In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix potential buffer overflow in setup_clusters() In setup_swap_map(), we only ensure badpages are in range (0, last_page]. As maxpages might be < last_page, setup_clusters() will encounter a buffer overflow when a badpage is >= maxpages. Only call inc_cluster_info_page() for badpage which is < maxpages to fix the issue.

The remote Ubuntu 24.04 LTS / 25.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7934-1 advisory.

    It was discovered that improper initialization of CPU cache memory could allow a local attacker with     hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

    Jean-Claude Graf, Sandro Regge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel     contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain     processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this to expose     sensitive information from the host OS. (CVE-2025-40300)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - PowerPC architecture;

    - S390 architecture;

    - x86 architecture;

    - Cryptographic API;

    - Network block device driver;

    - Character device driver;

    - Clock framework and drivers;

    - Data acquisition framework and drivers;

    - Hardware crypto device drivers;

    - Device frequency scaling framework;

    - DMA engine subsystem;

    - EDAC drivers;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - IIO subsystem;

    - IIO ADC drivers;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Multiple devices driver;

    - Media drivers;

    - Network drivers;

    - Mellanox network drivers;

    - PCI subsystem;

    - PHY drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - Power supply drivers;

    - Powercap sysfs driver;

    - Voltage and Current Regulator drivers;

    - S/390 drivers;

    - ASPEED SoC drivers;

    - SPI subsystem;

    - small TFT LCD display modules;

    - Media staging drivers;

    - USB Gadget drivers;

    - vDPA drivers;

    - VFIO drivers;

    - Framebuffer layer;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - Ceph distributed file system;

    - EFI Variable file system;

    - File systems infrastructure;

    - F2FS file system;

    - GFS2 file system;

    - Network file systems library;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - Proc file system;

    - SMB network file system;

    - DRM display driver;

    - io_uring subsystem;

    - Internal shared memory driver;

    - padata parallel execution mechanism;

    - Networking subsytem;

    - Bluetooth subsystem;

    - Netfilter;

    - UDP network protocol;

    - Tracing infrastructure;

    - BPF subsystem;

    - Perf events;

    - Padata parallel execution mechanism;

    - Codetag library;

    - KASAN memory debugging framework;

    - Memory management;

    - 802.1Q VLAN protocol;

    - Appletalk network protocol;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - MAC80211 subsystem;

    - Multipath TCP;

    - Netlink;

    - RxRPC session sockets;

    - Network traffic control;

    - SMC sockets;

    - Sun RPC protocol;

    - TIPC protocol;

    - TLS protocol;

    - VMware vSockets driver;

    - Wireless networking;

    - XFRM subsystem;

    - ADI SoundPort AD1816A based soundcard drivers;

    - MediaTek ASoC drivers;

    - SOF drivers;

    - USB sound devices;

    - KVM subsystem; (CVE-2025-38335, CVE-2025-38349, CVE-2025-38351, CVE-2025-38437, CVE-2025-38438,     CVE-2025-38439, CVE-2025-38440, CVE-2025-38441, CVE-2025-38443, CVE-2025-38444, CVE-2025-38445,     CVE-2025-38446, CVE-2025-38448, CVE-2025-38449, CVE-2025-38450, CVE-2025-38451, CVE-2025-38452,     CVE-2025-38453, CVE-2025-38454, CVE-2025-38455, CVE-2025-38456, CVE-2025-38457, CVE-2025-38458,     CVE-2025-38459, CVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463, CVE-2025-38464,     CVE-2025-38465, CVE-2025-38466, CVE-2025-38467, CVE-2025-38468, CVE-2025-38469, CVE-2025-38470,     CVE-2025-38471, CVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38475, CVE-2025-38476,     CVE-2025-38478, CVE-2025-38480, CVE-2025-38481, CVE-2025-38482, CVE-2025-38483, CVE-2025-38484,     CVE-2025-38485, CVE-2025-38487, CVE-2025-38488, CVE-2025-38489, CVE-2025-38490, CVE-2025-38491,     CVE-2025-38492, CVE-2025-38493, CVE-2025-38494, CVE-2025-38495, CVE-2025-38496, CVE-2025-38497,     CVE-2025-38501, CVE-2025-38503, CVE-2025-38505, CVE-2025-38506, CVE-2025-38507, CVE-2025-38508,     CVE-2025-38509, CVE-2025-38510, CVE-2025-38511, CVE-2025-38512, CVE-2025-38513, CVE-2025-38514,     CVE-2025-38515, CVE-2025-38516, CVE-2025-38517, CVE-2025-38520, CVE-2025-38521, CVE-2025-38524,     CVE-2025-38525, CVE-2025-38526, CVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530,     CVE-2025-38531, CVE-2025-38532, CVE-2025-38533, CVE-2025-38534, CVE-2025-38535, CVE-2025-38537,     CVE-2025-38538, CVE-2025-38539, CVE-2025-38540, CVE-2025-38542, CVE-2025-38543, CVE-2025-38544,     CVE-2025-38545, CVE-2025-38546, CVE-2025-38547, CVE-2025-38548, CVE-2025-38549, CVE-2025-38550,     CVE-2025-38551, CVE-2025-38552, CVE-2025-38553, CVE-2025-38555, CVE-2025-38556, CVE-2025-38557,     CVE-2025-38558, CVE-2025-38559, CVE-2025-38560, CVE-2025-38561, CVE-2025-38562, CVE-2025-38563,     CVE-2025-38565, CVE-2025-38566, CVE-2025-38567, CVE-2025-38568, CVE-2025-38569, CVE-2025-38570,     CVE-2025-38571, CVE-2025-38572, CVE-2025-38573, CVE-2025-38574, CVE-2025-38576, CVE-2025-38577,     CVE-2025-38578, CVE-2025-38579, CVE-2025-38581, CVE-2025-38582, CVE-2025-38583, CVE-2025-38584,     CVE-2025-38585, CVE-2025-38586, CVE-2025-38587, CVE-2025-38588, CVE-2025-38589, CVE-2025-38590,     CVE-2025-38593, CVE-2025-38595, CVE-2025-38601, CVE-2025-38602, CVE-2025-38604, CVE-2025-38605,     CVE-2025-38606, CVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612, CVE-2025-38615,     CVE-2025-38616, CVE-2025-38619, CVE-2025-38622, CVE-2025-38623, CVE-2025-38624, CVE-2025-38625,     CVE-2025-38626, CVE-2025-38628, CVE-2025-38629, CVE-2025-38630, CVE-2025-38631, CVE-2025-38632,     CVE-2025-38634, CVE-2025-38635, CVE-2025-38639, CVE-2025-38640, CVE-2025-38642, CVE-2025-38643,     CVE-2025-38644, CVE-2025-38645, CVE-2025-38646, CVE-2025-38648, CVE-2025-38649, CVE-2025-38650,     CVE-2025-38652, CVE-2025-38653, CVE-2025-38654, CVE-2025-38655, CVE-2025-38659, CVE-2025-38660,     CVE-2025-38662, CVE-2025-38663, CVE-2025-38664, CVE-2025-38665, CVE-2025-38666, CVE-2025-38668,     CVE-2025-38670, CVE-2025-38671, CVE-2025-38675, CVE-2025-38678, CVE-2025-39725, CVE-2025-39726,     CVE-2025-39727, CVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734, CVE-2025-39809,     CVE-2025-39818, CVE-2025-39946, CVE-2025-39964, CVE-2025-39993, CVE-2025-40018, CVE-2025-40157)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-21118 advisory.

    - fs/smb: Fix inconsistent refcnt update (Paulo Alcantara) [RHEL-124955] {CVE-2025-39819}
    - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120672] {CVE-2025-39955}
    - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113613]     {CVE-2025-39730}
    - of_numa: fix uninitialized memory nodes causing kernel panic (Charles Mirabile) [RHEL-123154]     {CVE-2025-39903}
    - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-122880] {CVE-2025-39864}
    - selftests: tls: test skb copy under mem pressure and OOB (CKI Backport Bot) [RHEL-120380]     {CVE-2025-39946}
    - tls: make sure to abort the stream if headers are bogus (CKI Backport Bot) [RHEL-120380]     {CVE-2025-39946}
    - eventpoll: Fix semi-unbounded recursion (CKI Backport Bot) [RHEL-111055] {CVE-2025-38614}
    - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-121702]     {CVE-2025-38498}
    - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-121702]     {CVE-2025-38498}
    - cgroup/psi: Set of->priv to NULL upon file release (CKI Backport Bot) [RHEL-119143] {CVE-2025-39881}
    - kernfs: Fix UAF in polling when open file is released (CKI Backport Bot) [RHEL-119143] {CVE-2025-39881}
    - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-119132]     {CVE-2025-39841}
    - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-118462] {CVE-2025-39817}
    - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117585]     {CVE-2025-39849}
    - ipv6: sr: Fix MAC comparison to be constant-time (CKI Backport Bot) [RHEL-116387] {CVE-2025-39702}
    - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114276] {CVE-2025-40300}
    - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114276] {CVE-2025-40300}
    - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114276] {CVE-2025-40300}
    - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114276] {CVE-2025-40300}
    - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114276] {CVE-2025-40300}
    - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114276] {CVE-2025-40300}
    - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114276] {CVE-2025-40300}
    - mm: swap: fix potential buffer overflow in setup_clusters() (CKI Backport Bot) [RHEL-114862]     {CVE-2025-39727}
    - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114852]     {CVE-2025-39751}
    - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114693]     {CVE-2025-38729}
    - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CKI Backport Bot) [RHEL-114693]     {CVE-2025-39757}
    - vsock/virtio: Validate length in packet header before skb_put() (CKI Backport Bot) [RHEL-114301]     {CVE-2025-39718}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20081-1 advisory.

    The SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2 kernel was updated to receive various     security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
    - CVE-2024-57891: sched_ext: Fix invalid irq restore in scx_ops_bypass() (bsc#1235953).
    - CVE-2024-57951: hrtimers: Handle CPU state correctly on hotplug (bsc#1237108).
    - CVE-2024-57952: Revert libfs: fix infinite directory reads for offset dir (bsc#1237131).
    - CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
    - CVE-2025-22034: mm/rmap: avoid -EBUSY from make_device_exclusive() (bsc#1241435).
    - CVE-2025-22077: Revert smb: client: fix TCP timers deadlock after rmmod (bsc#1241403).
    - CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses     (bsc#1242782).
    - CVE-2025-37821: sched/eevdf: Fix se->slice being set to U64_MAX and resulting (bsc#1242864).
    - CVE-2025-37849: KVM: arm64: Tear down vGIC on failed vCPU creation (bsc#1243000).
    - CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
    - CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
    - CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
    - CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
    - CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
    - CVE-2025-38019: mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (bsc#1245000).
    - CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
    - CVE-2025-38038: cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (bsc#1244812).
    - CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
    - CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
    - CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
    - CVE-2025-38101: ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (bsc#1245659).
    - CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
    - CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
    - CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
    - CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
    - CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
    - CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
    - CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
    - CVE-2025-38168: perf: arm-ni: Unregister PMUs on probe failure (bsc#1245763).
    - CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
    - CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
    - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
    - CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
    - CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
    - CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
    - CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
    - CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
    - CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
    - CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).
    - CVE-2025-38222: ext4: inline: fix len overflow in ext4_prepare_inline_data (bsc#1245976).
    - CVE-2025-38242: mm: userfaultfd: fix race of userfaultfd_move and swap cache (bsc#1246176).
    - CVE-2025-38244: smb: client: fix potential deadlock when reconnecting channels (bsc#1246183).
    - CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
    - CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
    - CVE-2025-38256: io_uring/rsrc: fix folio unpinning (bsc#1246188).
    - CVE-2025-38258: mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write     (bsc#1246185).
    - CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
    - CVE-2025-38267: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (bsc#1246245).
    - CVE-2025-38270: net: drv: netdevsim: do not napi_complete() from netpoll (bsc#1246252).
    - CVE-2025-38272: net: dsa: b53: do not enable EEE on bcm63xx (bsc#1246268).
    - CVE-2025-38301: nvmem: zynqmp_nvmem: unbreak driver after cleanup (bsc#1246351).
    - CVE-2025-38306: fs/fhandle.c: fix a race in call of has_locked_children() (bsc#1246366).
    - CVE-2025-38311: iavf: get rid of the crit lock (bsc#1246376).
    - CVE-2025-38318: perf: arm-ni: Fix missing platform_set_drvdata() (bsc#1246444).
    - CVE-2025-38322: perf/x86/intel: Fix crash in icl_update_topdown_event() (bsc#1246447).
    - CVE-2025-38323: net: atm: add lec_mutex (bsc#1246473).
    - CVE-2025-38337: jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (bsc#1246253).
    - CVE-2025-38341: eth: fbnic: avoid double free when failing to DMA-map FW msg (bsc#1246260).
    - CVE-2025-38349: eventpoll: do not decrement ep refcount while still holding the ep mutex (bsc#1246777).
    - CVE-2025-38350: net/sched: Always pass notifications when child class becomes empty (bsc#1246781).
    - CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
    - CVE-2025-38352: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()     (bsc#1246911).
    - CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).
    - CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
    - CVE-2025-38365: btrfs: fix a race between renames and directory logging (bsc#1247023).
    - CVE-2025-38374: optee: ffa: fix sleep in atomic context (bsc#1247024).
    - CVE-2025-38382: btrfs: fix iteration of extrefs during log replay (bsc#1247031).
    - CVE-2025-38383: mm/vmalloc: fix data race in show_numa_info() (bsc#1247250).
    - CVE-2025-38392: idpf: convert control queue mutex to a spinlock (bsc#1247169).
    - CVE-2025-38396: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (bsc#1247156).
    - CVE-2025-38399: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()     (bsc#1247097).
    - CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
    - CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
    - CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
    - CVE-2025-38419: remoteproc: core: Cleanup acquired resources when       rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
    - CVE-2025-38426: drm/amdgpu: Add basic validation for RAS header (bsc#1247252).
    - CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
    - CVE-2025-38440: net/mlx5e: Fix race between DIM disable and net_dim() (bsc#1247290).
    - CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()     (bsc#1247167).
    - CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
    - CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
    - CVE-2025-38451: md/md-bitmap: fix GPF in bitmap_get_stats() (bsc#1247102).
    - CVE-2025-38453: kABI: io_uring: msg_ring ensure io_kiocb freeing is deferred (bsc#1247234).
    - CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
    - CVE-2025-38457: net/sched: Abort __tc_modify_qdisc if parent class does not exist (bsc#1247098).
    - CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
    - CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
    - CVE-2025-38460: atm: clip: Fix potential null-ptr-deref in to_atmarpd() (bsc#1247143).
    - CVE-2025-38463: tcp: Correct signedness in skb remaining space calculation (bsc#1247113).
    - CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
    - CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime     (bsc#1247288).
    - CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
    - CVE-2025-38475: smc: Fix various oops due to inet_sock type confusion (bsc#1247308).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
    - CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
    - CVE-2025-38493: tracing/osnoise: Fix crash in timerlat_dump_stack() (bsc#1247283).
    - CVE-2025-38497: usb: gadget: configfs: Fix OOB read on empty string write (bsc#1247347).
    - CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns     (bsc#1247976).
    - CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface     (bsc#1248088).
    - CVE-2025-38508: x86/sev: Use TSC_FACTOR for Secure TSC frequency calculation (bsc#1248190).
    - CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
    - CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
    - CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
    - CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
    - CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
    - CVE-2025-38539: tracing: Add down_write(trace_event_sem) when adding trace event (bsc#1248211).
    - CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
    - CVE-2025-38545: net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info     (bsc#1248224).
    - CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
    - CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
    - CVE-2025-38554: mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped (bsc#1248299).
    - CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
    - CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
    - CVE-2025-38566: sunrpc: fix handling of server side tls alerts (bsc#1248374).
    - CVE-2025-38571: sunrpc: fix client side handling of tls alerts (bsc#1248401).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
    - CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
    - CVE-2025-38588: ipv6: prevent infinite loop in rt6_nlmsg_size() (bsc#1248368).
    - CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
    - CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port     (bsc#1248378).
    - CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
    - CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
    - CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
    - CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).
    - CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
    - CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
    - CVE-2025-38628: vdpa/mlx5: Fix release of uninitialized resources on error path (bsc#1248616).
    - CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
    - CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
    - CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
    - CVE-2025-38644: wifi: mac80211: reject TDLS operations when station is not associated (bsc#1248748).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
    - CVE-2025-38686: userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (bsc#1249160).
    - CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated     (bsc#1249182).
    - CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
    - CVE-2025-38709: loop: Avoid updating block size under exclusive owner (bsc#1249199).
    - CVE-2025-38710: gfs2: Validate i_depth for exhash directories (bsc#1249201).
    - CVE-2025-38730: io_uring/net: commit partial buffers on retry (bsc#1249172).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).
    - CVE-2025-39677: net/sched: Fix backlog accounting in qdisc_dequeue_internal (bsc#1249300).
    - CVE-2025-39681: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (bsc#1249303).
    - CVE-2025-39682: tls: fix handling of zero-length records on the rx_list (bsc#1249284).
    - CVE-2025-39683: tracing: Limit access to parser->buffer when trace_get_user failed (bsc#1249286).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39698: io_uring/futex: ensure io_futex_wait() cleans up properly on failure (bsc#1249322).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39723: kABI: netfs: handle new netfs_io_stream flag (bsc#1249314).
    - CVE-2025-39744: rcu: Fix rcu_read_unlock() deadloop due to IRQ work (bsc#1249494).
    - CVE-2025-39749: rcu: Protect ->defer_qs_iw_pending from data race (bsc#1249533).
    - CVE-2025-39754: mm/smaps: fix race between smaps_hugetlb_range and migration (bsc#1249524).
    - CVE-2025-39766: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (bsc#1249510).
    - CVE-2025-39770: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (bsc#1249508).
    - CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
    - CVE-2025-39775: mm/mremap: fix WARN with uffd that has remap events disabled (bsc#1249500).
    - CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
    - CVE-2025-39791: dm: dm-crypt: Do not partially accept write BIOs with zoned targets (bsc#1249550).
    - CVE-2025-39792: dm: Always split write BIOs to zoned device limits (bsc#1249618).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39813: ftrace: Also allocate and copy hash for reading of filter files (bsc#1250032).
    - CVE-2025-39816: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths     (bsc#1249906).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39825: smb: client: fix race with concurrent opens in rename(2) (bsc#1250179).
    - CVE-2025-39828: kABI workaround for struct atmdev_ops extension (bsc#1250205).
    - CVE-2025-39830: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (bsc#1249974).
    - CVE-2025-39838: cifs: prevent NULL pointer dereference in UTF16 conversion (bsc#1250365).
    - CVE-2025-39842: ocfs2: prevent release journal inode after journal shutdown (bsc#1250267).
    - CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
    - CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
    - CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).
    - CVE-2025-39852: net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (bsc#1250258).
    - CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
    - CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
    - CVE-2025-39857: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (bsc#1250251).
    - CVE-2025-39865: tee: fix NULL pointer dereference in tee_shm_put (bsc#1250294).
    - CVE-2025-39875: igb: Fix NULL pointer dereference in ethtool loopback test (bsc#1250398).
    - CVE-2025-39885: ocfs2: fix recursive semaphore deadlock in fiemap call (bsc#1250407).
    - CVE-2025-39898: e1000e: fix heap overflow in e1000_set_eeprom (bsc#1250742).
    - CVE-2025-39900: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (bsc#1250758).
    - CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).
    - CVE-2025-39922: ixgbe: fix incorrect map used in eee linkmode (bsc#1250722).
    - CVE-2025-39926: genetlink: fix genl_bind() invoking bind() after -EPERM (bsc#1250737).
    - CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
    - CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).
    - CVE-2025-40300: x86/vmscape: Warn when STIBP is disabled with SMT (bsc#1247483).
    - CVE-2025-38264: nvme-tcp: sanitize request list handling (bsc#1246387).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 25.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7879-1 advisory.

    It was discovered that improper initialization of CPU cache memory could allow a local attacker with     hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - PowerPC architecture;

    - S390 architecture;

    - x86 architecture;

    - Network block device driver;

    - Character device driver;

    - Clock framework and drivers;

    - Data acquisition framework and drivers;

    - Hardware crypto device drivers;

    - Device frequency scaling framework;

    - DMA engine subsystem;

    - EDAC drivers;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - IIO subsystem;

    - IIO ADC drivers;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Multiple devices driver;

    - Media drivers;

    - Network drivers;

    - Mellanox network drivers;

    - PCI subsystem;

    - PHY drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - Power supply drivers;

    - Powercap sysfs driver;

    - Voltage and Current Regulator drivers;

    - S/390 drivers;

    - ASPEED SoC drivers;

    - SPI subsystem;

    - small TFT LCD display modules;

    - Media staging drivers;

    - USB Gadget drivers;

    - vDPA drivers;

    - VFIO drivers;

    - Framebuffer layer;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - Ceph distributed file system;

    - EFI Variable file system;

    - File systems infrastructure;

    - F2FS file system;

    - GFS2 file system;

    - Network file systems library;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - Proc file system;

    - SMB network file system;

    - DRM display driver;

    - io_uring subsystem;

    - Internal shared memory driver;

    - padata parallel execution mechanism;

    - Networking subsytem;

    - Bluetooth subsystem;

    - Netfilter;

    - UDP network protocol;

    - Tracing infrastructure;

    - BPF subsystem;

    - Perf events;

    - Padata parallel execution mechanism;

    - Codetag library;

    - KASAN memory debugging framework;

    - Memory management;

    - 802.1Q VLAN protocol;

    - Appletalk network protocol;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - MAC80211 subsystem;

    - Multipath TCP;

    - Netlink;

    - RxRPC session sockets;

    - Network traffic control;

    - SMC sockets;

    - Sun RPC protocol;

    - TIPC protocol;

    - TLS protocol;

    - VMware vSockets driver;

    - Wireless networking;

    - XFRM subsystem;

    - ADI SoundPort AD1816A based soundcard drivers;

    - MediaTek ASoC drivers;

    - SOF drivers;

    - USB sound devices;

    - KVM subsystem; (CVE-2025-38335, CVE-2025-38349, CVE-2025-38351, CVE-2025-38437, CVE-2025-38438,     CVE-2025-38439, CVE-2025-38440, CVE-2025-38441, CVE-2025-38443, CVE-2025-38444, CVE-2025-38445,     CVE-2025-38446, CVE-2025-38448, CVE-2025-38449, CVE-2025-38450, CVE-2025-38451, CVE-2025-38452,     CVE-2025-38453, CVE-2025-38454, CVE-2025-38455, CVE-2025-38456, CVE-2025-38457, CVE-2025-38458,     CVE-2025-38459, CVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463, CVE-2025-38464,     CVE-2025-38465, CVE-2025-38466, CVE-2025-38467, CVE-2025-38468, CVE-2025-38469, CVE-2025-38470,     CVE-2025-38471, CVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38475, CVE-2025-38476,     CVE-2025-38478, CVE-2025-38480, CVE-2025-38481, CVE-2025-38482, CVE-2025-38483, CVE-2025-38484,     CVE-2025-38485, CVE-2025-38487, CVE-2025-38488, CVE-2025-38489, CVE-2025-38490, CVE-2025-38491,     CVE-2025-38492, CVE-2025-38493, CVE-2025-38494, CVE-2025-38495, CVE-2025-38496, CVE-2025-38497,     CVE-2025-38501, CVE-2025-38503, CVE-2025-38505, CVE-2025-38506, CVE-2025-38507, CVE-2025-38508,     CVE-2025-38509, CVE-2025-38510, CVE-2025-38511, CVE-2025-38512, CVE-2025-38513, CVE-2025-38514,     CVE-2025-38515, CVE-2025-38516, CVE-2025-38517, CVE-2025-38520, CVE-2025-38521, CVE-2025-38524,     CVE-2025-38525, CVE-2025-38526, CVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530,     CVE-2025-38531, CVE-2025-38532, CVE-2025-38533, CVE-2025-38534, CVE-2025-38535, CVE-2025-38537,     CVE-2025-38538, CVE-2025-38539, CVE-2025-38540, CVE-2025-38542, CVE-2025-38543, CVE-2025-38544,     CVE-2025-38545, CVE-2025-38546, CVE-2025-38547, CVE-2025-38548, CVE-2025-38549, CVE-2025-38550,     CVE-2025-38551, CVE-2025-38552, CVE-2025-38553, CVE-2025-38555, CVE-2025-38556, CVE-2025-38557,     CVE-2025-38558, CVE-2025-38559, CVE-2025-38560, CVE-2025-38561, CVE-2025-38562, CVE-2025-38563,     CVE-2025-38565, CVE-2025-38566, CVE-2025-38567, CVE-2025-38568, CVE-2025-38569, CVE-2025-38570,     CVE-2025-38571, CVE-2025-38572, CVE-2025-38573, CVE-2025-38574, CVE-2025-38576, CVE-2025-38577,     CVE-2025-38578, CVE-2025-38579, CVE-2025-38581, CVE-2025-38582, CVE-2025-38583, CVE-2025-38584,     CVE-2025-38585, CVE-2025-38586, CVE-2025-38587, CVE-2025-38588, CVE-2025-38589, CVE-2025-38590,     CVE-2025-38593, CVE-2025-38595, CVE-2025-38601, CVE-2025-38602, CVE-2025-38604, CVE-2025-38605,     CVE-2025-38606, CVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612, CVE-2025-38615,     CVE-2025-38616, CVE-2025-38619, CVE-2025-38622, CVE-2025-38623, CVE-2025-38624, CVE-2025-38625,     CVE-2025-38626, CVE-2025-38628, CVE-2025-38629, CVE-2025-38630, CVE-2025-38631, CVE-2025-38632,     CVE-2025-38634, CVE-2025-38635, CVE-2025-38639, CVE-2025-38640, CVE-2025-38642, CVE-2025-38643,     CVE-2025-38644, CVE-2025-38645, CVE-2025-38646, CVE-2025-38648, CVE-2025-38649, CVE-2025-38650,     CVE-2025-38652, CVE-2025-38653, CVE-2025-38654, CVE-2025-38655, CVE-2025-38659, CVE-2025-38660,     CVE-2025-38662, CVE-2025-38663, CVE-2025-38664, CVE-2025-38665, CVE-2025-38666, CVE-2025-38668,     CVE-2025-38670, CVE-2025-38671, CVE-2025-38675, CVE-2025-38678, CVE-2025-39725, CVE-2025-39726,     CVE-2025-39727, CVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734, CVE-2025-39809,     CVE-2025-39818, CVE-2025-40157)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7880-1 advisory.

    It was discovered that improper initialization of CPU cache memory could allow a local attacker with     hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - PowerPC architecture;

    - S390 architecture;

    - x86 architecture;

    - Network block device driver;

    - Character device driver;

    - Clock framework and drivers;

    - Data acquisition framework and drivers;

    - Hardware crypto device drivers;

    - Device frequency scaling framework;

    - DMA engine subsystem;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - IIO subsystem;

    - IIO ADC drivers;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Multiple devices driver;

    - Media drivers;

    - Network drivers;

    - Mellanox network drivers;

    - PCI subsystem;

    - PHY drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - Power supply drivers;

    - Powercap sysfs driver;

    - Voltage and Current Regulator drivers;

    - S/390 drivers;

    - ASPEED SoC drivers;

    - SPI subsystem;

    - small TFT LCD display modules;

    - Media staging drivers;

    - USB Gadget drivers;

    - vDPA drivers;

    - VFIO drivers;

    - Framebuffer layer;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - Ceph distributed file system;

    - EFI Variable file system;

    - File systems infrastructure;

    - F2FS file system;

    - GFS2 file system;

    - Network file systems library;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - Proc file system;

    - SMB network file system;

    - DRM display driver;

    - io_uring subsystem;

    - Internal shared memory driver;

    - padata parallel execution mechanism;

    - Networking subsytem;

    - Bluetooth subsystem;

    - Netfilter;

    - UDP network protocol;

    - Tracing infrastructure;

    - BPF subsystem;

    - Perf events;

    - Padata parallel execution mechanism;

    - Codetag library;

    - KASAN memory debugging framework;

    - Memory management;

    - 802.1Q VLAN protocol;

    - Appletalk network protocol;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - MAC80211 subsystem;

    - Multipath TCP;

    - Netlink;

    - RxRPC session sockets;

    - Network traffic control;

    - SMC sockets;

    - Sun RPC protocol;

    - TIPC protocol;

    - TLS protocol;

    - VMware vSockets driver;

    - Wireless networking;

    - XFRM subsystem;

    - ADI SoundPort AD1816A based soundcard drivers;

    - MediaTek ASoC drivers;

    - SOF drivers;

    - USB sound devices;

    - KVM subsystem; (CVE-2025-38335, CVE-2025-38349, CVE-2025-38351, CVE-2025-38437, CVE-2025-38438,     CVE-2025-38439, CVE-2025-38440, CVE-2025-38441, CVE-2025-38443, CVE-2025-38444, CVE-2025-38445,     CVE-2025-38446, CVE-2025-38448, CVE-2025-38449, CVE-2025-38450, CVE-2025-38451, CVE-2025-38452,     CVE-2025-38453, CVE-2025-38454, CVE-2025-38455, CVE-2025-38456, CVE-2025-38457, CVE-2025-38458,     CVE-2025-38459, CVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463, CVE-2025-38464,     CVE-2025-38465, CVE-2025-38466, CVE-2025-38467, CVE-2025-38468, CVE-2025-38469, CVE-2025-38470,     CVE-2025-38471, CVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38475, CVE-2025-38476,     CVE-2025-38478, CVE-2025-38480, CVE-2025-38481, CVE-2025-38482, CVE-2025-38483, CVE-2025-38484,     CVE-2025-38485, CVE-2025-38487, CVE-2025-38488, CVE-2025-38489, CVE-2025-38490, CVE-2025-38491,     CVE-2025-38492, CVE-2025-38493, CVE-2025-38494, CVE-2025-38495, CVE-2025-38496, CVE-2025-38497,     CVE-2025-38501, CVE-2025-38503, CVE-2025-38505, CVE-2025-38506, CVE-2025-38507, CVE-2025-38508,     CVE-2025-38509, CVE-2025-38510, CVE-2025-38511, CVE-2025-38512, CVE-2025-38513, CVE-2025-38514,     CVE-2025-38515, CVE-2025-38516, CVE-2025-38517, CVE-2025-38520, CVE-2025-38521, CVE-2025-38524,     CVE-2025-38525, CVE-2025-38526, CVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530,     CVE-2025-38531, CVE-2025-38532, CVE-2025-38533, CVE-2025-38534, CVE-2025-38535, CVE-2025-38537,     CVE-2025-38538, CVE-2025-38539, CVE-2025-38540, CVE-2025-38542, CVE-2025-38543, CVE-2025-38544,     CVE-2025-38545, CVE-2025-38546, CVE-2025-38547, CVE-2025-38548, CVE-2025-38549, CVE-2025-38550,     CVE-2025-38551, CVE-2025-38552, CVE-2025-38553, CVE-2025-38555, CVE-2025-38556, CVE-2025-38557,     CVE-2025-38558, CVE-2025-38559, CVE-2025-38560, CVE-2025-38561, CVE-2025-38562, CVE-2025-38563,     CVE-2025-38565, CVE-2025-38566, CVE-2025-38567, CVE-2025-38568, CVE-2025-38569, CVE-2025-38570,     CVE-2025-38571, CVE-2025-38572, CVE-2025-38573, CVE-2025-38574, CVE-2025-38576, CVE-2025-38577,     CVE-2025-38578, CVE-2025-38579, CVE-2025-38581, CVE-2025-38582, CVE-2025-38583, CVE-2025-38584,     CVE-2025-38585, CVE-2025-38586, CVE-2025-38587, CVE-2025-38588, CVE-2025-38589, CVE-2025-38590,     CVE-2025-38593, CVE-2025-38595, CVE-2025-38601, CVE-2025-38602, CVE-2025-38604, CVE-2025-38605,     CVE-2025-38606, CVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612, CVE-2025-38615,     CVE-2025-38616, CVE-2025-38619, CVE-2025-38622, CVE-2025-38623, CVE-2025-38624, CVE-2025-38625,     CVE-2025-38626, CVE-2025-38628, CVE-2025-38629, CVE-2025-38630, CVE-2025-38631, CVE-2025-38632,     CVE-2025-38634, CVE-2025-38635, CVE-2025-38639, CVE-2025-38640, CVE-2025-38642, CVE-2025-38643,     CVE-2025-38644, CVE-2025-38645, CVE-2025-38646, CVE-2025-38648, CVE-2025-38649, CVE-2025-38650,     CVE-2025-38652, CVE-2025-38653, CVE-2025-38654, CVE-2025-38655, CVE-2025-38659, CVE-2025-38660,     CVE-2025-38662, CVE-2025-38663, CVE-2025-38664, CVE-2025-38665, CVE-2025-38666, CVE-2025-38668,     CVE-2025-38670, CVE-2025-38671, CVE-2025-38675, CVE-2025-38678, CVE-2025-39725, CVE-2025-39726,     CVE-2025-39727, CVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21118 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498)

    * kernel: NFS: Fix a race when updating an existing write (CVE-2025-39697)

    * kernel: vsock/virtio: Validate length in packet header before skb_put() (CVE-2025-39718)

    * kernel: ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702)

    * kernel: mm: swap: fix potential buffer overflow in setup_clusters() (CVE-2025-39727)

    * kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757)

    * kernel: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CVE-2025-39751)

    * kernel: x86/vmscape: Add conditional IBPB mitigation (CVE-2025-40300)

    * kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)

    * kernel: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CVE-2025-39849)

    * kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path (CVE-2025-39841)

    * kernel: kernfs: Fix UAF in polling when open file is released (CVE-2025-39881)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:19106 advisory.

    * kernel: NFS: Fix a race when updating an existing write (CVE-2025-39697)

    * kernel: vsock/virtio: Validate length in packet header before skb_put() (CVE-2025-39718)

    * kernel: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)

    * kernel: mm: swap: fix potential buffer overflow in setup_clusters() (CVE-2025-39727)

    * kernel: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CVE-2025-39751)

    * kernel: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CVE-2025-39849)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-19106 advisory.

    - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114853]     {CVE-2025-39751}
    - erofs: fix blksize < PAGE_SIZE for file-backed mounts (CKI Backport Bot) [RHEL-83885] {CVE-2024-56750}
    - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113614]     {CVE-2025-39730}
    - NFS: Fix a race when updating an existing write (CKI Backport Bot) [RHEL-113859] {CVE-2025-39697}
    - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114304]     {CVE-2025-39718}
    - mm: swap: fix potential buffer overflow in setup_clusters() (CKI Backport Bot) [RHEL-114863]     {CVE-2025-39727}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19106 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: NFS: Fix a race when updating an existing write (CVE-2025-39697)

    * kernel: vsock/virtio: Validate length in packet header before skb_put() (CVE-2025-39718)

    * kernel: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)

    * kernel: mm: swap: fix potential buffer overflow in setup_clusters() (CVE-2025-39727)

    * kernel: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CVE-2025-39751)

    * kernel: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CVE-2025-39849)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20662 advisory.

    - tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832]     {CVE-2025-39682}
    - net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug:
    38401777] {CVE-2025-38736}
    - net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
    - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814]     {CVE-2025-38680}
    - hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829]     {CVE-2025-38683}
    - net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835]     {CVE-2025-38684}
    - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842]     {CVE-2025-38685}
    - userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug:
    38394850] {CVE-2025-38686}
    - btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270]     {CVE-2025-39738}
    - usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419]     {CVE-2025-39760}
    - iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
    - iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
    - dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
    - pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
    - block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug:
    38429189] {CVE-2025-39795}
    - exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
    - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and     w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
    - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885]     {CVE-2025-38694}
    - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug:
    38394892] {CVE-2025-38695}
    - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284]     {CVE-2025-39742}
    - scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
    - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [Orabug:
    38394929] {CVE-2025-38700}
    - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935]     {CVE-2025-38701}
    - fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942]     {CVE-2025-38702}
    - rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
    - wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316]     {CVE-2025-39746}
    - xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
    - drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323]     {CVE-2025-39747}
    - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958]     {CVE-2025-38704}
    - bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
    - rcu: Protect ->defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
    - drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
    - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356]     {CVE-2025-39751}
    - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976]     {CVE-2025-38706}
    - ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug:
    38423437] {CVE-2025-39763}
    - drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
    - loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
    - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
    - gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
    - tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758]     {CVE-2025-38616}
    - sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
    - netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065]     {CVE-2025-38721}
    - mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389]     {CVE-2025-39754}
    - eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
    - fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395]     {CVE-2025-39756}
    - NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug:
    38429209] {CVE-2025-39798}
    - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079]     {CVE-2025-38724}
    - net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
    - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123]     {CVE-2025-38727}
    - smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
    - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405]     {CVE-2025-39757}
    - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099]     {CVE-2025-38729}
    - usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
    - HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz)     [Orabug: 38334911] {CVE-2025-38557}
    - mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739]     {CVE-2025-39727}
    - platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915]     {CVE-2025-38559}
    - x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836]     {CVE-2025-38560}
    - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833]     {CVE-2025-38618}
    - net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762]     {CVE-2025-38617}
    - perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
    - perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
    - sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835]     {CVE-2025-38566}
    - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972]     {CVE-2025-38568}
    - benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
    - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834]     {CVE-2025-38571}
    - net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
    - ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
    - pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
    - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743]     {CVE-2025-39730}
    - vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
    - vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825]     {CVE-2025-38628}
    - pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837]     {CVE-2025-38632}
    - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug:
    38351898] {CVE-2025-38653}
    - bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064]     {CVE-2025-38586}
    - ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068]     {CVE-2025-38587}
    - ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
    - net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076]     {CVE-2025-38590}
    - netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852]     {CVE-2025-38639}
    - bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
    - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug:
    38335086] {CVE-2025-38593}
    - wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870]     {CVE-2025-38644}
    - wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug:
    38401750] {CVE-2025-39732}
    - net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug:
    38331464] {CVE-2025-38553}
    - net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
    - wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104]     {CVE-2025-38601}
    - iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108]     {CVE-2025-38602}
    - wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117]     {CVE-2025-38604}
    - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129]     {CVE-2025-38608}
    - PM / devfreq: Check governor before using governor->name (Lifeng Zheng) [Orabug: 38335133]     {CVE-2025-38609}
    - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153]     {CVE-2025-38612}
    - gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
    - parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
    - KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316]     {CVE-2025-38351}
    - ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
    - mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778]     {CVE-2025-39725}
    - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928]     {CVE-2025-38664}
    - arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989]     {CVE-2025-38670}
    - i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
    - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-     Budde) [Orabug: 38351934] {CVE-2025-38665}
    - xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug:
    38310014,38453837] {CVE-2025-38500}
    - xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014]     {CVE-2025-38675}
    - regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati)     [Orabug: 38351976] {CVE-2025-38668}
    - Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691]     {CVE-2025-38335}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1208 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix NULL pointer dereference in l3mdev_l3_rcv (CVE-2025-22103)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113)

    In the Linux kernel, the following vulnerability has been resolved:

    md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (CVE-2025-22124)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid1,raid10: don't ignore IO flags (CVE-2025-22125)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (CVE-2025-38453)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CVE-2025-38500)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix oob access in cgroup local storage (CVE-2025-38502)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Restrict conditions for adding duplicating netems to qdisc tree (CVE-2025-38553)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Prevent VMA split of buffer mappings (CVE-2025-38563)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Exit early on perf_mmap() fail (CVE-2025-38565)

    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: fix handling of server side tls alerts (CVE-2025-38566)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568)

    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: fix client side handling of tls alerts (CVE-2025-38571)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: reject malicious packets in ipv6_gso_segment() (CVE-2025-38572)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, arm64: Fix fp initialization for exception boundary (CVE-2025-38586)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix possible infinite loop in fib6_info_uses_dev() (CVE-2025-38587)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: prevent infinite loop in rt6_nlmsg_size() (CVE-2025-38588)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Remove skb secpath if xfrm state is not found (CVE-2025-38590)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (CVE-2025-38608)

    In the Linux kernel, the following vulnerability has been resolved:

    eventpoll: Fix semi-unbounded recursion (CVE-2025-38614)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: cancle set bad inode after removing name fails (CVE-2025-38615)

    In the Linux kernel, the following vulnerability has been resolved:

    tls: handle data disappearing from under the TLS ULP (CVE-2025-38616)

    In the Linux kernel, the following vulnerability has been resolved:

    net/packet: fix a race in packet_set_ring() and packet_notifier() (CVE-2025-38617)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: Do not allow binding to VMADDR_PORT_ANY (CVE-2025-38618)

    In the Linux kernel, the following vulnerability has been resolved:

    net: drop UFO packets in udp_rcv_segment() (CVE-2025-38622)

    In the Linux kernel, the following vulnerability has been resolved:

    pinmux: fix race causing mux_owner NULL with active mux_usecount (CVE-2025-38632)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_nfacct: don't assume acct name is null-terminated (CVE-2025-38639)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Disable migration in nf_hook_run_bpf(). (CVE-2025-38640)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Check device memory pointer before usage (CVE-2025-38645)

    In the Linux kernel, the following vulnerability has been resolved:

    proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653)

    In the Linux kernel, the following vulnerability has been resolved:

    [ceph] parse_longname(): strrchr() expects NUL-terminated string (CVE-2025-38660)

    In the Linux kernel, the following vulnerability has been resolved:

    can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (CVE-2025-38665)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (CVE-2025-38670)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: state: initialize state_ptrs earlier in xfrm_state_find (CVE-2025-38675)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: Avoid stack buffer overflow from kernel cmdline (CVE-2025-38676)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (CVE-2025-38681)

    In the Linux kernel, the following vulnerability has been resolved:

    hv_netvsc: Fix panic during namespace deletion with VF (CVE-2025-38683)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (CVE-2025-38685)

    In the Linux kernel, the following vulnerability has been resolved:

    userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (CVE-2025-38686)

    In the Linux kernel, the following vulnerability has been resolved:

    pNFS: Fix uninited ptr deref in block/scsi layout (CVE-2025-38691)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: add cluster chain loop check for dir (CVE-2025-38692)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (CVE-2025-38700)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (CVE-2025-38701)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: fix potential buffer overflow in do_register_framebuffer() (CVE-2025-38702)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access (CVE-2025-38704)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Add sanity check for file name (CVE-2025-38707)

    In the Linux kernel, the following vulnerability has been resolved:

    drbd: add missing kref_get in handle_write_conflicts (CVE-2025-38708)

    In the Linux kernel, the following vulnerability has been resolved:

    loop: Avoid updating block size under exclusive owner (CVE-2025-38709)

    In the Linux kernel, the following vulnerability has been resolved:

    net: kcm: Fix race condition in kcm_unattach() (CVE-2025-38717)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: fix refcount leak on table dump (CVE-2025-38721)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724)

    In the Linux kernel, the following vulnerability has been resolved:

    smb3: fix for slab out of bounds on mount to ksmbd (CVE-2025-38728)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/net: commit partial buffers on retry (CVE-2025-38730)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_reject: don't leak dst refcount for loopback packets (CVE-2025-38732)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix oops due to uninitialised variable (CVE-2025-38737)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Fix backlog accounting in qdisc_dequeue_internal (CVE-2025-39677)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (CVE-2025-39681)

    In the Linux kernel, the following vulnerability has been resolved:

    tls: fix handling of zero-length records on the rx_list (CVE-2025-39682)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Limit access to parser->buffer when trace_get_user failed (CVE-2025-39683)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Also allocate and copy hash for reading of filter files (CVE-2025-39689)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/buffer: fix use-after-free when call bh_read() helper (CVE-2025-39691)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix a race when updating an existing write (CVE-2025-39697)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CVE-2025-39698)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/ops-common: ignore migration request to invalid nodes (CVE-2025-39700)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock/virtio: Validate length in packet header before skb_put() (CVE-2025-39718)

    In the Linux kernel, the following vulnerability has been resolved:

    netfs: Fix unbuffered write error handling (CVE-2025-39723)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: fix panic due to PSLVERR (CVE-2025-39724)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (CVE-2025-39725)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: swap: fix potential buffer overflow in setup_clusters() (CVE-2025-39727)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)

    In the Linux kernel, the following vulnerability has been resolved:

    Revert fs/ntfs3: Replace inode_trylock with inode_lock (CVE-2025-39734)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not allow relocation of partially dropped subvolumes (CVE-2025-39738)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Fix rcu_read_unlock() deadloop due to IRQ work (CVE-2025-39744)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Forget ranges when refining tnum after JSET (CVE-2025-39748)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Protect ->defer_qs_iw_pending from data race (CVE-2025-39749)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/smaps: fix race between smaps_hugetlb_range and migration (CVE-2025-39754)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: Prevent file descriptor table allocations exceeding INT_MAX (CVE-2025-39756)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: qgroup: fix race between quota disable and quota rescan ioctl (CVE-2025-39759)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: core: config: Prevent OOB read in SS endpoint companion parsing (CVE-2025-39760)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (CVE-2025-39763)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (CVE-2025-39770)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: fix soft lockup in br_multicast_query_expired() (CVE-2025-39773)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: subpage: keep TOWRITE tag until folio is cleaned (CVE-2025-39779)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/ext: Fix invalid task state transitions on class switch (CVE-2025-39780)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: prevent softlockup in jbd2_log_do_checkpoint() (CVE-2025-39782)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: endpoint: Fix configfs group list head handling (CVE-2025-39783)

    In the Linux kernel, the following vulnerability has been resolved:

    dm: dm-crypt: Do not partially accept write BIOs with zoned targets (CVE-2025-39791)

    In the Linux kernel, the following vulnerability has been resolved:

    dm: Always split write BIOs to zoned device limits (CVE-2025-39792)

    In the Linux kernel, the following vulnerability has been resolved:

    block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (CVE-2025-39795)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: Duplicate SPI Handling (CVE-2025-39797)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix the setting of capabilities when automounting a new filesystem (CVE-2025-39798)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (CVE-2025-39800)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CVE-2025-39806)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: initialize more fields in sctp_v6_from_sk() (CVE-2025-39812)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (CVE-2025-39813)

    In the Linux kernel, the following vulnerability has been resolved:

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/smb: Fix inconsistent refcnt update (CVE-2025-39819)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: use array_index_nospec with indices that come from guest (CVE-2025-39823)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: asus: fix UAF via HID_CLAIMED_INPUT validation (CVE-2025-39824)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix race with concurrent opens in rename(2) (CVE-2025-39825)

    In the Linux kernel, the following vulnerability has been resolved:

    trace/fgraph: Fix the warning caused by missing unregister notifier (CVE-2025-39829)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Fix lockdep assertion on sync reset unload event (CVE-2025-39832)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: do not propagate ENODATA disk errors into xattr code (CVE-2025-39835)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: prevent NULL pointer dereference in UTF16 conversion (CVE-2025-39838)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: move page table sync declarations to linux/pgtable.h (CVE-2025-39844)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (CVE-2025-39845)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (CVE-2025-39850)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (CVE-2025-39851)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (CVE-2025-39852)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (CVE-2025-39894)

    In the Linux kernel, the following vulnerability has been resolved:

    sched: Fix sched_numa_find_nth_cpu() if mask offline (CVE-2025-39895)

    In the Linux kernel, the following vulnerability has been resolved:

    e1000e: fix heap overflow in e1000_set_eeprom (CVE-2025-39898)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (CVE-2025-39899)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (CVE-2025-39900)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)

    In the Linux kernel, the following vulnerability has been resolved:

    of_numa: fix uninitialized memory nodes causing kernel panic (CVE-2025-39903)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix potential buffer     overflow in setup_clusters() In setup_swap_map(), we only ensure badpages are in range (0, last_page]. As     maxpages might be < last_page, setup_clusters() will encounter a buffer overflow when a badpage is >=     maxpages. Only call inc_cluster_info_page() for badpage which is < maxpages to fix the issue.
    (CVE-2025-39727)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
278749	Ubuntu 24.04 LTS / 25.04 : Linux kernel (Azure) vulnerabilities (USN-7934-1)	Nessus	Ubuntu Local Security Checks	high
277391	Oracle Linux 10 : kernel (ELSA-2025-21118)	Nessus	Oracle Linux Local Security Checks	high
277010	openSUSE 16 Security Update : kernel (openSUSE-SU-2025-20081-1)	Nessus	SuSE Local Security Checks	high
276629	Ubuntu 24.04 LTS / 25.04 : Linux kernel vulnerabilities (USN-7879-1)	Nessus	Ubuntu Local Security Checks	high
276628	Ubuntu 24.04 LTS : Linux kernel (OEM) vulnerabilities (USN-7880-1)	Nessus	Ubuntu Local Security Checks	high
275177	RHEL 10 : kernel (RHSA-2025:21118)	Nessus	Red Hat Local Security Checks	high
272172	RockyLinux 10 : kernel (RLSA-2025:19106)	Nessus	Rocky Linux Local Security Checks	high
271932	Oracle Linux 10 : kernel (ELSA-2025-19106)	Nessus	Oracle Linux Local Security Checks	high
271734	RHEL 10 : kernel (RHSA-2025:19106)	Nessus	Red Hat Local Security Checks	high
270575	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20662)	Nessus	Oracle Linux Local Security Checks	high
266176	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2025-1208)	Nessus	Amazon Linux Local Security Checks	high
261688	Linux Distros Unpatched Vulnerability : CVE-2025-39727	Nessus	Misc.	high

Detections

Analytics

CVE-2025-39727

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high