In the Linux kernel, the following vulnerability has been resolved: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() BUG: kernel NULL pointer dereference, address: 00000000000002ec PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 28 UID: 0 PID: 343 Comm: kworker/28:1 Kdump: loaded Tainted: G OE 6.17.0-rc2+ #9 NONE Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Workqueue: smc_hs_wq smc_listen_work [smc] RIP: 0010:smc_ib_is_sg_need_sync+0x9e/0xd0 [smc] ... Call Trace: <TASK> smcr_buf_map_link+0x211/0x2a0 [smc] __smc_buf_create+0x522/0x970 [smc] smc_buf_create+0x3a/0x110 [smc] smc_find_rdma_v2_device_serv+0x18f/0x240 [smc] ? smc_vlan_by_tcpsk+0x7e/0xe0 [smc] smc_listen_find_device+0x1dd/0x2b0 [smc] smc_listen_work+0x30f/0x580 [smc] process_one_work+0x18c/0x340 worker_thread+0x242/0x360 kthread+0xe7/0x220 ret_from_fork+0x13a/0x160 ret_from_fork_asm+0x1a/0x30 </TASK> If the software RoCE device is used, ibdev->dma_device is a null pointer. As a result, the problem occurs. Null pointer detection is added to prevent problems.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6008 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6008-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     September 22, 2025                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2025-21751 CVE-2025-22103 CVE-2025-22113 CVE-2025-22124                      CVE-2025-22125 CVE-2025-23133 CVE-2025-38272 CVE-2025-38306                      CVE-2025-38453 CVE-2025-38502 CVE-2025-38556 CVE-2025-38676                      CVE-2025-38677 CVE-2025-38730 CVE-2025-38732 CVE-2025-38733                      CVE-2025-38734 CVE-2025-38735 CVE-2025-38736 CVE-2025-38737                      CVE-2025-39673 CVE-2025-39675 CVE-2025-39676 CVE-2025-39679                      CVE-2025-39681 CVE-2025-39682 CVE-2025-39683 CVE-2025-39684                      CVE-2025-39685 CVE-2025-39686 CVE-2025-39687 CVE-2025-39689                      CVE-2025-39691 CVE-2025-39692 CVE-2025-39693 CVE-2025-39694                      CVE-2025-39695 CVE-2025-39697 CVE-2025-39698 CVE-2025-39700                      CVE-2025-39701 CVE-2025-39702 CVE-2025-39703 CVE-2025-39705                      CVE-2025-39706 CVE-2025-39707 CVE-2025-39709 CVE-2025-39710                      CVE-2025-39711 CVE-2025-39712 CVE-2025-39713 CVE-2025-39714                      CVE-2025-39715 CVE-2025-39716 CVE-2025-39718 CVE-2025-39719                      CVE-2025-39720 CVE-2025-39721 CVE-2025-39722 CVE-2025-39723                      CVE-2025-39724 CVE-2025-39759 CVE-2025-39765 CVE-2025-39766                      CVE-2025-39767 CVE-2025-39770 CVE-2025-39772 CVE-2025-39773                      CVE-2025-39776 CVE-2025-39779 CVE-2025-39780 CVE-2025-39781                      CVE-2025-39782 CVE-2025-39783 CVE-2025-39787 CVE-2025-39788                      CVE-2025-39790 CVE-2025-39791 CVE-2025-39800 CVE-2025-39801                      CVE-2025-39805 CVE-2025-39806 CVE-2025-39807 CVE-2025-39808                      CVE-2025-39810 CVE-2025-39811 CVE-2025-39812 CVE-2025-39813                      CVE-2025-39815 CVE-2025-39817 CVE-2025-39819 CVE-2025-39823                      CVE-2025-39824 CVE-2025-39825 CVE-2025-39826 CVE-2025-39827                      CVE-2025-39828 CVE-2025-39829 CVE-2025-39831 CVE-2025-39832                      CVE-2025-39835 CVE-2025-39836 CVE-2025-39838 CVE-2025-39839                      CVE-2025-39841 CVE-2025-39842 CVE-2025-39843 CVE-2025-39844                      CVE-2025-39845 CVE-2025-39846 CVE-2025-39847 CVE-2025-39848                      CVE-2025-39849 CVE-2025-39850 CVE-2025-39851 CVE-2025-39852                      CVE-2025-39853 CVE-2025-39854 CVE-2025-39857 CVE-2025-39860                      CVE-2025-39861 CVE-2025-39863 CVE-2025-39864 CVE-2025-39865                      CVE-2025-39866 CVE-2025-40300

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (trixie), these problems have been fixed in     version 6.12.48-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6009 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6009-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     September 22, 2025                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2024-47704 CVE-2024-57924 CVE-2024-58240 CVE-2025-23143                      CVE-2025-23160 CVE-2025-37931 CVE-2025-37968 CVE-2025-38322                      CVE-2025-38347 CVE-2025-38491 CVE-2025-38502 CVE-2025-38552                      CVE-2025-38614 CVE-2025-38670 CVE-2025-38676 CVE-2025-38677                      CVE-2025-38679 CVE-2025-38680 CVE-2025-38681 CVE-2025-38683                      CVE-2025-38684 CVE-2025-38685 CVE-2025-38687 CVE-2025-38691                      CVE-2025-38693 CVE-2025-38694 CVE-2025-38695 CVE-2025-38696                      CVE-2025-38697 CVE-2025-38698 CVE-2025-38699 CVE-2025-38700                      CVE-2025-38701 CVE-2025-38702 CVE-2025-38706 CVE-2025-38707                      CVE-2025-38708 CVE-2025-38711 CVE-2025-38712 CVE-2025-38713                      CVE-2025-38714 CVE-2025-38715 CVE-2025-38721 CVE-2025-38723                      CVE-2025-38724 CVE-2025-38725 CVE-2025-38727 CVE-2025-38728                      CVE-2025-38729 CVE-2025-38732 CVE-2025-38735 CVE-2025-38736                      CVE-2025-39673 CVE-2025-39675 CVE-2025-39676 CVE-2025-39681                      CVE-2025-39682 CVE-2025-39683 CVE-2025-39684 CVE-2025-39685                      CVE-2025-39686 CVE-2025-39687 CVE-2025-39689 CVE-2025-39691                      CVE-2025-39692 CVE-2025-39693 CVE-2025-39694 CVE-2025-39697                      CVE-2025-39701 CVE-2025-39702 CVE-2025-39703 CVE-2025-39706                      CVE-2025-39709 CVE-2025-39710 CVE-2025-39713 CVE-2025-39714                      CVE-2025-39715 CVE-2025-39716 CVE-2025-39718 CVE-2025-39719                      CVE-2025-39724 CVE-2025-39736 CVE-2025-39737 CVE-2025-39738                      CVE-2025-39742 CVE-2025-39743 CVE-2025-39749 CVE-2025-39751                      CVE-2025-39752 CVE-2025-39756 CVE-2025-39757 CVE-2025-39759                      CVE-2025-39760 CVE-2025-39766 CVE-2025-39770 CVE-2025-39772                      CVE-2025-39773 CVE-2025-39776 CVE-2025-39782 CVE-2025-39783                      CVE-2025-39787 CVE-2025-39788 CVE-2025-39790 CVE-2025-39794                      CVE-2025-39795 CVE-2025-39798 CVE-2025-39800 CVE-2025-39801                      CVE-2025-39806 CVE-2025-39808 CVE-2025-39812 CVE-2025-39813                      CVE-2025-39817 CVE-2025-39819 CVE-2025-39823 CVE-2025-39824                      CVE-2025-39825 CVE-2025-39826 CVE-2025-39827 CVE-2025-39828                      CVE-2025-39835 CVE-2025-39838 CVE-2025-39839 CVE-2025-39841                      CVE-2025-39842 CVE-2025-39843 CVE-2025-39844 CVE-2025-39845                      CVE-2025-39846 CVE-2025-39847 CVE-2025-39848 CVE-2025-39849                      CVE-2025-39853 CVE-2025-39857 CVE-2025-39860 CVE-2025-39864                      CVE-2025-39865 CVE-2025-39866 CVE-2025-40300

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 6.1.153-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: net/smc: fix one NULL pointer     dereference in smc_ib_is_sg_need_sync() BUG: kernel NULL pointer dereference, address: 00000000000002ec     PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 28 UID: 0 PID: 343 Comm: kworker/28:1 Kdump: loaded     Tainted: G OE 6.17.0-rc2+ #9 NONE Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU     Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Workqueue: smc_hs_wq smc_listen_work [smc] RIP:
    0010:smc_ib_is_sg_need_sync+0x9e/0xd0 [smc] ... Call Trace: <TASK> smcr_buf_map_link+0x211/0x2a0 [smc]
    __smc_buf_create+0x522/0x970 [smc] smc_buf_create+0x3a/0x110 [smc]     smc_find_rdma_v2_device_serv+0x18f/0x240 [smc] ? smc_vlan_by_tcpsk+0x7e/0xe0 [smc]     smc_listen_find_device+0x1dd/0x2b0 [smc] smc_listen_work+0x30f/0x580 [smc] process_one_work+0x18c/0x340     worker_thread+0x242/0x360 kthread+0xe7/0x220 ret_from_fork+0x13a/0x160 ret_from_fork_asm+0x1a/0x30 </TASK>     If the software RoCE device is used, ibdev->dma_device is a null pointer. As a result, the problem occurs.
    Null pointer detection is added to prevent problems. (CVE-2025-39857)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
265710	Debian dsa-6008 : ata-modules-6.12.31-armmp-di - security update	Nessus	Debian Local Security Checks	high
265709	Debian dsa-6009 : affs-modules-6.1.0-37-4kc-malta-di - security update	Nessus	Debian Local Security Checks	medium
265456	Linux Distros Unpatched Vulnerability : CVE-2025-39857	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-39857

medium

Tenable Plugins

high

medium

medium