In the Linux kernel, the following vulnerability has been resolved: net: phylink: add lock for serializing concurrent pl->phydev writes with resolver Currently phylink_resolve() protects itself against concurrent phylink_bringup_phy() or phylink_disconnect_phy() calls which modify pl->phydev by relying on pl->state_mutex. The problem is that in phylink_resolve(), pl->state_mutex is in a lock inversion state with pl->phydev->lock. So pl->phydev->lock needs to be acquired prior to pl->state_mutex. But that requires dereferencing pl->phydev in the first place, and without pl->state_mutex, that is racy. Hence the reason for the extra lock. Currently it is redundant, but it will serve a functional purpose once mutex_lock(&phy->lock) will be moved outside of the mutex_lock(&pl->state_mutex) section. Another alternative considered would have been to let phylink_resolve() acquire the rtnl_mutex, which is also held when phylink_bringup_phy() and phylink_disconnect_phy() are called. But since phylink_disconnect_phy() runs under rtnl_lock(), it would deadlock with phylink_resolve() when calling flush_work(&pl->resolve). Additionally, it would have been undesirable because it would have unnecessarily blocked many other call paths as well in the entire kernel, so the smaller-scoped lock was preferred.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:0453 advisory.

    * kernel: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CVE-2025-39806)
      * kernel: audit: fix out-of-bounds read in audit_compare_dname_path() (CVE-2025-39840)
      * kernel: mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)
      * kernel: net: phylink: add lock for serializing concurrent pl->phydev writes with resolver     (CVE-2025-39905)
      * kernel: iommufd: Fix race during abort for file descriptors (CVE-2025-39966)
      * kernel: tls: wait for pending async decryptions if tls_strp_msg_hold fails (CVE-2025-40176)
      * kernel: sctp: avoid NULL dereference when chunk data buffer is missing (CVE-2025-40240)
      * kernel: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CVE-2025-40277)
      * kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths     (CVE-2025-68287)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:0453 advisory.

    * kernel: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CVE-2025-39806)

    * kernel: audit: fix out-of-bounds read in audit_compare_dname_path() (CVE-2025-39840)

    * kernel: mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)

    * kernel: net: phylink: add lock for serializing concurrent pl->phydev writes with resolver     (CVE-2025-39905)

    * kernel: iommufd: Fix race during abort for file descriptors (CVE-2025-39966)

    * kernel: tls: wait for pending async decryptions if tls_strp_msg_hold fails (CVE-2025-40176)

    * kernel: sctp: avoid NULL dereference when chunk data buffer is missing (CVE-2025-40240)

    * kernel: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CVE-2025-40277)

    * kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths     (CVE-2025-68287)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0453 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CVE-2025-39806)

    * kernel: audit: fix out-of-bounds read in audit_compare_dname_path() (CVE-2025-39840)

    * kernel: mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)

    * kernel: net: phylink: add lock for serializing concurrent pl->phydev writes with resolver     (CVE-2025-39905)

    * kernel: iommufd: Fix race during abort for file descriptors (CVE-2025-39966)

    * kernel: tls: wait for pending async decryptions if tls_strp_msg_hold fails (CVE-2025-40176)

    * kernel: sctp: avoid NULL dereference when chunk data buffer is missing (CVE-2025-40240)

    * kernel: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CVE-2025-40277)

    * kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths     (CVE-2025-68287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-0453 advisory.

    - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (CKI Backport Bot)     [RHEL-137150] {CVE-2025-68287}
    - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134431]     {CVE-2025-40277}
    - net: phylink: add lock for serializing concurrent pl->phydev writes with resolver (CKI Backport Bot)     [RHEL-129812] {CVE-2025-39905}
    - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-134010]     {CVE-2025-40240}
    - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CKI Backport Bot) [RHEL-124610]     {CVE-2025-39806}
    - audit: fix out-of-bounds read in audit_compare_dname_path() (Richard Guy Briggs) [RHEL-119185]     {CVE-2025-39840}
    - iommufd: Fix race during abort for file descriptors (Eder Zulian) [RHEL-123789] {CVE-2025-39966}
    - mm: slub: avoid wake up kswapd in set_track_prepare (Audra Mitchell) [RHEL-125522] {CVE-2025-39843}
    - tls: wait for pending async decryptions if tls_strp_msg_hold fails (CKI Backport Bot) [RHEL-128866]     {CVE-2025-40176}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: phylink: add lock for serializing concurrent pl->phydev writes with resolver Currently     phylink_resolve() protects itself against concurrent phylink_bringup_phy() or phylink_disconnect_phy()     calls which modify pl->phydev by relying on pl->state_mutex. The problem is that in phylink_resolve(),     pl->state_mutex is in a lock inversion state with pl->phydev->lock. So pl->phydev->lock needs to be     acquired prior to pl->state_mutex. But that requires dereferencing pl->phydev in the first place, and     without pl->state_mutex, that is racy. Hence the reason for the extra lock. Currently it is redundant, but     it will serve a functional purpose once mutex_lock(&phy->lock) will be moved outside of the     mutex_lock(&pl->state_mutex) section. Another alternative considered would have been to let     phylink_resolve() acquire the rtnl_mutex, which is also held when phylink_bringup_phy() and     phylink_disconnect_phy() are called. But since phylink_disconnect_phy() runs under rtnl_lock(), it would     deadlock with phylink_resolve() when calling flush_work(&pl->resolve). Additionally, it would have been     undesirable because it would have unnecessarily blocked many other call paths as well in the entire     kernel, so the smaller-scoped lock was preferred. (CVE-2025-39905)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
291602	AlmaLinux 10 : kernel (ALSA-2026:0453)	Nessus	Alma Linux Local Security Checks	high
291297	RockyLinux 10 : kernel (RLSA-2026:0453)	Nessus	Rocky Linux Local Security Checks	high
283499	RHEL 10 : kernel (RHSA-2026:0453)	Nessus	Red Hat Local Security Checks	high
282630	Oracle Linux 10 : kernel (ELSA-2026-0453)	Nessus	Oracle Linux Local Security Checks	high
279911	Photon OS 5.0: Linux PHSA-2025-5.0-0720	Nessus	PhotonOS Local Security Checks	high
269255	Linux Distros Unpatched Vulnerability : CVE-2025-39905	Nessus	Misc.	high

Detections

Analytics

CVE-2025-39905

high

Tenable Plugins

high

high

high

high

high

high