In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Remove skb secpath if xfrm state is not found Hardware returns a unique identifier for a decrypted packet's xfrm state, this state is looked up in an xarray. However, the state might have been freed by the time of this lookup. Currently, if the state is not found, only a counter is incremented. The secpath (sp) extension on the skb is not removed, resulting in sp->len becoming 0. Subsequently, functions like __xfrm_policy_check() attempt to access fields such as xfrm_input_state(skb)->xso.type (which dereferences sp->xvec[sp->len - 1]) without first validating sp->len. This leads to a crash when dereferencing an invalid state pointer. This patch prevents the crash by explicitly removing the secpath extension from the skb if the xfrm state is not found after hardware decryption. This ensures downstream functions do not operate on a zero-length secpath. BUG: unable to handle page fault for address: ffffffff000002c8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 282e067 P4D 282e067 PUD 0 Oops: Oops: 0000 [#1] SMP CPU: 12 UID: 0 PID: 0 Comm: swapper/12 Not tainted 6.15.0-rc7_for_upstream_min_debug_2025_05_27_22_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:__xfrm_policy_check+0x61a/0xa30 Code: b6 77 7f 83 e6 02 74 14 4d 8b af d8 00 00 00 41 0f b6 45 05 c1 e0 03 48 98 49 01 c5 41 8b 45 00 83 e8 01 48 98 49 8b 44 c5 10 <0f> b6 80 c8 02 00 00 83 e0 0c 3c 04 0f 84 0c 02 00 00 31 ff 80 fa RSP: 0018:ffff88885fb04918 EFLAGS: 00010297 RAX: ffffffff00000000 RBX: 0000000000000002 RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000000 RBP: ffffffff8311af80 R08: 0000000000000020 R09: 00000000c2eda353 R10: ffff88812be2bbc8 R11: 000000001faab533 R12: ffff88885fb049c8 R13: ffff88812be2bbc8 R14: 0000000000000000 R15: ffff88811896ae00 FS: 0000000000000000(0000) GS:ffff8888dca82000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff000002c8 CR3: 0000000243050002 CR4: 0000000000372eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> ? try_to_wake_up+0x108/0x4c0 ? udp4_lib_lookup2+0xbe/0x150 ? udp_lib_lport_inuse+0x100/0x100 ? __udp4_lib_lookup+0x2b0/0x410 __xfrm_policy_check2.constprop.0+0x11e/0x130 udp_queue_rcv_one_skb+0x1d/0x530 udp_unicast_rcv_skb+0x76/0x90 __udp4_lib_rcv+0xa64/0xe90 ip_protocol_deliver_rcu+0x20/0x130 ip_local_deliver_finish+0x75/0xa0 ip_local_deliver+0xc1/0xd0 ? ip_protocol_deliver_rcu+0x130/0x130 ip_sublist_rcv+0x1f9/0x240 ? ip_rcv_finish_core+0x430/0x430 ip_list_rcv+0xfc/0x130 __netif_receive_skb_list_core+0x181/0x1e0 netif_receive_skb_list_internal+0x200/0x360 ? mlx5e_build_rx_skb+0x1bc/0xda0 [mlx5_core] gro_receive_skb+0xfd/0x210 mlx5e_handle_rx_cqe_mpwrq+0x141/0x280 [mlx5_core] mlx5e_poll_rx_cq+0xcc/0x8e0 [mlx5_core] ? mlx5e_handle_rx_dim+0x91/0xd0 [mlx5_core] mlx5e_napi_poll+0x114/0xab0 [mlx5_core] __napi_poll+0x25/0x170 net_rx_action+0x32d/0x3a0 ? mlx5_eq_comp_int+0x8d/0x280 [mlx5_core] ? notifier_call_chain+0x33/0xa0 handle_softirqs+0xda/0x250 irq_exit_rcu+0x6d/0xc0 common_interrupt+0x81/0xa0 </IRQ>

suse_linux SUSE-SU-2025:03600-1: SUSE openSUSE 15 : Security update for the Linux Kernel (Important) (SUSE-SU-2025:03600-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3751-1 advisory.

    The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
    - CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
    - CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
    - CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
    - CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
    - CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
    - CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
    - CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
    - CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
    - CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
    - CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in     rproc_attach() (bsc#1247136).
    - CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
    - CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
    - CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
    - CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
    - CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
    - CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
    - CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
    - CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
    - CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
    - CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
    - CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
    - CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
    - CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port     (bsc#1248378).
    - CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
    - CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
    - CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
    - CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
    - CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
    - CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
    - CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
    - CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
    - CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data     (bsc#1248647).
    - CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
    - CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
    - CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
    - CVE-2025-38705: drm/amd/pm: fix null pointer access (bsc#1249334).
    - CVE-2025-38709: loop: Avoid updating block size under exclusive owner (bsc#1249199).
    - CVE-2025-38721: netfilter: ctnetlink: fix refcount leak on table dump (bsc#1249176).
    - CVE-2025-38722: habanalabs: fix UAF in export_dmabuf() (bsc#1249163).
    - CVE-2025-38730: io_uring/net: commit partial buffers on retry (bsc#1249172).
    - CVE-2025-38732: netfilter: nf_reject: do not leak dst refcount for loopback packets (bsc#1249262).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
    - CVE-2025-39677: net/sched: Fix backlog accounting in qdisc_dequeue_internal (bsc#1249300).
    - CVE-2025-39678: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL (bsc#1249290).
    - CVE-2025-39681: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (bsc#1249303).
    - CVE-2025-39682: tls: fix handling of zero-length records on the rx_list (bsc#1249284).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39705: drm/amd/display: fix a Null pointer dereference vulnerability (bsc#1249295).
    - CVE-2025-39718: vsock/virtio: Validate length in packet header before skb_put() (bsc#1249305).
    - CVE-2025-39738: btrfs: do not allow relocation of partially dropped subvolumes (bsc#1249540).
    - CVE-2025-39744: rcu: Fix rcu_read_unlock() deadloop due to IRQ work (bsc#1249494).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39749: rcu: Protect ->defer_qs_iw_pending from data race (bsc#1249533).
    - CVE-2025-39754: mm/smaps: fix race between smaps_hugetlb_range and migration (bsc#1249524).
    - CVE-2025-39764: netfilter: ctnetlink: remove refcounting in expectation dumpers (bsc#1249513).
    - CVE-2025-39766: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (bsc#1249510).
    - CVE-2025-39770: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (bsc#1249508).
    - CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
    - CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
    - CVE-2025-39787: soc: qcom: mdt_loader: Deal with zero e_shentsize (bsc#1249545).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39825: smb: client: fix race with concurrent opens in rename(2) (bsc#1250179).
    - CVE-2025-39832: net/mlx5: Fix lockdep assertion on sync reset unload event (bsc#1249901).
    - CVE-2025-39835: xfs: do not propagate ENODATA disk errors into xattr code (bsc#1250025).
    - CVE-2025-39838: cifs: prevent NULL pointer dereference in UTF16 conversion (bsc#1250365).
    - CVE-2025-39842: ocfs2: prevent release journal inode after journal shutdown (bsc#1250267).
    - CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
    - CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
    - CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
    - CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
    - CVE-2025-39857: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (bsc#1250251).
    - CVE-2025-39865: tee: fix NULL pointer dereference in tee_shm_put (bsc#1250294).
    - CVE-2025-39885: ocfs2: fix recursive semaphore deadlock in fiemap call (bsc#1250407).
    - CVE-2025-40300: x86/vmscape: Warn when STIBP is disabled with SMT (bsc#1247483).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3725-1 advisory.

    The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
    - CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
    - CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
    - CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
    - CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
    - CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
    - CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
    - CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
    - CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
    - CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
    - CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
    - CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in     rproc_attach() (bsc#1247136).
    - CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
    - CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
    - CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
    - CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
    - CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
    - CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
    - CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
    - CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
    - CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
    - CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
    - CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
    - CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
    - CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port     (bsc#1248378).
    - CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
    - CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
    - CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
    - CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
    - CVE-2025-38628: vdpa/mlx5: Fix release of uninitialized resources on error path (bsc#1248616).
    - CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
    - CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
    - CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
    - CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
    - CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
    - CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
    - CVE-2025-38705: drm/amd/pm: fix null pointer access (bsc#1249334).
    - CVE-2025-38709: loop: Avoid updating block size under exclusive owner (bsc#1249199).
    - CVE-2025-38710: gfs2: Validate i_depth for exhash directories (bsc#1249201).
    - CVE-2025-38721: netfilter: ctnetlink: fix refcount leak on table dump (bsc#1249176).
    - CVE-2025-38722: habanalabs: fix UAF in export_dmabuf() (bsc#1249163).
    - CVE-2025-38730: io_uring/net: commit partial buffers on retry (bsc#1249172).
    - CVE-2025-38732: netfilter: nf_reject: do not leak dst refcount for loopback packets (bsc#1249262).
    - CVE-2025-39677: net/sched: Fix backlog accounting in qdisc_dequeue_internal (bsc#1249300).
    - CVE-2025-39678: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL (bsc#1249290).
    - CVE-2025-39681: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (bsc#1249303).
    - CVE-2025-39682: tls: fix handling of zero-length records on the rx_list (bsc#1249284).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39705: drm/amd/display: fix a Null pointer dereference vulnerability (bsc#1249295).
    - CVE-2025-39718: vsock/virtio: Validate length in packet header before skb_put() (bsc#1249305).
    - CVE-2025-39738: btrfs: do not allow relocation of partially dropped subvolumes (bsc#1249540).
    - CVE-2025-39744: rcu: Fix rcu_read_unlock() deadloop due to IRQ work (bsc#1249494).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39749: rcu: Protect ->defer_qs_iw_pending from data race (bsc#1249533).
    - CVE-2025-39754: mm/smaps: fix race between smaps_hugetlb_range and migration (bsc#1249524).
    - CVE-2025-39764: netfilter: ctnetlink: remove refcounting in expectation dumpers (bsc#1249513).
    - CVE-2025-39766: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (bsc#1249510).
    - CVE-2025-39770: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (bsc#1249508).
    - CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
    - CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
    - CVE-2025-39787: soc: qcom: mdt_loader: Deal with zero e_shentsize (bsc#1249545).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39816: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths     (bsc#1249906).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39825: smb: client: fix race with concurrent opens in rename(2) (bsc#1250179).
    - CVE-2025-39830: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (bsc#1249974).
    - CVE-2025-39834: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow     (bsc#1250021).
    - CVE-2025-39835: xfs: do not propagate ENODATA disk errors into xattr code (bsc#1250025).
    - CVE-2025-39838: cifs: prevent NULL pointer dereference in UTF16 conversion (bsc#1250365).
    - CVE-2025-39842: ocfs2: prevent release journal inode after journal shutdown (bsc#1250267).
    - CVE-2025-39857: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (bsc#1250251).
    - CVE-2025-39865: tee: fix NULL pointer dereference in tee_shm_put (bsc#1250294).
    - CVE-2025-39885: ocfs2: fix recursive semaphore deadlock in fiemap call (bsc#1250407).
    - CVE-2025-39922: ixgbe: fix incorrect map used in eee linkmode (bsc#1250722).
    - CVE-2025-40300: x86/vmscape: Warn when STIBP is disabled with SMT (bsc#1247483).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03601-1 advisory.

    The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
    - CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
    - CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
    - CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
    - CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
    - CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
    - CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
    - CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
    - CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
    - CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
    - CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
    - CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in     rproc_attach() (bsc#1247136).
    - CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
    - CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
    - CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
    - CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
    - CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
    - CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
    - CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
    - CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
    - CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
    - CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
    - CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
    - CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
    - CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port     (bsc#1248378).
    - CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
    - CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
    - CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
    - CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
    - CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
    - CVE-2025-38628: vdpa/mlx5: Fix release of uninitialized resources on error path (bsc#1248616).
    - CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
    - CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
    - CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
    - CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data     (bsc#1248647).
    - CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
    - CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
    - CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
    - CVE-2025-38705: drm/amd/pm: fix null pointer access (bsc#1249334).
    - CVE-2025-38709: loop: Avoid updating block size under exclusive owner (bsc#1249199).
    - CVE-2025-38710: gfs2: Validate i_depth for exhash directories (bsc#1249201).
    - CVE-2025-38721: netfilter: ctnetlink: fix refcount leak on table dump (bsc#1249176).
    - CVE-2025-38722: habanalabs: fix UAF in export_dmabuf() (bsc#1249163).
    - CVE-2025-38730: io_uring/net: commit partial buffers on retry (bsc#1249172).
    - CVE-2025-38732: netfilter: nf_reject: do not leak dst refcount for loopback packets (bsc#1249262).
    - CVE-2025-39677: net/sched: Fix backlog accounting in qdisc_dequeue_internal (bsc#1249300).
    - CVE-2025-39678: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL (bsc#1249290).
    - CVE-2025-39681: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (bsc#1249303).
    - CVE-2025-39682: tls: fix handling of zero-length records on the rx_list (bsc#1249284).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39705: drm/amd/display: fix a Null pointer dereference vulnerability (bsc#1249295).
    - CVE-2025-39718: vsock/virtio: Validate length in packet header before skb_put() (bsc#1249305).
    - CVE-2025-39738: btrfs: do not allow relocation of partially dropped subvolumes (bsc#1249540).
    - CVE-2025-39744: rcu: Fix rcu_read_unlock() deadloop due to IRQ work (bsc#1249494).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39749: rcu: Protect ->defer_qs_iw_pending from data race (bsc#1249533).
    - CVE-2025-39754: mm/smaps: fix race between smaps_hugetlb_range and migration (bsc#1249524).
    - CVE-2025-39764: netfilter: ctnetlink: remove refcounting in expectation dumpers (bsc#1249513).
    - CVE-2025-39766: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (bsc#1249510).
    - CVE-2025-39770: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (bsc#1249508).
    - CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
    - CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
    - CVE-2025-39787: soc: qcom: mdt_loader: Deal with zero e_shentsize (bsc#1249545).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39816: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths     (bsc#1249906).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39825: smb: client: fix race with concurrent opens in rename(2) (bsc#1250179).
    - CVE-2025-39830: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (bsc#1249974).
    - CVE-2025-39834: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow     (bsc#1250021).
    - CVE-2025-39835: xfs: do not propagate ENODATA disk errors into xattr code (bsc#1250025).
    - CVE-2025-39838: cifs: prevent NULL pointer dereference in UTF16 conversion (bsc#1250365).
    - CVE-2025-39842: ocfs2: prevent release journal inode after journal shutdown (bsc#1250267).
    - CVE-2025-39857: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (bsc#1250251).
    - CVE-2025-39865: tee: fix NULL pointer dereference in tee_shm_put (bsc#1250294).
    - CVE-2025-39885: ocfs2: fix recursive semaphore deadlock in fiemap call (bsc#1250407).
    - CVE-2025-39922: ixgbe: fix incorrect map used in eee linkmode (bsc#1250722).
    - CVE-2025-40300: x86/vmscape: Warn when STIBP is disabled with SMT (bsc#1247483).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03602-1 advisory.

    The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security     bugfixes.


    The following security bugs were fixed:

    - CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
    - CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39718: vsock/virtio: Validate length in packet header before skb_put() (bsc#1249305).
    - CVE-2025-39705: drm/amd/display: fix a Null pointer dereference vulnerability (bsc#1249295).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39682: tls: fix handling of zero-length records on the rx_list (bsc#1249284).
    - CVE-2025-39678: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL (bsc#1249290).
    - CVE-2025-38732: netfilter: nf_reject: do not leak dst refcount for loopback packets (bsc#1249262).
    - CVE-2025-38730: io_uring/net: commit partial buffers on retry (bsc#1249172).
    - CVE-2025-38722: habanalabs: fix UAF in export_dmabuf() (bsc#1249163).
    - CVE-2025-38721: netfilter: ctnetlink: fix refcount leak on table dump (bsc#1249176).
    - CVE-2025-38709: loop: Avoid updating block size under exclusive owner (bsc#1249199).
    - CVE-2025-38705: drm/amd/pm: fix null pointer access (bsc#1249334).
    - CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
    - CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
    - CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data     (bsc#1248647).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
    - CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
    - CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
    - CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
    - CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
    - CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
    - CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).
    - CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
    - CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
    - CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
    - CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port     (bsc#1248378).
    - CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
    - CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
    - CVE-2025-38591: bpf: Reject narrower access to pointer ctx fields (bsc#1248363).
    - CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
    - CVE-2025-38585: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (bsc#1248355).
    - CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
    - CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
    - CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
    - CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
    - CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
    - CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
    - CVE-2025-38531: iio: common: st_sensors: Fix use of uninitialize device structs (bsc#1248205).
    - CVE-2025-38528: bpf: Reject %p% format string in bprintf-like helpers (bsc#1248198).
    - CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
    - CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
    - CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
    - CVE-2025-38520: drm/amdkfd: Do not call mmput from MMU notifier callback (bsc#1248217).
    - CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
    - CVE-2025-38506: KVM: Allow CPU to reschedule while setting per-page memory attributes (bsc#1248186).
    - CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface     (bsc#1248088).
    - CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns     (bsc#1247976).
    - CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
    - CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
    - CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
    - CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
    - CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
    - CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
    - CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
    - CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
    - CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()     (bsc#1247167).
    - CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
    - CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in     rproc_attach() (bsc#1247136).
    - CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
    - CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
    - CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
    - CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
    - CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
    - CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
    - CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
    - CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
    - CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
    - CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
    - CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
    - CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
    - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
    - CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
    - CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
    - CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
    - CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
    - CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
    - CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
    - CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
    - CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03633-1 advisory.

    The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
    - CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
    - CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
    - CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
    - CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
    - CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
    - CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
    - CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
    - CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
    - CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
    - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
    - CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
    - CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
    - CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
    - CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
    - CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
    - CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
    - CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
    - CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
    - CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
    - CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
    - CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
    - CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
    - CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
    - CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
    - CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
    - CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in     rproc_attach() (bsc#1247136).
    - CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
    - CVE-2025-38440: net/mlx5e: Fix race between DIM disable and net_dim() (bsc#1247290).
    - CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()     (bsc#1247167).
    - CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
    - CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
    - CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
    - CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
    - CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
    - CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
    - CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
    - CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
    - CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
    - CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns     (bsc#1247976).
    - CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface     (bsc#1248088).
    - CVE-2025-38506: KVM: Allow CPU to reschedule while setting per-page memory attributes (bsc#1248186).
    - CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
    - CVE-2025-38520: drm/amdkfd: Do not call mmput from MMU notifier callback (bsc#1248217).
    - CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
    - CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
    - CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
    - CVE-2025-38528: bpf: Reject %p% format string in bprintf-like helpers (bsc#1248198).
    - CVE-2025-38531: iio: common: st_sensors: Fix use of uninitialize device structs (bsc#1248205).
    - CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
    - CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
    - CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
    - CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
    - CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
    - CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
    - CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
    - CVE-2025-38585: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (bsc#1248355).
    - CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
    - CVE-2025-38591: bpf: Reject narrower access to pointer ctx fields (bsc#1248363).
    - CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
    - CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
    - CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port     (bsc#1248378).
    - CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
    - CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
    - CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
    - CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
    - CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).
    - CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
    - CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
    - CVE-2025-38628: vdpa/mlx5: Fix release of uninitialized resources on error path (bsc#1248616).
    - CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
    - CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
    - CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
    - CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data     (bsc#1248647).
    - CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
    - CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
    - CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
    - CVE-2025-38705: drm/amd/pm: fix null pointer access (bsc#1249334).
    - CVE-2025-38709: loop: Avoid updating block size under exclusive owner (bsc#1249199).
    - CVE-2025-38710: gfs2: Validate i_depth for exhash directories (bsc#1249201).
    - CVE-2025-38721: netfilter: ctnetlink: fix refcount leak on table dump (bsc#1249176).
    - CVE-2025-38722: habanalabs: fix UAF in export_dmabuf() (bsc#1249163).
    - CVE-2025-38730: io_uring/net: commit partial buffers on retry (bsc#1249172).
    - CVE-2025-38732: netfilter: nf_reject: do not leak dst refcount for loopback packets (bsc#1249262).
    - CVE-2025-39677: net/sched: Fix backlog accounting in qdisc_dequeue_internal (bsc#1249300).
    - CVE-2025-39678: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL (bsc#1249290).
    - CVE-2025-39681: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (bsc#1249303).
    - CVE-2025-39682: tls: fix handling of zero-length records on the rx_list (bsc#1249284).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39705: drm/amd/display: fix a Null pointer dereference vulnerability (bsc#1249295).
    - CVE-2025-39718: vsock/virtio: Validate length in packet header before skb_put() (bsc#1249305).
    - CVE-2025-39738: btrfs: do not allow relocation of partially dropped subvolumes (bsc#1249540).
    - CVE-2025-39744: rcu: Fix rcu_read_unlock() deadloop due to IRQ work (bsc#1249494).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39749: rcu: Protect ->defer_qs_iw_pending from data race (bsc#1249533).
    - CVE-2025-39754: mm/smaps: fix race between smaps_hugetlb_range and migration (bsc#1249524).
    - CVE-2025-39764: netfilter: ctnetlink: remove refcounting in expectation dumpers (bsc#1249513).
    - CVE-2025-39766: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (bsc#1249510).
    - CVE-2025-39770: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (bsc#1249508).
    - CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
    - CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
    - CVE-2025-39787: soc: qcom: mdt_loader: Deal with zero e_shentsize (bsc#1249545).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39816: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths     (bsc#1249906).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39825: smb: client: fix race with concurrent opens in rename(2) (bsc#1250179).
    - CVE-2025-39830: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (bsc#1249974).
    - CVE-2025-39834: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow     (bsc#1250021).
    - CVE-2025-39835: xfs: do not propagate ENODATA disk errors into xattr code (bsc#1250025).
    - CVE-2025-39838: cifs: prevent NULL pointer dereference in UTF16 conversion (bsc#1250365).
    - CVE-2025-39842: ocfs2: prevent release journal inode after journal shutdown (bsc#1250267).
    - CVE-2025-39857: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (bsc#1250251).
    - CVE-2025-39865: tee: fix NULL pointer dereference in tee_shm_put (bsc#1250294).
    - CVE-2025-39885: ocfs2: fix recursive semaphore deadlock in fiemap call (bsc#1250407).
    - CVE-2025-39922: ixgbe: fix incorrect map used in eee linkmode (bsc#1250722).
    - CVE-2025-40300: x86/vmscape: Warn when STIBP is disabled with SMT (bsc#1247483).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03634-1 advisory.

    The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
    - CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
    - CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
    - CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
    - CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
    - CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
    - CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
    - CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
    - CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
    - CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
    - CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
    - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
    - CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
    - CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
    - CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
    - CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
    - CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
    - CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
    - CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
    - CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
    - CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
    - CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
    - CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
    - CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
    - CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
    - CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
    - CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in     rproc_attach() (bsc#1247136).
    - CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
    - CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()     (bsc#1247167).
    - CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
    - CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
    - CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
    - CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
    - CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
    - CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
    - CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
    - CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
    - CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
    - CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns     (bsc#1247976).
    - CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface     (bsc#1248088).
    - CVE-2025-38506: KVM: Allow CPU to reschedule while setting per-page memory attributes (bsc#1248186).
    - CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
    - CVE-2025-38520: drm/amdkfd: Do not call mmput from MMU notifier callback (bsc#1248217).
    - CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
    - CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
    - CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
    - CVE-2025-38528: bpf: Reject %p% format string in bprintf-like helpers (bsc#1248198).
    - CVE-2025-38531: iio: common: st_sensors: Fix use of uninitialize device structs (bsc#1248205).
    - CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
    - CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
    - CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
    - CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
    - CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
    - CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
    - CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
    - CVE-2025-38585: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (bsc#1248355).
    - CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
    - CVE-2025-38591: bpf: Reject narrower access to pointer ctx fields (bsc#1248363).
    - CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
    - CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
    - CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port     (bsc#1248378).
    - CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
    - CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
    - CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
    - CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
    - CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).
    - CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
    - CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
    - CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
    - CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
    - CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
    - CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data     (bsc#1248647).
    - CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
    - CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
    - CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
    - CVE-2025-38705: drm/amd/pm: fix null pointer access (bsc#1249334).
    - CVE-2025-38709: loop: Avoid updating block size under exclusive owner (bsc#1249199).
    - CVE-2025-38721: netfilter: ctnetlink: fix refcount leak on table dump (bsc#1249176).
    - CVE-2025-38722: habanalabs: fix UAF in export_dmabuf() (bsc#1249163).
    - CVE-2025-38730: io_uring/net: commit partial buffers on retry (bsc#1249172).
    - CVE-2025-38732: netfilter: nf_reject: do not leak dst refcount for loopback packets (bsc#1249262).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
    - CVE-2025-39677: net/sched: Fix backlog accounting in qdisc_dequeue_internal (bsc#1249300).
    - CVE-2025-39678: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL (bsc#1249290).
    - CVE-2025-39681: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (bsc#1249303).
    - CVE-2025-39682: tls: fix handling of zero-length records on the rx_list (bsc#1249284).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39705: drm/amd/display: fix a Null pointer dereference vulnerability (bsc#1249295).
    - CVE-2025-39718: vsock/virtio: Validate length in packet header before skb_put() (bsc#1249305).
    - CVE-2025-39738: btrfs: do not allow relocation of partially dropped subvolumes (bsc#1249540).
    - CVE-2025-39744: rcu: Fix rcu_read_unlock() deadloop due to IRQ work (bsc#1249494).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39749: rcu: Protect ->defer_qs_iw_pending from data race (bsc#1249533).
    - CVE-2025-39754: mm/smaps: fix race between smaps_hugetlb_range and migration (bsc#1249524).
    - CVE-2025-39764: netfilter: ctnetlink: remove refcounting in expectation dumpers (bsc#1249513).
    - CVE-2025-39766: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (bsc#1249510).
    - CVE-2025-39770: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (bsc#1249508).
    - CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
    - CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
    - CVE-2025-39787: soc: qcom: mdt_loader: Deal with zero e_shentsize (bsc#1249545).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39825: smb: client: fix race with concurrent opens in rename(2) (bsc#1250179).
    - CVE-2025-39828: kABI workaround for struct atmdev_ops extension (bsc#1250205).
    - CVE-2025-39832: net/mlx5: Fix lockdep assertion on sync reset unload event (bsc#1249901).
    - CVE-2025-39835: xfs: do not propagate ENODATA disk errors into xattr code (bsc#1250025).
    - CVE-2025-39838: cifs: prevent NULL pointer dereference in UTF16 conversion (bsc#1250365).
    - CVE-2025-39842: ocfs2: prevent release journal inode after journal shutdown (bsc#1250267).
    - CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
    - CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
    - CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
    - CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
    - CVE-2025-39857: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (bsc#1250251).
    - CVE-2025-39865: tee: fix NULL pointer dereference in tee_shm_put (bsc#1250294).
    - CVE-2025-39885: ocfs2: fix recursive semaphore deadlock in fiemap call (bsc#1250407).
    - CVE-2025-40300: x86/vmscape: Warn when STIBP is disabled with SMT (bsc#1247483).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20662 advisory.

    - tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832]     {CVE-2025-39682}
    - net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug:
    38401777] {CVE-2025-38736}
    - net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
    - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814]     {CVE-2025-38680}
    - hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829]     {CVE-2025-38683}
    - net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835]     {CVE-2025-38684}
    - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842]     {CVE-2025-38685}
    - userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug:
    38394850] {CVE-2025-38686}
    - btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270]     {CVE-2025-39738}
    - usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419]     {CVE-2025-39760}
    - iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
    - iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
    - dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
    - pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
    - block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug:
    38429189] {CVE-2025-39795}
    - exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
    - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and     w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
    - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885]     {CVE-2025-38694}
    - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug:
    38394892] {CVE-2025-38695}
    - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284]     {CVE-2025-39742}
    - scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
    - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [Orabug:
    38394929] {CVE-2025-38700}
    - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935]     {CVE-2025-38701}
    - fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942]     {CVE-2025-38702}
    - rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
    - wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316]     {CVE-2025-39746}
    - xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
    - drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323]     {CVE-2025-39747}
    - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958]     {CVE-2025-38704}
    - bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
    - rcu: Protect ->defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
    - drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
    - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356]     {CVE-2025-39751}
    - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976]     {CVE-2025-38706}
    - ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug:
    38423437] {CVE-2025-39763}
    - drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
    - loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
    - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
    - gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
    - tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758]     {CVE-2025-38616}
    - sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
    - netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065]     {CVE-2025-38721}
    - mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389]     {CVE-2025-39754}
    - eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
    - fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395]     {CVE-2025-39756}
    - NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug:
    38429209] {CVE-2025-39798}
    - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079]     {CVE-2025-38724}
    - net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
    - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123]     {CVE-2025-38727}
    - smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
    - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405]     {CVE-2025-39757}
    - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099]     {CVE-2025-38729}
    - usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
    - HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz)     [Orabug: 38334911] {CVE-2025-38557}
    - mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739]     {CVE-2025-39727}
    - platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915]     {CVE-2025-38559}
    - x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836]     {CVE-2025-38560}
    - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833]     {CVE-2025-38618}
    - net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762]     {CVE-2025-38617}
    - perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
    - perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
    - sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835]     {CVE-2025-38566}
    - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972]     {CVE-2025-38568}
    - benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
    - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834]     {CVE-2025-38571}
    - net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
    - ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
    - pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
    - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743]     {CVE-2025-39730}
    - vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
    - vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825]     {CVE-2025-38628}
    - pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837]     {CVE-2025-38632}
    - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug:
    38351898] {CVE-2025-38653}
    - bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064]     {CVE-2025-38586}
    - ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068]     {CVE-2025-38587}
    - ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
    - net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076]     {CVE-2025-38590}
    - netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852]     {CVE-2025-38639}
    - bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
    - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug:
    38335086] {CVE-2025-38593}
    - wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870]     {CVE-2025-38644}
    - wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug:
    38401750] {CVE-2025-39732}
    - net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug:
    38331464] {CVE-2025-38553}
    - net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
    - wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104]     {CVE-2025-38601}
    - iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108]     {CVE-2025-38602}
    - wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117]     {CVE-2025-38604}
    - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129]     {CVE-2025-38608}
    - PM / devfreq: Check governor before using governor->name (Lifeng Zheng) [Orabug: 38335133]     {CVE-2025-38609}
    - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153]     {CVE-2025-38612}
    - gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
    - parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
    - KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316]     {CVE-2025-38351}
    - ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
    - mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778]     {CVE-2025-39725}
    - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928]     {CVE-2025-38664}
    - arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989]     {CVE-2025-38670}
    - i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
    - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-     Budde) [Orabug: 38351934] {CVE-2025-38665}
    - xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug:
    38310014,38453837] {CVE-2025-38500}
    - xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014]     {CVE-2025-38675}
    - regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati)     [Orabug: 38351976] {CVE-2025-38668}
    - Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691]     {CVE-2025-38335}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1208 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix NULL pointer dereference in l3mdev_l3_rcv (CVE-2025-22103)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113)

    In the Linux kernel, the following vulnerability has been resolved:

    md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (CVE-2025-22124)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid1,raid10: don't ignore IO flags (CVE-2025-22125)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (CVE-2025-38453)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CVE-2025-38500)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix oob access in cgroup local storage (CVE-2025-38502)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Restrict conditions for adding duplicating netems to qdisc tree (CVE-2025-38553)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Prevent VMA split of buffer mappings (CVE-2025-38563)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Exit early on perf_mmap() fail (CVE-2025-38565)

    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: fix handling of server side tls alerts (CVE-2025-38566)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568)

    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: fix client side handling of tls alerts (CVE-2025-38571)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: reject malicious packets in ipv6_gso_segment() (CVE-2025-38572)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, arm64: Fix fp initialization for exception boundary (CVE-2025-38586)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix possible infinite loop in fib6_info_uses_dev() (CVE-2025-38587)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: prevent infinite loop in rt6_nlmsg_size() (CVE-2025-38588)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Remove skb secpath if xfrm state is not found (CVE-2025-38590)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (CVE-2025-38608)

    In the Linux kernel, the following vulnerability has been resolved:

    eventpoll: Fix semi-unbounded recursion (CVE-2025-38614)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: cancle set bad inode after removing name fails (CVE-2025-38615)

    In the Linux kernel, the following vulnerability has been resolved:

    tls: handle data disappearing from under the TLS ULP (CVE-2025-38616)

    In the Linux kernel, the following vulnerability has been resolved:

    net/packet: fix a race in packet_set_ring() and packet_notifier() (CVE-2025-38617)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: Do not allow binding to VMADDR_PORT_ANY (CVE-2025-38618)

    In the Linux kernel, the following vulnerability has been resolved:

    net: drop UFO packets in udp_rcv_segment() (CVE-2025-38622)

    In the Linux kernel, the following vulnerability has been resolved:

    pinmux: fix race causing mux_owner NULL with active mux_usecount (CVE-2025-38632)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_nfacct: don't assume acct name is null-terminated (CVE-2025-38639)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Disable migration in nf_hook_run_bpf(). (CVE-2025-38640)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Check device memory pointer before usage (CVE-2025-38645)

    In the Linux kernel, the following vulnerability has been resolved:

    proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653)

    In the Linux kernel, the following vulnerability has been resolved:

    [ceph] parse_longname(): strrchr() expects NUL-terminated string (CVE-2025-38660)

    In the Linux kernel, the following vulnerability has been resolved:

    can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (CVE-2025-38665)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (CVE-2025-38670)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: state: initialize state_ptrs earlier in xfrm_state_find (CVE-2025-38675)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: Avoid stack buffer overflow from kernel cmdline (CVE-2025-38676)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (CVE-2025-38681)

    In the Linux kernel, the following vulnerability has been resolved:

    hv_netvsc: Fix panic during namespace deletion with VF (CVE-2025-38683)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (CVE-2025-38685)

    In the Linux kernel, the following vulnerability has been resolved:

    userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (CVE-2025-38686)

    In the Linux kernel, the following vulnerability has been resolved:

    pNFS: Fix uninited ptr deref in block/scsi layout (CVE-2025-38691)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: add cluster chain loop check for dir (CVE-2025-38692)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (CVE-2025-38700)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (CVE-2025-38701)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: fix potential buffer overflow in do_register_framebuffer() (CVE-2025-38702)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access (CVE-2025-38704)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Add sanity check for file name (CVE-2025-38707)

    In the Linux kernel, the following vulnerability has been resolved:

    drbd: add missing kref_get in handle_write_conflicts (CVE-2025-38708)

    In the Linux kernel, the following vulnerability has been resolved:

    loop: Avoid updating block size under exclusive owner (CVE-2025-38709)

    In the Linux kernel, the following vulnerability has been resolved:

    net: kcm: Fix race condition in kcm_unattach() (CVE-2025-38717)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: fix refcount leak on table dump (CVE-2025-38721)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724)

    In the Linux kernel, the following vulnerability has been resolved:

    smb3: fix for slab out of bounds on mount to ksmbd (CVE-2025-38728)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/net: commit partial buffers on retry (CVE-2025-38730)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_reject: don't leak dst refcount for loopback packets (CVE-2025-38732)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix oops due to uninitialised variable (CVE-2025-38737)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Fix backlog accounting in qdisc_dequeue_internal (CVE-2025-39677)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (CVE-2025-39681)

    In the Linux kernel, the following vulnerability has been resolved:

    tls: fix handling of zero-length records on the rx_list (CVE-2025-39682)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Limit access to parser->buffer when trace_get_user failed (CVE-2025-39683)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Also allocate and copy hash for reading of filter files (CVE-2025-39689)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/buffer: fix use-after-free when call bh_read() helper (CVE-2025-39691)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix a race when updating an existing write (CVE-2025-39697)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CVE-2025-39698)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/ops-common: ignore migration request to invalid nodes (CVE-2025-39700)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock/virtio: Validate length in packet header before skb_put() (CVE-2025-39718)

    In the Linux kernel, the following vulnerability has been resolved:

    netfs: Fix unbuffered write error handling (CVE-2025-39723)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: fix panic due to PSLVERR (CVE-2025-39724)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (CVE-2025-39725)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: swap: fix potential buffer overflow in setup_clusters() (CVE-2025-39727)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)

    In the Linux kernel, the following vulnerability has been resolved:

    Revert fs/ntfs3: Replace inode_trylock with inode_lock (CVE-2025-39734)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not allow relocation of partially dropped subvolumes (CVE-2025-39738)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Fix rcu_read_unlock() deadloop due to IRQ work (CVE-2025-39744)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Forget ranges when refining tnum after JSET (CVE-2025-39748)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Protect ->defer_qs_iw_pending from data race (CVE-2025-39749)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/smaps: fix race between smaps_hugetlb_range and migration (CVE-2025-39754)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: Prevent file descriptor table allocations exceeding INT_MAX (CVE-2025-39756)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: qgroup: fix race between quota disable and quota rescan ioctl (CVE-2025-39759)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: core: config: Prevent OOB read in SS endpoint companion parsing (CVE-2025-39760)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (CVE-2025-39763)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (CVE-2025-39770)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: fix soft lockup in br_multicast_query_expired() (CVE-2025-39773)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: subpage: keep TOWRITE tag until folio is cleaned (CVE-2025-39779)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/ext: Fix invalid task state transitions on class switch (CVE-2025-39780)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: prevent softlockup in jbd2_log_do_checkpoint() (CVE-2025-39782)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: endpoint: Fix configfs group list head handling (CVE-2025-39783)

    In the Linux kernel, the following vulnerability has been resolved:

    dm: dm-crypt: Do not partially accept write BIOs with zoned targets (CVE-2025-39791)

    In the Linux kernel, the following vulnerability has been resolved:

    dm: Always split write BIOs to zoned device limits (CVE-2025-39792)

    In the Linux kernel, the following vulnerability has been resolved:

    block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (CVE-2025-39795)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: Duplicate SPI Handling (CVE-2025-39797)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix the setting of capabilities when automounting a new filesystem (CVE-2025-39798)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (CVE-2025-39800)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CVE-2025-39806)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: initialize more fields in sctp_v6_from_sk() (CVE-2025-39812)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (CVE-2025-39813)

    In the Linux kernel, the following vulnerability has been resolved:

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/smb: Fix inconsistent refcnt update (CVE-2025-39819)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: use array_index_nospec with indices that come from guest (CVE-2025-39823)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: asus: fix UAF via HID_CLAIMED_INPUT validation (CVE-2025-39824)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix race with concurrent opens in rename(2) (CVE-2025-39825)

    In the Linux kernel, the following vulnerability has been resolved:

    trace/fgraph: Fix the warning caused by missing unregister notifier (CVE-2025-39829)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Fix lockdep assertion on sync reset unload event (CVE-2025-39832)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: do not propagate ENODATA disk errors into xattr code (CVE-2025-39835)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: prevent NULL pointer dereference in UTF16 conversion (CVE-2025-39838)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: move page table sync declarations to linux/pgtable.h (CVE-2025-39844)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (CVE-2025-39845)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (CVE-2025-39850)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (CVE-2025-39851)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (CVE-2025-39852)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (CVE-2025-39894)

    In the Linux kernel, the following vulnerability has been resolved:

    sched: Fix sched_numa_find_nth_cpu() if mask offline (CVE-2025-39895)

    In the Linux kernel, the following vulnerability has been resolved:

    e1000e: fix heap overflow in e1000_set_eeprom (CVE-2025-39898)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (CVE-2025-39899)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (CVE-2025-39900)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)

    In the Linux kernel, the following vulnerability has been resolved:

    of_numa: fix uninitialized memory nodes causing kernel panic (CVE-2025-39903)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1210 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    fs: relax assertions on failure to encode file handles (CVE-2024-57924)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. (CVE-2025-23143)

    In the Linux kernel, the following vulnerability has been resolved:

    media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization     (CVE-2025-23160)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: adjust subpage bit start based on sectorsize (CVE-2025-37931)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/core: Fix KASAN: slab-use-after-free Read in ib_register_device problem (CVE-2025-38022)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (CVE-2025-38201)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix oob access in cgroup local storage (CVE-2025-38502)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Remove skb secpath if xfrm state is not found (CVE-2025-38590)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Fix backlog accounting in qdisc_dequeue_internal (CVE-2025-39677)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: prevent NULL pointer dereference in UTF16 conversion (CVE-2025-39838)

    In the Linux kernel, the following vulnerability has been resolved:

    batman-adv: fix OOB read/write in network-coding decode (CVE-2025-39839)

    In the Linux kernel, the following vulnerability has been resolved:

    ocfs2: prevent release journal inode after journal shutdown (CVE-2025-39842)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: move page table sync declarations to linux/pgtable.h (CVE-2025-39844)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (CVE-2025-39845)

    In the Linux kernel, the following vulnerability has been resolved:

    pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (CVE-2025-39846)

    In the Linux kernel, the following vulnerability has been resolved:

    ppp: fix memory leak in pad_compress_skb (CVE-2025-39847)

    In the Linux kernel, the following vulnerability has been resolved:

    ax25: properly unshare skbs in ax25_kiss_rcv() (CVE-2025-39848)

    In the Linux kernel, the following vulnerability has been resolved:

    wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CVE-2025-39849)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866)

    In the Linux kernel, the following vulnerability has been resolved:x86/vmscape: Add conditional IBPB     mitigation

    VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a     userspace hypervisor (like QEMU). Existing mitigations already protect kernel/KVM from a malicious guest.
    Userspace can additionally be protected by flushing the branch predictors after a VMexit.

    Since it is the userspace that consumes the poisoned branch predictors, conditionally issue an IBPB after     a VMexit and before returning to userspace. Workloads that frequently switch between hypervisor and     userspace will incur the most overhead from the new IBPB.

    This new IBPB is not integrated with the existing IBPB sites. For instance, a task can use the existing     speculation control prctl() to get an IBPB at context switch time. With this implementation, the IBPB is     doubled up: one at context switch and another before running userspace. The intent is to integrate and     optimize these cases post-embargo.[ dhansen: elaborate on suboptimal IBPB solution ] (CVE-2025-40300)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net/mlx5e: Remove skb secpath if xfrm state is not found Hardware returns a unique identifier for a     decrypted packet's xfrm state, this state is looked up in an xarray. However, the state might have been     freed by the time of this lookup. Currently, if the state is not found, only a counter is incremented. The     secpath (sp) extension on the skb is not removed, resulting in sp->len becoming 0. Subsequently, functions     like __xfrm_policy_check() attempt to access fields such as xfrm_input_state(skb)->xso.type (which     dereferences sp->xvec[sp->len - 1]) without first validating sp->len. This leads to a crash when     dereferencing an invalid state pointer. This patch prevents the crash by explicitly removing the secpath     extension from the skb if the xfrm state is not found after hardware decryption. This ensures downstream     functions do not operate on a zero-length secpath. BUG: unable to handle page fault for address:
    ffffffff000002c8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD     282e067 P4D 282e067 PUD 0 Oops: Oops: 0000 [#1] SMP CPU: 12 UID: 0 PID: 0 Comm: swapper/12 Not tainted     6.15.0-rc7_for_upstream_min_debug_2025_05_27_22_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9,     2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP:
    0010:__xfrm_policy_check+0x61a/0xa30 Code: b6 77 7f 83 e6 02 74 14 4d 8b af d8 00 00 00 41 0f b6 45 05 c1     e0 03 48 98 49 01 c5 41 8b 45 00 83 e8 01 48 98 49 8b 44 c5 10 <0f> b6 80 c8 02 00 00 83 e0 0c 3c 04 0f 84     0c 02 00 00 31 ff 80 fa RSP: 0018:ffff88885fb04918 EFLAGS: 00010297 RAX: ffffffff00000000 RBX:
    0000000000000002 RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000000     RBP: ffffffff8311af80 R08: 0000000000000020 R09: 00000000c2eda353 R10: ffff88812be2bbc8 R11:
    000000001faab533 R12: ffff88885fb049c8 R13: ffff88812be2bbc8 R14: 0000000000000000 R15: ffff88811896ae00     FS: 0000000000000000(0000) GS:ffff8888dca82000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000     CR0: 0000000080050033 CR2: ffffffff000002c8 CR3: 0000000243050002 CR4: 0000000000372eb0 DR0:
    0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0     DR7: 0000000000000400 Call Trace: <IRQ> ? try_to_wake_up+0x108/0x4c0 ? udp4_lib_lookup2+0xbe/0x150 ?     udp_lib_lport_inuse+0x100/0x100 ? __udp4_lib_lookup+0x2b0/0x410
    __xfrm_policy_check2.constprop.0+0x11e/0x130 udp_queue_rcv_one_skb+0x1d/0x530     udp_unicast_rcv_skb+0x76/0x90 __udp4_lib_rcv+0xa64/0xe90 ip_protocol_deliver_rcu+0x20/0x130     ip_local_deliver_finish+0x75/0xa0 ip_local_deliver+0xc1/0xd0 ? ip_protocol_deliver_rcu+0x130/0x130     ip_sublist_rcv+0x1f9/0x240 ? ip_rcv_finish_core+0x430/0x430 ip_list_rcv+0xfc/0x130
    __netif_receive_skb_list_core+0x181/0x1e0 netif_receive_skb_list_internal+0x200/0x360 ?     mlx5e_build_rx_skb+0x1bc/0xda0 [mlx5_core] gro_receive_skb+0xfd/0x210     mlx5e_handle_rx_cqe_mpwrq+0x141/0x280 [mlx5_core] mlx5e_poll_rx_cq+0xcc/0x8e0 [mlx5_core] ?     mlx5e_handle_rx_dim+0x91/0xd0 [mlx5_core] mlx5e_napi_poll+0x114/0xab0 [mlx5_core] __napi_poll+0x25/0x170     net_rx_action+0x32d/0x3a0 ? mlx5_eq_comp_int+0x8d/0x280 [mlx5_core] ? notifier_call_chain+0x33/0xa0     handle_softirqs+0xda/0x250 irq_exit_rcu+0x6d/0xc0 common_interrupt+0x81/0xa0 </IRQ> (CVE-2025-38590)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
271407	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:3751-1)	Nessus	SuSE Local Security Checks	high
271252	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:3725-1)	Nessus	SuSE Local Security Checks	high
270865	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2025:03601-1)	Nessus	SuSE Local Security Checks	high
270860	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:03602-1)	Nessus	SuSE Local Security Checks	medium
270852	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:03633-1)	Nessus	SuSE Local Security Checks	high
270738	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:03634-1)	Nessus	SuSE Local Security Checks	high
270575	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20662)	Nessus	Oracle Linux Local Security Checks	high
266176	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2025-1208)	Nessus	Amazon Linux Local Security Checks	high
266148	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1210)	Nessus	Amazon Linux Local Security Checks	medium
260085	Linux Distros Unpatched Vulnerability : CVE-2025-38590	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-38590

medium

Tenable Plugins

Coming Soon

high

high

high

medium

high

high

high

high

medium

medium