In the Linux kernel, the following vulnerability has been resolved: smb: client: fix regression with native SMB symlinks Some users and customers reported that their backup/copy tools started to fail when the directory being copied contained symlink targets that the client couldn't parse - even when those symlinks weren't followed. Fix this by allowing lstat(2) and readlink(2) to succeed even when the client can't resolve the symlink target, restoring old behavior.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50160 advisory.

    - mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
    - platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501]     {CVE-2026-23237}
    - scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
    - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990]     {CVE-2025-71234}
    - xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
    - scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979]     {CVE-2025-71232}
    - scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992]     {CVE-2025-71235}
    - scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998]     {CVE-2025-71236}
    - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972]     {CVE-2025-71229}
    - crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052]     {CVE-2026-23229}
    - crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug:
    38997976] {CVE-2025-71231}
    - smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug:
    38998059] {CVE-2026-23230}
    - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593]     {CVE-2026-23202}
    - ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
    - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598]     {CVE-2026-23200}
    - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug:
    38970170] {CVE-2026-23111}
    - net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
    - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508]     {CVE-2026-23209}
    - net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
    - smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
    - btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156]     {CVE-2026-23214}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug:
    38985169] {CVE-2026-23216}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug:
    38970453] {CVE-2026-23193}
    - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416]     {CVE-2026-23179}
    - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
    - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413]     {CVE-2026-23178}
    - md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
    - wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
    - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163]     {CVE-2025-71224}
    - procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476]     {CVE-2026-23199}
    - mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
    - ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug:
    38970590] {CVE-2026-23201}
    - ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595]     {CVE-2026-23189}
    - mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192]     {CVE-2026-23219}
    - ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
    - x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
    - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176]     {CVE-2026-23112}
    - perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581]     {CVE-2026-23159}
    - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126]     {CVE-2024-58096}
    - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug:
    38970348] {CVE-2026-23163}
    - net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
    - mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345]     {CVE-2026-23161}
    - flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
    - nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608]     {CVE-2026-23148}
    - efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
    - net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
    - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364]     {CVE-2026-23166}
    - rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
    - bonding: annotate data-races around slave->last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
    - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587]     {CVE-2026-23151}
    - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604]     {CVE-2026-23146}
    - wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129]     {CVE-2024-58097}
    - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802]     {CVE-2025-68358}
    - sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605]     {CVE-2025-68333}
    - exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
    - bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881]     {CVE-2025-68725}
    - migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066]     {CVE-2026-23097}
    - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120]     {CVE-2026-23108}
    - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug:
    38930881] {CVE-2026-23061}
    - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859]     {CVE-2026-23058}
    - irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001]     {CVE-2026-23085}
    - intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
    - tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024]     {CVE-2026-23088}
    - arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
    - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118]     {CVE-2026-23107}
    - wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939]     {CVE-2026-23073}
    - wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
    - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029]     {CVE-2026-23089}
    - ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973]     {CVE-2026-23078}
    - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966]     {CVE-2026-23076}
    - leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091]     {CVE-2026-23101}
    - dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
    - vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
    - vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug:
    38930919] {CVE-2026-23069}
    - bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199]     {CVE-2026-23119}
    - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992]     {CVE-2026-23084}
    - ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
    - netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233]     {CVE-2026-23126}
    - scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867]     {CVE-2026-23059}
    - scsi: core: Wake up the error handler when final completions race against each other (David Jeffery)     [Orabug: 38931132] {CVE-2026-23110}
    - regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930]     {CVE-2026-23071}
    - interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug:
    38970218] {CVE-2026-23123}
    - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181]     {CVE-2026-23113}
    - platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug:
    38930890] {CVE-2026-23062}
    - platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug:
    38970247] {CVE-2026-23131}
    - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014]     {CVE-2026-23087}
    - w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796]     {CVE-2025-71197}
    - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Taeyang Lee) [Orabug:
    38930874] {CVE-2026-23060}
    - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi     Salim) [Orabug: 38931110] {CVE-2026-23105}
    - net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948]     {CVE-2026-23074}
    - ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
    - l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
    - gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
    - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225]     {CVE-2026-23125}
    - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde)     [Orabug: 38931184] {CVE-2026-23082}
    - l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
    - bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
    - vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7856-1 advisory.

    Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Kpf, Stavros Volos, and Flavien Solt discovered     that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting     in the leakage of privileged information. A local attacker could possibly use this to expose sensitive     information. (CVE-2024-36350, CVE-2024-36357)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - x86 architecture;

    - ACPI drivers;

    - Serial ATA and Parallel ATA drivers;

    - ATM drivers;

    - Drivers core;

    - ATA over ethernet (AOE) driver;

    - Ublk userspace block driver;

    - Bus devices;

    - DMA engine subsystem;

    - Arm Firmware Framework for ARMv8-A(FFA);

    - Cirrus firmware drivers;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - InfiniBand drivers;

    - Input Device (Miscellaneous) drivers;

    - Multiple devices driver;

    - Media drivers;

    - TI TPS6594 PFSM driver;

    - MMC subsystem;

    - MTD block device drivers;

    - Network drivers;

    - NVME drivers;

    - x86 platform drivers;

    - RapidIO drivers;

    - Voltage and Current Regulator drivers;

    - Remote Processor subsystem;

    - S/390 drivers;

    - SCSI subsystem;

    - TCM subsystem;

    - Trusted Execution Environment drivers;

    - TTY drivers;

    - ChipIdea USB driver;

    - USB Type-C support driver;

    - Framebuffer layer;

    - TSM Common Guest driver;

    - File systems infrastructure;

    - BTRFS file system;

    - Ceph distributed file system;

    - Ext4 file system;

    - F2FS file system;

    - JFFS2 file system;

    - JFS file system;

    - Network file systems library;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - SMB network file system;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - Memory Management;

    - Bluetooth subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - IPC subsystem;

    - BPF subsystem;

    - Perf events;

    - Kernel exit() syscall;

    - IRQ subsystem;

    - Scheduler infrastructure;

    - Maple Tree data structure library;

    - Memory management;

    - Ethernet bridge;

    - Networking core;

    - IPv6 networking;

    - MultiProtocol Label Switching driver;

    - Netfilter;

    - NFC subsystem;

    - Rose network layer;

    - Network traffic control;

    - Sun RPC protocol;

    - TIPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - WCD audio codecs;

    - USB sound devices; (CVE-2025-38084, CVE-2025-38085, CVE-2025-38086, CVE-2025-38087, CVE-2025-38089,     CVE-2025-38090, CVE-2025-38179, CVE-2025-38180, CVE-2025-38181, CVE-2025-38182, CVE-2025-38183,     CVE-2025-38184, CVE-2025-38185, CVE-2025-38186, CVE-2025-38188, CVE-2025-38189, CVE-2025-38190,     CVE-2025-38191, CVE-2025-38192, CVE-2025-38193, CVE-2025-38194, CVE-2025-38196, CVE-2025-38197,     CVE-2025-38198, CVE-2025-38199, CVE-2025-38200, CVE-2025-38201, CVE-2025-38202, CVE-2025-38203,     CVE-2025-38204, CVE-2025-38205, CVE-2025-38206, CVE-2025-38208, CVE-2025-38210, CVE-2025-38211,     CVE-2025-38212, CVE-2025-38214, CVE-2025-38215, CVE-2025-38217, CVE-2025-38218, CVE-2025-38219,     CVE-2025-38220, CVE-2025-38222, CVE-2025-38223, CVE-2025-38224, CVE-2025-38225, CVE-2025-38226,     CVE-2025-38227, CVE-2025-38228, CVE-2025-38229, CVE-2025-38230, CVE-2025-38231, CVE-2025-38232,     CVE-2025-38233, CVE-2025-38234, CVE-2025-38236, CVE-2025-38237, CVE-2025-38238, CVE-2025-38239,     CVE-2025-38241, CVE-2025-38242, CVE-2025-38244, CVE-2025-38245, CVE-2025-38246, CVE-2025-38248,     CVE-2025-38249, CVE-2025-38250, CVE-2025-38251, CVE-2025-38253, CVE-2025-38254, CVE-2025-38255,     CVE-2025-38256, CVE-2025-38257, CVE-2025-38258, CVE-2025-38259, CVE-2025-38260, CVE-2025-38261,     CVE-2025-38262, CVE-2025-38263, CVE-2025-38264, CVE-2025-38320, CVE-2025-38321, CVE-2025-38322,     CVE-2025-38323, CVE-2025-38324, CVE-2025-38325, CVE-2025-38326, CVE-2025-38328, CVE-2025-38329,     CVE-2025-38330, CVE-2025-38331, CVE-2025-38332, CVE-2025-38333, CVE-2025-38334, CVE-2025-38336,     CVE-2025-38337, CVE-2025-38338, CVE-2025-38339, CVE-2025-38340, CVE-2025-38341, CVE-2025-38342,     CVE-2025-38343, CVE-2025-38344, CVE-2025-38345, CVE-2025-38346, CVE-2025-38347, CVE-2025-38348,     CVE-2025-38353, CVE-2025-38354, CVE-2025-38355, CVE-2025-38356, CVE-2025-38359, CVE-2025-38360,     CVE-2025-38361, CVE-2025-38362, CVE-2025-38363, CVE-2025-38364, CVE-2025-38365, CVE-2025-38368,     CVE-2025-38369, CVE-2025-38370, CVE-2025-38371, CVE-2025-38372, CVE-2025-38373, CVE-2025-38374,     CVE-2025-38375, CVE-2025-38376, CVE-2025-38377, CVE-2025-38381, CVE-2025-38382, CVE-2025-38383,     CVE-2025-38384, CVE-2025-38385, CVE-2025-38386, CVE-2025-38387, CVE-2025-38388, CVE-2025-38389,     CVE-2025-38390, CVE-2025-38391, CVE-2025-38392, CVE-2025-38393, CVE-2025-38395, CVE-2025-38396,     CVE-2025-38399, CVE-2025-38400, CVE-2025-38401, CVE-2025-38402, CVE-2025-38403, CVE-2025-38405,     CVE-2025-38406, CVE-2025-38407, CVE-2025-38408, CVE-2025-38409, CVE-2025-38410, CVE-2025-38411,     CVE-2025-38412, CVE-2025-38413, CVE-2025-38416, CVE-2025-38417, CVE-2025-38418, CVE-2025-38419,     CVE-2025-38420, CVE-2025-38421, CVE-2025-38422, CVE-2025-38423, CVE-2025-38424, CVE-2025-38425,     CVE-2025-38426, CVE-2025-38427, CVE-2025-38428, CVE-2025-38429, CVE-2025-38430, CVE-2025-38431,     CVE-2025-38434, CVE-2025-38435, CVE-2025-38436, CVE-2025-38523, CVE-2025-38541, CVE-2025-39682)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 25.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7834-1 advisory.

    Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Kpf, Stavros Volos, and Flavien Solt discovered     that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting     in the leakage of privileged information. A local attacker could possibly use this to expose sensitive     information. (CVE-2024-36350, CVE-2024-36357)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - x86 architecture;

    - ACPI drivers;

    - Serial ATA and Parallel ATA drivers;

    - Drivers core;

    - ATA over ethernet (AOE) driver;

    - Ublk userspace block driver;

    - Bus devices;

    - DMA engine subsystem;

    - Arm Firmware Framework for ARMv8-A(FFA);

    - Cirrus firmware drivers;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - InfiniBand drivers;

    - Input Device (Miscellaneous) drivers;

    - Multiple devices driver;

    - Media drivers;

    - TI TPS6594 PFSM driver;

    - MMC subsystem;

    - MTD block device drivers;

    - Network drivers;

    - NVME drivers;

    - x86 platform drivers;

    - RapidIO drivers;

    - Voltage and Current Regulator drivers;

    - Remote Processor subsystem;

    - S/390 drivers;

    - SCSI subsystem;

    - TCM subsystem;

    - Trusted Execution Environment drivers;

    - TTY drivers;

    - ChipIdea USB driver;

    - USB Type-C support driver;

    - Framebuffer layer;

    - TSM Common Guest driver;

    - File systems infrastructure;

    - BTRFS file system;

    - Ceph distributed file system;

    - Ext4 file system;

    - F2FS file system;

    - JFFS2 file system;

    - JFS file system;

    - Network file systems library;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - SMB network file system;

    - Memory Management;

    - Bluetooth subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - IPC subsystem;

    - BPF subsystem;

    - Perf events;

    - Kernel exit() syscall;

    - IRQ subsystem;

    - Scheduler infrastructure;

    - Maple Tree data structure library;

    - Memory management;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - Ethernet bridge;

    - Networking core;

    - IPv6 networking;

    - MultiProtocol Label Switching driver;

    - Netfilter;

    - NFC subsystem;

    - Rose network layer;

    - Network traffic control;

    - Sun RPC protocol;

    - TIPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - WCD audio codecs;

    - USB sound devices; (CVE-2025-38217, CVE-2025-38259, CVE-2025-38257, CVE-2025-38388, CVE-2025-38258,     CVE-2025-38086, CVE-2025-38416, CVE-2025-38428, CVE-2025-38368, CVE-2025-38233, CVE-2025-38391,     CVE-2025-38364, CVE-2025-38328, CVE-2025-38417, CVE-2025-38228, CVE-2025-38413, CVE-2025-38360,     CVE-2025-38248, CVE-2025-38346, CVE-2025-38197, CVE-2025-38179, CVE-2025-38186, CVE-2025-38356,     CVE-2025-38371, CVE-2025-38231, CVE-2025-38249, CVE-2025-38334, CVE-2025-38325, CVE-2025-38353,     CVE-2025-38422, CVE-2025-38387, CVE-2025-38225, CVE-2025-38224, CVE-2025-38400, CVE-2025-38245,     CVE-2025-38411, CVE-2025-38205, CVE-2025-38362, CVE-2025-38200, CVE-2025-38250, CVE-2025-38541,     CVE-2025-38326, CVE-2025-38342, CVE-2025-38208, CVE-2025-38261, CVE-2025-38407, CVE-2025-38202,     CVE-2025-38331, CVE-2025-38189, CVE-2025-38090, CVE-2025-38184, CVE-2025-38255, CVE-2025-38419,     CVE-2025-38340, CVE-2025-38383, CVE-2025-38423, CVE-2025-38332, CVE-2025-38246, CVE-2025-38429,     CVE-2025-38410, CVE-2025-38396, CVE-2025-38262, CVE-2025-38191, CVE-2025-38420, CVE-2025-38226,     CVE-2025-38341, CVE-2025-38199, CVE-2025-38085, CVE-2025-38188, CVE-2025-38253, CVE-2025-38182,     CVE-2025-38087, CVE-2025-38203, CVE-2025-38194, CVE-2025-38227, CVE-2025-38365, CVE-2025-38238,     CVE-2025-38201, CVE-2025-38196, CVE-2025-38232, CVE-2025-38361, CVE-2025-38392, CVE-2025-38254,     CVE-2025-38370, CVE-2025-38192, CVE-2025-38229, CVE-2025-38241, CVE-2025-38222, CVE-2025-38337,     CVE-2025-38343, CVE-2025-38321, CVE-2025-38183, CVE-2025-38381, CVE-2025-38354, CVE-2025-38234,     CVE-2025-38385, CVE-2025-38239, CVE-2025-38218, CVE-2025-38426, CVE-2025-38330, CVE-2025-38427,     CVE-2025-38523, CVE-2025-38260, CVE-2025-38425, CVE-2025-38320, CVE-2025-38424, CVE-2025-38372,     CVE-2025-38412, CVE-2025-38434, CVE-2025-38089, CVE-2025-38322, CVE-2025-38236, CVE-2025-38339,     CVE-2025-38237, CVE-2025-38386, CVE-2025-38395, CVE-2025-38431, CVE-2025-38329, CVE-2025-38436,     CVE-2025-38369, CVE-2025-38405, CVE-2025-38204, CVE-2025-38374, CVE-2025-38263, CVE-2025-38181,     CVE-2025-38363, CVE-2025-38084, CVE-2025-38206, CVE-2025-38359, CVE-2025-38347, CVE-2025-38421,     CVE-2025-38418, CVE-2025-38375, CVE-2025-38389, CVE-2025-38373, CVE-2025-38403, CVE-2025-38348,     CVE-2025-38399, CVE-2025-38242, CVE-2025-38393, CVE-2025-38336, CVE-2025-38264, CVE-2025-38408,     CVE-2025-38384, CVE-2025-38406, CVE-2025-38382, CVE-2025-38211, CVE-2025-38220, CVE-2025-38376,     CVE-2025-38401, CVE-2025-38344, CVE-2025-38223, CVE-2025-38251, CVE-2025-38324, CVE-2025-38402,     CVE-2025-38198, CVE-2025-38210, CVE-2025-38377, CVE-2025-38345, CVE-2025-38219, CVE-2025-39682,     CVE-2025-38355, CVE-2025-38333, CVE-2025-38338, CVE-2025-38256, CVE-2025-38390, CVE-2025-38435,     CVE-2025-38430, CVE-2025-38409, CVE-2025-38212)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 25.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7833-1 advisory.

    Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Kpf, Stavros Volos, and Flavien Solt discovered     that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting     in the leakage of privileged information. A local attacker could possibly use this to expose sensitive     information. (CVE-2024-36350, CVE-2024-36357)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - x86 architecture;

    - ACPI drivers;

    - Serial ATA and Parallel ATA drivers;

    - Drivers core;

    - ATA over ethernet (AOE) driver;

    - Ublk userspace block driver;

    - Bus devices;

    - DMA engine subsystem;

    - Arm Firmware Framework for ARMv8-A(FFA);

    - Cirrus firmware drivers;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - InfiniBand drivers;

    - Input Device (Miscellaneous) drivers;

    - Multiple devices driver;

    - Media drivers;

    - TI TPS6594 PFSM driver;

    - MMC subsystem;

    - MTD block device drivers;

    - Network drivers;

    - NVME drivers;

    - x86 platform drivers;

    - RapidIO drivers;

    - Voltage and Current Regulator drivers;

    - Remote Processor subsystem;

    - S/390 drivers;

    - SCSI subsystem;

    - TCM subsystem;

    - Trusted Execution Environment drivers;

    - TTY drivers;

    - ChipIdea USB driver;

    - USB Type-C support driver;

    - Framebuffer layer;

    - TSM Common Guest driver;

    - File systems infrastructure;

    - BTRFS file system;

    - Ceph distributed file system;

    - Ext4 file system;

    - F2FS file system;

    - JFFS2 file system;

    - JFS file system;

    - Network file systems library;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - SMB network file system;

    - Memory Management;

    - Bluetooth subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - IPC subsystem;

    - BPF subsystem;

    - Perf events;

    - Kernel exit() syscall;

    - IRQ subsystem;

    - Scheduler infrastructure;

    - Maple Tree data structure library;

    - Memory management;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - Ethernet bridge;

    - Networking core;

    - IPv6 networking;

    - MultiProtocol Label Switching driver;

    - Netfilter;

    - NFC subsystem;

    - Rose network layer;

    - Network traffic control;

    - Sun RPC protocol;

    - TIPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - WCD audio codecs;

    - USB sound devices; (CVE-2025-38339, CVE-2025-38391, CVE-2025-38262, CVE-2025-38345, CVE-2025-38387,     CVE-2025-38373, CVE-2025-38395, CVE-2025-38330, CVE-2025-38425, CVE-2025-38210, CVE-2025-38206,     CVE-2025-38219, CVE-2025-38245, CVE-2025-38253, CVE-2025-38401, CVE-2025-38410, CVE-2025-38086,     CVE-2025-38340, CVE-2025-38368, CVE-2025-38385, CVE-2025-38384, CVE-2025-38326, CVE-2025-38224,     CVE-2025-38338, CVE-2025-38191, CVE-2025-39682, CVE-2025-38343, CVE-2025-38090, CVE-2025-38228,     CVE-2025-38182, CVE-2025-38231, CVE-2025-38183, CVE-2025-38184, CVE-2025-38237, CVE-2025-38413,     CVE-2025-38356, CVE-2025-38246, CVE-2025-38202, CVE-2025-38248, CVE-2025-38254, CVE-2025-38426,     CVE-2025-38429, CVE-2025-38364, CVE-2025-38388, CVE-2025-38435, CVE-2025-38403, CVE-2025-38186,     CVE-2025-38199, CVE-2025-38402, CVE-2025-38181, CVE-2025-38264, CVE-2025-38362, CVE-2025-38341,     CVE-2025-38422, CVE-2025-38331, CVE-2025-38423, CVE-2025-38233, CVE-2025-38337, CVE-2025-38328,     CVE-2025-38196, CVE-2025-38412, CVE-2025-38205, CVE-2025-38242, CVE-2025-38324, CVE-2025-38354,     CVE-2025-38347, CVE-2025-38217, CVE-2025-38393, CVE-2025-38392, CVE-2025-38390, CVE-2025-38321,     CVE-2025-38541, CVE-2025-38363, CVE-2025-38203, CVE-2025-38250, CVE-2025-38418, CVE-2025-38336,     CVE-2025-38333, CVE-2025-38194, CVE-2025-38372, CVE-2025-38348, CVE-2025-38370, CVE-2025-38411,     CVE-2025-38188, CVE-2025-38365, CVE-2025-38241, CVE-2025-38201, CVE-2025-38259, CVE-2025-38355,     CVE-2025-38227, CVE-2025-38225, CVE-2025-38405, CVE-2025-38329, CVE-2025-38232, CVE-2025-38344,     CVE-2025-38238, CVE-2025-38239, CVE-2025-38260, CVE-2025-38257, CVE-2025-38399, CVE-2025-38419,     CVE-2025-38430, CVE-2025-38251, CVE-2025-38332, CVE-2025-38220, CVE-2025-38417, CVE-2025-38396,     CVE-2025-38234, CVE-2025-38434, CVE-2025-38197, CVE-2025-38436, CVE-2025-38408, CVE-2025-38204,     CVE-2025-38222, CVE-2025-38361, CVE-2025-38218, CVE-2025-38212, CVE-2025-38198, CVE-2025-38255,     CVE-2025-38389, CVE-2025-38085, CVE-2025-38244, CVE-2025-38089, CVE-2025-38428, CVE-2025-38369,     CVE-2025-38189, CVE-2025-38084, CVE-2025-38400, CVE-2025-38382, CVE-2025-38223, CVE-2025-38325,     CVE-2025-38263, CVE-2025-38249, CVE-2025-38346, CVE-2025-38320, CVE-2025-38409, CVE-2025-38374,     CVE-2025-38208, CVE-2025-38256, CVE-2025-38371, CVE-2025-38192, CVE-2025-38406, CVE-2025-38360,     CVE-2025-38258, CVE-2025-38226, CVE-2025-38376, CVE-2025-38375, CVE-2025-38200, CVE-2025-38523,     CVE-2025-38334, CVE-2025-38236, CVE-2025-38386, CVE-2025-38421, CVE-2025-38087, CVE-2025-38416,     CVE-2025-38179, CVE-2025-38420, CVE-2025-38424, CVE-2025-38377, CVE-2025-38359, CVE-2025-38342,     CVE-2025-38431, CVE-2025-38407, CVE-2025-38427, CVE-2025-38229, CVE-2025-38353, CVE-2025-38383,     CVE-2025-38211, CVE-2025-38322, CVE-2025-38381, CVE-2025-38261)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: smb: client: fix regression with     native SMB symlinks Some users and customers reported that their backup/copy tools started to fail when     the directory being copied contained symlink targets that the client couldn't parse - even when those     symlinks weren't followed. Fix this by allowing lstat(2) and readlink(2) to succeed even when the client     can't resolve the symlink target, restoring old behavior. (CVE-2025-38431)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
303468	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50160)	Nessus	Oracle Linux Local Security Checks	critical
272302	Ubuntu 24.04 LTS : Linux kernel (HWE) vulnerabilities (USN-7856-1)	Nessus	Ubuntu Local Security Checks	medium
271193	Ubuntu 24.04 LTS / 25.04 : Linux kernel (Azure) vulnerabilities (USN-7834-1)	Nessus	Ubuntu Local Security Checks	medium
271191	Ubuntu 24.04 LTS / 25.04 : Linux kernel vulnerabilities (USN-7833-1)	Nessus	Ubuntu Local Security Checks	medium
251333	Linux Distros Unpatched Vulnerability : CVE-2025-38431	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-38431

medium

Tenable Plugins

critical

medium

medium

medium

medium