In the Linux kernel, the following vulnerability has been resolved: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y syzbot reported a WARNING in est_timer() [1] Problem here is that with CONFIG_PREEMPT_RT=y, timer callbacks can be preempted. Adopt preempt_disable_nested()/preempt_enable_nested() to fix this. [1] WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 __seqprop_assert include/linux/seqlock.h:221 [inline] WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 est_timer+0x6dc/0x9f0 net/core/gen_estimator.c:93 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:__seqprop_assert include/linux/seqlock.h:221 [inline] RIP: 0010:est_timer+0x6dc/0x9f0 net/core/gen_estimator.c:93 Call Trace: <TASK> call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1798 [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x648/0x970 kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403 handle_softirqs+0x22c/0x710 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] run_ktimerd+0xcf/0x190 kernel/softirq.c:1043 smpboot_thread_fn+0x53f/0xa60 kernel/smpboot.c:160 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK>

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4057-1 advisory.

    The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
    - CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).
    - CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).
    - CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al     (bsc#1248630).
    - CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).
    - CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated     (bsc#1249182).
    - CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
    - CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).
    - CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).
    - CVE-2025-39683: tracing: Limit access to parser->buffer when trace_get_user failed (bsc#1249286).
    - CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).
    - CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).
    - CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).
    - CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).
    - CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
    - CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).
    - CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).
    - CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).
    - CVE-2025-39832: net/mlx5: Add sync reset drop mode support (bsc#1249901).
    - CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
    - CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
    - CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).
    - CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
    - CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
    - CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).
    - CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).
    - CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).
    - CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).
    - CVE-2025-39898: e1000e: fix heap overflow in e1000_set_eeprom (bsc#1250742).
    - CVE-2025-39900: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (bsc#1250758).
    - CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).
    - CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).
    - CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
    - CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).
    - CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).
    - CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).
    - CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).
    - CVE-2025-39955: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (bsc#1251804).
    - CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
    - CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).
    - CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).
    - CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052).
    - CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).
    - CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
    - CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).
    - CVE-2025-39984: net: tun: Update napi->skb after XDP process (bsc#1252081).
    - CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062).
    - CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349).
    - CVE-2025-40012: net/smc: fix warning in smc_rx_splice() when calling get_page() (bsc#1252330).
    - CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
    - CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858).
    - CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826).
    - CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848).
    - CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).
    - CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree     (bsc#1252918).

    The following non security issues were fixed:

    - ACPI/processor_idle: Add FFH state handling (jsc#PED-13815).
    - ACPI/processor_idle: Export acpi_processor_ffh_play_dead() (jsc#PED-13815).
    - ACPI: battery: Add synchronization between interface updates (git-fixes).
    - ACPI: processor: Rescan 'dead' SMT siblings during initialization (jsc#PED-13815).
    - KVM: PPC: Fix misleading interrupts comment in kvmppc_prepare_to_enter() (bsc#1215199).
    - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() (git-fixes).
    - KVM: x86: Process 'guest stopped request' once per guest time update (git-fixes).
    - PM: hibernate: Add pm_hibernation_mode_is_suspend() (bsc#1243112).
    - PM: hibernate: Add stub for pm_hibernate_is_recovering() (bsc#1243112).
    - PM: hibernate: Fix pm_hibernation_mode_is_suspend() build breakage (bsc#1243112).
    - PM: hibernate: add new api pm_hibernate_is_recovering() (bsc#1243112).
    - bpf: Allow helper bpf_get_[ns_]current_pid_tgid() for all prog types (bsc#1252364).
    - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (stable-fixes git-fixes).
    - cpuidle: Do not return from cpuidle_play_dead() on callback failures (jsc#PED-13815).
    - dpll: Make ZL3073X invisible (bsc#1252253).
    - dpll: zl3073x: Add firmware loading functionality (bsc#1252253).
    - dpll: zl3073x: Add functions to access hardware registers (bsc#1252253).
    - dpll: zl3073x: Add low-level flash functions (bsc#1252253).
    - dpll: zl3073x: Add support to get fractional frequency offset (bsc#1252253).
    - dpll: zl3073x: Add support to get phase offset on connected input pin (bsc#1252253).
    - dpll: zl3073x: Add support to get/set esync on pins (bsc#1252253).
    - dpll: zl3073x: Fix build failure (bsc#1252253).
    - dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() (bsc#1252253).
    - dpll: zl3073x: Handle missing or corrupted flash configuration (bsc#1252253).
    - dpll: zl3073x: Implement devlink flash callback (bsc#1252253).
    - dpll: zl3073x: Increase maximum size of flash utility (bsc#1252253).
    - dpll: zl3073x: Refactor DPLL initialization (bsc#1252253).
    - dpll: zl3073x: ZL3073X_I2C and ZL3073X_SPI should depend on NET (bsc#1252253).
    - drm/amd : Update MES API header file for v11 & v12 (stable-fixes).
    - drm/amd/amdgpu: Implement MES suspend/resume gang functionality for v12 (bsc#1243112).
    - drm/amd/display: Add NULL check for stream before dereference in 'dm_vupdate_high_irq' (bsc#1243112).
    - drm/amd/display: Enable Dynamic DTBCLK Switch (bsc#1243112).
    - drm/amd/display: Fix vupdate_offload_work doc (bsc#1243112).
    - drm/amd/display: fix dmub access race condition (bsc#1243112).
    - drm/amd/display: more liberal vmin/vmax update for freesync (bsc#1243112).
    - drm/amd/include : MES v11 and v12 API header update (stable-fixes).
    - drm/amd/include : Update MES v12 API for fence update (stable-fixes).
    - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes).
    - drm/amd: Avoid evicting resources at S5 (bsc#1243112).
    - drm/amd: Check whether secure display TA loaded successfully (bsc#1243112).
    - drm/amd: Fix hybrid sleep (bsc#1243112).
    - drm/amd: Only restore cached manual clock settings in restore if OD enabled (bsc#1243112).
    - drm/amd: Restore cached manual clock settings during resume (bsc#1243112).
    - drm/amdgpu/mes11: implement detect and reset callback (bsc#1243112).
    - drm/amdgpu/mes12: implement detect and reset callback (bsc#1243112).
    - drm/amdgpu/mes: add front end for detect and reset hung queue (bsc#1243112).
    - drm/amdgpu/vpe: cancel delayed work in hw_fini (bsc#1243112).
    - drm/amdgpu: Avoid rma causes GPU duplicate reset (bsc#1243112).
    - drm/amdgpu: Fix for GPU reset being blocked by KIQ I/O (bsc#1243112).
    - drm/amdgpu: Report individual reset error (bsc#1243112).
    - drm/amdgpu: do not resume device in thaw for normal hibernation (bsc#1243112).
    - drm/amdgpu: fix link error for !PM_SLEEP (bsc#1243112).
    - drm/amdkfd: Fix mmap write lock not release (bsc#1243112).
    - drm/xe/guc: Prepare GuC register list and update ADS size for error capture (stable-fixes).
    - ext4: fix checks for orphan inodes (bsc#1250119).
    - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (git-fixes).
    - intel_idle: Provide the default enter_dead() handler (jsc#PED-13815).
    - intel_idle: Rescan 'dead' SMT siblings during initialization (jsc#PED-13815).
    - intel_idle: Use subsys_initcall_sync() for initialization (jsc#PED-13815).
    - ixgbe: handle IXGBE_VF_FEATURES_NEGOTIATE mbox cmd (bsc#1247222).
    - ixgbe: handle IXGBE_VF_GET_PF_LINK_STATE mailbox operation (bsc#1247222).
    - ixgbevf: fix getting link speed data for E610 devices (bsc#1247222).
    - ixgbevf: fix mailbox API compatibility by negotiating supported features (bsc#1247222).
    - kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939).
    - net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency     (bsc#1248754).
    - netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237).
    - nvme-auth: update bi_directional flag (git-fixes bsc#1249735).
    - nvme-auth: update sc_c in host response (git-fixes bsc#1249397).
    - nvme-fc: use lock accessing port_state and rport state (bsc#1245193 bsc#1247500).
    - nvme-tcp: send only permitted commands for secure concat (git-fixes bsc#1247683).
    - nvmet-fc: avoid scheduling association deletion twice (bsc#1245193 bsc#1247500).
    - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (bsc#1245193 bsc#1247500).
    - nvmet-fcloop: call done callback even when remote port is gone (bsc#1245193 bsc#1247500).
    - perf/x86/intel: Allow to update user space GPRs from PEBS records (git-fixes).
    - perf/x86/intel: Fix crash in icl_update_topdown_event() (git-fixes).
    - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes).
    - platform/x86/amd/pmc: Add 1Ah family series to STB support list (bsc#1243112).
    - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (bsc#1243112).
    - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (bsc#1243112).
    - platform/x86/amd/pmc: Add VPE information for AMDI000A platform (bsc#1243112).
    - platform/x86/amd/pmc: Add idlemask support for 1Ah family (bsc#1243112).
    - platform/x86/amd/pmc: Extend support for PMC features on new AMD platform (bsc#1243112).
    - platform/x86/amd/pmc: Fix SMU command submission path on new AMD platform (bsc#1243112).
    - platform/x86/amd/pmc: Modify SMU message port for latest AMD platform (bsc#1243112).
    - platform/x86/amd/pmc: Notify user when platform does not support s0ix transition (bsc#1243112).
    - platform/x86/amd/pmc: Remove unnecessary line breaks (bsc#1243112).
    - platform/x86/amd/pmc: Send OS_HINT command for AMDI000A platform (bsc#1243112).
    - platform/x86/amd/pmc: Send OS_HINT command for new AMD platform (bsc#1243112).
    - platform/x86/amd/pmc: Update IP information structure for newer SoCs (bsc#1243112).
    - platform/x86/amd/pmc: Use ARRAY_SIZE() to fill num_ips information (bsc#1243112).
    - platform/x86/amd/pmc: call amd_pmc_get_ip_info() during driver probe (bsc#1243112).
    - platform/x86/amd: pmc: Add new ACPI ID AMDI000B (bsc#1243112).
    - platform/x86/amd: pmc: Drop SMU F/W match for Cezanne (bsc#1243112).
    - platform/x86/amd: pmc: Use guard(mutex) (bsc#1243112).
    - powerpc/boot: Fix build with gcc 15 (bsc#1215199).
    - powerpc/fadump: skip parameter area allocation when fadump is disabled (jsc#PED-9891 git-fixes).
    - powerpc/kvm: Fix ifdef to remove build warning (bsc#1215199).
    - powerpc/powernv/pci: Fix underflow and leak issue (bsc#1215199).
    - powerpc/pseries/msi: Fix potential underflow and leak issue (bsc#1215199).
    - powerpc: floppy: Add missing checks after DMA map (bsc#1215199).
    - proc: fix missing pde_set_flags() for net proc files (bsc#1248630)
    - proc: fix type confusion in pde_set_flags() (bsc#1248630)
    - sched/idle: Conditionally handle tick broadcast in default_idle_call() (bsc#1248517).
    - scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (bsc#1250519).
    - scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (bsc#1250519).
    - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (bsc#1250519).
    - scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (bsc#1250519).
    - scsi: lpfc: Copyright updates for 14.4.0.11 patches (bsc#1250519).
    - scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (bsc#1250519).
    - scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (bsc#1250519).
    - scsi: lpfc: Fix buffer free/clear order in deferred receive path (bsc#1250519).
    - scsi: lpfc: Fix wrong function reference in a comment (bsc#1250519).
    - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (bsc#1250519).
    - scsi: lpfc: Remove redundant assignment to avoid memory leak (bsc#1250519).
    - scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (bsc#1250519).
    - scsi: lpfc: Update lpfc version to 14.4.0.11 (bsc#1250519).
    - scsi: lpfc: Use int type to store negative error codes (bsc#1250519).
    - scsi: lpfc: use min() to improve code (bsc#1250519).
    - serial: sc16is7xx: rename Kconfig CONFIG_SERIAL_SC16IS7XX_CORE (bsc#1252469) Re-enable     CONFIG_SERIAL_SC16IS7X for aarch64 and x86_64 default configurations, but keep it disabled for kvmsmall     configurations. For ppc64 and s390x drivers was not enabled, so keep it that way. Add sc16is7xx_spi and     sc16is7xx_i2c drivers to supported list.
    - skmsg: Return copied bytes in sk_msg_memcopy_from_iter (bsc#1250650).
    - smb: client: fix crypto buffers in non-linear memory (bsc#1250491, bsc#1239206).
    - smb: client: fix potential cfid UAF in smb2_query_info_compound (bsc#1248886).
    - tcp_bpf: Fix copied value in tcp_bpf_sendmsg (bsc#1250650).
    - tracing: Remove unneeded goto out logic (bsc#1249286).
    - x86/idle: Sanitize X86_BUG_AMD_E400 handling (bsc#1248517).
    - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID     (bsc#1252734).
    - x86/resctrl: Refactor resctrl_arch_rmid_read() (bsc#1252734).
    - x86/smp: Allow calling mwait_play_dead with an arbitrary hint (jsc#PED-13815).
    - x86/smp: Fix mwait_play_dead() and acpi_processor_ffh_play_dead() noreturn behavior (jsc#PED-13815).
    - x86/smp: PM/hibernate: Split arch_resume_nosmt() (jsc#PED-13815).
    - x86/topology: Implement topology_is_core_online() to address SMT regression (jsc#PED-13815).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-25754 advisory.

    [6.12.0-105.51.5]
    - RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad)  [Orabug: 38226124]
    - arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska)  [Orabug: 38454705]
    - arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska)  [Orabug: 38454705]
    - arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska)  [Orabug: 38454705]
    - cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska)  [Orabug: 38454705]
    - cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska)  [Orabug: 38454705]
    - arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu)  [Orabug: 38454705]
    - ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams)  [Orabug: 38454705]
    - perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono)  [Orabug: 38454705]
    - perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono)  [Orabug: 38454705]
    - perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono)  [Orabug: 38454705]
    - perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono)  [Orabug: 38454705]
    - cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan)  [Orabug: 38454705]
    - Revert 'sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails' (Joseph Salisbury)     [Orabug: 38498945]
    - uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar)  [Orabug: 38526374]
    - LTS version: v6.12.51 (Jack Vogel)
    - ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
    - wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)
    - mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)
    - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)
    - media: rc: fix races with imon_disconnect() (Larshin Sergey)
    - media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)
    - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)
    - scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)
    - gcc-plugins: Remove TODO_verify_il for GCC >= 16 (Kees Cook)
    - crypto: sha256 - fix crash at kexec (Breno Leitao)
    - LTS version v6.12.50 (Jack Vogel)
    - drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
    - Revert 'usb: xhci: remove option to change a default ring's TRB cycle bit' (Niklas Neronin)
    - iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)
    - fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
    - fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)
    - mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)
    - kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
    - gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
    - fs/proc/task_mmu: check p->vec_buf for NULL (Jakub Acs)
    - afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
    - drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
    - arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
    - arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
    - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
    - tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))
    - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)
    - i40e: improve VF MAC filters accounting (Lukasz Czapnik)
    - i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
    - i40e: add max boundary check for VF filters (Lukasz Czapnik)
    - i40e: fix validation of VF state in get resources (Lukasz Czapnik)
    - i40e: fix input validation logic for action_meta (Lukasz Czapnik)
    - i40e: fix idx validation in config queues msg (Lukasz Czapnik)
    - i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)
    - i40e: add validation for ring_len param (Lukasz Czapnik)
    - HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
    - smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)
    - platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
    - drm/panthor: Defer scheduler entitiy destruction to queue release (Adrian Larumbe)
    - futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)
    - drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)
    - mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
    - mm: revert 'mm/gup: clear the LRU flag of a page before adding to LRU batch' (Hugh Dickins)
    - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
    - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
    - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir     Oltean)
    - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
    - selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
    - nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)
    - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
    - bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
    - vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)
    - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)
    - Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
    - ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
    - net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
    - net: tun: Update napi->skb after XDP process (Wang Liang)
    - can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean)
    - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
    - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
    - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
    - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
    - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)
    - bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
    - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
    - wifi: virt_wifi: Fix page fault on connect (James Guan)
    - btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
    - bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)
    - smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
    - smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
    - cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
    - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
    - arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
    - firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
    - HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
    - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
    - net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
    - ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)
    - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)
    - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)
    - i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)
    - mmc: sdhci-cadence: add Mobileye eyeQ support (Benoit Monin)
    - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
    - net: fec: rename struct fec_devinfo fec_imx6x_info -> fec_imx6sx_info (Marc Kleine-Budde)
    - usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
    - ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
    - ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
    - ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
    - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
    - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
    - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
    - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
    - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
    - ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
    - ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
    - firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
    - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)

    [6.12.0-105.49.4]
    - fs/dax: don't disassociate zero page entries (Alistair Popple)  [Orabug: 36859857]
    - device/dax: properly refcount device dax pages when mapping (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: properly refcount fs dax pages (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: Fix 'don't skip locked entries when scanning entries' (Alistair Popple)  [Orabug: 36859857]
    - mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle))  [Orabug: 36859857]
    - dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams)  [Orabug: 36859857]
    - mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple)  [Orabug: 36859857]
    - mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple)  [Orabug: 36859857]
    - mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple)  [Orabug: 36859857]
    - mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple)  [Orabug: 36859857]
    - mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple)  [Orabug: 36859857]
    - mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple)  [Orabug:
    36859857]
    - mm: allow compound zone device pages (Alistair Popple)  [Orabug: 36859857]
    - mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple)  [Orabug: 36859857]
    - mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple)  [Orabug: 36859857]
    - dax: use folios more widely within DAX (Matthew Wilcox (Oracle))  [Orabug: 36859857]
    - dax: remove access to page->index (Matthew Wilcox (Oracle))  [Orabug: 36859857]
    - fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple)  [Orabug: 36859857]
    - mm: optimize invalidation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
    - mm: optimize truncation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
    - fs/dax: create a common implementation to break DAX layouts (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: refactor wait for dax idle page (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: don't skip locked entries when scanning entries (Alistair Popple)  [Orabug: 36859857]
    - fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple)  [Orabug:
    36859857]
    - uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi)  [Orabug: 38459242]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y syzbot reported a WARNING in est_timer()     [1] Problem here is that with CONFIG_PREEMPT_RT=y, timer callbacks can be preempted. Adopt     preempt_disable_nested()/preempt_enable_nested() to fix this. [1] WARNING: CPU: 0 PID: 16 at     ./include/linux/seqlock.h:221 __seqprop_assert include/linux/seqlock.h:221 [inline] WARNING: CPU: 0 PID:
    16 at ./include/linux/seqlock.h:221 est_timer+0x6dc/0x9f0 net/core/gen_estimator.c:93 Modules linked in:
    CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google     Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:__seqprop_assert     include/linux/seqlock.h:221 [inline] RIP: 0010:est_timer+0x6dc/0x9f0 net/core/gen_estimator.c:93 Call     Trace: <TASK> call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1798     [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x648/0x970     kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb7/0x180     kernel/time/timer.c:2403 handle_softirqs+0x22c/0x710 kernel/softirq.c:579 __do_softirq     kernel/softirq.c:613 [inline] run_ktimerd+0xcf/0x190 kernel/softirq.c:1043 smpboot_thread_fn+0x53f/0xa60     kernel/smpboot.c:160 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x3fc/0x770     arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK>     (CVE-2025-39900)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1208 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix NULL pointer dereference in l3mdev_l3_rcv (CVE-2025-22103)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113)

    In the Linux kernel, the following vulnerability has been resolved:

    md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (CVE-2025-22124)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid1,raid10: don't ignore IO flags (CVE-2025-22125)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (CVE-2025-38453)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CVE-2025-38500)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix oob access in cgroup local storage (CVE-2025-38502)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Restrict conditions for adding duplicating netems to qdisc tree (CVE-2025-38553)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Prevent VMA split of buffer mappings (CVE-2025-38563)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Exit early on perf_mmap() fail (CVE-2025-38565)

    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: fix handling of server side tls alerts (CVE-2025-38566)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568)

    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: fix client side handling of tls alerts (CVE-2025-38571)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: reject malicious packets in ipv6_gso_segment() (CVE-2025-38572)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, arm64: Fix fp initialization for exception boundary (CVE-2025-38586)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix possible infinite loop in fib6_info_uses_dev() (CVE-2025-38587)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: prevent infinite loop in rt6_nlmsg_size() (CVE-2025-38588)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Remove skb secpath if xfrm state is not found (CVE-2025-38590)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (CVE-2025-38608)

    In the Linux kernel, the following vulnerability has been resolved:

    eventpoll: Fix semi-unbounded recursion (CVE-2025-38614)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: cancle set bad inode after removing name fails (CVE-2025-38615)

    In the Linux kernel, the following vulnerability has been resolved:

    tls: handle data disappearing from under the TLS ULP (CVE-2025-38616)

    In the Linux kernel, the following vulnerability has been resolved:

    net/packet: fix a race in packet_set_ring() and packet_notifier() (CVE-2025-38617)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: Do not allow binding to VMADDR_PORT_ANY (CVE-2025-38618)

    In the Linux kernel, the following vulnerability has been resolved:

    net: drop UFO packets in udp_rcv_segment() (CVE-2025-38622)

    In the Linux kernel, the following vulnerability has been resolved:

    pinmux: fix race causing mux_owner NULL with active mux_usecount (CVE-2025-38632)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_nfacct: don't assume acct name is null-terminated (CVE-2025-38639)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Disable migration in nf_hook_run_bpf(). (CVE-2025-38640)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Check device memory pointer before usage (CVE-2025-38645)

    In the Linux kernel, the following vulnerability has been resolved:

    proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653)

    In the Linux kernel, the following vulnerability has been resolved:

    [ceph] parse_longname(): strrchr() expects NUL-terminated string (CVE-2025-38660)

    In the Linux kernel, the following vulnerability has been resolved:

    can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (CVE-2025-38665)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (CVE-2025-38670)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: state: initialize state_ptrs earlier in xfrm_state_find (CVE-2025-38675)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: Avoid stack buffer overflow from kernel cmdline (CVE-2025-38676)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (CVE-2025-38681)

    In the Linux kernel, the following vulnerability has been resolved:

    hv_netvsc: Fix panic during namespace deletion with VF (CVE-2025-38683)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (CVE-2025-38685)

    In the Linux kernel, the following vulnerability has been resolved:

    userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (CVE-2025-38686)

    In the Linux kernel, the following vulnerability has been resolved:

    pNFS: Fix uninited ptr deref in block/scsi layout (CVE-2025-38691)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: add cluster chain loop check for dir (CVE-2025-38692)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (CVE-2025-38700)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (CVE-2025-38701)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: fix potential buffer overflow in do_register_framebuffer() (CVE-2025-38702)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access (CVE-2025-38704)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Add sanity check for file name (CVE-2025-38707)

    In the Linux kernel, the following vulnerability has been resolved:

    drbd: add missing kref_get in handle_write_conflicts (CVE-2025-38708)

    In the Linux kernel, the following vulnerability has been resolved:

    loop: Avoid updating block size under exclusive owner (CVE-2025-38709)

    In the Linux kernel, the following vulnerability has been resolved:

    net: kcm: Fix race condition in kcm_unattach() (CVE-2025-38717)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: fix refcount leak on table dump (CVE-2025-38721)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724)

    In the Linux kernel, the following vulnerability has been resolved:

    smb3: fix for slab out of bounds on mount to ksmbd (CVE-2025-38728)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/net: commit partial buffers on retry (CVE-2025-38730)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_reject: don't leak dst refcount for loopback packets (CVE-2025-38732)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix oops due to uninitialised variable (CVE-2025-38737)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Fix backlog accounting in qdisc_dequeue_internal (CVE-2025-39677)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (CVE-2025-39681)

    In the Linux kernel, the following vulnerability has been resolved:

    tls: fix handling of zero-length records on the rx_list (CVE-2025-39682)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Limit access to parser->buffer when trace_get_user failed (CVE-2025-39683)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Also allocate and copy hash for reading of filter files (CVE-2025-39689)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/buffer: fix use-after-free when call bh_read() helper (CVE-2025-39691)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix a race when updating an existing write (CVE-2025-39697)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CVE-2025-39698)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/ops-common: ignore migration request to invalid nodes (CVE-2025-39700)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock/virtio: Validate length in packet header before skb_put() (CVE-2025-39718)

    In the Linux kernel, the following vulnerability has been resolved:

    netfs: Fix unbuffered write error handling (CVE-2025-39723)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: fix panic due to PSLVERR (CVE-2025-39724)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (CVE-2025-39725)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: swap: fix potential buffer overflow in setup_clusters() (CVE-2025-39727)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)

    In the Linux kernel, the following vulnerability has been resolved:

    Revert fs/ntfs3: Replace inode_trylock with inode_lock (CVE-2025-39734)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not allow relocation of partially dropped subvolumes (CVE-2025-39738)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Fix rcu_read_unlock() deadloop due to IRQ work (CVE-2025-39744)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Forget ranges when refining tnum after JSET (CVE-2025-39748)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Protect ->defer_qs_iw_pending from data race (CVE-2025-39749)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/smaps: fix race between smaps_hugetlb_range and migration (CVE-2025-39754)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: Prevent file descriptor table allocations exceeding INT_MAX (CVE-2025-39756)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: qgroup: fix race between quota disable and quota rescan ioctl (CVE-2025-39759)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: core: config: Prevent OOB read in SS endpoint companion parsing (CVE-2025-39760)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (CVE-2025-39763)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (CVE-2025-39770)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: fix soft lockup in br_multicast_query_expired() (CVE-2025-39773)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: subpage: keep TOWRITE tag until folio is cleaned (CVE-2025-39779)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/ext: Fix invalid task state transitions on class switch (CVE-2025-39780)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: prevent softlockup in jbd2_log_do_checkpoint() (CVE-2025-39782)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: endpoint: Fix configfs group list head handling (CVE-2025-39783)

    In the Linux kernel, the following vulnerability has been resolved:

    dm: dm-crypt: Do not partially accept write BIOs with zoned targets (CVE-2025-39791)

    In the Linux kernel, the following vulnerability has been resolved:

    dm: Always split write BIOs to zoned device limits (CVE-2025-39792)

    In the Linux kernel, the following vulnerability has been resolved:

    block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (CVE-2025-39795)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: Duplicate SPI Handling (CVE-2025-39797)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix the setting of capabilities when automounting a new filesystem (CVE-2025-39798)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (CVE-2025-39800)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CVE-2025-39806)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: initialize more fields in sctp_v6_from_sk() (CVE-2025-39812)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (CVE-2025-39813)

    In the Linux kernel, the following vulnerability has been resolved:

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/smb: Fix inconsistent refcnt update (CVE-2025-39819)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: use array_index_nospec with indices that come from guest (CVE-2025-39823)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: asus: fix UAF via HID_CLAIMED_INPUT validation (CVE-2025-39824)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix race with concurrent opens in rename(2) (CVE-2025-39825)

    In the Linux kernel, the following vulnerability has been resolved:

    trace/fgraph: Fix the warning caused by missing unregister notifier (CVE-2025-39829)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Fix lockdep assertion on sync reset unload event (CVE-2025-39832)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: do not propagate ENODATA disk errors into xattr code (CVE-2025-39835)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: prevent NULL pointer dereference in UTF16 conversion (CVE-2025-39838)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: move page table sync declarations to linux/pgtable.h (CVE-2025-39844)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (CVE-2025-39845)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (CVE-2025-39850)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (CVE-2025-39851)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (CVE-2025-39852)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (CVE-2025-39894)

    In the Linux kernel, the following vulnerability has been resolved:

    sched: Fix sched_numa_find_nth_cpu() if mask offline (CVE-2025-39895)

    In the Linux kernel, the following vulnerability has been resolved:

    e1000e: fix heap overflow in e1000_set_eeprom (CVE-2025-39898)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (CVE-2025-39899)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (CVE-2025-39900)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)

    In the Linux kernel, the following vulnerability has been resolved:

    of_numa: fix uninitialized memory nodes causing kernel panic (CVE-2025-39903)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
275294	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2025:4057-1)	Nessus	SuSE Local Security Checks	high
274584	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2025-25754)	Nessus	Oracle Linux Local Security Checks	high
269673	Linux Distros Unpatched Vulnerability : CVE-2025-39900	Nessus	Misc.	medium
266176	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2025-1208)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2025-39900

medium

Tenable Plugins

high

high

medium

high