In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() ath11k_mac_disable_peer_fixed_rate() is passed as the iterator to ieee80211_iterate_stations_atomic(). Note in this case the iterator is required to be atomic, however ath11k_mac_disable_peer_fixed_rate() does not follow it as it might sleep. Consequently below warning is seen: BUG: sleeping function called from invalid context at wmi.c:304 Call Trace: <TASK> dump_stack_lvl __might_resched.cold ath11k_wmi_cmd_send ath11k_wmi_set_peer_param ath11k_mac_disable_peer_fixed_rate ieee80211_iterate_stations_atomic ath11k_mac_op_set_bitrate_mask.cold Change to ieee80211_iterate_stations_mtx() to fix this issue. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30

suse_linux SUSE-SU-2025:03600-1: SUSE openSUSE 15 : Security update for the Linux Kernel (Important) (SUSE-SU-2025:03600-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3751-1 advisory.

    The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
    - CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
    - CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
    - CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
    - CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
    - CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
    - CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
    - CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
    - CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
    - CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
    - CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in     rproc_attach() (bsc#1247136).
    - CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
    - CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
    - CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
    - CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
    - CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
    - CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
    - CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
    - CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
    - CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
    - CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
    - CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
    - CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
    - CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port     (bsc#1248378).
    - CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
    - CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
    - CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
    - CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
    - CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
    - CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
    - CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
    - CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
    - CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data     (bsc#1248647).
    - CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
    - CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
    - CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
    - CVE-2025-38705: drm/amd/pm: fix null pointer access (bsc#1249334).
    - CVE-2025-38709: loop: Avoid updating block size under exclusive owner (bsc#1249199).
    - CVE-2025-38721: netfilter: ctnetlink: fix refcount leak on table dump (bsc#1249176).
    - CVE-2025-38722: habanalabs: fix UAF in export_dmabuf() (bsc#1249163).
    - CVE-2025-38730: io_uring/net: commit partial buffers on retry (bsc#1249172).
    - CVE-2025-38732: netfilter: nf_reject: do not leak dst refcount for loopback packets (bsc#1249262).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
    - CVE-2025-39677: net/sched: Fix backlog accounting in qdisc_dequeue_internal (bsc#1249300).
    - CVE-2025-39678: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL (bsc#1249290).
    - CVE-2025-39681: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (bsc#1249303).
    - CVE-2025-39682: tls: fix handling of zero-length records on the rx_list (bsc#1249284).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39705: drm/amd/display: fix a Null pointer dereference vulnerability (bsc#1249295).
    - CVE-2025-39718: vsock/virtio: Validate length in packet header before skb_put() (bsc#1249305).
    - CVE-2025-39738: btrfs: do not allow relocation of partially dropped subvolumes (bsc#1249540).
    - CVE-2025-39744: rcu: Fix rcu_read_unlock() deadloop due to IRQ work (bsc#1249494).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39749: rcu: Protect ->defer_qs_iw_pending from data race (bsc#1249533).
    - CVE-2025-39754: mm/smaps: fix race between smaps_hugetlb_range and migration (bsc#1249524).
    - CVE-2025-39764: netfilter: ctnetlink: remove refcounting in expectation dumpers (bsc#1249513).
    - CVE-2025-39766: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (bsc#1249510).
    - CVE-2025-39770: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (bsc#1249508).
    - CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
    - CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
    - CVE-2025-39787: soc: qcom: mdt_loader: Deal with zero e_shentsize (bsc#1249545).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39825: smb: client: fix race with concurrent opens in rename(2) (bsc#1250179).
    - CVE-2025-39832: net/mlx5: Fix lockdep assertion on sync reset unload event (bsc#1249901).
    - CVE-2025-39835: xfs: do not propagate ENODATA disk errors into xattr code (bsc#1250025).
    - CVE-2025-39838: cifs: prevent NULL pointer dereference in UTF16 conversion (bsc#1250365).
    - CVE-2025-39842: ocfs2: prevent release journal inode after journal shutdown (bsc#1250267).
    - CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
    - CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
    - CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
    - CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
    - CVE-2025-39857: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (bsc#1250251).
    - CVE-2025-39865: tee: fix NULL pointer dereference in tee_shm_put (bsc#1250294).
    - CVE-2025-39885: ocfs2: fix recursive semaphore deadlock in fiemap call (bsc#1250407).
    - CVE-2025-40300: x86/vmscape: Warn when STIBP is disabled with SMT (bsc#1247483).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03634-1 advisory.

    The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
    - CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
    - CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
    - CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
    - CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
    - CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
    - CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
    - CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
    - CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
    - CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
    - CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
    - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
    - CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
    - CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
    - CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
    - CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
    - CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
    - CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
    - CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
    - CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
    - CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
    - CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
    - CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
    - CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
    - CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
    - CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
    - CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in     rproc_attach() (bsc#1247136).
    - CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
    - CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()     (bsc#1247167).
    - CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
    - CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
    - CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
    - CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
    - CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
    - CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
    - CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
    - CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
    - CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
    - CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns     (bsc#1247976).
    - CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface     (bsc#1248088).
    - CVE-2025-38506: KVM: Allow CPU to reschedule while setting per-page memory attributes (bsc#1248186).
    - CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
    - CVE-2025-38520: drm/amdkfd: Do not call mmput from MMU notifier callback (bsc#1248217).
    - CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
    - CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
    - CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
    - CVE-2025-38528: bpf: Reject %p% format string in bprintf-like helpers (bsc#1248198).
    - CVE-2025-38531: iio: common: st_sensors: Fix use of uninitialize device structs (bsc#1248205).
    - CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
    - CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
    - CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
    - CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
    - CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
    - CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
    - CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
    - CVE-2025-38585: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (bsc#1248355).
    - CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
    - CVE-2025-38591: bpf: Reject narrower access to pointer ctx fields (bsc#1248363).
    - CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
    - CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
    - CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port     (bsc#1248378).
    - CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
    - CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
    - CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
    - CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
    - CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).
    - CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
    - CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
    - CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
    - CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
    - CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
    - CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data     (bsc#1248647).
    - CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
    - CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
    - CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
    - CVE-2025-38705: drm/amd/pm: fix null pointer access (bsc#1249334).
    - CVE-2025-38709: loop: Avoid updating block size under exclusive owner (bsc#1249199).
    - CVE-2025-38721: netfilter: ctnetlink: fix refcount leak on table dump (bsc#1249176).
    - CVE-2025-38722: habanalabs: fix UAF in export_dmabuf() (bsc#1249163).
    - CVE-2025-38730: io_uring/net: commit partial buffers on retry (bsc#1249172).
    - CVE-2025-38732: netfilter: nf_reject: do not leak dst refcount for loopback packets (bsc#1249262).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
    - CVE-2025-39677: net/sched: Fix backlog accounting in qdisc_dequeue_internal (bsc#1249300).
    - CVE-2025-39678: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL (bsc#1249290).
    - CVE-2025-39681: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (bsc#1249303).
    - CVE-2025-39682: tls: fix handling of zero-length records on the rx_list (bsc#1249284).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39705: drm/amd/display: fix a Null pointer dereference vulnerability (bsc#1249295).
    - CVE-2025-39718: vsock/virtio: Validate length in packet header before skb_put() (bsc#1249305).
    - CVE-2025-39738: btrfs: do not allow relocation of partially dropped subvolumes (bsc#1249540).
    - CVE-2025-39744: rcu: Fix rcu_read_unlock() deadloop due to IRQ work (bsc#1249494).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39749: rcu: Protect ->defer_qs_iw_pending from data race (bsc#1249533).
    - CVE-2025-39754: mm/smaps: fix race between smaps_hugetlb_range and migration (bsc#1249524).
    - CVE-2025-39764: netfilter: ctnetlink: remove refcounting in expectation dumpers (bsc#1249513).
    - CVE-2025-39766: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (bsc#1249510).
    - CVE-2025-39770: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (bsc#1249508).
    - CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
    - CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
    - CVE-2025-39787: soc: qcom: mdt_loader: Deal with zero e_shentsize (bsc#1249545).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39825: smb: client: fix race with concurrent opens in rename(2) (bsc#1250179).
    - CVE-2025-39828: kABI workaround for struct atmdev_ops extension (bsc#1250205).
    - CVE-2025-39832: net/mlx5: Fix lockdep assertion on sync reset unload event (bsc#1249901).
    - CVE-2025-39835: xfs: do not propagate ENODATA disk errors into xattr code (bsc#1250025).
    - CVE-2025-39838: cifs: prevent NULL pointer dereference in UTF16 conversion (bsc#1250365).
    - CVE-2025-39842: ocfs2: prevent release journal inode after journal shutdown (bsc#1250267).
    - CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
    - CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
    - CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
    - CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
    - CVE-2025-39857: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (bsc#1250251).
    - CVE-2025-39865: tee: fix NULL pointer dereference in tee_shm_put (bsc#1250294).
    - CVE-2025-39885: ocfs2: fix recursive semaphore deadlock in fiemap call (bsc#1250407).
    - CVE-2025-40300: x86/vmscape: Warn when STIBP is disabled with SMT (bsc#1247483).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20662 advisory.

    - tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832]     {CVE-2025-39682}
    - net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug:
    38401777] {CVE-2025-38736}
    - net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
    - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814]     {CVE-2025-38680}
    - hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829]     {CVE-2025-38683}
    - net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835]     {CVE-2025-38684}
    - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842]     {CVE-2025-38685}
    - userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug:
    38394850] {CVE-2025-38686}
    - btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270]     {CVE-2025-39738}
    - usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419]     {CVE-2025-39760}
    - iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
    - iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
    - dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
    - pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
    - block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug:
    38429189] {CVE-2025-39795}
    - exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
    - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and     w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
    - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885]     {CVE-2025-38694}
    - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug:
    38394892] {CVE-2025-38695}
    - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284]     {CVE-2025-39742}
    - scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
    - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [Orabug:
    38394929] {CVE-2025-38700}
    - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935]     {CVE-2025-38701}
    - fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942]     {CVE-2025-38702}
    - rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
    - wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316]     {CVE-2025-39746}
    - xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
    - drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323]     {CVE-2025-39747}
    - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958]     {CVE-2025-38704}
    - bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
    - rcu: Protect ->defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
    - drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
    - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356]     {CVE-2025-39751}
    - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976]     {CVE-2025-38706}
    - ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug:
    38423437] {CVE-2025-39763}
    - drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
    - loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
    - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
    - gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
    - tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758]     {CVE-2025-38616}
    - sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
    - netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065]     {CVE-2025-38721}
    - mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389]     {CVE-2025-39754}
    - eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
    - fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395]     {CVE-2025-39756}
    - NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug:
    38429209] {CVE-2025-39798}
    - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079]     {CVE-2025-38724}
    - net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
    - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123]     {CVE-2025-38727}
    - smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
    - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405]     {CVE-2025-39757}
    - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099]     {CVE-2025-38729}
    - usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
    - HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz)     [Orabug: 38334911] {CVE-2025-38557}
    - mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739]     {CVE-2025-39727}
    - platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915]     {CVE-2025-38559}
    - x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836]     {CVE-2025-38560}
    - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833]     {CVE-2025-38618}
    - net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762]     {CVE-2025-38617}
    - perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
    - perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
    - sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835]     {CVE-2025-38566}
    - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972]     {CVE-2025-38568}
    - benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
    - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834]     {CVE-2025-38571}
    - net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
    - ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
    - pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
    - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743]     {CVE-2025-39730}
    - vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
    - vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825]     {CVE-2025-38628}
    - pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837]     {CVE-2025-38632}
    - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug:
    38351898] {CVE-2025-38653}
    - bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064]     {CVE-2025-38586}
    - ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068]     {CVE-2025-38587}
    - ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
    - net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076]     {CVE-2025-38590}
    - netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852]     {CVE-2025-38639}
    - bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
    - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug:
    38335086] {CVE-2025-38593}
    - wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870]     {CVE-2025-38644}
    - wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug:
    38401750] {CVE-2025-39732}
    - net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug:
    38331464] {CVE-2025-38553}
    - net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
    - wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104]     {CVE-2025-38601}
    - iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108]     {CVE-2025-38602}
    - wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117]     {CVE-2025-38604}
    - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129]     {CVE-2025-38608}
    - PM / devfreq: Check governor before using governor->name (Lifeng Zheng) [Orabug: 38335133]     {CVE-2025-38609}
    - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153]     {CVE-2025-38612}
    - gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
    - parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
    - KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316]     {CVE-2025-38351}
    - ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
    - mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778]     {CVE-2025-39725}
    - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928]     {CVE-2025-38664}
    - arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989]     {CVE-2025-38670}
    - i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
    - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-     Budde) [Orabug: 38351934] {CVE-2025-38665}
    - xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug:
    38310014,38453837] {CVE-2025-38500}
    - xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014]     {CVE-2025-38675}
    - regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati)     [Orabug: 38351976] {CVE-2025-38668}
    - Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691]     {CVE-2025-38335}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()     ath11k_mac_disable_peer_fixed_rate() is passed as the iterator to ieee80211_iterate_stations_atomic().
    Note in this case the iterator is required to be atomic, however ath11k_mac_disable_peer_fixed_rate() does     not follow it as it might sleep. Consequently below warning is seen: BUG: sleeping function called from     invalid context at wmi.c:304 Call Trace: <TASK> dump_stack_lvl __might_resched.cold ath11k_wmi_cmd_send     ath11k_wmi_set_peer_param ath11k_mac_disable_peer_fixed_rate ieee80211_iterate_stations_atomic     ath11k_mac_op_set_bitrate_mask.cold Change to ieee80211_iterate_stations_mtx() to fix this issue. Tested-     on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30 (CVE-2025-39732)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
271407	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:3751-1)	Nessus	SuSE Local Security Checks	high
270738	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:03634-1)	Nessus	SuSE Local Security Checks	high
270575	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20662)	Nessus	Oracle Linux Local Security Checks	high
261690	Linux Distros Unpatched Vulnerability : CVE-2025-39732	Nessus	Misc.	high
153035	Photon OS 4.0: Linux PHSA-2021-4.0-0095	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2025-39732

high

Tenable Plugins

Coming Soon

high

high

high

high

high