In the Linux kernel, the following vulnerability has been resolved: ipv6: reject malicious packets in ipv6_gso_segment() syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header. This 16bit field has a limited range. Add skb_reset_transport_header_careful() helper and use it from ipv6_gso_segment() WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline] WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Modules linked in: CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline] RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Call Trace: <TASK> skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110 skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 __skb_gso_segment+0x342/0x510 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950 validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000 sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329 __dev_xmit_skb net/core/dev.c:4102 [inline] __dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03301-1 advisory.

    The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
    - CVE-2024-49996: cifs: Fix buffer overflow when parsing NFS reparse points (bsc#1232089).
    - CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
    - CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
    - CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
    - CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
    - CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
    - CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
    - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
    - CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
    - CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
    - CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
    - CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
    - CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
    - CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
    - CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
    - CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
    - CVE-2025-38563: perf/core: Prevent VMA split of buffer mappings (bsc#1248306).
    - CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
    - CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()     (bsc#1247167).
    - CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
    - CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
    - CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
    - CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
    - CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
    - CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
    - CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
    - CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
    - CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns     (bsc#1247976).
    - CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface     (bsc#1248088).
    - CVE-2025-38506: KVM: Allow CPU to reschedule while setting per-page memory attributes (bsc#1248186).
    - CVE-2025-38520: drm/amdkfd: Do not call mmput from MMU notifier callback (bsc#1248217).
    - CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
    - CVE-2025-38528: bpf: Reject %p% format string in bprintf-like helpers (bsc#1248198).
    - CVE-2025-38531: iio: common: st_sensors: Fix use of uninitialize device structs (bsc#1248205).
    - CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
    - CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
    - CVE-2025-38585: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (bsc#1248355).
    - CVE-2025-38591: bpf: Reject narrower access to pointer ctx fields (bsc#1248363).
    - CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
    - CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03290-1 advisory.

    The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
    - CVE-2024-49996: cifs: Fix buffer overflow when parsing NFS reparse points (bsc#1232089).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
    - CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
    - CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
    - CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
    - CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
    - CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
    - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
    - CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
    - CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
    - CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
    - CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
    - CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
    - CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
    - CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
    - CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
    - CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
    - CVE-2025-38440: net/mlx5e: Fix race between DIM disable and net_dim() (bsc#1247290).
    - CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()     (bsc#1247167).
    - CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
    - CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
    - CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
    - CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
    - CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
    - CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
    - CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
    - CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
    - CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns     (bsc#1247976).
    - CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface     (bsc#1248088).
    - CVE-2025-38506: KVM: Allow CPU to reschedule while setting per-page memory attributes (bsc#1248186).
    - CVE-2025-38520: drm/amdkfd: Do not call mmput from MMU notifier callback (bsc#1248217).
    - CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
    - CVE-2025-38528: bpf: Reject %p% format string in bprintf-like helpers (bsc#1248198).
    - CVE-2025-38531: iio: common: st_sensors: Fix use of uninitialize device structs (bsc#1248205).
    - CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
    - CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
    - CVE-2025-38563: perf/core: Prevent VMA split of buffer mappings (bsc#1248306).
    - CVE-2025-38585: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (bsc#1248355).
    - CVE-2025-38591: bpf: Reject narrower access to pointer ctx fields (bsc#1248363).
    - CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
    - CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03272-1 advisory.

    The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
    - CVE-2024-49996: cifs: Fix buffer overflow when parsing NFS reparse points (bsc#1232089).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
    - CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
    - CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
    - CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
    - CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
    - CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
    - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
    - CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
    - CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
    - CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
    - CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
    - CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
    - CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
    - CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
    - CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
    - CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
    - CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()     (bsc#1247167).
    - CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
    - CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
    - CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
    - CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
    - CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
    - CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
    - CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
    - CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
    - CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns     (bsc#1247976).
    - CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface     (bsc#1248088).
    - CVE-2025-38506: KVM: Allow CPU to reschedule while setting per-page memory attributes (bsc#1248186).
    - CVE-2025-38520: drm/amdkfd: Do not call mmput from MMU notifier callback (bsc#1248217).
    - CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
    - CVE-2025-38528: bpf: Reject %p% format string in bprintf-like helpers (bsc#1248198).
    - CVE-2025-38531: iio: common: st_sensors: Fix use of uninitialize device structs (bsc#1248205).
    - CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
    - CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
    - CVE-2025-38563: perf/core: Prevent VMA split of buffer mappings (bsc#1248306).
    - CVE-2025-38585: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (bsc#1248355).
    - CVE-2025-38591: bpf: Reject narrower access to pointer ctx fields (bsc#1248363).
    - CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
    - CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.242-239.961. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-104 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix deadlock when cloning inline extents and using qgroups (CVE-2021-46987)

    In the Linux kernel, the following vulnerability has been resolved:

    uio_hv_generic: Fix another memory leak in error handling paths (CVE-2021-47070)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/rxe: Return CQE error if invalid lkey was supplied (CVE-2021-47076)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Fix link down processing to address NULL pointer dereference (CVE-2021-47183)

    In the Linux kernel, the following vulnerability has been resolved:

    block: don't call rq_qos_ops->done_bio if the bio isn't tracked (CVE-2021-47412)

    In the Linux kernel, the following vulnerability has been resolved:

    ptp: Fix possible memory leak in ptp_clock_register() (CVE-2021-47455)

    In the Linux kernel, the following vulnerability has been resolved:

    dm rq: don't queue request to blk-mq during DM suspend (CVE-2021-47498)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix UAF in decryption with multichannel (CVE-2025-37750)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-net: ensure the received length does not exceed allocated size (CVE-2025-38375)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: net: sierra: check for no status endpoint (CVE-2025-38474)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_qfq: Fix race condition on qfq_aggregate (CVE-2025-38477)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix use-after-free in crypt_message when using async crypto (CVE-2025-38488)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: do not bypass hid_hw_raw_request (CVE-2025-38494)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: ensure the allocated report buffer can contain the reserved report ID (CVE-2025-38495)

    In the Linux kernel, the following vulnerability has been resolved:

    clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (CVE-2025-38499)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Restrict conditions for adding duplicating netems to qdisc tree (CVE-2025-38553)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: reject malicious packets in ipv6_gso_segment() (CVE-2025-38572)

    In the Linux kernel, the following vulnerability has been resolved:

    net/packet: fix a race in packet_set_ring() and packet_notifier() (CVE-2025-38617)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: Do not allow binding to VMADDR_PORT_ANY (CVE-2025-38618)

    In the Linux kernel, the following vulnerability has been resolved:

    net: drop UFO packets in udp_rcv_segment() (CVE-2025-38622)

    In the Linux kernel, the following vulnerability has been resolved:

    hfsplus: remove mutex_lock check in hfsplus_free_extents (CVE-2025-38650)

    In the Linux kernel, the following vulnerability has been resolved:

    regulator: core: fix NULL dereference on unbind due to stale coupling data (CVE-2025-38668)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.298-218.429. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2025-109 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix UAF in cifs_demultiplex_thread() (CVE-2023-52572)

    In the Linux kernel, the following vulnerability has been resolved:

    nfs: fix UAF in direct writes (CVE-2024-26958)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: sch_sfq: don't allow 1 packet limit (CVE-2024-57996)

    In the Linux kernel, the following vulnerability has been resolved:

    codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CVE-2025-37798)

    In the Linux kernel, the following vulnerability has been resolved:

    dma-buf: insert memory barrier before updating num_fences (CVE-2025-38095)

    In the Linux kernel, the following vulnerability has been resolved:

    sch_hfsc: make hfsc_qlen_notify() idempotent (CVE-2025-38177)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: sch_sfq: reject invalid perturb period (CVE-2025-38193)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-net: ensure the received length does not exceed allocated size (CVE-2025-38375)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: net: sierra: check for no status endpoint (CVE-2025-38474)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_qfq: Fix race condition on qfq_aggregate (CVE-2025-38477)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: do not bypass hid_hw_raw_request (CVE-2025-38494)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: ensure the allocated report buffer can contain the reserved report ID (CVE-2025-38495)

    In the Linux kernel, the following vulnerability has been resolved:

    clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (CVE-2025-38499)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Restrict conditions for adding duplicating netems to qdisc tree (CVE-2025-38553)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: reject malicious packets in ipv6_gso_segment() (CVE-2025-38572)

    In the Linux kernel, the following vulnerability has been resolved:

    net/packet: fix a race in packet_set_ring() and packet_notifier() (CVE-2025-38617)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: Do not allow binding to VMADDR_PORT_ANY (CVE-2025-38618)

    In the Linux kernel, the following vulnerability has been resolved:

    net: drop UFO packets in udp_rcv_segment() (CVE-2025-38622)

    In the Linux kernel, the following vulnerability has been resolved:

    hfsplus: remove mutex_lock check in hfsplus_free_extents (CVE-2025-38650)

    In the Linux kernel, the following vulnerability has been resolved:

    regulator: core: fix NULL dereference on unbind due to stale coupling data (CVE-2025-38668)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (CVE-2025-38695)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1169 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: Avoid race in open_cached_dir with lease breaks (CVE-2025-37954)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (CVE-2025-38162)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: fix double free in delayed_free (CVE-2025-38206)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CVE-2025-38500)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Restrict conditions for adding duplicating netems to qdisc tree (CVE-2025-38553)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/sev: Evict cache lines during SNP memory validation (CVE-2025-38560)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: reject malicious packets in ipv6_gso_segment() (CVE-2025-38572)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix possible infinite loop in fib6_info_uses_dev() (CVE-2025-38587)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: prevent infinite loop in rt6_nlmsg_size() (CVE-2025-38588)

    In the Linux kernel, the following vulnerability has been resolved:

    net/packet: fix a race in packet_set_ring() and packet_notifier() (CVE-2025-38617)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: Do not allow binding to VMADDR_PORT_ANY (CVE-2025-38618)

    In the Linux kernel, the following vulnerability has been resolved:

    net: drop UFO packets in udp_rcv_segment() (CVE-2025-38622)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Check device memory pointer before usage (CVE-2025-38645)

    In the Linux kernel, the following vulnerability has been resolved:

    proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653)

    In the Linux kernel, the following vulnerability has been resolved:

    can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (CVE-2025-38665)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ipv6: reject malicious packets in ipv6_gso_segment() syzbot was able to craft a packet with very long IPv6     extension headers leading to an overflow of skb->transport_header. This 16bit field has a limited range.
    Add skb_reset_transport_header_careful() helper and use it from ipv6_gso_segment() WARNING: CPU: 0 PID:
    5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline]     WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0     net/ipv6/ip6_offload.c:151 Modules linked in: CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted     6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google     Compute Engine, BIOS Google 07/12/2025 RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032     [inline] RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Call Trace: <TASK>     skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110     skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 __skb_gso_segment+0x342/0x510 net/core/gso.c:124     skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950     validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000 sch_direct_xmit+0xd3/0x4b0     net/sched/sch_generic.c:329 __dev_xmit_skb net/core/dev.c:4102 [inline] __dev_queue_xmit+0x17b6/0x3a70     net/core/dev.c:4679 (CVE-2025-38572)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
265775	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:03301-1)	Nessus	SuSE Local Security Checks	high
265749	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2025:03290-1)	Nessus	SuSE Local Security Checks	high
265433	Photon OS 4.0: Linux PHSA-2025-4.0-0864	Nessus	PhotonOS Local Security Checks	high
265422	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:03272-1)	Nessus	SuSE Local Security Checks	high
265084	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2025-104 (ALASKERNEL-5.10-2025-104)	Nessus	Amazon Linux Local Security Checks	medium
265070	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2025-109 (ALASKERNEL-5.4-2025-109)	Nessus	Amazon Linux Local Security Checks	high
261737	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1169)	Nessus	Amazon Linux Local Security Checks	high
261144	Photon OS 5.0: Linux PHSA-2025-5.0-0610	Nessus	PhotonOS Local Security Checks	high
260103	Linux Distros Unpatched Vulnerability : CVE-2025-38572	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-38572

high

Tenable Plugins

high

high

high

high

medium

high

high

high

medium