE-2025-38434, CVE-2025-38197, CVE-2025-38436, CVE-2025-38408, CVE-2025-38204,     CVE-2025-38222, CVE-2025-38361, CVE-2025-38218, CVE-2025-38212, CVE-2025-38198, CVE-2025-38255,     CVE-2025-38389, CVE-2025-38085, CVE-2025-38244, CVE-2025-38089, CVE-2025-38428, CVE-2025-38369,     CVE-2025-38189, CVE-2025-38084, CVE-2025-38400, CVE-2025-38382, CVE-2025-38223, CVE-2025-38325,     CVE-2025-38263, CVE-2025-38249, CVE-2025-38346, CVE-2025-38320, CVE-2025-38409, CVE-2025-38374,     CVE-2025-38208, CVE-2025-38256, CVE-2025-38371, CVE-2025-38192, CVE-2025-38406, CVE-2025-38360,     CVE-2025-38258, CVE-2025-38226, CVE-2025-38376, CVE-2025-38375, CVE-2025-38200, CVE-2025-38523,     CVE-2025-38334, CVE-2025-38236, CVE-2025-38386, CVE-2025-38421, CVE-2025-38087, CVE-2025-38416,     CVE-2025-38179, CVE-2025-38420, CVE-2025-38424, CVE-2025-38377, CVE-2025-38359, CVE-2025-38342,     CVE-2025-38431, CVE-2025-38407, CVE-2025-38427, CVE-2025-38229, CVE-2025-38353, CVE-2025-38383,     CVE-2025-38211, CVE-2025-38322, CVE-2025-38381, CVE-2025-38261)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4328 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4328-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     October 13, 2025                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.1     Version        : 6.1.153-1     CVE ID         : CVE-2024-36331 CVE-2024-36350 CVE-2024-36357 CVE-2024-36913                      CVE-2024-41013 CVE-2024-47704 CVE-2024-56758 CVE-2024-57883                      CVE-2024-57924 CVE-2024-58240 CVE-2025-21816 CVE-2025-22119                      CVE-2025-23143 CVE-2025-23160 CVE-2025-27558 CVE-2025-37925                      CVE-2025-37931 CVE-2025-37958 CVE-2025-37968 CVE-2025-38000                      CVE-2025-38001 CVE-2025-38003 CVE-2025-38004 CVE-2025-38031                      CVE-2025-38034 CVE-2025-38035 CVE-2025-38037 CVE-2025-38040                      CVE-2025-38043 CVE-2025-38044 CVE-2025-38048 CVE-2025-38051                      CVE-2025-38052 CVE-2025-38058 CVE-2025-38061 CVE-2025-38062                      CVE-2025-38063 CVE-2025-38065 CVE-2025-38066 CVE-2025-38067                      CVE-2025-38068 CVE-2025-38071 CVE-2025-38072 CVE-2025-38074                      CVE-2025-38075 CVE-2025-38077 CVE-2025-38078 CVE-2025-38079                      CVE-2025-38083 CVE-2025-38084 CVE-2025-38085 CVE-2025-38086                      CVE-2025-38088 CVE-2025-38090 CVE-2025-38097 CVE-2025-38100                      CVE-2025-38102 CVE-2025-38103 CVE-2025-38107 CVE-2025-38108                      CVE-2025-38111 CVE-2025-38112 CVE-2025-38113 CVE-2025-38115                      CVE-2025-38118 CVE-2025-38119 CVE-2025-38120 CVE-2025-38122                      CVE-2025-38124 CVE-2025-38126 CVE-2025-38131 CVE-2025-38135                      CVE-2025-38136 CVE-2025-38138 CVE-2025-38142 CVE-2025-38143                      CVE-2025-38145 CVE-2025-38146 CVE-2025-38147 CVE-2025-38148                      CVE-2025-38151 CVE-2025-38153 CVE-2025-38154 CVE-2025-38157                      CVE-2025-38158 CVE-2025-38159 CVE-2025-38160 CVE-2025-38161                      CVE-2025-38163 CVE-2025-38165 CVE-2025-38166 CVE-2025-38167                      CVE-2025-38170 CVE-2025-38173 CVE-2025-38174 CVE-2025-38180                      CVE-2025-38181 CVE-2025-38183 CVE-2025-38184 CVE-2025-38185                      CVE-2025-38190 CVE-2025-38191 CVE-2025-38193 CVE-2025-38194                      CVE-2025-38197 CVE-2025-38198 CVE-2025-38200 CVE-2025-38202                      CVE-2025-38211 CVE-2025-38212 CVE-2025-38214 CVE-2025-38215                      CVE-2025-38218 CVE-2025-38219 CVE-2025-38222 CVE-2025-38225                      CVE-2025-38226 CVE-2025-38227 CVE-2025-38229 CVE-2025-38230                      CVE-2025-38231 CVE-2025-38236 CVE-2025-38239 CVE-2025-38245                      CVE-2025-38249 CVE-2025-38251 CVE-2025-38257 CVE-2025-38259                      CVE-2025-38260 CVE-2025-38262 CVE-2025-38263 CVE-2025-38273                      CVE-2025-38275 CVE-2025-38277 CVE-2025-38280 CVE-2025-38282                      CVE-2025-38285 CVE-2025-38286 CVE-2025-38293 CVE-2025-38298                      CVE-2025-38300 CVE-2025-38304 CVE-2025-38305 CVE-2025-38310                      CVE-2025-38312 CVE-2025-38313 CVE-2025-38319 CVE-2025-38320                      CVE-2025-38322 CVE-2025-38323 CVE-2025-38324 CVE-2025-38326                      CVE-2025-38328 CVE-2025-38331 CVE-2025-38332 CVE-2025-38334                      CVE-2025-38335 CVE-2025-38336 CVE-2025-38337 CVE-2025-38342                      CVE-2025-38344 CVE-2025-38345 CVE-2025-38346 CVE-2025-38347                      CVE-2025-38348 CVE-2025-38350 CVE-2025-38352 CVE-2025-38354                      CVE-2025-38362 CVE-2025-38363 CVE-2025-38364 CVE-2025-38365                      CVE-2025-38371 CVE-2025-38375 CVE-2025-38377 CVE-2025-38382                      CVE-2025-38384 CVE-2025-38385 CVE-2025-38386 CVE-2025-38387                      CVE-2025-38389 CVE-2025-38391 CVE-2025-38393 CVE-2025-38395                      CVE-2025-38396 CVE-2025-38399 CVE-2025-38400 CVE-2025-38401                      CVE-2025-38403 CVE-2025-38404 CVE-2025-38406 CVE-2025-38409                      CVE-2025-38410 CVE-2025-38412 CVE-2025-38415 CVE-2025-38416                      CVE-2025-38418 CVE-2025-38419 CVE-2025-38420 CVE-2025-38422                      CVE-2025-38424 CVE-2025-38425 CVE-2025-38428 CVE-2025-38430                      CVE-2025-38437 CVE-2025-38439 CVE-2025-38441 CVE-2025-38443                      CVE-2025-38444 CVE-2025-38445 CVE-2025-38448 CVE-2025-38451                      CVE-2025-38455 CVE-2025-38456 CVE-2025-38457 CVE-2025-38458                      CVE-2025-38459 CVE-2025-38460 CVE-2025-38461 CVE-2025-38462                      CVE-2025-38464 CVE-2025-38465 CVE-2025-38466 CVE-2025-38467                      CVE-2025-38468 CVE-2025-38470 CVE-2025-38471 CVE-2025-38472                      CVE-2025-38473 CVE-2025-38474 CVE-2025-38476 CVE-2025-38477                      CVE-2025-38478 CVE-2025-38480 CVE-2025-38481 CVE-2025-38482                      CVE-2025-38483 CVE-2025-38485 CVE-2025-38487 CVE-2025-38488                      CVE-2025-38491 CVE-2025-38494 CVE-2025-38495 CVE-2025-38497                      CVE-2025-38498 CVE-2025-38499 CVE-2025-38500 CVE-2025-38501                      CVE-2025-38502 CVE-2025-38503 CVE-2025-38510 CVE-2025-38512                      CVE-2025-38513 CVE-2025-38514 CVE-2025-38515 CVE-2025-38516                      CVE-2025-38520 CVE-2025-38527 CVE-2025-38528 CVE-2025-38529                      CVE-2025-38530 CVE-2025-38535 CVE-2025-38538 CVE-2025-38539                      CVE-2025-38540 CVE-2025-38542 CVE-2025-38543 CVE-2025-38546                      CVE-2025-38548 CVE-2025-38550 CVE-2025-38552 CVE-2025-38553                      CVE-2025-38555 CVE-2025-38560 CVE-2025-38561 CVE-2025-38562                      CVE-2025-38563 CVE-2025-38565 CVE-2025-38569 CVE-2025-38572                      CVE-2025-38574 CVE-2025-38576 CVE-2025-38577 CVE-2025-38578                      CVE-2025-38579 CVE-2025-38581 CVE-2025-38583 CVE-2025-38587                      CVE-2025-38588 CVE-2025-38601 CVE-2025-38602 CVE-2025-38604                      CVE-2025-38608 CVE-2025-38609 CVE-2025-38610 CVE-2025-38612                      CVE-2025-38614 CVE-2025-38617 CVE-2025-38618 CVE-2025-38622                      CVE-2025-38623 CVE-2025-38624 CVE-2025-38630 CVE-2025-38634                      CVE-2025-38635 CVE-2025-38639 CVE-2025-38644 CVE-2025-38645                      CVE-2025-38650 CVE-2025-38652 CVE-2025-38653 CVE-2025-38663                      CVE-2025-38664 CVE-2025-38665 CVE-2025-38666 CVE-2025-38668                      CVE-2025-38670 CVE-2025-38671 CVE-2025-38676 CVE-2025-38677                      CVE-2025-38679 CVE-2025-38680 CVE-2025-38681 CVE-2025-38683                      CVE-2025-38684 CVE-2025-38685 CVE-2025-38687 CVE-2025-38691                      CVE-2025-38693 CVE-2025-38694 CVE-2025-38695 CVE-2025-38696                      CVE-2025-38697 CVE-2025-38698 CVE-2025-38699 CVE-2025-38700                      CVE-2025-38701 CVE-2025-38702 CVE-2025-38706 CVE-2025-38707                      CVE-2025-38708 CVE-2025-38711 CVE-2025-38712 CVE-2025-38713                      CVE-2025-38714 CVE-2025-38715 CVE-2025-38721 CVE-2025-38723                      CVE-2025-38724 CVE-2025-38725 CVE-2025-38727 CVE-2025-38728                      CVE-2025-38729 CVE-2025-38732 CVE-2025-38735 CVE-2025-38736                      CVE-2025-39673 CVE-2025-39675 CVE-2025-39676 CVE-2025-39681                      CVE-2025-39682 CVE-2025-39683 CVE-2025-39684 CVE-2025-39685                      CVE-2025-39686 CVE-2025-39687 CVE-2025-39689 CVE-2025-39691                      CVE-2025-39692 CVE-2025-39693 CVE-2025-39694 CVE-2025-39697                      CVE-2025-39701 CVE-2025-39702 CVE-2025-39703 CVE-2025-39706                      CVE-2025-39709 CVE-2025-39710 CVE-2025-39713 CVE-2025-39714                      CVE-2025-39715 CVE-2025-39716 CVE-2025-39718 CVE-2025-39719                      CVE-2025-39724 CVE-2025-39730 CVE-2025-39731 CVE-2025-39734                      CVE-2025-39736 CVE-2025-39737 CVE-2025-39738 CVE-2025-39742                      CVE-2025-39743 CVE-2025-39749 CVE-2025-39752 CVE-2025-39756                      CVE-2025-39757 CVE-2025-39759 CVE-2025-39760 CVE-2025-39766                      CVE-2025-39770 CVE-2025-39772 CVE-2025-39773 CVE-2025-39776                      CVE-2025-39782 CVE-2025-39783 CVE-2025-39787 CVE-2025-39788                      CVE-2025-39790 CVE-2025-39794 CVE-2025-39795 CVE-2025-39798                      CVE-2025-39800 CVE-2025-39801 CVE-2025-39806 CVE-2025-39808                      CVE-2025-39812 CVE-2025-39813 CVE-2025-39817 CVE-2025-39819                      CVE-2025-39823 CVE-2025-39824 CVE-2025-39825 CVE-2025-39826                      CVE-2025-39827 CVE-2025-39828 CVE-2025-39835 CVE-2025-39838                      CVE-2025-39839 CVE-2025-39841 CVE-2025-39842 CVE-2025-39843                      CVE-2025-39844 CVE-2025-39845 CVE-2025-39846 CVE-2025-39847                      CVE-2025-39848 CVE-2025-39849 CVE-2025-39853 CVE-2025-39857                      CVE-2025-39860 CVE-2025-39864 CVE-2025-39865 CVE-2025-39866                      CVE-2025-39869 CVE-2025-39870 CVE-2025-39873 CVE-2025-39876                      CVE-2025-39877 CVE-2025-39880 CVE-2025-39881 CVE-2025-39883                      CVE-2025-39885 CVE-2025-39891 CVE-2025-39894 CVE-2025-39898                      CVE-2025-39902 CVE-2025-39907 CVE-2025-39909 CVE-2025-39911                      CVE-2025-39913 CVE-2025-39914 CVE-2025-39916 CVE-2025-39920                      CVE-2025-39923 CVE-2025-40300     Debian Bug     : 1040901 1107479 1107511 1108065 1108069 1108271 1108430                      1109734 1111017 1114773

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 11 bullseye, these problems have been fixed in version     6.1.153-1~deb11u1.  Starting with this version, modules are signed     with an ephemeral key on all architectures, and the broken pktcdvd     driver is disabled.  This version additionally includes many more bug     fixes from stable updates 6.1.141-6.1.153.

    We recommend that you upgrade your linux-6.1 packages.

    For the detailed security status of linux-6.1 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.1

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20551 advisory.

    - scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug:
    38175020,38226429] {CVE-2025-38238}
    - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug:
    38254220] {CVE-2025-38469}
    - btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug:
    37844509] {CVE-2025-22115}
    - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug:
    38310005] {CVE-2025-38499}
    - efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug:
    38324320] {CVE-2025-38549}
    - rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
    - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212]     {CVE-2025-38468}
    - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug:
    38254223] {CVE-2025-38470}
    - tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
    - virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
    - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug:
    38254235] {CVE-2025-38472}
    - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
    - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239]     {CVE-2025-38473}
    - usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
    - ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
    - hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug:
    38324317] {CVE-2025-38548}
    - net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
    - smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256]     {CVE-2025-38475}
    - smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
    - rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
    - net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
    - bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225]     {CVE-2025-38528}
    - comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug:
    38254270] {CVE-2025-38478}
    - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276]     {CVE-2025-38480}
    - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283]     {CVE-2025-38481}
    - comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
    - comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
    - comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
    - comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
    - iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242]     {CVE-2025-38531}
    - iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
    - iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314]     {CVE-2025-38547}
    - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306]     {CVE-2025-38485}
    - smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug:
    38254322] {CVE-2025-38488}
    - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325]     {CVE-2025-38489}
    - net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
    - net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
    - net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
    - dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
    - mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332]     {CVE-2025-38552}
    - mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329]     {CVE-2025-38491}
    - tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
    - tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268]     {CVE-2025-38539}
    - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
    - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires)     [Orabug: 38254346] {CVE-2025-38495}
    - dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
    - usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356]     {CVE-2025-38497}
    - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256]     {CVE-2025-38535}
    - rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070]     {CVE-2025-38067}
    - crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089]     {CVE-2025-37984}
    - ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080]     {CVE-2025-38437}
    - kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146]     {CVE-2025-38510}
    - HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137]     {CVE-2025-38507}
    - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277]     {CVE-2025-38540}
    - btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
    - ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084]     {CVE-2025-38438}
    - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088]     {CVE-2025-38439}
    - net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092]     {CVE-2025-38440}
    - net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
    - netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug:
    38254094] {CVE-2025-38441}
    - drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
    - nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
    - wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286]     {CVE-2025-38541}
    - raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
    - md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107]     {CVE-2025-38445}
    - drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294]     {CVE-2025-38543}
    - wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug:
    38324159] {CVE-2025-38513}
    - clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112]     {CVE-2025-38446}
    - lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192]     {CVE-2025-38517}
    - usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116]     {CVE-2025-38448}
    - drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178]     {CVE-2025-38515}
    - drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122]     {CVE-2025-38449}
    - drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196]     {CVE-2025-38520}
    - drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199]     {CVE-2025-38521}
    - wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu)     [Orabug: 38254130] {CVE-2025-38450}
    - wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132]     {CVE-2025-38505}
    - wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
    - pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184]     {CVE-2025-38516}
    - net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133]     {CVE-2025-38452}
    - ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug:
    38254137] {CVE-2025-38454}
    - KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134]     {CVE-2025-38506}
    - KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson)     [Orabug: 38254139] {CVE-2025-38455}
    - ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug:
    38254142] {CVE-2025-38456}
    - rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168]     {CVE-2025-38514}
    - rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
    - net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145]     {CVE-2025-38457}
    - net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar)     [Orabug: 38324304] {CVE-2025-38545}
    - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151]     {CVE-2025-38458}
    - atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159]     {CVE-2025-38459}
    - atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
    - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165]     {CVE-2025-38460}
    - vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
    - vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
    - tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177]     {CVE-2025-38463}
    - tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
    - netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
    - perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
    - drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV     (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
    - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug:
    38254201] {CVE-2025-38467}
    - eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug:
    38209551] {CVE-2025-38349}
    - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827]     {CVE-2024-36350,CVE-2024-36357}
    - x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827]     {CVE-2024-36350,CVE-2024-36357}
    - mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034]     {CVE-2025-38242}
    - mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
    - usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
    - riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
    - optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
    - i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
    - usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838]     {CVE-2025-38376}
    - IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
    - fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909]     {CVE-2025-38396}
    - mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862]     {CVE-2025-38384}
    - ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873]     {CVE-2025-38386}
    - wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
    - scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi)     [Orabug: 38253913] {CVE-2025-38399}
    - genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955]     {CVE-2025-38408}
    - drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
    - drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
    - drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787]     {CVE-2025-38360}
    - drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775]     {CVE-2025-38356}
    - netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033]     {CVE-2025-38139}
    - bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug:
    38180467] {CVE-2025-38279}
    - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503]     {CVE-2025-38289}
    - net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337]     {CVE-2025-38350}
    - rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840]     {CVE-2025-38377}
    - idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
    - idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932]     {CVE-2025-38402}
    - drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885]     {CVE-2025-38389}
    - net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870]     {CVE-2025-38385}
    - smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
    - platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug:
    38253975] {CVE-2025-38412}
    - nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
    - btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149]     {CVE-2025-38243}
    - btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
    - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899]     {CVE-2025-38393}
    - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug:
    38253921] {CVE-2025-38400}
    - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879]     {CVE-2025-38387}
    - RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824]     {CVE-2025-38372}
    - firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug:
    38253883] {CVE-2025-38388}
    - firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890]     {CVE-2025-38390}
    - drm/v3d: Disable interrupts before resetting the GPU (Maira Canal) [Orabug: 38253819] {CVE-2025-38371}
    - mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926]     {CVE-2025-38401}
    - usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892]     {CVE-2025-38391}
    - Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug:
    38253852] {CVE-2025-38381}
    - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug:
    38253905] {CVE-2025-38395}
    - vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug:
    38253935] {CVE-2025-38403}
    - virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug:
    38253832] {CVE-2025-38375}
    - virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5973 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5973-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     August 12, 2025                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2024-36350 CVE-2024-36357 CVE-2024-36913 CVE-2024-41013                      CVE-2024-56758 CVE-2024-57883 CVE-2025-21816 CVE-2025-22119                      CVE-2025-27558 CVE-2025-37958 CVE-2025-38000 CVE-2025-38001                      CVE-2025-38003 CVE-2025-38004 CVE-2025-38031 CVE-2025-38034                      CVE-2025-38035 CVE-2025-38037 CVE-2025-38040 CVE-2025-38043                      CVE-2025-38044 CVE-2025-38048 CVE-2025-38051 CVE-2025-38052                      CVE-2025-38058 CVE-2025-38061 CVE-2025-38062 CVE-2025-38063                      CVE-2025-38065 CVE-2025-38066 CVE-2025-38067 CVE-2025-38068                      CVE-2025-38071 CVE-2025-38072 CVE-2025-38074 CVE-2025-38075                      CVE-2025-38077 CVE-2025-38078 CVE-2025-38079 CVE-2025-38083                      CVE-2025-38084 CVE-2025-38085 CVE-2025-38086 CVE-2025-38088                      CVE-2025-38090 CVE-2025-38097 CVE-2025-38100 CVE-2025-38102                      CVE-2025-38103 CVE-2025-38107 CVE-2025-38108 CVE-2025-38111                      CVE-2025-38112 CVE-2025-38113 CVE-2025-38115 CVE-2025-38118                      CVE-2025-38119 CVE-2025-38120 CVE-2025-38122 CVE-2025-38124                      CVE-2025-38126 CVE-2025-38131 CVE-2025-38135 CVE-2025-38136                      CVE-2025-38138 CVE-2025-38142 CVE-2025-38143 CVE-2025-38145                      CVE-2025-38146 CVE-2025-38147 CVE-2025-38148 CVE-2025-38151                      CVE-2025-38153 CVE-2025-38154 CVE-2025-38157 CVE-2025-38158                      CVE-2025-38159 CVE-2025-38160 CVE-2025-38161 CVE-2025-38163                      CVE-2025-38165 CVE-2025-38166 CVE-2025-38167 CVE-2025-38170                      CVE-2025-38173 CVE-2025-38174 CVE-2025-38180 CVE-2025-38181                      CVE-2025-38183 CVE-2025-38184 CVE-2025-38185 CVE-2025-38190                      CVE-2025-38191 CVE-2025-38193 CVE-2025-38194 CVE-2025-38197                      CVE-2025-38198 CVE-2025-38200 CVE-2025-38202 CVE-2025-38211                      CVE-2025-38212 CVE-2025-38214 CVE-2025-38215 CVE-2025-38218                      CVE-2025-38219 CVE-2025-38222 CVE-2025-38225 CVE-2025-38226                      CVE-2025-38227 CVE-2025-38229 CVE-2025-38230 CVE-2025-38231                      CVE-2025-38236 CVE-2025-38239 CVE-2025-38245 CVE-2025-38249                      CVE-2025-38251 CVE-2025-38257 CVE-2025-38259 CVE-2025-38260                      CVE-2025-38262 CVE-2025-38263 CVE-2025-38273 CVE-2025-38275                      CVE-2025-38277 CVE-2025-38280 CVE-2025-38282 CVE-2025-38285                      CVE-2025-38286 CVE-2025-38293 CVE-2025-38298 CVE-2025-38300                      CVE-2025-38304 CVE-2025-38305 CVE-2025-38310 CVE-2025-38312                      CVE-2025-38313 CVE-2025-38319 CVE-2025-38320 CVE-2025-38323                      CVE-2025-38324 CVE-2025-38326 CVE-2025-38328 CVE-2025-38331                      CVE-2025-38332 CVE-2025-38334 CVE-2025-38336 CVE-2025-38337                      CVE-2025-38342 CVE-2025-38344 CVE-2025-38345 CVE-2025-38346                      CVE-2025-38348 CVE-2025-38350 CVE-2025-38352 CVE-2025-38354                      CVE-2025-38362 CVE-2025-38363 CVE-2025-38364 CVE-2025-38365                      CVE-2025-38371 CVE-2025-38375 CVE-2025-38377 CVE-2025-38380                      CVE-2025-38382 CVE-2025-38384 CVE-2025-38385 CVE-2025-38386                      CVE-2025-38387 CVE-2025-38389 CVE-2025-38391 CVE-2025-38393                      CVE-2025-38395 CVE-2025-38396 CVE-2025-38399 CVE-2025-38400                      CVE-2025-38401 CVE-2025-38403 CVE-2025-38404 CVE-2025-38406                      CVE-2025-38409 CVE-2025-38410 CVE-2025-38412 CVE-2025-38415                      CVE-2025-38416 CVE-2025-38418 CVE-2025-38419 CVE-2025-38420                      CVE-2025-38422 CVE-2025-38424 CVE-2025-38425 CVE-2025-38428                      CVE-2025-38430 CVE-2025-38437 CVE-2025-38439 CVE-2025-38441                      CVE-2025-38443 CVE-2025-38444 CVE-2025-38445 CVE-2025-38448                      CVE-2025-38451 CVE-2025-38455 CVE-2025-38456 CVE-2025-38457                      CVE-2025-38458 CVE-2025-38459 CVE-2025-38460 CVE-2025-38461                      CVE-2025-38462 CVE-2025-38464 CVE-2025-38465 CVE-2025-38466                      CVE-2025-38467 CVE-2025-38468 CVE-2025-38470 CVE-2025-38471                      CVE-2025-38472 CVE-2025-38473 CVE-2025-38474 CVE-2025-38476                      CVE-2025-38477 CVE-2025-38478 CVE-2025-38480 CVE-2025-38481                      CVE-2025-38482 CVE-2025-38483 CVE-2025-38485 CVE-2025-38487                      CVE-2025-38488 CVE-2025-38494 CVE-2025-38495 CVE-2025-38497                      CVE-2025-38498 CVE-2025-38499

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 6.1.147-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - btrfs: handle csum tree error with rescue=ibadroots correctly [BUG] There is syzbot based reproducer that     can crash the kernel, with the following call trace: (With some debug output added) DEBUG:
    rescue=ibadroots parsed BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8     /dev/loop0 (7:0) scanned by repro (1010) BTRFS info (device loop0): first mount of filesystem     14d642db-7b15-43e4-81e6-4b8fac6a25f8 BTRFS info (device loop0): using blake2b (blake2b-256-generic)     checksum algorithm BTRFS info (device loop0): using free-space-tree BTRFS warning (device loop0): checksum     verify failed on logical 5312512 mirror 1 wanted     0xb043382657aede36608fd3386d6b001692ff406164733d94e2d9a180412c6003 found     0x810ceb2bacb7f0f9eb2bf3b2b15c02af867cb35ad450898169f3b1f0bd818651 level 0 DEBUG: read tree root path     failed for tree csum, ret=-5 BTRFS warning (device loop0): checksum verify failed on logical 5328896     mirror 1 wanted 0x51be4e8b303da58e6340226815b70e3a93592dac3f30dd510c7517454de8567a found     0x51be4e8b303da58e634022a315b70e3a93592dac3f30dd510c7517454de8567a level 0 BTRFS warning (device loop0):
    checksum verify failed on logical 5292032 mirror 1 wanted     0x1924ccd683be9efc2fa98582ef58760e3848e9043db8649ee382681e220cdee4 found     0x0cb6184f6e8799d9f8cb335dccd1d1832da1071d12290dab3b85b587ecacca6e level 0 process 'repro' launched     './file2' with NULL argv: empty string added DEBUG: no csum root, idatacsums=0 ibadroots=134217728 Oops:
    general protection fault, probably for non-canonical address 0xdffffc0000000041: 0000 [#1] SMP KASAN NOPTI     KASAN: null-ptr-deref in range [0x0000000000000208-0x000000000000020f] CPU: 5 UID: 0 PID: 1010 Comm: repro     Tainted: G OE 6.15.0-custom+ #249 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS     unknown 02/02/2022 RIP: 0010:btrfs_lookup_csum+0x93/0x3d0 [btrfs] Call Trace: <TASK>     btrfs_lookup_bio_sums+0x47a/0xdf0 [btrfs] btrfs_submit_bbio+0x43e/0x1a80 [btrfs] submit_one_bio+0xde/0x160     [btrfs] btrfs_readahead+0x498/0x6a0 [btrfs] read_pages+0x1c3/0xb20 page_cache_ra_order+0x4b5/0xc20     filemap_get_pages+0x2d3/0x19e0 filemap_read+0x314/0xde0 __kernel_read+0x35b/0x900 bprm_execve+0x62e/0x1140     do_execveat_common.isra.0+0x3fc/0x520 __x64_sys_execveat+0xdc/0x130 do_syscall_64+0x54/0x1d0     entry_SYSCALL_64_after_hwframe+0x76/0x7e ---[ end trace 0000000000000000 ]--- [CAUSE] Firstly the fs has a     corrupted csum tree root, thus to mount the fs we have to go ro,rescue=ibadroots mount option. Normally     with that mount option, a bad csum tree root should set BTRFS_FS_STATE_NO_DATA_CSUMS flag, so that any     future data read will ignore csum search. But in this particular case, we have the following call trace     that caused NULL csum root, but not setting BTRFS_FS_STATE_NO_DATA_CSUMS: load_global_roots_objectid():
    ret = btrfs_search_slot(); /* Succeeded */ btrfs_item_key_to_cpu() found = true; /* We found the root item     for csum tree. */ root = read_tree_root_path(); if (IS_ERR(root)) { if (!btrfs_test_opt(fs_info,     IGNOREBADROOTS)) /* * Since we have rescue=ibadroots mount option, * @ret is still 0. */ break; if (!found     || ret) { /* @found is true, @ret is 0, error handling for csum * tree is skipped. */ } This means we     completely skipped to set BTRFS_FS_STATE_NO_DATA_CSUMS if the csum tree is corrupted, which results     unexpected later csum lookup. [FIX] If read_tree_root_path() failed, always populate @ret to the error     number. As at the end of the function, we need @ret to determine if we need to do the extra error handling     for csum tree. (CVE-2025-38260)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1130 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    virtio: break and reset virtio devices on device_shutdown() (CVE-2025-38064)

    In the Linux kernel, the following vulnerability has been resolved:

    netfs: Fix oops in write-retry from mis-resetting the subreq iterator (CVE-2025-38139)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Don't leave consecutive consumed OOB skbs. (CVE-2025-38236)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: userfaultfd: fix race of userfaultfd_move and swap cache (CVE-2025-38242)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix potential deadlock when reconnecting channels (CVE-2025-38244)

    In the Linux kernel, the following vulnerability has been resolved:

    lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (CVE-2025-38255)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/rsrc: fix folio unpinning (CVE-2025-38256)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write (CVE-2025-38258)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: handle csum tree error with rescue=ibadroots correctly (CVE-2025-38260)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: serial: uartlite: register uart driver in init (CVE-2025-38262)

    In the Linux kernel, the following vulnerability has been resolved:

    bcache: fix NULL pointer in cache_set_flush() (CVE-2025-38263)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: sanitize request list handling (CVE-2025-38264)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Always pass notifications when child class becomes empty (CVE-2025-38350)

    In the Linux kernel, the following vulnerability has been resolved:

    maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (CVE-2025-38364)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix a race between renames and directory logging (CVE-2025-38365)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (CVE-2025-38372)

    In the Linux kernel, the following vulnerability has been resolved:

    IB/mlx5: Fix potential deadlock in MR deregistration (CVE-2025-38373)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-net: ensure the received length does not exceed allocated size (CVE-2025-38375)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix warning when reconnecting channel (CVE-2025-38379)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix iteration of extrefs during log replay (CVE-2025-38382)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/vmalloc: fix data race in show_numa_info() (CVE-2025-38383)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Refuse to evaluate a method if arguments are missing (CVE-2025-38386)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (CVE-2025-38387)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (CVE-2025-38388)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/gt: Fix timeline left held on VMA alloc error (CVE-2025-38389)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: arm_ffa: Fix memory leak by freeing notifier callback node (CVE-2025-38390)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (CVE-2025-38393)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (CVE-2025-38396)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (CVE-2025-38399)

    In the Linux kernel, the following vulnerability has been resolved:

    nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (CVE-2025-38400)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock/vmci: Clear the vmci transport packet properly when initializing it (CVE-2025-38403)

    In the Linux kernel, the following vulnerability has been resolved:

    nvmet: fix memory leak of bio integrity (CVE-2025-38405)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-net: xsk: rx: fix the frame's length check (CVE-2025-38413)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix the smbd_response slab to allow usercopy (CVE-2025-38523)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1111 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails (CVE-2024-36913)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: don't walk off the end of a directory data block (CVE-2024-41013)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: hugetlb: independent PMD page table shared count (CVE-2024-57883)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix kmemleak warning for percpu hashmap (CVE-2025-37807)

    In the Linux kernel, the following vulnerability has been resolved:

    net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (CVE-2025-37945)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: prio: fix a race in prio_tune() (CVE-2025-38083)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/hugetlb: unshare page tables during VMA split, not before (CVE-2025-38084)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085)

    In the Linux kernel, the following vulnerability has been resolved:

    VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (CVE-2025-38102)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (CVE-2025-38103)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: red: fix a race in __red_change() (CVE-2025-38108)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mdiobus: Fix potential out-of-bounds read/write access (CVE-2025-38111)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Fix TOCTOU issue in sk_is_readable() (CVE-2025-38112)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (CVE-2025-38113)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: sch_sfq: fix a potential crash on gso_skb handling (CVE-2025-38115)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_set_pipapo_avx2: fix initial map fill (CVE-2025-38120)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix udp gso skb_segment after pull from frag_list (CVE-2025-38124)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: Fix the dead loop of MPLS parse (CVE-2025-38146)

    In the Linux kernel, the following vulnerability has been resolved:

    calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (CVE-2025-38151)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Avoid using sk_socket after free when sending (CVE-2025-38154)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (CVE-2025-38161)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix panic when calling skb_linearize (CVE-2025-38165)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: fix ktls panic with sockmap (CVE-2025-38166)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: handle hdr_first_de() return value (CVE-2025-38167)

    In the Linux kernel, the following vulnerability has been resolved:

    calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (CVE-2025-38181)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: sch_sfq: reject invalid perturb period (CVE-2025-38193)

    In the Linux kernel, the following vulnerability has been resolved:

    fbcon: Make sure modelist not set on unregistered console (CVE-2025-38198)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (CVE-2025-38202)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211)

    In the Linux kernel, the following vulnerability has been resolved:

    ipc: fix to protect IPCS lookups using RCU (CVE-2025-38212)

    In the Linux kernel, the following vulnerability has been resolved:

    vgacon: Add check for vc_origin address range in vgacon_scroll() (CVE-2025-38213)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (CVE-2025-38214)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (CVE-2025-38215)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: inline: fix len overflow in ext4_prepare_inline_data (CVE-2025-38222)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (CVE-2025-38231)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Don't leave consecutive consumed OOB skbs. (CVE-2025-38236)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: handle csum tree error with rescue=ibadroots correctly (CVE-2025-38260)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: serial: uartlite: register uart driver in init (CVE-2025-38262)

    In the Linux kernel, the following vulnerability has been resolved:

    bcache: fix NULL pointer in cache_set_flush() (CVE-2025-38263)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Avoid __bpf_prog_ret0_warn when jit fails (CVE-2025-38280)

    In the Linux kernel, the following vulnerability has been resolved:

    kernfs: Relax constraint in draining guard (CVE-2025-38282)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix WARN() in get_bpf_raw_tp_regs (CVE-2025-38285)

    In the Linux kernel, the following vulnerability has been resolved:

    EDAC/skx_common: Fix general protection fault (CVE-2025-38298)

    In the Linux kernel, the following vulnerability has been resolved:

    ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() (CVE-2025-38305)

    In the Linux kernel, the following vulnerability has been resolved:

    seg6: Fix validation of nexthop addresses (CVE-2025-38310)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (CVE-2025-38312)

    In the Linux kernel, the following vulnerability has been resolved:

    mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (CVE-2025-38324)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (CVE-2025-38337)

    In the Linux kernel, the following vulnerability has been resolved:

    software node: Correct a OOB check in software_node_get_reference_args() (CVE-2025-38342)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: fix acpi parse and parseext cache leaks (CVE-2025-38344)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Always pass notifications when child class becomes empty (CVE-2025-38350)

    In the Linux kernel, the following vulnerability has been resolved:

    posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix a race between renames and directory logging (CVE-2025-38365)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-net: ensure the received length does not exceed allocated size (CVE-2025-38375)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix iteration of extrefs during log replay (CVE-2025-38382)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Refuse to evaluate a method if arguments are missing (CVE-2025-38386)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (CVE-2025-38387)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/gt: Fix timeline left held on VMA alloc error (CVE-2025-38389)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (CVE-2025-38393)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (CVE-2025-38399)

    In the Linux kernel, the following vulnerability has been resolved:

    nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (CVE-2025-38400)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock/vmci: Clear the vmci transport packet properly when initializing it (CVE-2025-38403)

    In the Linux kernel, the following vulnerability has been resolved:

    Squashfs: check return result of sb_min_blocksize (CVE-2025-38415)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: Fix sample vs do_exit() (CVE-2025-38424)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (CVE-2025-38430)

    In the Linux kernel, the following vulnerability has been resolved:

    do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
272302	Ubuntu 24.04 LTS : Linux kernel (HWE) vulnerabilities (USN-7856-1)	Nessus	Ubuntu Local Security Checks	medium
271193	Ubuntu 24.04 LTS / 25.04 : Linux kernel (Azure) vulnerabilities (USN-7834-1)	Nessus	Ubuntu Local Security Checks	medium
271191	Ubuntu 24.04 LTS / 25.04 : Linux kernel vulnerabilities (USN-7833-1)	Nessus	Ubuntu Local Security Checks	medium
270134	Debian dla-4328 : linux-config-6.1 - security update	Nessus	Debian Local Security Checks	high
261833	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20551)	Nessus	Oracle Linux Local Security Checks	medium
249177	Debian dsa-5973 : affs-modules-6.1.0-37-4kc-malta-di - security update	Nessus	Debian Local Security Checks	high
246783	Linux Distros Unpatched Vulnerability : CVE-2025-38260	Nessus	Misc.	medium
243505	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2025-1130)	Nessus	Amazon Linux Local Security Checks	high
243500	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1111)	Nessus	Amazon Linux Local Security Checks	high
242163	Photon OS 5.0: Linux PHSA-2025-5.0-0558	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2025-38260

high

Tenable Plugins

medium

medium

medium

high

medium

high

medium

high

high

high