In the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion. The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)[n].lock, but when enabled CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare, and try to hold the per_cpu(hrtimer_bases)[n].lock. Avoid deadlock caused by implicitly waking up kswapd by passing in allocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the debug_objects_fill_pool() case. Inside stack depot they are processed by gfp_nested_mask(). Since ___slab_alloc() has preemption disabled, we mask out __GFP_DIRECT_RECLAIM from the flags there. The oops looks something like: BUG: spinlock recursion on CPU#3, swapper/3/0 lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3 Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT) Call trace: spin_bug+0x0 _raw_spin_lock_irqsave+0x80 hrtimer_try_to_cancel+0x94 task_contending+0x10c enqueue_dl_entity+0x2a4 dl_server_start+0x74 enqueue_task_fair+0x568 enqueue_task+0xac do_activate_task+0x14c ttwu_do_activate+0xcc try_to_wake_up+0x6c8 default_wake_function+0x20 autoremove_wake_function+0x1c __wake_up+0xac wakeup_kswapd+0x19c wake_all_kswapds+0x78 __alloc_pages_slowpath+0x1ac __alloc_pages_noprof+0x298 stack_depot_save_flags+0x6b0 stack_depot_save+0x14 set_track_prepare+0x5c ___slab_alloc+0xccc __kmalloc_cache_noprof+0x470 __set_page_owner+0x2bc post_alloc_hook[jt]+0x1b8 prep_new_page+0x28 get_page_from_freelist+0x1edc __alloc_pages_noprof+0x13c alloc_slab_page+0x244 allocate_slab+0x7c ___slab_alloc+0x8e8 kmem_cache_alloc_noprof+0x450 debug_objects_fill_pool+0x22c debug_object_activate+0x40 enqueue_hrtimer[jt]+0xdc hrtimer_start_range_ns+0x5f8 ...

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:0453 advisory.

    * kernel: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CVE-2025-39806)
      * kernel: audit: fix out-of-bounds read in audit_compare_dname_path() (CVE-2025-39840)
      * kernel: mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)
      * kernel: net: phylink: add lock for serializing concurrent pl->phydev writes with resolver     (CVE-2025-39905)
      * kernel: iommufd: Fix race during abort for file descriptors (CVE-2025-39966)
      * kernel: tls: wait for pending async decryptions if tls_strp_msg_hold fails (CVE-2025-40176)
      * kernel: sctp: avoid NULL dereference when chunk data buffer is missing (CVE-2025-40240)
      * kernel: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CVE-2025-40277)
      * kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths     (CVE-2025-68287)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:0453 advisory.

    * kernel: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CVE-2025-39806)

    * kernel: audit: fix out-of-bounds read in audit_compare_dname_path() (CVE-2025-39840)

    * kernel: mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)

    * kernel: net: phylink: add lock for serializing concurrent pl->phydev writes with resolver     (CVE-2025-39905)

    * kernel: iommufd: Fix race during abort for file descriptors (CVE-2025-39966)

    * kernel: tls: wait for pending async decryptions if tls_strp_msg_hold fails (CVE-2025-40176)

    * kernel: sctp: avoid NULL dereference when chunk data buffer is missing (CVE-2025-40240)

    * kernel: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CVE-2025-40277)

    * kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths     (CVE-2025-68287)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0453 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CVE-2025-39806)

    * kernel: audit: fix out-of-bounds read in audit_compare_dname_path() (CVE-2025-39840)

    * kernel: mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)

    * kernel: net: phylink: add lock for serializing concurrent pl->phydev writes with resolver     (CVE-2025-39905)

    * kernel: iommufd: Fix race during abort for file descriptors (CVE-2025-39966)

    * kernel: tls: wait for pending async decryptions if tls_strp_msg_hold fails (CVE-2025-40176)

    * kernel: sctp: avoid NULL dereference when chunk data buffer is missing (CVE-2025-40240)

    * kernel: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CVE-2025-40277)

    * kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths     (CVE-2025-68287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-11506:95 advisory.

    kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (CVE-2022-50087)     kernel: sunrpc: fix client side handling of tls alerts (CVE-2025-38571)     kernel: sunrpc: fix handling of server side tls alerts (CVE-2025-38566)     kernel: vsock/virtio: Validate length in packet header before skb_put() (CVE-2025-39718)     kernel: ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702)     kernel: x86/vmscape: Add conditional IBPB mitigation (CVE-2025-40300)     kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)     kernel: pstore/ram: Check start of empty przs during init (CVE-2023-53331)     kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367)     kernel: crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)     kernel: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CVE-2025-39849)     kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path (CVE-2025-39841)     kernel: crypto: xts - Handle EBUSY correctly (CVE-2023-53494)     kernel: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (CVE-2025-38351)     kernel: do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498)     kernel: NFS: Fix a race when updating an existing write (CVE-2025-39697)     kernel: kernfs: Fix UAF in polling when open file is released (CVE-2025-39881)     kernel: Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (CVE-2025-39982)     kernel: i40e: fix idx validation in config queues msg (CVE-2025-39971)     kernel: Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue (CVE-2025-39983)     kernel: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (CVE-2025-40047)     kernel: mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-0453 advisory.

    - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (CKI Backport Bot)     [RHEL-137150] {CVE-2025-68287}
    - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134431]     {CVE-2025-40277}
    - net: phylink: add lock for serializing concurrent pl->phydev writes with resolver (CKI Backport Bot)     [RHEL-129812] {CVE-2025-39905}
    - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-134010]     {CVE-2025-40240}
    - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CKI Backport Bot) [RHEL-124610]     {CVE-2025-39806}
    - audit: fix out-of-bounds read in audit_compare_dname_path() (Richard Guy Briggs) [RHEL-119185]     {CVE-2025-39840}
    - iommufd: Fix race during abort for file descriptors (Eder Zulian) [RHEL-123789] {CVE-2025-39966}
    - mm: slub: avoid wake up kswapd in set_track_prepare (Audra Mitchell) [RHEL-125522] {CVE-2025-39843}
    - tls: wait for pending async decryptions if tls_strp_msg_hold fails (CKI Backport Bot) [RHEL-128866]     {CVE-2025-40176}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0271 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: x86/vmscape: Add conditional IBPB mitigation (CVE-2025-40300)

    * kernel: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CVE-2025-39806)

    * kernel: mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)

    * kernel: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CVE-2025-39883)

    * kernel: can: j1939: implement NETDEV_UNREGISTER notification handler (CVE-2025-39925)

    * kernel: Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (CVE-2025-39982)

    * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)

    * kernel: Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue (CVE-2025-39983)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23789 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)

    * kernel: can: j1939: implement NETDEV_UNREGISTER notification handler (CVE-2025-39925)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-651.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in     set_track_prepare set_track_prepare() can incur lock recursion. The issue is that it is called from     hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)[n].lock, but when enabled     CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare, and try to hold the     per_cpu(hrtimer_bases)[n].lock. Avoid deadlock caused by implicitly waking up kswapd by passing in     allocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the debug_objects_fill_pool() case. Inside     stack depot they are processed by gfp_nested_mask(). Since ___slab_alloc() has preemption disabled, we     mask out __GFP_DIRECT_RECLAIM from the flags there. The oops looks something like: BUG: spinlock recursion     on CPU#3, swapper/3/0 lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3     Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT) Call trace: spin_bug+0x0
    _raw_spin_lock_irqsave+0x80 hrtimer_try_to_cancel+0x94 task_contending+0x10c enqueue_dl_entity+0x2a4     dl_server_start+0x74 enqueue_task_fair+0x568 enqueue_task+0xac do_activate_task+0x14c     ttwu_do_activate+0xcc try_to_wake_up+0x6c8 default_wake_function+0x20 autoremove_wake_function+0x1c
    __wake_up+0xac wakeup_kswapd+0x19c wake_all_kswapds+0x78 __alloc_pages_slowpath+0x1ac
    __alloc_pages_noprof+0x298 stack_depot_save_flags+0x6b0 stack_depot_save+0x14 set_track_prepare+0x5c
    ___slab_alloc+0xccc __kmalloc_cache_noprof+0x470 __set_page_owner+0x2bc post_alloc_hook[jt]+0x1b8     prep_new_page+0x28 get_page_from_freelist+0x1edc __alloc_pages_noprof+0x13c alloc_slab_page+0x244     allocate_slab+0x7c ___slab_alloc+0x8e8 kmem_cache_alloc_noprof+0x450 debug_objects_fill_pool+0x22c     debug_object_activate+0x40 enqueue_hrtimer[jt]+0xdc hrtimer_start_range_ns+0x5f8 ... (CVE-2025-39843)

  - In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure that     caller has CAP_SYS_ADMIN in the right userns What we want is to verify there is that clone won't expose     something hidden by a mount we wouldn't be able to undo. Wouldn't be able to undo may be a result of     MNT_LOCKED on a child, but it may also come from lacking admin rights in the userns of the namespace mount     belongs to. clone_private_mnt() checks the former, but not the latter. There's a number of rather     confusing CAP_SYS_ADMIN checks in various userns during the mount, especially with the new mount API; they     serve different purposes and in case of clone_private_mnt() they usually, but not always end up covering     the missing check mentioned above. (CVE-2025-38499)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-21926 advisory.

    - mm: slub: avoid wake up kswapd in set_track_prepare (Audra Mitchell) [RHEL-125521] {CVE-2025-39843}
    - slub: Reflow ___slab_alloc() (Audra Mitchell) [RHEL-125521] {CVE-2025-39843}
    - kernfs: Fix UAF in polling when open file is released (Pavel Reichl) [RHEL-122087] {CVE-2025-39881}
    - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123808] {CVE-2025-39968}
    - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123808] {CVE-2025-39969}
    - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123808] {CVE-2025-39970}
    - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123808] {CVE-2025-39971}
    - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123808] {CVE-2025-39972}
    - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123808] {CVE-2025-39973}
    - io_uring/waitid: always prune wait queue entry in io_waitid_wait() (CKI Backport Bot) [RHEL-124971]     {CVE-2025-40047}
    - Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue (CKI Backport Bot) [RHEL-124129] {CVE-2025-39983}
    - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (CKI Backport Bot) [RHEL-123821]     {CVE-2025-39982}
    - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-121704]     {CVE-2025-38498}
    - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-121704]     {CVE-2025-38498}
    - KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Jon Maloy) [RHEL-117136]     {CVE-2025-38351}
    - NFS: Fix a race when updating an existing write (CKI Backport Bot) [RHEL-113855] {CVE-2025-39697}
    - crypto: xts - Handle EBUSY correctly (Vladis Dronov) [RHEL-119236] {CVE-2023-53494}
    - ipv6: sr: Fix MAC comparison to be constant-time (CKI Backport Bot) [RHEL-116383] {CVE-2025-39702}
    - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114298]     {CVE-2025-39718}
    - pstore/ram: Check start of empty przs during init (CKI Backport Bot) [RHEL-122068] {CVE-2023-53331}
    - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-119130]     {CVE-2025-39841}
    - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-118257] {CVE-2025-39817}
    - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [RHEL-110810] {CVE-2025-38571}
    - fs/smb: Fix inconsistent refcnt update (Paulo Alcantara) [RHEL-117880] {CVE-2025-39819}
    - sunrpc: fix handling of server side tls alerts (Steve Dickson) [RHEL-111069] {CVE-2025-38566}
    - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117580]     {CVE-2025-39849}
    - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117235] {CVE-2023-53373}
    - fs: fix UAF/GPF bug in nilfs_mdt_destroy (CKI Backport Bot) [RHEL-116662] {CVE-2022-50367}
    - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-113837]     {CVE-2022-50087}
    - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114272] {CVE-2025-40300}
    - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114272] {CVE-2025-40300}
    - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114272] {CVE-2025-40300}
    - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114272] {CVE-2025-40300}
    - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114272] {CVE-2025-40300}
    - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114272] {CVE-2025-40300}
    - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114272] {CVE-2025-40300}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:21926 advisory.

    * kernel: mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:21926 advisory.

    * kernel: mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21926 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-25754 advisory.

    [6.12.0-105.51.5]
    - RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad)  [Orabug: 38226124]
    - arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska)  [Orabug: 38454705]
    - arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska)  [Orabug: 38454705]
    - arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska)  [Orabug: 38454705]
    - cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska)  [Orabug: 38454705]
    - cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska)  [Orabug: 38454705]
    - arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu)  [Orabug: 38454705]
    - ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams)  [Orabug: 38454705]
    - perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono)  [Orabug: 38454705]
    - perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono)  [Orabug: 38454705]
    - perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono)  [Orabug: 38454705]
    - perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono)  [Orabug: 38454705]
    - cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan)  [Orabug: 38454705]
    - Revert 'sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails' (Joseph Salisbury)     [Orabug: 38498945]
    - uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar)  [Orabug: 38526374]
    - LTS version: v6.12.51 (Jack Vogel)
    - ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
    - wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)
    - mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)
    - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)
    - media: rc: fix races with imon_disconnect() (Larshin Sergey)
    - media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)
    - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)
    - scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)
    - gcc-plugins: Remove TODO_verify_il for GCC >= 16 (Kees Cook)
    - crypto: sha256 - fix crash at kexec (Breno Leitao)
    - LTS version v6.12.50 (Jack Vogel)
    - drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
    - Revert 'usb: xhci: remove option to change a default ring's TRB cycle bit' (Niklas Neronin)
    - iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)
    - fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
    - fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)
    - mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)
    - kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
    - gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
    - fs/proc/task_mmu: check p->vec_buf for NULL (Jakub Acs)
    - afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
    - drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
    - arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
    - arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
    - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
    - tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))
    - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)
    - i40e: improve VF MAC filters accounting (Lukasz Czapnik)
    - i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
    - i40e: add max boundary check for VF filters (Lukasz Czapnik)
    - i40e: fix validation of VF state in get resources (Lukasz Czapnik)
    - i40e: fix input validation logic for action_meta (Lukasz Czapnik)
    - i40e: fix idx validation in config queues msg (Lukasz Czapnik)
    - i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)
    - i40e: add validation for ring_len param (Lukasz Czapnik)
    - HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
    - smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)
    - platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
    - drm/panthor: Defer scheduler entitiy destruction to queue release (Adrian Larumbe)
    - futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)
    - drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)
    - mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
    - mm: revert 'mm/gup: clear the LRU flag of a page before adding to LRU batch' (Hugh Dickins)
    - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
    - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
    - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir     Oltean)
    - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
    - selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
    - nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)
    - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
    - bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
    - vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)
    - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)
    - Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
    - ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
    - net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
    - net: tun: Update napi->skb after XDP process (Wang Liang)
    - can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean)
    - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
    - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
    - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
    - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
    - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)
    - bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
    - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
    - wifi: virt_wifi: Fix page fault on connect (James Guan)
    - btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
    - bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)
    - smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
    - smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
    - cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
    - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
    - arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
    - firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
    - HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
    - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
    - net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
    - ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)
    - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)
    - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)
    - i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)
    - mmc: sdhci-cadence: add Mobileye eyeQ support (Benoit Monin)
    - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
    - net: fec: rename struct fec_devinfo fec_imx6x_info -> fec_imx6sx_info (Marc Kleine-Budde)
    - usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
    - ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
    - ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
    - ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
    - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
    - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
    - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
    - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
    - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
    - ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
    - ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
    - firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
    - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)

    [6.12.0-105.49.4]
    - fs/dax: don't disassociate zero page entries (Alistair Popple)  [Orabug: 36859857]
    - device/dax: properly refcount device dax pages when mapping (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: properly refcount fs dax pages (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: Fix 'don't skip locked entries when scanning entries' (Alistair Popple)  [Orabug: 36859857]
    - mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle))  [Orabug: 36859857]
    - dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams)  [Orabug: 36859857]
    - mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple)  [Orabug: 36859857]
    - mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple)  [Orabug: 36859857]
    - mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple)  [Orabug: 36859857]
    - mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple)  [Orabug: 36859857]
    - mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple)  [Orabug: 36859857]
    - mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple)  [Orabug:
    36859857]
    - mm: allow compound zone device pages (Alistair Popple)  [Orabug: 36859857]
    - mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple)  [Orabug: 36859857]
    - mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple)  [Orabug: 36859857]
    - dax: use folios more widely within DAX (Matthew Wilcox (Oracle))  [Orabug: 36859857]
    - dax: remove access to page->index (Matthew Wilcox (Oracle))  [Orabug: 36859857]
    - fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple)  [Orabug: 36859857]
    - mm: optimize invalidation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
    - mm: optimize truncation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
    - fs/dax: create a common implementation to break DAX layouts (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: refactor wait for dax idle page (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: don't skip locked entries when scanning entries (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple)  [Orabug:
    36859857]
    - uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi)  [Orabug: 38459242]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4328 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4328-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     October 13, 2025                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.1     Version        : 6.1.153-1     CVE ID         : CVE-2024-36331 CVE-2024-36350 CVE-2024-36357 CVE-2024-36913                      CVE-2024-41013 CVE-2024-47704 CVE-2024-56758 CVE-2024-57883                      CVE-2024-57924 CVE-2024-58240 CVE-2025-21816 CVE-2025-22119                      CVE-2025-23143 CVE-2025-23160 CVE-2025-27558 CVE-2025-37925                      CVE-2025-37931 CVE-2025-37958 CVE-2025-37968 CVE-2025-38000                      CVE-2025-38001 CVE-2025-38003 CVE-2025-38004 CVE-2025-38031                      CVE-2025-38034 CVE-2025-38035 CVE-2025-38037 CVE-2025-38040                      CVE-2025-38043 CVE-2025-38044 CVE-2025-38048 CVE-2025-38051                      CVE-2025-38052 CVE-2025-38058 CVE-2025-38061 CVE-2025-38062                      CVE-2025-38063 CVE-2025-38065 CVE-2025-38066 CVE-2025-38067                      CVE-2025-38068 CVE-2025-38071 CVE-2025-38072 CVE-2025-38074                      CVE-2025-38075 CVE-2025-38077 CVE-2025-38078 CVE-2025-38079                      CVE-2025-38083 CVE-2025-38084 CVE-2025-38085 CVE-2025-38086                      CVE-2025-38088 CVE-2025-38090 CVE-2025-38097 CVE-2025-38100                      CVE-2025-38102 CVE-2025-38103 CVE-2025-38107 CVE-2025-38108                      CVE-2025-38111 CVE-2025-38112 CVE-2025-38113 CVE-2025-38115                      CVE-2025-38118 CVE-2025-38119 CVE-2025-38120 CVE-2025-38122                      CVE-2025-38124 CVE-2025-38126 CVE-2025-38131 CVE-2025-38135                      CVE-2025-38136 CVE-2025-38138 CVE-2025-38142 CVE-2025-38143                      CVE-2025-38145 CVE-2025-38146 CVE-2025-38147 CVE-2025-38148                      CVE-2025-38151 CVE-2025-38153 CVE-2025-38154 CVE-2025-38157                      CVE-2025-38158 CVE-2025-38159 CVE-2025-38160 CVE-2025-38161                      CVE-2025-38163 CVE-2025-38165 CVE-2025-38166 CVE-2025-38167                      CVE-2025-38170 CVE-2025-38173 CVE-2025-38174 CVE-2025-38180                      CVE-2025-38181 CVE-2025-38183 CVE-2025-38184 CVE-2025-38185                      CVE-2025-38190 CVE-2025-38191 CVE-2025-38193 CVE-2025-38194                      CVE-2025-38197 CVE-2025-38198 CVE-2025-38200 CVE-2025-38202                      CVE-2025-38211 CVE-2025-38212 CVE-2025-38214 CVE-2025-38215                      CVE-2025-38218 CVE-2025-38219 CVE-2025-38222 CVE-2025-38225                      CVE-2025-38226 CVE-2025-38227 CVE-2025-38229 CVE-2025-38230                      CVE-2025-38231 CVE-2025-38236 CVE-2025-38239 CVE-2025-38245                      CVE-2025-38249 CVE-2025-38251 CVE-2025-38257 CVE-2025-38259                      CVE-2025-38260 CVE-2025-38262 CVE-2025-38263 CVE-2025-38273                      CVE-2025-38275 CVE-2025-38277 CVE-2025-38280 CVE-2025-38282                      CVE-2025-38285 CVE-2025-38286 CVE-2025-38293 CVE-2025-38298                      CVE-2025-38300 CVE-2025-38304 CVE-2025-38305 CVE-2025-38310                      CVE-2025-38312 CVE-2025-38313 CVE-2025-38319 CVE-2025-38320                      CVE-2025-38322 CVE-2025-38323 CVE-2025-38324 CVE-2025-38326                      CVE-2025-38328 CVE-2025-38331 CVE-2025-38332 CVE-2025-38334                      CVE-2025-38335 CVE-2025-38336 CVE-2025-38337 CVE-2025-38342                      CVE-2025-38344 CVE-2025-38345 CVE-2025-38346 CVE-2025-38347                      CVE-2025-38348 CVE-2025-38350 CVE-2025-38352 CVE-2025-38354                      CVE-2025-38362 CVE-2025-38363 CVE-2025-38364 CVE-2025-38365                      CVE-2025-38371 CVE-2025-38375 CVE-2025-38377 CVE-2025-38382                      CVE-2025-38384 CVE-2025-38385 CVE-2025-38386 CVE-2025-38387                      CVE-2025-38389 CVE-2025-38391 CVE-2025-38393 CVE-2025-38395                      CVE-2025-38396 CVE-2025-38399 CVE-2025-38400 CVE-2025-38401                      CVE-2025-38403 CVE-2025-38404 CVE-2025-38406 CVE-2025-38409                      CVE-2025-38410 CVE-2025-38412 CVE-2025-38415 CVE-2025-38416                      CVE-2025-38418 CVE-2025-38419 CVE-2025-38420 CVE-2025-38422                      CVE-2025-38424 CVE-2025-38425 CVE-2025-38428 CVE-2025-38430                      CVE-2025-38437 CVE-2025-38439 CVE-2025-38441 CVE-2025-38443                      CVE-2025-38444 CVE-2025-38445 CVE-2025-38448 CVE-2025-38451                      CVE-2025-38455 CVE-2025-38456 CVE-2025-38457 CVE-2025-38458                      CVE-2025-38459 CVE-2025-38460 CVE-2025-38461 CVE-2025-38462                      CVE-2025-38464 CVE-2025-38465 CVE-2025-38466 CVE-2025-38467                      CVE-2025-38468 CVE-2025-38470 CVE-2025-38471 CVE-2025-38472                      CVE-2025-38473 CVE-2025-38474 CVE-2025-38476 CVE-2025-38477                      CVE-2025-38478 CVE-2025-38480 CVE-2025-38481 CVE-2025-38482                      CVE-2025-38483 CVE-2025-38485 CVE-2025-38487 CVE-2025-38488                      CVE-2025-38491 CVE-2025-38494 CVE-2025-38495 CVE-2025-38497                      CVE-2025-38498 CVE-2025-38499 CVE-2025-38500 CVE-2025-38501                      CVE-2025-38502 CVE-2025-38503 CVE-2025-38510 CVE-2025-38512                      CVE-2025-38513 CVE-2025-38514 CVE-2025-38515 CVE-2025-38516                      CVE-2025-38520 CVE-2025-38527 CVE-2025-38528 CVE-2025-38529                      CVE-2025-38530 CVE-2025-38535 CVE-2025-38538 CVE-2025-38539                      CVE-2025-38540 CVE-2025-38542 CVE-2025-38543 CVE-2025-38546                      CVE-2025-38548 CVE-2025-38550 CVE-2025-38552 CVE-2025-38553                      CVE-2025-38555 CVE-2025-38560 CVE-2025-38561 CVE-2025-38562                      CVE-2025-38563 CVE-2025-38565 CVE-2025-38569 CVE-2025-38572                      CVE-2025-38574 CVE-2025-38576 CVE-2025-38577 CVE-2025-38578                      CVE-2025-38579 CVE-2025-38581 CVE-2025-38583 CVE-2025-38587                      CVE-2025-38588 CVE-2025-38601 CVE-2025-38602 CVE-2025-38604                      CVE-2025-38608 CVE-2025-38609 CVE-2025-38610 CVE-2025-38612                      CVE-2025-38614 CVE-2025-38617 CVE-2025-38618 CVE-2025-38622                      CVE-2025-38623 CVE-2025-38624 CVE-2025-38630 CVE-2025-38634                      CVE-2025-38635 CVE-2025-38639 CVE-2025-38644 CVE-2025-38645                      CVE-2025-38650 CVE-2025-38652 CVE-2025-38653 CVE-2025-38663                      CVE-2025-38664 CVE-2025-38665 CVE-2025-38666 CVE-2025-38668                      CVE-2025-38670 CVE-2025-38671 CVE-2025-38676 CVE-2025-38677                      CVE-2025-38679 CVE-2025-38680 CVE-2025-38681 CVE-2025-38683                      CVE-2025-38684 CVE-2025-38685 CVE-2025-38687 CVE-2025-38691                      CVE-2025-38693 CVE-2025-38694 CVE-2025-38695 CVE-2025-38696                      CVE-2025-38697 CVE-2025-38698 CVE-2025-38699 CVE-2025-38700                      CVE-2025-38701 CVE-2025-38702 CVE-2025-38706 CVE-2025-38707                      CVE-2025-38708 CVE-2025-38711 CVE-2025-38712 CVE-2025-38713                      CVE-2025-38714 CVE-2025-38715 CVE-2025-38721 CVE-2025-38723                      CVE-2025-38724 CVE-2025-38725 CVE-2025-38727 CVE-2025-38728                      CVE-2025-38729 CVE-2025-38732 CVE-2025-38735 CVE-2025-38736                      CVE-2025-39673 CVE-2025-39675 CVE-2025-39676 CVE-2025-39681                      CVE-2025-39682 CVE-2025-39683 CVE-2025-39684 CVE-2025-39685                      CVE-2025-39686 CVE-2025-39687 CVE-2025-39689 CVE-2025-39691                      CVE-2025-39692 CVE-2025-39693 CVE-2025-39694 CVE-2025-39697                      CVE-2025-39701 CVE-2025-39702 CVE-2025-39703 CVE-2025-39706                      CVE-2025-39709 CVE-2025-39710 CVE-2025-39713 CVE-2025-39714                      CVE-2025-39715 CVE-2025-39716 CVE-2025-39718 CVE-2025-39719                      CVE-2025-39724 CVE-2025-39730 CVE-2025-39731 CVE-2025-39734                      CVE-2025-39736 CVE-2025-39737 CVE-2025-39738 CVE-2025-39742                      CVE-2025-39743 CVE-2025-39749 CVE-2025-39752 CVE-2025-39756                      CVE-2025-39757 CVE-2025-39759 CVE-2025-39760 CVE-2025-39766                      CVE-2025-39770 CVE-2025-39772 CVE-2025-39773 CVE-2025-39776                      CVE-2025-39782 CVE-2025-39783 CVE-2025-39787 CVE-2025-39788                      CVE-2025-39790 CVE-2025-39794 CVE-2025-39795 CVE-2025-39798                      CVE-2025-39800 CVE-2025-39801 CVE-2025-39806 CVE-2025-39808                      CVE-2025-39812 CVE-2025-39813 CVE-2025-39817 CVE-2025-39819                      CVE-2025-39823 CVE-2025-39824 CVE-2025-39825 CVE-2025-39826                      CVE-2025-39827 CVE-2025-39828 CVE-2025-39835 CVE-2025-39838                      CVE-2025-39839 CVE-2025-39841 CVE-2025-39842 CVE-2025-39843                      CVE-2025-39844 CVE-2025-39845 CVE-2025-39846 CVE-2025-39847                      CVE-2025-39848 CVE-2025-39849 CVE-2025-39853 CVE-2025-39857                      CVE-2025-39860 CVE-2025-39864 CVE-2025-39865 CVE-2025-39866                      CVE-2025-39869 CVE-2025-39870 CVE-2025-39873 CVE-2025-39876                      CVE-2025-39877 CVE-2025-39880 CVE-2025-39881 CVE-2025-39883                      CVE-2025-39885 CVE-2025-39891 CVE-2025-39894 CVE-2025-39898                      CVE-2025-39902 CVE-2025-39907 CVE-2025-39909 CVE-2025-39911                      CVE-2025-39913 CVE-2025-39914 CVE-2025-39916 CVE-2025-39920                      CVE-2025-39923 CVE-2025-40300     Debian Bug     : 1040901 1107479 1107511 1108065 1108069 1108271 1108430                      1109734 1111017 1114773

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 11 bullseye, these problems have been fixed in version     6.1.153-1~deb11u1.  Starting with this version, modules are signed     with an ephemeral key on all architectures, and the broken pktcdvd     driver is disabled.  This version additionally includes many more bug     fixes from stable updates 6.1.141-6.1.153.

    We recommend that you upgrade your linux-6.1 packages.

    For the detailed security status of linux-6.1 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.1

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1208 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix NULL pointer dereference in l3mdev_l3_rcv (CVE-2025-22103)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113)

    In the Linux kernel, the following vulnerability has been resolved:

    md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (CVE-2025-22124)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid1,raid10: don't ignore IO flags (CVE-2025-22125)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (CVE-2025-38453)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CVE-2025-38500)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix oob access in cgroup local storage (CVE-2025-38502)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Restrict conditions for adding duplicating netems to qdisc tree (CVE-2025-38553)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Prevent VMA split of buffer mappings (CVE-2025-38563)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Exit early on perf_mmap() fail (CVE-2025-38565)

    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: fix handling of server side tls alerts (CVE-2025-38566)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568)

    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: fix client side handling of tls alerts (CVE-2025-38571)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: reject malicious packets in ipv6_gso_segment() (CVE-2025-38572)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, arm64: Fix fp initialization for exception boundary (CVE-2025-38586)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix possible infinite loop in fib6_info_uses_dev() (CVE-2025-38587)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: prevent infinite loop in rt6_nlmsg_size() (CVE-2025-38588)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Remove skb secpath if xfrm state is not found (CVE-2025-38590)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (CVE-2025-38608)

    In the Linux kernel, the following vulnerability has been resolved:

    eventpoll: Fix semi-unbounded recursion (CVE-2025-38614)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: cancle set bad inode after removing name fails (CVE-2025-38615)

    In the Linux kernel, the following vulnerability has been resolved:

    tls: handle data disappearing from under the TLS ULP (CVE-2025-38616)

    In the Linux kernel, the following vulnerability has been resolved:

    net/packet: fix a race in packet_set_ring() and packet_notifier() (CVE-2025-38617)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: Do not allow binding to VMADDR_PORT_ANY (CVE-2025-38618)

    In the Linux kernel, the following vulnerability has been resolved:

    net: drop UFO packets in udp_rcv_segment() (CVE-2025-38622)

    In the Linux kernel, the following vulnerability has been resolved:

    pinmux: fix race causing mux_owner NULL with active mux_usecount (CVE-2025-38632)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_nfacct: don't assume acct name is null-terminated (CVE-2025-38639)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Disable migration in nf_hook_run_bpf(). (CVE-2025-38640)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Check device memory pointer before usage (CVE-2025-38645)

    In the Linux kernel, the following vulnerability has been resolved:

    proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653)

    In the Linux kernel, the following vulnerability has been resolved:

    [ceph] parse_longname(): strrchr() expects NUL-terminated string (CVE-2025-38660)

    In the Linux kernel, the following vulnerability has been resolved:

    can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (CVE-2025-38665)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (CVE-2025-38670)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: state: initialize state_ptrs earlier in xfrm_state_find (CVE-2025-38675)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: Avoid stack buffer overflow from kernel cmdline (CVE-2025-38676)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (CVE-2025-38681)

    In the Linux kernel, the following vulnerability has been resolved:

    hv_netvsc: Fix panic during namespace deletion with VF (CVE-2025-38683)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (CVE-2025-38685)

    In the Linux kernel, the following vulnerability has been resolved:

    userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (CVE-2025-38686)

    In the Linux kernel, the following vulnerability has been resolved:

    pNFS: Fix uninited ptr deref in block/scsi layout (CVE-2025-38691)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: add cluster chain loop check for dir (CVE-2025-38692)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (CVE-2025-38700)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (CVE-2025-38701)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: fix potential buffer overflow in do_register_framebuffer() (CVE-2025-38702)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access (CVE-2025-38704)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Add sanity check for file name (CVE-2025-38707)

    In the Linux kernel, the following vulnerability has been resolved:

    drbd: add missing kref_get in handle_write_conflicts (CVE-2025-38708)

    In the Linux kernel, the following vulnerability has been resolved:

    loop: Avoid updating block size under exclusive owner (CVE-2025-38709)

    In the Linux kernel, the following vulnerability has been resolved:

    net: kcm: Fix race condition in kcm_unattach() (CVE-2025-38717)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: fix refcount leak on table dump (CVE-2025-38721)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724)

    In the Linux kernel, the following vulnerability has been resolved:

    smb3: fix for slab out of bounds on mount to ksmbd (CVE-2025-38728)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/net: commit partial buffers on retry (CVE-2025-38730)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_reject: don't leak dst refcount for loopback packets (CVE-2025-38732)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix oops due to uninitialised variable (CVE-2025-38737)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Fix backlog accounting in qdisc_dequeue_internal (CVE-2025-39677)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (CVE-2025-39681)

    In the Linux kernel, the following vulnerability has been resolved:

    tls: fix handling of zero-length records on the rx_list (CVE-2025-39682)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Limit access to parser->buffer when trace_get_user failed (CVE-2025-39683)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Also allocate and copy hash for reading of filter files (CVE-2025-39689)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/buffer: fix use-after-free when call bh_read() helper (CVE-2025-39691)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix a race when updating an existing write (CVE-2025-39697)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CVE-2025-39698)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/ops-common: ignore migration request to invalid nodes (CVE-2025-39700)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock/virtio: Validate length in packet header before skb_put() (CVE-2025-39718)

    In the Linux kernel, the following vulnerability has been resolved:

    netfs: Fix unbuffered write error handling (CVE-2025-39723)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: fix panic due to PSLVERR (CVE-2025-39724)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (CVE-2025-39725)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: swap: fix potential buffer overflow in setup_clusters() (CVE-2025-39727)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)

    In the Linux kernel, the following vulnerability has been resolved:

    Revert fs/ntfs3: Replace inode_trylock with inode_lock (CVE-2025-39734)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not allow relocation of partially dropped subvolumes (CVE-2025-39738)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Fix rcu_read_unlock() deadloop due to IRQ work (CVE-2025-39744)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Forget ranges when refining tnum after JSET (CVE-2025-39748)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Protect ->defer_qs_iw_pending from data race (CVE-2025-39749)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/smaps: fix race between smaps_hugetlb_range and migration (CVE-2025-39754)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: Prevent file descriptor table allocations exceeding INT_MAX (CVE-2025-39756)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: qgroup: fix race between quota disable and quota rescan ioctl (CVE-2025-39759)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: core: config: Prevent OOB read in SS endpoint companion parsing (CVE-2025-39760)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (CVE-2025-39763)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (CVE-2025-39770)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: fix soft lockup in br_multicast_query_expired() (CVE-2025-39773)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: subpage: keep TOWRITE tag until folio is cleaned (CVE-2025-39779)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/ext: Fix invalid task state transitions on class switch (CVE-2025-39780)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: prevent softlockup in jbd2_log_do_checkpoint() (CVE-2025-39782)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: endpoint: Fix configfs group list head handling (CVE-2025-39783)

    In the Linux kernel, the following vulnerability has been resolved:

    dm: dm-crypt: Do not partially accept write BIOs with zoned targets (CVE-2025-39791)

    In the Linux kernel, the following vulnerability has been resolved:

    dm: Always split write BIOs to zoned device limits (CVE-2025-39792)

    In the Linux kernel, the following vulnerability has been resolved:

    block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (CVE-2025-39795)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: Duplicate SPI Handling (CVE-2025-39797)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix the setting of capabilities when automounting a new filesystem (CVE-2025-39798)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (CVE-2025-39800)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CVE-2025-39806)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: initialize more fields in sctp_v6_from_sk() (CVE-2025-39812)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (CVE-2025-39813)

    In the Linux kernel, the following vulnerability has been resolved:

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/smb: Fix inconsistent refcnt update (CVE-2025-39819)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: use array_index_nospec with indices that come from guest (CVE-2025-39823)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: asus: fix UAF via HID_CLAIMED_INPUT validation (CVE-2025-39824)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix race with concurrent opens in rename(2) (CVE-2025-39825)

    In the Linux kernel, the following vulnerability has been resolved:

    trace/fgraph: Fix the warning caused by missing unregister notifier (CVE-2025-39829)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Fix lockdep assertion on sync reset unload event (CVE-2025-39832)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: do not propagate ENODATA disk errors into xattr code (CVE-2025-39835)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: prevent NULL pointer dereference in UTF16 conversion (CVE-2025-39838)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: move page table sync declarations to linux/pgtable.h (CVE-2025-39844)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (CVE-2025-39845)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (CVE-2025-39850)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (CVE-2025-39851)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (CVE-2025-39852)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (CVE-2025-39894)

    In the Linux kernel, the following vulnerability has been resolved:

    sched: Fix sched_numa_find_nth_cpu() if mask offline (CVE-2025-39895)

    In the Linux kernel, the following vulnerability has been resolved:

    e1000e: fix heap overflow in e1000_set_eeprom (CVE-2025-39898)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (CVE-2025-39899)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (CVE-2025-39900)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)

    In the Linux kernel, the following vulnerability has been resolved:

    of_numa: fix uninitialized memory nodes causing kernel panic (CVE-2025-39903)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1210 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    fs: relax assertions on failure to encode file handles (CVE-2024-57924)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. (CVE-2025-23143)

    In the Linux kernel, the following vulnerability has been resolved:

    media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization     (CVE-2025-23160)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: adjust subpage bit start based on sectorsize (CVE-2025-37931)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/core: Fix KASAN: slab-use-after-free Read in ib_register_device problem (CVE-2025-38022)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (CVE-2025-38201)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix oob access in cgroup local storage (CVE-2025-38502)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Remove skb secpath if xfrm state is not found (CVE-2025-38590)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Fix backlog accounting in qdisc_dequeue_internal (CVE-2025-39677)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: prevent NULL pointer dereference in UTF16 conversion (CVE-2025-39838)

    In the Linux kernel, the following vulnerability has been resolved:

    batman-adv: fix OOB read/write in network-coding decode (CVE-2025-39839)

    In the Linux kernel, the following vulnerability has been resolved:

    ocfs2: prevent release journal inode after journal shutdown (CVE-2025-39842)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: move page table sync declarations to linux/pgtable.h (CVE-2025-39844)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (CVE-2025-39845)

    In the Linux kernel, the following vulnerability has been resolved:

    pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (CVE-2025-39846)

    In the Linux kernel, the following vulnerability has been resolved:

    ppp: fix memory leak in pad_compress_skb (CVE-2025-39847)

    In the Linux kernel, the following vulnerability has been resolved:

    ax25: properly unshare skbs in ax25_kiss_rcv() (CVE-2025-39848)

    In the Linux kernel, the following vulnerability has been resolved:

    wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CVE-2025-39849)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866)

    In the Linux kernel, the following vulnerability has been resolved:x86/vmscape: Add conditional IBPB     mitigation

    VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a     userspace hypervisor (like QEMU). Existing mitigations already protect kernel/KVM from a malicious guest.
    Userspace can additionally be protected by flushing the branch predictors after a VMexit.

    Since it is the userspace that consumes the poisoned branch predictors, conditionally issue an IBPB after     a VMexit and before returning to userspace. Workloads that frequently switch between hypervisor and     userspace will incur the most overhead from the new IBPB.

    This new IBPB is not integrated with the existing IBPB sites. For instance, a task can use the existing     speculation control prctl() to get an IBPB at context switch time. With this implementation, the IBPB is     doubled up: one at context switch and another before running userspace. The intent is to integrate and     optimize these cases post-embargo.[ dhansen: elaborate on suboptimal IBPB solution ] (CVE-2025-40300)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6008 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6008-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     September 22, 2025                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2025-21751 CVE-2025-22103 CVE-2025-22113 CVE-2025-22124                      CVE-2025-22125 CVE-2025-23133 CVE-2025-38272 CVE-2025-38306                      CVE-2025-38453 CVE-2025-38502 CVE-2025-38556 CVE-2025-38676                      CVE-2025-38677 CVE-2025-38730 CVE-2025-38732 CVE-2025-38733                      CVE-2025-38734 CVE-2025-38735 CVE-2025-38736 CVE-2025-38737                      CVE-2025-39673 CVE-2025-39675 CVE-2025-39676 CVE-2025-39679                      CVE-2025-39681 CVE-2025-39682 CVE-2025-39683 CVE-2025-39684                      CVE-2025-39685 CVE-2025-39686 CVE-2025-39687 CVE-2025-39689                      CVE-2025-39691 CVE-2025-39692 CVE-2025-39693 CVE-2025-39694                      CVE-2025-39695 CVE-2025-39697 CVE-2025-39698 CVE-2025-39700                      CVE-2025-39701 CVE-2025-39702 CVE-2025-39703 CVE-2025-39705                      CVE-2025-39706 CVE-2025-39707 CVE-2025-39709 CVE-2025-39710                      CVE-2025-39711 CVE-2025-39712 CVE-2025-39713 CVE-2025-39714                      CVE-2025-39715 CVE-2025-39716 CVE-2025-39718 CVE-2025-39719                      CVE-2025-39720 CVE-2025-39721 CVE-2025-39722 CVE-2025-39723                      CVE-2025-39724 CVE-2025-39759 CVE-2025-39765 CVE-2025-39766                      CVE-2025-39767 CVE-2025-39770 CVE-2025-39772 CVE-2025-39773                      CVE-2025-39776 CVE-2025-39779 CVE-2025-39780 CVE-2025-39781                      CVE-2025-39782 CVE-2025-39783 CVE-2025-39787 CVE-2025-39788                      CVE-2025-39790 CVE-2025-39791 CVE-2025-39800 CVE-2025-39801                      CVE-2025-39805 CVE-2025-39806 CVE-2025-39807 CVE-2025-39808                      CVE-2025-39810 CVE-2025-39811 CVE-2025-39812 CVE-2025-39813                      CVE-2025-39815 CVE-2025-39817 CVE-2025-39819 CVE-2025-39823                      CVE-2025-39824 CVE-2025-39825 CVE-2025-39826 CVE-2025-39827                      CVE-2025-39828 CVE-2025-39829 CVE-2025-39831 CVE-2025-39832                      CVE-2025-39835 CVE-2025-39836 CVE-2025-39838 CVE-2025-39839                      CVE-2025-39841 CVE-2025-39842 CVE-2025-39843 CVE-2025-39844                      CVE-2025-39845 CVE-2025-39846 CVE-2025-39847 CVE-2025-39848                      CVE-2025-39849 CVE-2025-39850 CVE-2025-39851 CVE-2025-39852                      CVE-2025-39853 CVE-2025-39854 CVE-2025-39857 CVE-2025-39860                      CVE-2025-39861 CVE-2025-39863 CVE-2025-39864 CVE-2025-39865                      CVE-2025-39866 CVE-2025-40300

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (trixie), these problems have been fixed in     version 6.12.48-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6009 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6009-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     September 22, 2025                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2024-47704 CVE-2024-57924 CVE-2024-58240 CVE-2025-23143                      CVE-2025-23160 CVE-2025-37931 CVE-2025-37968 CVE-2025-38322                      CVE-2025-38347 CVE-2025-38491 CVE-2025-38502 CVE-2025-38552                      CVE-2025-38614 CVE-2025-38670 CVE-2025-38676 CVE-2025-38677                      CVE-2025-38679 CVE-2025-38680 CVE-2025-38681 CVE-2025-38683                      CVE-2025-38684 CVE-2025-38685 CVE-2025-38687 CVE-2025-38691                      CVE-2025-38693 CVE-2025-38694 CVE-2025-38695 CVE-2025-38696                      CVE-2025-38697 CVE-2025-38698 CVE-2025-38699 CVE-2025-38700                      CVE-2025-38701 CVE-2025-38702 CVE-2025-38706 CVE-2025-38707                      CVE-2025-38708 CVE-2025-38711 CVE-2025-38712 CVE-2025-38713                      CVE-2025-38714 CVE-2025-38715 CVE-2025-38721 CVE-2025-38723                      CVE-2025-38724 CVE-2025-38725 CVE-2025-38727 CVE-2025-38728                      CVE-2025-38729 CVE-2025-38732 CVE-2025-38735 CVE-2025-38736                      CVE-2025-39673 CVE-2025-39675 CVE-2025-39676 CVE-2025-39681                      CVE-2025-39682 CVE-2025-39683 CVE-2025-39684 CVE-2025-39685                      CVE-2025-39686 CVE-2025-39687 CVE-2025-39689 CVE-2025-39691                      CVE-2025-39692 CVE-2025-39693 CVE-2025-39694 CVE-2025-39697                      CVE-2025-39701 CVE-2025-39702 CVE-2025-39703 CVE-2025-39706                      CVE-2025-39709 CVE-2025-39710 CVE-2025-39713 CVE-2025-39714                      CVE-2025-39715 CVE-2025-39716 CVE-2025-39718 CVE-2025-39719                      CVE-2025-39724 CVE-2025-39736 CVE-2025-39737 CVE-2025-39738                      CVE-2025-39742 CVE-2025-39743 CVE-2025-39749 CVE-2025-39751                      CVE-2025-39752 CVE-2025-39756 CVE-2025-39757 CVE-2025-39759                      CVE-2025-39760 CVE-2025-39766 CVE-2025-39770 CVE-2025-39772                      CVE-2025-39773 CVE-2025-39776 CVE-2025-39782 CVE-2025-39783                      CVE-2025-39787 CVE-2025-39788 CVE-2025-39790 CVE-2025-39794                      CVE-2025-39795 CVE-2025-39798 CVE-2025-39800 CVE-2025-39801                      CVE-2025-39806 CVE-2025-39808 CVE-2025-39812 CVE-2025-39813                      CVE-2025-39817 CVE-2025-39819 CVE-2025-39823 CVE-2025-39824                      CVE-2025-39825 CVE-2025-39826 CVE-2025-39827 CVE-2025-39828                      CVE-2025-39835 CVE-2025-39838 CVE-2025-39839 CVE-2025-39841                      CVE-2025-39842 CVE-2025-39843 CVE-2025-39844 CVE-2025-39845                      CVE-2025-39846 CVE-2025-39847 CVE-2025-39848 CVE-2025-39849                      CVE-2025-39853 CVE-2025-39857 CVE-2025-39860 CVE-2025-39864                      CVE-2025-39865 CVE-2025-39866 CVE-2025-40300

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 6.1.153-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion. The     issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)[n].lock, but     when enabled CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare, and try to hold the     per_cpu(hrtimer_bases)[n].lock. Avoid deadlock caused by implicitly waking up kswapd by passing in     allocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the debug_objects_fill_pool() case. Inside     stack depot they are processed by gfp_nested_mask(). Since ___slab_alloc() has preemption disabled, we     mask out __GFP_DIRECT_RECLAIM from the flags there. The oops looks something like: BUG: spinlock recursion     on CPU#3, swapper/3/0 lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3     Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT) Call trace: spin_bug+0x0
    _raw_spin_lock_irqsave+0x80 hrtimer_try_to_cancel+0x94 task_contending+0x10c enqueue_dl_entity+0x2a4     dl_server_start+0x74 enqueue_task_fair+0x568 enqueue_task+0xac do_activate_task+0x14c     ttwu_do_activate+0xcc try_to_wake_up+0x6c8 default_wake_function+0x20 autoremove_wake_function+0x1c
    __wake_up+0xac wakeup_kswapd+0x19c wake_all_kswapds+0x78 __alloc_pages_slowpath+0x1ac
    __alloc_pages_noprof+0x298 stack_depot_save_flags+0x6b0 stack_depot_save+0x14 set_track_prepare+0x5c
    ___slab_alloc+0xccc __kmalloc_cache_noprof+0x470 __set_page_owner+0x2bc post_alloc_hook[jt]+0x1b8     prep_new_page+0x28 get_page_from_freelist+0x1edc __alloc_pages_noprof+0x13c alloc_slab_page+0x244     allocate_slab+0x7c ___slab_alloc+0x8e8 kmem_cache_alloc_noprof+0x450 debug_objects_fill_pool+0x22c     debug_object_activate+0x40 enqueue_hrtimer[jt]+0xdc hrtimer_start_range_ns+0x5f8 ... (CVE-2025-39843)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
291602	AlmaLinux 10 : kernel (ALSA-2026:0453)	Nessus	Alma Linux Local Security Checks	high
291297	RockyLinux 10 : kernel (RLSA-2026:0453)	Nessus	Rocky Linux Local Security Checks	high
283499	RHEL 10 : kernel (RHSA-2026:0453)	Nessus	Red Hat Local Security Checks	high
283189	MiracleLinux 9 : kernel-5.14.0-611.9.1.el9_7 (AXSA:2025-11506:95)	Nessus	Miracle Linux Local Security Checks	high
282630	Oracle Linux 10 : kernel (ELSA-2026-0453)	Nessus	Oracle Linux Local Security Checks	high
282419	RHEL 10 : kernel (RHSA-2026:0271)	Nessus	Red Hat Local Security Checks	medium
279502	RHEL 9 : kernel (RHSA-2025:23789)	Nessus	Red Hat Local Security Checks	medium
278721	CentOS 9 : kernel-5.14.0-651.el9	Nessus	CentOS Local Security Checks	medium
277331	Oracle Linux 9 : kernel (ELSA-2025-21926)	Nessus	Oracle Linux Local Security Checks	medium
277304	AlmaLinux 9 : kernel (ALSA-2025:21926)	Nessus	Alma Linux Local Security Checks	medium
277153	RockyLinux 9 : kernel (RLSA-2025:21926)	Nessus	Rocky Linux Local Security Checks	medium
276625	RHEL 9 : kernel (RHSA-2025:21926)	Nessus	Red Hat Local Security Checks	medium
274584	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2025-25754)	Nessus	Oracle Linux Local Security Checks	high
270134	Debian dla-4328 : linux-config-6.1 - security update	Nessus	Debian Local Security Checks	high
266289	Photon OS 5.0: Linux PHSA-2025-5.0-0630	Nessus	PhotonOS Local Security Checks	high
266176	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2025-1208)	Nessus	Amazon Linux Local Security Checks	high
266148	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1210)	Nessus	Amazon Linux Local Security Checks	medium
265710	Debian dsa-6008 : ata-modules-6.12.31-armmp-di - security update	Nessus	Debian Local Security Checks	high
265709	Debian dsa-6009 : affs-modules-6.1.0-37-4kc-malta-di - security update	Nessus	Debian Local Security Checks	medium
265483	Linux Distros Unpatched Vulnerability : CVE-2025-39843	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-39843

medium

Tenable Plugins

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

high

high

high

high

medium

high

medium

medium