In the Linux kernel, the following vulnerability has been resolved: bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() Currently, calling bpf_map_kmalloc_node() from __bpf_async_init() can cause various locking issues; see the following stack trace (edited for style) as one example: ... [10.011566] do_raw_spin_lock.cold [10.011570] try_to_wake_up (5) double-acquiring the same [10.011575] kick_pool rq_lock, causing a hardlockup [10.011579] __queue_work [10.011582] queue_work_on [10.011585] kernfs_notify [10.011589] cgroup_file_notify [10.011593] try_charge_memcg (4) memcg accounting raises an [10.011597] obj_cgroup_charge_pages MEMCG_MAX event [10.011599] obj_cgroup_charge_account [10.011600] __memcg_slab_post_alloc_hook [10.011603] __kmalloc_node_noprof ... [10.011611] bpf_map_kmalloc_node [10.011612] __bpf_async_init [10.011615] bpf_timer_init (3) BPF calls bpf_timer_init() [10.011617] bpf_prog_xxxxxxxxxxxxxxxx_fcg_runnable [10.011619] bpf__sched_ext_ops_runnable [10.011620] enqueue_task_scx (2) BPF runs with rq_lock held [10.011622] enqueue_task [10.011626] ttwu_do_activate [10.011629] sched_ttwu_pending (1) grabs rq_lock ... The above was reproduced on bpf-next (b338cf849ec8) by modifying ./tools/sched_ext/scx_flatcg.bpf.c to call bpf_timer_init() during ops.runnable(), and hacking the memcg accounting code a bit to make a bpf_timer_init() call more likely to raise an MEMCG_MAX event. We have also run into other similar variants (both internally and on bpf-next), including double-acquiring cgroup_file_kn_lock, the same worker_pool::lock, etc. As suggested by Shakeel, fix this by using __GFP_HIGH instead of GFP_ATOMIC in __bpf_async_init(), so that e.g. if try_charge_memcg() raises an MEMCG_MAX event, we call __memcg_memory_event() with @allow_spinning=false and avoid calling cgroup_file_notify() there. Depends on mm patch "memcg: skip cgroup_file_notify if spinning is not allowed": https://lore.kernel.org/bpf/20250905201606.66198-1-shakeel.butt@linux.dev/ v0 approach s/bpf_map_kmalloc_node/bpf_mem_alloc/ https://lore.kernel.org/bpf/20250905061919.439648-1-yepeilin@google.com/ v1 approach: https://lore.kernel.org/bpf/20250905234547.862249-1-yepeilin@google.com/

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8095-1 advisory.

    Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM).
    An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor     profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege     escalation, or possibly escape a container. (LP: #2143853)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - MIPS architecture;

    - Nios II architecture;

    - PA-RISC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - Sun Sparc architecture;

    - User-Mode Linux (UML);

    - x86 architecture;

    - Xtensa architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Compute Acceleration Framework;

    - ACPI drivers;

    - ATM drivers;

    - Drivers core;

    - Block device driver;

    - Network block device driver;

    - Bluetooth drivers;

    - Bus devices;

    - Hardware random number generator core;

    - Character device driver;

    - Data acquisition framework and drivers;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - Device frequency scaling framework;

    - DMA engine subsystem;

    - ARM SCMI message protocol;

    - EFI core;

    - Intel Stratix 10 firmware drivers;

    - GPU drivers;

    - HID subsystem;

    - CoreSight HW tracing drivers;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Input Device (Miscellaneous) drivers;

    - Input Device (Tablet) drivers;

    - IOMMU subsystem;

    - ISDN/mISDN subsystem;

    - Mailbox framework;

    - Multiple devices driver;

    - Media drivers;

    - Fastrpc Driver;

    - MOST (Media Oriented Systems Transport) drivers;

    - MTD block device drivers;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - Texas Instruments network drivers;

    - Ethernet team driver;

    - NVME drivers;

    - PCI subsystem;

    - PCCARD (PCMCIA/CardBus) bus subsystem;

    - Performance monitor drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - ARM PM domains;

    - PPS (Pulse Per Second) driver;

    - PTP clock framework;

    - PWM drivers;

    - Remote Processor subsystem;

    - S/390 drivers;

    - SCSI subsystem;

    - Texas Instruments SoC drivers;

    - TCM subsystem;

    - Trusted Execution Environment drivers;

    - TTY drivers;

    - Userspace I/O drivers;

    - Cadence USB3 driver;

    - DesignWare USB3 driver;

    - USB Gadget drivers;

    - USB Host Controller drivers;

    - Renesas USBHS Controller drivers;

    - USB Mass Storage drivers;

    - Virtio Host (VHOST) subsystem;

    - Framebuffer layer;

    - Xen hypervisor drivers;

    - AFS file system;

    - BTRFS file system;

    - Ceph distributed file system;

    - File systems infrastructure;

    - EFI Variable file system;

    - exFAT file system;

    - Ext4 file system;

    - F2FS file system;

    - FUSE (File system in Userspace);

    - GFS2 file system;

    - HFS file system;

    - HFS+ file system;

    - HugeTLB file system;

    - JFS file system;

    - KERNFS file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - File system notification infrastructure;

    - NTFS3 file system;

    - OCFS2 file system;

    - OrangeFS file system;

    - Proc file system;

    - Diskquota system;

    - SMB network file system;

    - SquashFS file system;

    - UDF file system;

    - XFS file system;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - BPF subsystem;

    - Mellanox drivers;

    - NFS page cache wrapper;

    - Memory management;

    - Memory Management;

    - Media input infrastructure;

    - Bluetooth subsystem;

    - IP tunnels definitions;

    - Network traffic control;

    - Rose network layer;

    - Network sockets;

    - io_uring subsystem;

    - Control group (cgroup);

    - Kernel crash support code;

    - Kernel futex primitives;

    - PID allocator;

    - Scheduler infrastructure;

    - Syscalls implementation;

    - Timer subsystem;

    - Tracing infrastructure;

    - 9P file system network protocol;

    - Amateur Radio drivers;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - Ceph Core library;

    - Networking core;

    - Devlink API;

    - IPv4 networking;

    - IPv6 networking;

    - MAC80211 subsystem;

    - Multipath TCP;

    - Netfilter;

    - NFC subsystem;

    - Open vSwitch;

    - RF switch subsystem;

    - SCTP protocol;

    - SMC sockets;

    - Sun RPC protocol;

    - TIPC protocol;

    - TLS protocol;

    - VMware vSockets driver;

    - Wireless networking;

    - eXpress Data Path;

    - XFRM subsystem;

    - Integrity Measurement Architecture(IMA) framework;

    - Intel ASoC drivers;

    - QCOM ASoC drivers;

    - USB sound devices; (CVE-2025-21833, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106, CVE-2025-22107,     CVE-2025-22113, CVE-2025-22121, CVE-2025-22124, CVE-2025-22125, CVE-2025-23129, CVE-2025-23130,     CVE-2025-23133, CVE-2025-23143, CVE-2025-37860, CVE-2025-38105, CVE-2025-38502, CVE-2025-38556,     CVE-2025-38627, CVE-2025-38643, CVE-2025-38709, CVE-2025-39678, CVE-2025-39697, CVE-2025-39805,     CVE-2025-39806, CVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811, CVE-2025-39812,     CVE-2025-39813, CVE-2025-39815, CVE-2025-39817, CVE-2025-39819, CVE-2025-39823, CVE-2025-39824,     CVE-2025-39825, CVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829, CVE-2025-39832,     CVE-2025-39835, CVE-2025-39836, CVE-2025-39838, CVE-2025-39839, CVE-2025-39841, CVE-2025-39842,     CVE-2025-39843, CVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847, CVE-2025-39848,     CVE-2025-39849, CVE-2025-39850, CVE-2025-39851, CVE-2025-39852, CVE-2025-39853, CVE-2025-39854,     CVE-2025-39857, CVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864, CVE-2025-39865,     CVE-2025-39866, CVE-2025-39869, CVE-2025-39870, CVE-2025-39871, CVE-2025-39873, CVE-2025-39876,     CVE-2025-39877, CVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885, CVE-2025-39886,     CVE-2025-39891, CVE-2025-39894, CVE-2025-39895, CVE-2025-39897, CVE-2025-39899, CVE-2025-39901,     CVE-2025-39902, CVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913, CVE-2025-39914,     CVE-2025-39916, CVE-2025-39920, CVE-2025-39923, CVE-2025-39927, CVE-2025-39929, CVE-2025-39931,     CVE-2025-39932, CVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940, CVE-2025-39942,     CVE-2025-39943, CVE-2025-39944, CVE-2025-39945, CVE-2025-39947, CVE-2025-39948, CVE-2025-39949,     CVE-2025-39950, CVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955, CVE-2025-39957,     CVE-2025-39961, CVE-2025-39965, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970,     CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978, CVE-2025-39980,     CVE-2025-39981, CVE-2025-39982, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988,     CVE-2025-39991, CVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998,     CVE-2025-40000, CVE-2025-40001, CVE-2025-40006, CVE-2025-40008, CVE-2025-40009, CVE-2025-40010,     CVE-2025-40011, CVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021, CVE-2025-40024,     CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032,     CVE-2025-40033, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038, CVE-2025-40042,     CVE-2025-40043, CVE-2025-40044, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40051,     CVE-2025-40052, CVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057, CVE-2025-40058,     CVE-2025-40059, CVE-2025-40060, CVE-2025-40061, CVE-2025-40062, CVE-2025-40067, CVE-2025-40068,     CVE-2025-40070, CVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079, CVE-2025-40080,     CVE-2025-40081, CVE-2025-40083, CVE-2025-40084, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088,     CVE-2025-40092, CVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096, CVE-2025-40099,     CVE-2025-40100, CVE-2025-40101, CVE-2025-40103, CVE-2025-40104, CVE-2025-40105, CVE-2025-40106,     CVE-2025-40107, CVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115,     CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40123, CVE-2025-40124,     CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134, CVE-2025-40137,     CVE-2025-40140, CVE-2025-40141, CVE-2025-40153, CVE-2025-40154, CVE-2025-40155, CVE-2025-40156,     CVE-2025-40159, CVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167, CVE-2025-40169,     CVE-2025-40171, CVE-2025-40172, CVE-2025-40173, CVE-2025-40176, CVE-2025-40178, CVE-2025-40179,     CVE-2025-40180, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192, CVE-2025-40193,     CVE-2025-40194, CVE-2025-40196, CVE-2025-40198, CVE-2025-40200, CVE-2025-40201, CVE-2025-40204,     CVE-2025-40205, CVE-2025-40206, CVE-2025-40207, CVE-2025-40211, CVE-2025-40218, CVE-2025-40219,     CVE-2025-40220, CVE-2025-40221, CVE-2025-40223, CVE-2025-40226, CVE-2025-40231, CVE-2025-40233,     CVE-2025-40235, CVE-2025-40237, CVE-2025-40238, CVE-2025-40240, CVE-2025-40242, CVE-2025-40243,     CVE-2025-40244, CVE-2025-40245, CVE-2025-40248, CVE-2025-40250, CVE-2025-40251, CVE-2025-40252,     CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261,     CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40266, CVE-2025-40268, CVE-2025-40269,     CVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277, CVE-2025-40278,     CVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283, CVE-2025-40284,     CVE-2025-40285, CVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40292,     CVE-2025-40293, CVE-2025-40294, CVE-2025-40301, CVE-2025-40303, CVE-2025-40304, CVE-2025-40305,     CVE-2025-40306, CVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310, CVE-2025-40311,     CVE-2025-40312, CVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40317, CVE-2025-40318,     CVE-2025-40319, CVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323, CVE-2025-40324,     CVE-2025-40328, CVE-2025-40329, CVE-2025-40331, CVE-2025-40333, CVE-2025-40337, CVE-2025-40339,     CVE-2025-40341, CVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346, CVE-2025-40347,     CVE-2025-40349, CVE-2025-40350, CVE-2025-40351, CVE-2025-40353, CVE-2025-40358, CVE-2025-40360,     CVE-2025-40363, CVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173, CVE-2025-68176,     CVE-2025-68177, CVE-2025-68178, CVE-2025-68179, CVE-2025-68180, CVE-2025-68183, CVE-2025-68184,     CVE-2025-68185, CVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194, CVE-2025-68198,     CVE-2025-68200, CVE-2025-68201, CVE-2025-68204, CVE-2025-68208, CVE-2025-68213, CVE-2025-68214,     CVE-2025-68217, CVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222, CVE-2025-68223,     CVE-2025-68227, CVE-2025-68229, CVE-2025-68231, CVE-2025-68233, CVE-2025-68235, CVE-2025-68237,     CVE-2025-68238, CVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246, CVE-2025-68249,     CVE-2025-68282, CVE-2025-68283, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286, CVE-2025-68287,     CVE-2025-68288, CVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297, CVE-2025-68301,     CVE-2025-68302, CVE-2025-68303, CVE-2025-68305, CVE-2025-68307, CVE-2025-68308, CVE-2025-68310,     CVE-2025-68311, CVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320, CVE-2025-68321,     CVE-2025-68322, CVE-2025-68327, CVE-2025-68328, CVE-2025-68330, CVE-2025-68331, CVE-2025-68339,     CVE-2025-68340, CVE-2025-68342, CVE-2025-68343, CVE-2025-68734)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8100-1 advisory.

    Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM).
    An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor     profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege     escalation, or possibly escape a container. (LP: #2143853)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - MIPS architecture;

    - Nios II architecture;

    - PA-RISC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - Sun Sparc architecture;

    - User-Mode Linux (UML);

    - x86 architecture;

    - Xtensa architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Compute Acceleration Framework;

    - ACPI drivers;

    - ATM drivers;

    - Drivers core;

    - Block device driver;

    - Network block device driver;

    - Bluetooth drivers;

    - Bus devices;

    - Hardware random number generator core;

    - Character device driver;

    - Data acquisition framework and drivers;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - Device frequency scaling framework;

    - DMA engine subsystem;

    - ARM SCMI message protocol;

    - EFI core;

    - Intel Stratix 10 firmware drivers;

    - GPU drivers;

    - HID subsystem;

    - CoreSight HW tracing drivers;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Input Device (Miscellaneous) drivers;

    - Input Device (Tablet) drivers;

    - IOMMU subsystem;

    - ISDN/mISDN subsystem;

    - Mailbox framework;

    - Multiple devices driver;

    - Media drivers;

    - Fastrpc Driver;

    - MOST (Media Oriented Systems Transport) drivers;

    - MTD block device drivers;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - Texas Instruments network drivers;

    - Ethernet team driver;

    - NVME drivers;

    - PCI subsystem;

    - PCCARD (PCMCIA/CardBus) bus subsystem;

    - Performance monitor drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - ARM PM domains;

    - PPS (Pulse Per Second) driver;

    - PTP clock framework;

    - PWM drivers;

    - Remote Processor subsystem;

    - S/390 drivers;

    - SCSI subsystem;

    - Texas Instruments SoC drivers;

    - SPI subsystem;

    - TCM subsystem;

    - Trusted Execution Environment drivers;

    - TTY drivers;

    - Userspace I/O drivers;

    - Cadence USB3 driver;

    - DesignWare USB3 driver;

    - USB Gadget drivers;

    - USB Host Controller drivers;

    - Renesas USBHS Controller drivers;

    - USB Mass Storage drivers;

    - Virtio Host (VHOST) subsystem;

    - Framebuffer layer;

    - Xen hypervisor drivers;

    - AFS file system;

    - BTRFS file system;

    - Ceph distributed file system;

    - File systems infrastructure;

    - EFI Variable file system;

    - exFAT file system;

    - Ext4 file system;

    - F2FS file system;

    - FUSE (File system in Userspace);

    - GFS2 file system;

    - HFS file system;

    - HFS+ file system;

    - HugeTLB file system;

    - JFS file system;

    - KERNFS file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - File system notification infrastructure;

    - NTFS3 file system;

    - OCFS2 file system;

    - OrangeFS file system;

    - Proc file system;

    - Diskquota system;

    - SMB network file system;

    - SquashFS file system;

    - UDF file system;

    - XFS file system;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - BPF subsystem;

    - Mellanox drivers;

    - NFS page cache wrapper;

    - Memory management;

    - Memory Management;

    - Media input infrastructure;

    - Bluetooth subsystem;

    - IP tunnels definitions;

    - Network traffic control;

    - Rose network layer;

    - Network sockets;

    - io_uring subsystem;

    - Control group (cgroup);

    - Kernel crash support code;

    - Kernel futex primitives;

    - PID allocator;

    - Scheduler infrastructure;

    - Syscalls implementation;

    - Timer subsystem;

    - Tracing infrastructure;

    - 9P file system network protocol;

    - Amateur Radio drivers;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - Ceph Core library;

    - Networking core;

    - Devlink API;

    - IPv4 networking;

    - IPv6 networking;

    - MAC80211 subsystem;

    - Multipath TCP;

    - Netfilter;

    - NFC subsystem;

    - Open vSwitch;

    - RF switch subsystem;

    - SCTP protocol;

    - SMC sockets;

    - Sun RPC protocol;

    - TIPC protocol;

    - TLS protocol;

    - VMware vSockets driver;

    - Wireless networking;

    - eXpress Data Path;

    - XFRM subsystem;

    - Integrity Measurement Architecture(IMA) framework;

    - Intel ASoC drivers;

    - QCOM ASoC drivers;

    - USB sound devices; (CVE-2025-21833, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106, CVE-2025-22107,     CVE-2025-22113, CVE-2025-22121, CVE-2025-22124, CVE-2025-22125, CVE-2025-23129, CVE-2025-23130,     CVE-2025-23133, CVE-2025-23143, CVE-2025-37860, CVE-2025-38105, CVE-2025-38502, CVE-2025-38556,     CVE-2025-38627, CVE-2025-38643, CVE-2025-38709, CVE-2025-39678, CVE-2025-39697, CVE-2025-39805,     CVE-2025-39806, CVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811, CVE-2025-39812,     CVE-2025-39813, CVE-2025-39815, CVE-2025-39817, CVE-2025-39819, CVE-2025-39823, CVE-2025-39824,     CVE-2025-39825, CVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829, CVE-2025-39832,     CVE-2025-39835, CVE-2025-39836, CVE-2025-39838, CVE-2025-39839, CVE-2025-39841, CVE-2025-39842,     CVE-2025-39843, CVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847, CVE-2025-39848,     CVE-2025-39849, CVE-2025-39850, CVE-2025-39851, CVE-2025-39852, CVE-2025-39853, CVE-2025-39854,     CVE-2025-39857, CVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864, CVE-2025-39865,     CVE-2025-39866, CVE-2025-39869, CVE-2025-39870, CVE-2025-39871, CVE-2025-39873, CVE-2025-39876,     CVE-2025-39877, CVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885, CVE-2025-39886,     CVE-2025-39891, CVE-2025-39894, CVE-2025-39895, CVE-2025-39897, CVE-2025-39899, CVE-2025-39901,     CVE-2025-39902, CVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913, CVE-2025-39914,     CVE-2025-39916, CVE-2025-39920, CVE-2025-39923, CVE-2025-39927, CVE-2025-39929, CVE-2025-39931,     CVE-2025-39932, CVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940, CVE-2025-39942,     CVE-2025-39943, CVE-2025-39944, CVE-2025-39945, CVE-2025-39947, CVE-2025-39948, CVE-2025-39949,     CVE-2025-39950, CVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955, CVE-2025-39957,     CVE-2025-39961, CVE-2025-39965, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970,     CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978, CVE-2025-39980,     CVE-2025-39981, CVE-2025-39982, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988,     CVE-2025-39991, CVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998,     CVE-2025-40000, CVE-2025-40001, CVE-2025-40006, CVE-2025-40008, CVE-2025-40009, CVE-2025-40010,     CVE-2025-40011, CVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021, CVE-2025-40024,     CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032,     CVE-2025-40033, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038, CVE-2025-40042,     CVE-2025-40043, CVE-2025-40044, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40051,     CVE-2025-40052, CVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057, CVE-2025-40058,     CVE-2025-40059, CVE-2025-40060, CVE-2025-40061, CVE-2025-40062, CVE-2025-40067, CVE-2025-40068,     CVE-2025-40070, CVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079, CVE-2025-40080,     CVE-2025-40081, CVE-2025-40083, CVE-2025-40084, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088,     CVE-2025-40092, CVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096, CVE-2025-40099,     CVE-2025-40100, CVE-2025-40101, CVE-2025-40103, CVE-2025-40104, CVE-2025-40105, CVE-2025-40106,     CVE-2025-40107, CVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115,     CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40123, CVE-2025-40124,     CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134, CVE-2025-40137,     CVE-2025-40140, CVE-2025-40141, CVE-2025-40153, CVE-2025-40154, CVE-2025-40155, CVE-2025-40156,     CVE-2025-40159, CVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167, CVE-2025-40169,     CVE-2025-40171, CVE-2025-40172, CVE-2025-40173, CVE-2025-40176, CVE-2025-40178, CVE-2025-40179,     CVE-2025-40180, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192, CVE-2025-40193,     CVE-2025-40194, CVE-2025-40196, CVE-2025-40198, CVE-2025-40200, CVE-2025-40201, CVE-2025-40204,     CVE-2025-40205, CVE-2025-40206, CVE-2025-40207, CVE-2025-40211, CVE-2025-40218, CVE-2025-40219,     CVE-2025-40220, CVE-2025-40221, CVE-2025-40223, CVE-2025-40226, CVE-2025-40231, CVE-2025-40233,     CVE-2025-40235, CVE-2025-40237, CVE-2025-40238, CVE-2025-40240, CVE-2025-40242, CVE-2025-40243,     CVE-2025-40244, CVE-2025-40245, CVE-2025-40248, CVE-2025-40250, CVE-2025-40251, CVE-2025-40252,     CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261,     CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40266, CVE-2025-40268, CVE-2025-40269,     CVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277, CVE-2025-40278,     CVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283, CVE-2025-40284,     CVE-2025-40285, CVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40292,     CVE-2025-40293, CVE-2025-40294, CVE-2025-40301, CVE-2025-40303, CVE-2025-40304, CVE-2025-40305,     CVE-2025-40306, CVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310, CVE-2025-40311,     CVE-2025-40312, CVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40317, CVE-2025-40318,     CVE-2025-40319, CVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323, CVE-2025-40324,     CVE-2025-40328, CVE-2025-40329, CVE-2025-40331, CVE-2025-40333, CVE-2025-40337, CVE-2025-40339,     CVE-2025-40341, CVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346, CVE-2025-40347,     CVE-2025-40349, CVE-2025-40350, CVE-2025-40351, CVE-2025-40353, CVE-2025-40358, CVE-2025-40360,     CVE-2025-40363, CVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173, CVE-2025-68176,     CVE-2025-68177, CVE-2025-68178, CVE-2025-68179, CVE-2025-68180, CVE-2025-68183, CVE-2025-68184,     CVE-2025-68185, CVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194, CVE-2025-68198,     CVE-2025-68200, CVE-2025-68201, CVE-2025-68204, CVE-2025-68208, CVE-2025-68213, CVE-2025-68214,     CVE-2025-68217, CVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222, CVE-2025-68223,     CVE-2025-68227, CVE-2025-68229, CVE-2025-68231, CVE-2025-68233, CVE-2025-68235, CVE-2025-68237,     CVE-2025-68238, CVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246, CVE-2025-68249,     CVE-2025-68282, CVE-2025-68283, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286, CVE-2025-68287,     CVE-2025-68288, CVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297, CVE-2025-68301,     CVE-2025-68302, CVE-2025-68303, CVE-2025-68305, CVE-2025-68307, CVE-2025-68308, CVE-2025-68310,     CVE-2025-68311, CVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320, CVE-2025-68321,     CVE-2025-68322, CVE-2025-68327, CVE-2025-68328, CVE-2025-68330, CVE-2025-68331, CVE-2025-68339,     CVE-2025-68340, CVE-2025-68342, CVE-2025-68343, CVE-2025-68734, CVE-2026-23202, CVE-2026-23207)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-25754 advisory.

    [6.12.0-105.51.5]
    - RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad)  [Orabug: 38226124]
    - arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska)  [Orabug: 38454705]
    - arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska)  [Orabug: 38454705]
    - arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska)  [Orabug: 38454705]
    - cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska)  [Orabug: 38454705]
    - cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska)  [Orabug: 38454705]
    - arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu)  [Orabug: 38454705]
    - ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams)  [Orabug: 38454705]
    - perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono)  [Orabug: 38454705]
    - perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono)  [Orabug: 38454705]
    - perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono)  [Orabug: 38454705]
    - perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono)  [Orabug: 38454705]
    - cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan)  [Orabug: 38454705]
    - Revert 'sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails' (Joseph Salisbury)     [Orabug: 38498945]
    - uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar)  [Orabug: 38526374]
    - LTS version: v6.12.51 (Jack Vogel)
    - ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
    - wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)
    - mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)
    - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)
    - media: rc: fix races with imon_disconnect() (Larshin Sergey)
    - media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)
    - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)
    - scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)
    - gcc-plugins: Remove TODO_verify_il for GCC >= 16 (Kees Cook)
    - crypto: sha256 - fix crash at kexec (Breno Leitao)
    - LTS version v6.12.50 (Jack Vogel)
    - drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
    - Revert 'usb: xhci: remove option to change a default ring's TRB cycle bit' (Niklas Neronin)
    - iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)
    - fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
    - fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)
    - mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)
    - kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
    - gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
    - fs/proc/task_mmu: check p->vec_buf for NULL (Jakub Acs)
    - afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
    - drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
    - arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
    - arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
    - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
    - tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))
    - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)
    - i40e: improve VF MAC filters accounting (Lukasz Czapnik)
    - i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
    - i40e: add max boundary check for VF filters (Lukasz Czapnik)
    - i40e: fix validation of VF state in get resources (Lukasz Czapnik)
    - i40e: fix input validation logic for action_meta (Lukasz Czapnik)
    - i40e: fix idx validation in config queues msg (Lukasz Czapnik)
    - i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)
    - i40e: add validation for ring_len param (Lukasz Czapnik)
    - HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
    - smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)
    - platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
    - drm/panthor: Defer scheduler entitiy destruction to queue release (Adrian Larumbe)
    - futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)
    - drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)
    - mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
    - mm: revert 'mm/gup: clear the LRU flag of a page before adding to LRU batch' (Hugh Dickins)
    - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
    - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
    - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir     Oltean)
    - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
    - selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
    - nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)
    - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
    - bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
    - vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)
    - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)
    - Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
    - ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
    - net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
    - net: tun: Update napi->skb after XDP process (Wang Liang)
    - can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean)
    - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
    - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
    - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
    - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
    - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)
    - bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
    - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
    - wifi: virt_wifi: Fix page fault on connect (James Guan)
    - btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
    - bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)
    - smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
    - smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
    - cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
    - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
    - arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
    - firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
    - HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
    - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
    - net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
    - ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)
    - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)
    - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)
    - i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)
    - mmc: sdhci-cadence: add Mobileye eyeQ support (Benoit Monin)
    - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
    - net: fec: rename struct fec_devinfo fec_imx6x_info -> fec_imx6sx_info (Marc Kleine-Budde)
    - usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
    - ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
    - ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
    - ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
    - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
    - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
    - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
    - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
    - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
    - ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
    - ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
    - firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
    - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)

    [6.12.0-105.49.4]
    - fs/dax: don't disassociate zero page entries (Alistair Popple)  [Orabug: 36859857]
    - device/dax: properly refcount device dax pages when mapping (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: properly refcount fs dax pages (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: Fix 'don't skip locked entries when scanning entries' (Alistair Popple)  [Orabug: 36859857]
    - mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle))  [Orabug: 36859857]
    - dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams)  [Orabug: 36859857]
    - mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple)  [Orabug: 36859857]
    - mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple)  [Orabug: 36859857]
    - mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple)  [Orabug: 36859857]
    - mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple)  [Orabug: 36859857]
    - mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple)  [Orabug: 36859857]
    - mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple)  [Orabug:
    36859857]
    - mm: allow compound zone device pages (Alistair Popple)  [Orabug: 36859857]
    - mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple)  [Orabug: 36859857]
    - mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple)  [Orabug: 36859857]
    - dax: use folios more widely within DAX (Matthew Wilcox (Oracle))  [Orabug: 36859857]
    - dax: remove access to page->index (Matthew Wilcox (Oracle))  [Orabug: 36859857]
    - fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple)  [Orabug: 36859857]
    - mm: optimize invalidation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
    - mm: optimize truncation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
    - fs/dax: create a common implementation to break DAX layouts (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: refactor wait for dax idle page (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: don't skip locked entries when scanning entries (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple)  [Orabug:
    36859857]
    - uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi)  [Orabug: 38459242]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1227 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    bridge: mcast: Fix use-after-free during router port configuration (CVE-2025-38248)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Fix backlog accounting in qdisc_dequeue_internal (CVE-2025-39677)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (CVE-2025-39830)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/sysfs: fix use-after-free in state_show() (CVE-2025-39877)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: fix invalid accesses to ceph_connection_v1_info (CVE-2025-39880)

    In the Linux kernel, the following vulnerability has been resolved:

    kernfs: Fix UAF in polling when open file is released (CVE-2025-39881)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CVE-2025-39883)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix subvolume deletion lockup caused by inodes xarray race (CVE-2025-39884)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (CVE-2025-39886)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (CVE-2025-39909)

    In the Linux kernel, the following vulnerability has been resolved:

    nfs/localio: restore creds before releasing pageio data (CVE-2025-39912)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. (CVE-2025-39913)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Silence warning when chunk allocation fails in trace_pid_write (CVE-2025-39914)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (CVE-2025-39916)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (CVE-2025-39917)

    In the Linux kernel, the following vulnerability has been resolved:

    genetlink: fix genl_bind() invoking bind() after -EPERM (CVE-2025-39926)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix race condition validating r_parent before applying state (CVE-2025-39927)

    In the Linux kernel, the following vulnerability has been resolved:x86/vmscape: Add conditional IBPB     mitigation

    VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a     userspace hypervisor (like QEMU). Existing mitigations already protect kernel/KVM from a malicious guest.
    Userspace can additionally be protected by flushing the branch predictors after a VMexit.

    Since it is the userspace that consumes the poisoned branch predictors, conditionally issue an IBPB after     a VMexit and before returning to userspace. Workloads that frequently switch between hypervisor and     userspace will incur the most overhead from the new IBPB.

    This new IBPB is not integrated with the existing IBPB sites. For instance, a task can use the existing     speculation control prctl() to get an IBPB at context switch time. With this implementation, the IBPB is     doubled up: one at context switch and another before running userspace. The intent is to integrate and     optimize these cases post-embargo.[ dhansen: elaborate on suboptimal IBPB solution ] (CVE-2025-40300)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() Currently, calling     bpf_map_kmalloc_node() from __bpf_async_init() can cause various locking issues; see the following stack     trace (edited for style) as one example: ... [10.011566] do_raw_spin_lock.cold [10.011570] try_to_wake_up     (5) double-acquiring the same [10.011575] kick_pool rq_lock, causing a hardlockup [10.011579] __queue_work     [10.011582] queue_work_on [10.011585] kernfs_notify [10.011589] cgroup_file_notify [10.011593]     try_charge_memcg (4) memcg accounting raises an [10.011597] obj_cgroup_charge_pages MEMCG_MAX event     [10.011599] obj_cgroup_charge_account [10.011600] __memcg_slab_post_alloc_hook [10.011603]
    __kmalloc_node_noprof ... [10.011611] bpf_map_kmalloc_node [10.011612] __bpf_async_init [10.011615]     bpf_timer_init (3) BPF calls bpf_timer_init() [10.011617] bpf_prog_xxxxxxxxxxxxxxxx_fcg_runnable     [10.011619] bpf__sched_ext_ops_runnable [10.011620] enqueue_task_scx (2) BPF runs with rq_lock held     [10.011622] enqueue_task [10.011626] ttwu_do_activate [10.011629] sched_ttwu_pending (1) grabs rq_lock ...
    The above was reproduced on bpf-next (b338cf849ec8) by modifying ./tools/sched_ext/scx_flatcg.bpf.c to     call bpf_timer_init() during ops.runnable(), and hacking the memcg accounting code a bit to make a     bpf_timer_init() call more likely to raise an MEMCG_MAX event. We have also run into other similar     variants (both internally and on bpf-next), including double-acquiring cgroup_file_kn_lock, the same     worker_pool::lock, etc. As suggested by Shakeel, fix this by using __GFP_HIGH instead of GFP_ATOMIC in
    __bpf_async_init(), so that e.g. if try_charge_memcg() raises an MEMCG_MAX event, we call
    __memcg_memory_event() with @allow_spinning=false and avoid calling cgroup_file_notify() there. Depends on     mm patch memcg: skip cgroup_file_notify if spinning is not allowed:
    https://lore.kernel.org/bpf/20250905201606.66198-1-shakeel.butt@linux.dev/ v0 approach     s/bpf_map_kmalloc_node/bpf_mem_alloc/     https://lore.kernel.org/bpf/20250905061919.439648-1-yepeilin@google.com/ v1 approach:
    https://lore.kernel.org/bpf/20250905234547.862249-1-yepeilin@google.com/ (CVE-2025-39886)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
302764	Ubuntu 22.04 LTS / 24.04 LTS : Linux kernel vulnerabilities (USN-8095-1)	Nessus	Ubuntu Local Security Checks	high
302763	Ubuntu 22.04 LTS / 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8100-1)	Nessus	Ubuntu Local Security Checks	high
274584	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2025-25754)	Nessus	Oracle Linux Local Security Checks	high
271775	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2025-1227)	Nessus	Amazon Linux Local Security Checks	high
265877	Linux Distros Unpatched Vulnerability : CVE-2025-39886	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-39886

medium

Tenable Plugins

high

high

high

high

medium