In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save Improper use of secondary pointer (&dev->i2c_subip_regs) caused kernel crash and out-of-bounds error: BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107 CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary) Workqueue: async async_run_entry_fn Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x660 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x26/0x200 kasan_report+0xe1/0x120 ? _regmap_bulk_read+0x449/0x510 ? _regmap_bulk_read+0x449/0x510 __asan_report_store4_noabort+0x17/0x30 _regmap_bulk_read+0x449/0x510 ? __pfx__regmap_bulk_read+0x10/0x10 regmap_bulk_read+0x270/0x3d0 pio_complete+0x1ee/0x2c0 [intel_thc] ? __pfx_pio_complete+0x10/0x10 [intel_thc] ? __pfx_pio_wait+0x10/0x10 [intel_thc] ? regmap_update_bits_base+0x13b/0x1f0 thc_i2c_subip_pio_read+0x117/0x270 [intel_thc] thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc] ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc] [...] The buggy address belongs to the object at ffff888136005d00 which belongs to the cache kmalloc-rnd-12-192 of size 192 The buggy address is located 0 bytes to the right of allocated 192-byte region [ffff888136005d00, ffff888136005dc0) Replaced with direct array indexing (&dev->i2c_subip_regs[i]) to ensure safe memory access.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-688.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-     free in nf_tables_addchain() nf_tables_addchain() publishes the chain to table->chains via     list_add_tail_rcu() (in nft_chain_add()) before registering hooks. If nf_tables_register_hook() then     fails, the error path calls nft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy() with no     RCU grace period in between. This creates two use-after-free conditions: 1) Control-plane:
    nf_tables_dump_chains() traverses table->chains under rcu_read_lock(). A concurrent dump can still be     walking the chain when the error path frees it. 2) Packet path: for NFPROTO_INET, nf_register_net_hook()     briefly installs the IPv4 hook before IPv6 registration fails. Packets entering nft_do_chain() via the     transient IPv4 hook can still be dereferencing chain->blob_gen_X when the error path frees the chain. Add     synchronize_rcu() between nft_chain_del() and the chain destroy so that all RCU readers -- both dump     threads and in-flight packet evaluation -- have finished before the chain is freed. (CVE-2026-23231)

  - In the Linux kernel, the following vulnerability has been resolved: autofs: fix memory leak of waitqueues     in autofs_catatonic_mode Syzkaller reports a memory leak: BUG: memory leak unreferenced object     0xffff88810b279e00 (size 96): comm syz-executor399, pid 3631, jiffies 4294964921 (age 23.870s) hex dump     (first 32 bytes): 00 00 00 00 00 00 00 00 08 9e 27 0b 81 88 ff ff ..........'..... 08 9e 27 0b 81 88 ff ff     00 00 00 00 00 00 00 00 ..'............. backtrace: [<ffffffff814cfc90>] kmalloc_trace+0x20/0x90     mm/slab_common.c:1046 [<ffffffff81bb75ca>] kmalloc include/linux/slab.h:576 [inline] [<ffffffff81bb75ca>]     autofs_wait+0x3fa/0x9a0 fs/autofs/waitq.c:378 [<ffffffff81bb88a7>] autofs_do_expire_multi+0xa7/0x3e0     fs/autofs/expire.c:593 [<ffffffff81bb8c33>] autofs_expire_multi+0x53/0x80 fs/autofs/expire.c:619     [<ffffffff81bb6972>] autofs_root_ioctl_unlocked+0x322/0x3b0 fs/autofs/root.c:897 [<ffffffff81bb6a95>]     autofs_root_ioctl+0x25/0x30 fs/autofs/root.c:910 [<ffffffff81602a9c>] vfs_ioctl fs/ioctl.c:51 [inline]     [<ffffffff81602a9c>] __do_sys_ioctl fs/ioctl.c:870 [inline] [<ffffffff81602a9c>] __se_sys_ioctl     fs/ioctl.c:856 [inline] [<ffffffff81602a9c>] __x64_sys_ioctl+0xfc/0x140 fs/ioctl.c:856     [<ffffffff84608225>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff84608225>]     do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [<ffffffff84800087>]     entry_SYSCALL_64_after_hwframe+0x63/0xcd autofs_wait_queue structs should be freed if their wait_ctr     becomes zero. Otherwise they will be lost. In this case an AUTOFS_IOC_EXPIRE_MULTI ioctl is done, then a     new waitqueue struct is allocated in autofs_wait(), its initial wait_ctr equals 2. After that     wait_event_killable() is interrupted (it returns -ERESTARTSYS), so that 'wq->name.name == NULL' condition     may be not satisfied. Actually, this condition can be satisfied when autofs_wait_release() or     autofs_catatonic_mode() is called and, what is also important, wait_ctr is decremented in those places.
    Upon the exit of autofs_wait(), wait_ctr is decremented to 1. Then the unmounting process begins: kill_sb     calls autofs_catatonic_mode(), which should have freed the waitqueues, but it only decrements its usage     counter to zero which is not a correct behaviour. edit:imk This description is of course not correct. The     umount performed as a result of an expire is a umount of a mount that has been automounted, it's not the     autofs mount itself. They happen independently, usually after everything mounted within the autofs file     system has been expired away. If everything hasn't been expired away the automount daemon can still exit     leaving mounts in place. But expires done in both cases will result in a notification that calls     autofs_wait_release() with a result status. The problem case is the summary execution of of the automount     daemon. In this case any waiting processes won't be woken up until either they are terminated or the mount     is umounted. end edit: imk So in catatonic mode we should free waitqueues which counter becomes zero.
    edit: imk Initially I was concerned that the calling of autofs_wait_release() and autofs_catatonic_mode()     was not mutually exclusive but that can't be the case (obviously) because the queue entry (or entries) is     removed from the list when either of these two functions are called. Consequently the wait entry will be     freed by only one of these functions or by the woken process in autofs_wait() depending on the order of     the calls. end edit: imk (CVE-2023-54134)

  - In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: independent PMD page     table shared count The folio refcount may be increased unexpectly through try_get_folio() by caller such     as split_huge_pages. In huge_pmd_unshare(), we use refcount to check whether a pmd page table is shared.
    The check is incorrect if the refcount is increased by the above caller, and this can cause the page table     leaked: BUG: Bad page state in process sh pfn:109324 page: refcount:0 mapcount:0 mapping:0000000000000000     index:0x66 pfn:0x109324 flags: 0x17ffff800000000(node=0|zone=2|lastcpupid=0xfffff) page_type: f2(table)     raw: 017ffff800000000 0000000000000000 0000000000000000 0000000000000000 raw: 0000000000000066     0000000000000000 00000000f2000000 0000000000000000 page dumped because: nonzero mapcount ... CPU: 31 UID:
    0 PID: 7515 Comm: sh Kdump: loaded Tainted: G B 6.13.0-rc2master+ #7 Tainted: [B]=BAD_PAGE Hardware name:
    QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 Call trace: show_stack+0x20/0x38 (C)     dump_stack_lvl+0x80/0xf8 dump_stack+0x18/0x28 bad_page+0x8c/0x130 free_page_is_bad_report+0xa4/0xb0     free_unref_page+0x3cc/0x620 __folio_put+0xf4/0x158 split_huge_pages_all+0x1e0/0x3e8     split_huge_pages_write+0x25c/0x2d8 full_proxy_write+0x64/0xd8 vfs_write+0xcc/0x280 ksys_write+0x70/0x110
    __arm64_sys_write+0x24/0x38 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0xc8/0xf0     do_el0_svc+0x24/0x38 el0_svc+0x34/0x128 el0t_64_sync_handler+0xc8/0xd0 el0t_64_sync+0x190/0x198 The issue     may be triggered by damon, offline_page, page_idle, etc, which will increase the refcount of page table.
    1. The page table itself will be discarded after reporting the nonzero mapcount. 2. The HugeTLB page     mapped by the page table miss freeing since we treat the page table as shared and a shared page table will     not be unmapped. Fix it by introducing independent PMD page table shared count. As described by comment,     pt_index/pt_mm/pt_frag_refcount are used for s390 gmap, x86 pgds and powerpc, pt_share_count is used for     x86/arm64/riscv pmds, so we can reuse the field as pt_share_count. (CVE-2024-57883)

  - In the Linux kernel, the following vulnerability has been resolved: net: atm: fix /proc/net/atm/lec     handling /proc/net/atm/lec must ensure safety against dev_lec[] changes. It appears it had dev_put() calls     without prior dev_hold(), leading to imbalance and UAF. (CVE-2025-38180)

  - In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-thc: Fix     incorrect pointer arithmetic in I2C regs save Improper use of secondary pointer (&dev->i2c_subip_regs)     caused kernel crash and out-of-bounds error: BUG: KASAN: slab-out-of-bounds in
    _regmap_bulk_read+0x449/0x510 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107 CPU: 3     UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary) Workqueue: async     async_run_entry_fn Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x660 ?
    __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x26/0x200     kasan_report+0xe1/0x120 ? _regmap_bulk_read+0x449/0x510 ? _regmap_bulk_read+0x449/0x510
    __asan_report_store4_noabort+0x17/0x30 _regmap_bulk_read+0x449/0x510 ? __pfx__regmap_bulk_read+0x10/0x10     regmap_bulk_read+0x270/0x3d0 pio_complete+0x1ee/0x2c0 [intel_thc] ? __pfx_pio_complete+0x10/0x10     [intel_thc] ? __pfx_pio_wait+0x10/0x10 [intel_thc] ? regmap_update_bits_base+0x13b/0x1f0     thc_i2c_subip_pio_read+0x117/0x270 [intel_thc] thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc] ?
    __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc] [...] The buggy address belongs to the object at     ffff888136005d00 which belongs to the cache kmalloc-rnd-12-192 of size 192 The buggy address is located 0     bytes to the right of allocated 192-byte region [ffff888136005d00, ffff888136005dc0) Replaced with direct     array indexing (&dev->i2c_subip_regs[i]) to ensure safe memory access. (CVE-2025-39818)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:4759 advisory.

    * kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save     (CVE-2025-39818)

    * kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CVE-2025-68800)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-356:22 advisory.

    * kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save     (CVE-2025-39818)
      * kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CVE-2025-68800)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:4759 advisory.

    * kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save     (CVE-2025-39818)
      * kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CVE-2025-68800)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-4759 advisory.

    [5.14.0-611.41.1]
    - Disable UKI signing [Orabug: 36571828]
    - Update Oracle Linux certificates (Kevin Lyons)
    - Disable signing for aarch64 (Ilya Okomin)
    - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem)     [Orabug: 29539237]
    - Update x509.genkey [Orabug: 24817676]
    - Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
    - Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
    - Add Oracle Linux IMA certificates
    - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

    [5.14.0-611.41.1]
    - net: vxlan: prevent NULL deref in vxlan_xmit_one (Antoine Tenart) [RHEL-133369]
    - ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Mark Langsdorf) [RHEL-123057]

    [5.14.0-611.40.1]
    - s390/pci: Allow automatic recovery with minimal driver support (CKI Backport Bot) [RHEL-118881]
    - mm/hugetlb: ignore hugepage kernel args if hugepages are unsupported (Luiz Capitulino) [RHEL-143846]

    [5.14.0-611.39.1]
    - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (CKI Backport Bot)     [RHEL-142232] {CVE-2025-39818}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4759 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save     (CVE-2025-39818)

    * kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CVE-2025-68800)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:4012 advisory.

    * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting     (CVE-2025-38141)
      * kernel: Linux kernel io_uring: Local privilege escalation, information disclosure, or denial of     service via use-after-free (CVE-2025-38106)
      * kernel: drm/xe: Make dma-fences compliant with the safe access rules (CVE-2025-38703)
      * kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing     (CVE-2025-39760)
      * kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save     (CVE-2025-39818)
      * kernel: Kernel: Use-after-free in GPIO character device allows privilege escalation or denial of     service (CVE-2025-40249)
      * kernel: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CVE-2025-71085)
      * kernel: macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001)
      * kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration (CVE-2026-23097)
      * kernel: Linux kernel: Information disclosure in efivarfs via incorrect error propagation     (CVE-2026-23156)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-4012 advisory.

    - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (CKI Backport Bot)     [RHEL-142253] {CVE-2025-39818}
    - drm/xe: Make dma-fences compliant with the safe access rules (Mika Penttila) [RHEL-122272]     {CVE-2025-38703}
    - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143548]     {CVE-2025-71085}
    - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137370]     {CVE-2025-39760}
    - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150116] {CVE-2026-23156}
    - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147270] {CVE-2026-23097}
    - io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() (Jeff Moyer) [RHEL-137992]     {CVE-2025-38106}
    - gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify() (CKI Backport Bot) [RHEL-145597]     {CVE-2025-40249}
    - gpio: cdev: make sure the cdev fd is still active before emitting events (CKI Backport Bot)     [RHEL-145597] {CVE-2025-40249}
    - macvlan: fix possible UAF in macvlan_forward_source() (CKI Backport Bot) [RHEL-144128] {CVE-2026-23001}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4012 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting     (CVE-2025-38141)

    * kernel: Linux kernel io_uring: Local privilege escalation, information disclosure, or denial of service     via use-after-free (CVE-2025-38106)

    * kernel: drm/xe: Make dma-fences compliant with the safe access rules (CVE-2025-38703)

    * kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing     (CVE-2025-39760)

    * kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save     (CVE-2025-39818)

    * kernel: Kernel: Use-after-free in GPIO character device allows privilege escalation or denial of service     (CVE-2025-40249)

    * kernel: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CVE-2025-71085)

    * kernel: macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001)

    * kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration (CVE-2026-23097)

    * kernel: Linux kernel: Information disclosure in efivarfs via incorrect error propagation     (CVE-2026-23156)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 25.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7934-1 advisory.

    It was discovered that improper initialization of CPU cache memory could allow a local attacker with     hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

    Jean-Claude Graf, Sandro Regge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel     contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain     processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this to expose     sensitive information from the host OS. (CVE-2025-40300)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - PowerPC architecture;

    - S390 architecture;

    - x86 architecture;

    - Cryptographic API;

    - Network block device driver;

    - Character device driver;

    - Clock framework and drivers;

    - Data acquisition framework and drivers;

    - Hardware crypto device drivers;

    - Device frequency scaling framework;

    - DMA engine subsystem;

    - EDAC drivers;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - IIO subsystem;

    - IIO ADC drivers;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Multiple devices driver;

    - Media drivers;

    - Network drivers;

    - Mellanox network drivers;

    - PCI subsystem;

    - PHY drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - Power supply drivers;

    - Powercap sysfs driver;

    - Voltage and Current Regulator drivers;

    - S/390 drivers;

    - ASPEED SoC drivers;

    - SPI subsystem;

    - small TFT LCD display modules;

    - Media staging drivers;

    - USB Gadget drivers;

    - vDPA drivers;

    - VFIO drivers;

    - Framebuffer layer;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - Ceph distributed file system;

    - EFI Variable file system;

    - File systems infrastructure;

    - F2FS file system;

    - GFS2 file system;

    - Network file systems library;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - Proc file system;

    - SMB network file system;

    - DRM display driver;

    - io_uring subsystem;

    - Internal shared memory driver;

    - padata parallel execution mechanism;

    - Networking subsytem;

    - Bluetooth subsystem;

    - Netfilter;

    - UDP network protocol;

    - Tracing infrastructure;

    - BPF subsystem;

    - Perf events;

    - Padata parallel execution mechanism;

    - Codetag library;

    - KASAN memory debugging framework;

    - Memory management;

    - 802.1Q VLAN protocol;

    - Appletalk network protocol;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - MAC80211 subsystem;

    - Multipath TCP;

    - Netlink;

    - RxRPC session sockets;

    - Network traffic control;

    - SMC sockets;

    - Sun RPC protocol;

    - TIPC protocol;

    - TLS protocol;

    - VMware vSockets driver;

    - Wireless networking;

    - XFRM subsystem;

    - ADI SoundPort AD1816A based soundcard drivers;

    - MediaTek ASoC drivers;

    - SOF drivers;

    - USB sound devices;

    - KVM subsystem; (CVE-2025-38335, CVE-2025-38349, CVE-2025-38351, CVE-2025-38437, CVE-2025-38438,     CVE-2025-38439, CVE-2025-38440, CVE-2025-38441, CVE-2025-38443, CVE-2025-38444, CVE-2025-38445,     CVE-2025-38446, CVE-2025-38448, CVE-2025-38449, CVE-2025-38450, CVE-2025-38451, CVE-2025-38452,     CVE-2025-38453, CVE-2025-38454, CVE-2025-38455, CVE-2025-38456, CVE-2025-38457, CVE-2025-38458,     CVE-2025-38459, CVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463, CVE-2025-38464,     CVE-2025-38465, CVE-2025-38466, CVE-2025-38467, CVE-2025-38468, CVE-2025-38469, CVE-2025-38470,     CVE-2025-38471, CVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38475, CVE-2025-38476,     CVE-2025-38478, CVE-2025-38480, CVE-2025-38481, CVE-2025-38482, CVE-2025-38483, CVE-2025-38484,     CVE-2025-38485, CVE-2025-38487, CVE-2025-38488, CVE-2025-38489, CVE-2025-38490, CVE-2025-38491,     CVE-2025-38492, CVE-2025-38493, CVE-2025-38494, CVE-2025-38495, CVE-2025-38496, CVE-2025-38497,     CVE-2025-38501, CVE-2025-38503, CVE-2025-38505, CVE-2025-38506, CVE-2025-38507, CVE-2025-38508,     CVE-2025-38509, CVE-2025-38510, CVE-2025-38511, CVE-2025-38512, CVE-2025-38513, CVE-2025-38514,     CVE-2025-38515, CVE-2025-38516, CVE-2025-38517, CVE-2025-38520, CVE-2025-38521, CVE-2025-38524,     CVE-2025-38525, CVE-2025-38526, CVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530,     CVE-2025-38531, CVE-2025-38532, CVE-2025-38533, CVE-2025-38534, CVE-2025-38535, CVE-2025-38537,     CVE-2025-38538, CVE-2025-38539, CVE-2025-38540, CVE-2025-38542, CVE-2025-38543, CVE-2025-38544,     CVE-2025-38545, CVE-2025-38546, CVE-2025-38547, CVE-2025-38548, CVE-2025-38549, CVE-2025-38550,     CVE-2025-38551, CVE-2025-38552, CVE-2025-38553, CVE-2025-38555, CVE-2025-38556, CVE-2025-38557,     CVE-2025-38558, CVE-2025-38559, CVE-2025-38560, CVE-2025-38561, CVE-2025-38562, CVE-2025-38563,     CVE-2025-38565, CVE-2025-38566, CVE-2025-38567, CVE-2025-38568, CVE-2025-38569, CVE-2025-38570,     CVE-2025-38571, CVE-2025-38572, CVE-2025-38573, CVE-2025-38574, CVE-2025-38576, CVE-2025-38577,     CVE-2025-38578, CVE-2025-38579, CVE-2025-38581, CVE-2025-38582, CVE-2025-38583, CVE-2025-38584,     CVE-2025-38585, CVE-2025-38586, CVE-2025-38587, CVE-2025-38588, CVE-2025-38589, CVE-2025-38590,     CVE-2025-38593, CVE-2025-38595, CVE-2025-38601, CVE-2025-38602, CVE-2025-38604, CVE-2025-38605,     CVE-2025-38606, CVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612, CVE-2025-38615,     CVE-2025-38616, CVE-2025-38619, CVE-2025-38622, CVE-2025-38623, CVE-2025-38624, CVE-2025-38625,     CVE-2025-38626, CVE-2025-38628, CVE-2025-38629, CVE-2025-38630, CVE-2025-38631, CVE-2025-38632,     CVE-2025-38634, CVE-2025-38635, CVE-2025-38639, CVE-2025-38640, CVE-2025-38642, CVE-2025-38643,     CVE-2025-38644, CVE-2025-38645, CVE-2025-38646, CVE-2025-38648, CVE-2025-38649, CVE-2025-38650,     CVE-2025-38652, CVE-2025-38653, CVE-2025-38654, CVE-2025-38655, CVE-2025-38659, CVE-2025-38660,     CVE-2025-38662, CVE-2025-38663, CVE-2025-38664, CVE-2025-38665, CVE-2025-38666, CVE-2025-38668,     CVE-2025-38670, CVE-2025-38671, CVE-2025-38675, CVE-2025-38678, CVE-2025-39725, CVE-2025-39726,     CVE-2025-39727, CVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734, CVE-2025-39809,     CVE-2025-39818, CVE-2025-39946, CVE-2025-39964, CVE-2025-39993, CVE-2025-40018, CVE-2025-40157)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 25.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7879-1 advisory.

    It was discovered that improper initialization of CPU cache memory could allow a local attacker with     hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - PowerPC architecture;

    - S390 architecture;

    - x86 architecture;

    - Network block device driver;

    - Character device driver;

    - Clock framework and drivers;

    - Data acquisition framework and drivers;

    - Hardware crypto device drivers;

    - Device frequency scaling framework;

    - DMA engine subsystem;

    - EDAC drivers;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - IIO subsystem;

    - IIO ADC drivers;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Multiple devices driver;

    - Media drivers;

    - Network drivers;

    - Mellanox network drivers;

    - PCI subsystem;

    - PHY drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - Power supply drivers;

    - Powercap sysfs driver;

    - Voltage and Current Regulator drivers;

    - S/390 drivers;

    - ASPEED SoC drivers;

    - SPI subsystem;

    - small TFT LCD display modules;

    - Media staging drivers;

    - USB Gadget drivers;

    - vDPA drivers;

    - VFIO drivers;

    - Framebuffer layer;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - Ceph distributed file system;

    - EFI Variable file system;

    - File systems infrastructure;

    - F2FS file system;

    - GFS2 file system;

    - Network file systems library;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - Proc file system;

    - SMB network file system;

    - DRM display driver;

    - io_uring subsystem;

    - Internal shared memory driver;

    - padata parallel execution mechanism;

    - Networking subsytem;

    - Bluetooth subsystem;

    - Netfilter;

    - UDP network protocol;

    - Tracing infrastructure;

    - BPF subsystem;

    - Perf events;

    - Padata parallel execution mechanism;

    - Codetag library;

    - KASAN memory debugging framework;

    - Memory management;

    - 802.1Q VLAN protocol;

    - Appletalk network protocol;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - MAC80211 subsystem;

    - Multipath TCP;

    - Netlink;

    - RxRPC session sockets;

    - Network traffic control;

    - SMC sockets;

    - Sun RPC protocol;

    - TIPC protocol;

    - TLS protocol;

    - VMware vSockets driver;

    - Wireless networking;

    - XFRM subsystem;

    - ADI SoundPort AD1816A based soundcard drivers;

    - MediaTek ASoC drivers;

    - SOF drivers;

    - USB sound devices;

    - KVM subsystem; (CVE-2025-38335, CVE-2025-38349, CVE-2025-38351, CVE-2025-38437, CVE-2025-38438,     CVE-2025-38439, CVE-2025-38440, CVE-2025-38441, CVE-2025-38443, CVE-2025-38444, CVE-2025-38445,     CVE-2025-38446, CVE-2025-38448, CVE-2025-38449, CVE-2025-38450, CVE-2025-38451, CVE-2025-38452,     CVE-2025-38453, CVE-2025-38454, CVE-2025-38455, CVE-2025-38456, CVE-2025-38457, CVE-2025-38458,     CVE-2025-38459, CVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463, CVE-2025-38464,     CVE-2025-38465, CVE-2025-38466, CVE-2025-38467, CVE-2025-38468, CVE-2025-38469, CVE-2025-38470,     CVE-2025-38471, CVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38475, CVE-2025-38476,     CVE-2025-38478, CVE-2025-38480, CVE-2025-38481, CVE-2025-38482, CVE-2025-38483, CVE-2025-38484,     CVE-2025-38485, CVE-2025-38487, CVE-2025-38488, CVE-2025-38489, CVE-2025-38490, CVE-2025-38491,     CVE-2025-38492, CVE-2025-38493, CVE-2025-38494, CVE-2025-38495, CVE-2025-38496, CVE-2025-38497,     CVE-2025-38501, CVE-2025-38503, CVE-2025-38505, CVE-2025-38506, CVE-2025-38507, CVE-2025-38508,     CVE-2025-38509, CVE-2025-38510, CVE-2025-38511, CVE-2025-38512, CVE-2025-38513, CVE-2025-38514,     CVE-2025-38515, CVE-2025-38516, CVE-2025-38517, CVE-2025-38520, CVE-2025-38521, CVE-2025-38524,     CVE-2025-38525, CVE-2025-38526, CVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530,     CVE-2025-38531, CVE-2025-38532, CVE-2025-38533, CVE-2025-38534, CVE-2025-38535, CVE-2025-38537,     CVE-2025-38538, CVE-2025-38539, CVE-2025-38540, CVE-2025-38542, CVE-2025-38543, CVE-2025-38544,     CVE-2025-38545, CVE-2025-38546, CVE-2025-38547, CVE-2025-38548, CVE-2025-38549, CVE-2025-38550,     CVE-2025-38551, CVE-2025-38552, CVE-2025-38553, CVE-2025-38555, CVE-2025-38556, CVE-2025-38557,     CVE-2025-38558, CVE-2025-38559, CVE-2025-38560, CVE-2025-38561, CVE-2025-38562, CVE-2025-38563,     CVE-2025-38565, CVE-2025-38566, CVE-2025-38567, CVE-2025-38568, CVE-2025-38569, CVE-2025-38570,     CVE-2025-38571, CVE-2025-38572, CVE-2025-38573, CVE-2025-38574, CVE-2025-38576, CVE-2025-38577,     CVE-2025-38578, CVE-2025-38579, CVE-2025-38581, CVE-2025-38582, CVE-2025-38583, CVE-2025-38584,     CVE-2025-38585, CVE-2025-38586, CVE-2025-38587, CVE-2025-38588, CVE-2025-38589, CVE-2025-38590,     CVE-2025-38593, CVE-2025-38595, CVE-2025-38601, CVE-2025-38602, CVE-2025-38604, CVE-2025-38605,     CVE-2025-38606, CVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612, CVE-2025-38615,     CVE-2025-38616, CVE-2025-38619, CVE-2025-38622, CVE-2025-38623, CVE-2025-38624, CVE-2025-38625,     CVE-2025-38626, CVE-2025-38628, CVE-2025-38629, CVE-2025-38630, CVE-2025-38631, CVE-2025-38632,     CVE-2025-38634, CVE-2025-38635, CVE-2025-38639, CVE-2025-38640, CVE-2025-38642, CVE-2025-38643,     CVE-2025-38644, CVE-2025-38645, CVE-2025-38646, CVE-2025-38648, CVE-2025-38649, CVE-2025-38650,     CVE-2025-38652, CVE-2025-38653, CVE-2025-38654, CVE-2025-38655, CVE-2025-38659, CVE-2025-38660,     CVE-2025-38662, CVE-2025-38663, CVE-2025-38664, CVE-2025-38665, CVE-2025-38666, CVE-2025-38668,     CVE-2025-38670, CVE-2025-38671, CVE-2025-38675, CVE-2025-38678, CVE-2025-39725, CVE-2025-39726,     CVE-2025-39727, CVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734, CVE-2025-39809,     CVE-2025-39818, CVE-2025-40157)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-thc: Fix     incorrect pointer arithmetic in I2C regs save Improper use of secondary pointer (&dev->i2c_subip_regs)     caused kernel crash and out-of-bounds error: BUG: KASAN: slab-out-of-bounds in
    _regmap_bulk_read+0x449/0x510 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107 CPU: 3     UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary) Workqueue: async     async_run_entry_fn Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x660 ?
    __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x26/0x200     kasan_report+0xe1/0x120 ? _regmap_bulk_read+0x449/0x510 ? _regmap_bulk_read+0x449/0x510
    __asan_report_store4_noabort+0x17/0x30 _regmap_bulk_read+0x449/0x510 ? __pfx__regmap_bulk_read+0x10/0x10     regmap_bulk_read+0x270/0x3d0 pio_complete+0x1ee/0x2c0 [intel_thc] ? __pfx_pio_complete+0x10/0x10     [intel_thc] ? __pfx_pio_wait+0x10/0x10 [intel_thc] ? regmap_update_bits_base+0x13b/0x1f0     thc_i2c_subip_pio_read+0x117/0x270 [intel_thc] thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc] ?
    __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc] [...] The buggy address belongs to the object at     ffff888136005d00 which belongs to the cache kmalloc-rnd-12-192 of size 192 The buggy address is located 0     bytes to the right of allocated 192-byte region [ffff888136005d00, ffff888136005dc0) Replaced with direct     array indexing (&dev->i2c_subip_regs[i]) to ensure safe memory access. (CVE-2025-39818)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
304415	CentOS 9 : kernel-5.14.0-688.el9	Nessus	CentOS Local Security Checks	high
303868	RockyLinux 9 : kernel (RLSA-2026:4759)	Nessus	Rocky Linux Local Security Checks	high
303823	MiracleLinux 9 : kernel-5.14.0-611.41.1.el9_7 (AXSA:2026-356:22)	Nessus	Miracle Linux Local Security Checks	high
303185	AlmaLinux 9 : kernel (ALSA-2026:4759)	Nessus	Alma Linux Local Security Checks	high
302924	Oracle Linux 9 : kernel (ELSA-2026-4759)	Nessus	Oracle Linux Local Security Checks	high
302794	RHEL 9 : kernel (RHSA-2026:4759)	Nessus	Red Hat Local Security Checks	high
302183	AlmaLinux 10 : kernel (ALSA-2026:4012)	Nessus	Alma Linux Local Security Checks	high
301787	Oracle Linux 10 : kernel (ELSA-2026-4012)	Nessus	Oracle Linux Local Security Checks	high
301548	RHEL 10 : kernel (RHSA-2026:4012)	Nessus	Red Hat Local Security Checks	high
278749	Ubuntu 24.04 LTS / 25.04 : Linux kernel (Azure) vulnerabilities (USN-7934-1)	Nessus	Ubuntu Local Security Checks	high
276629	Ubuntu 24.04 LTS / 25.04 : Linux kernel vulnerabilities (USN-7879-1)	Nessus	Ubuntu Local Security Checks	high
265153	Linux Distros Unpatched Vulnerability : CVE-2025-39818	Nessus	Misc.	high

Detections

Analytics

CVE-2025-39818

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high