In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket. After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk. Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk. Let's remove reqsk_fastopen_remove() in tcp_conn_request(). Note that other callers make sure tp->fastopen_rsk is not NULL. [0]: refcount_t: underflow; use-after-free. WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 Call Trace: <IRQ> tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input (net/ipv6/ip6_input.c:500) ipv6_rcv (net/ipv6/ip6_input.c:311) __netif_receive_skb (net/core/dev.c:6104) process_backlog (net/core/dev.c:6456) __napi_poll (net/core/dev.c:7506) net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480) </IRQ>

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4515-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-50364: i2c: mux: reg: check return value after calling platform_get_resource() (bsc#1250083).
    - CVE-2022-50368: drm/msm/dsi: fix memory corruption with too many bridges (bsc#1250009).
    - CVE-2022-50494: thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash     (bsc#1251173).
    - CVE-2022-50545: r6040: Fix kmemleak in probe and remove (bsc#1251285).
    - CVE-2022-50551: wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()     (bsc#1251322).
    - CVE-2022-50569: xfrm: Update ipcomp_scratches with NULL when freed (bsc#1252640).
    - CVE-2022-50578: class: fix possible memory leak in __class_register() (bsc#1252519).
    - CVE-2023-53229: wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta     (bsc#1249650).
    - CVE-2023-53369: net: dcb: choose correct policy to parse DCB_ATTR_BCN (bsc#1250206).
    - CVE-2023-53431: scsi: ses: Don't attach if enclosure has no components (bsc#1250374).
    - CVE-2023-53542: ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy (bsc#1251154).
    - CVE-2023-53597: cifs: fix mid leak during reconnection after timeout threshold (bsc#1251159).
    - CVE-2023-53641: wifi: ath9k: hif_usb: fix memory leak of remain_skbs (bsc#1251728).
    - CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).
    - CVE-2025-38436: drm/scheduler: signal scheduled fence when kill job (bsc#1247227).
    - CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
    - CVE-2025-39967: fbcon: fix integer overflow in fbcon_do_set_font (bsc#1252033).
    - CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
    - CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
    - CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).
    - CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).
    - CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).
    - CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
    - CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
    - CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
    - CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).
    - CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).
    - CVE-2025-40205: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (bsc#1253456).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4521-1 advisory.

    The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
    - CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).
    - CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).
    - CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
    - CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).
    - CVE-2025-38361: drm/amd/display: Check dce_hwseq before dereferencing it (bsc#1247079).
    - CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).
    - CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
    - CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
    - CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
    - CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
    - CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
    - CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
    - CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
    - CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
    - CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).
    - CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
    - CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).
    - CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).
    - CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
    - CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
    - CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
    - CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
    - CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).
    - CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
    - CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
    - CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state()     (bsc#1252917).
    - CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
    - CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
    - CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
    - CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).
    - CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
    - CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).
    - CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).
    - CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).
    - CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4517-1 advisory.

    The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
    - CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).
    - CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).
    - CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
    - CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).
    - CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
    - CVE-2025-38361: drm/amd/display: Check dce_hwseq before dereferencing it (bsc#1247079).
    - CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).
    - CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
    - CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
    - CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
    - CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
    - CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
    - CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
    - CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
    - CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
    - CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
    - CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).
    - CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
    - CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).
    - CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
    - CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).
    - CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
    - CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
    - CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
    - CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
    - CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).
    - CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
    - CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
    - CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
    - CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state()     (bsc#1252917).
    - CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
    - CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
    - CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
    - CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).
    - CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
    - CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).
    - CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).
    - CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).
    - CVE-2025-40185: ice: ice_adapter: release xa entry on adapter allocation failure (bsc#1253394).
    - CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4516-1 advisory.

    The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
    - CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).
    - CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).
    - CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
    - CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).
    - CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).
    - CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
    - CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
    - CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
    - CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
    - CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
    - CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
    - CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
    - CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
    - CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
    - CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).
    - CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
    - CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).
    - CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
    - CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).
    - CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
    - CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
    - CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
    - CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
    - CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).
    - CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
    - CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774).
    - CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
    - CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
    - CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state()     (bsc#1252917).
    - CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
    - CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
    - CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
    - CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).
    - CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
    - CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).
    - CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).
    - CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).
    - CVE-2025-40185: ice: ice_adapter: release xa entry on adapter allocation failure (bsc#1253394).
    - CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).
    - CVE-2025-40206: Add missing bugzilla reference to net fix (bsc#1250237 bsc#1253393).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025:20172-1 advisory.

    The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
    - CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
    - CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245431 bsc#1245498).
    - CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
    - CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
    - CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
    - CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
    - CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
    - CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
    - CVE-2025-39831: fbnic: Move phylink resume out of service_task and into open/close (bsc#1249977).
    - CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
    - CVE-2025-39897: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval     (bsc#1250746).
    - CVE-2025-39917: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (bsc#1250723).
    - CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
    - CVE-2025-39961: iommu/amd/pgtbl: Fix possible race while increase page table level (bsc#1251817).
    - CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
    - CVE-2025-39990: bpf: Check the helper function is valid in get_helper_proto (bsc#1252054).
    - CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
    - CVE-2025-40003: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (bsc#1252301).
    - CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
    - CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
    - CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
    - CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
    - CVE-2025-40031: tee: fix register_shm_helper() (bsc#1252779).
    - CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()     (bsc#1252824).
    - CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
    - CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
    - CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
    - CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
    - CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
    - CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
    - CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
    - CVE-2025-40074: tcp: convert to dev_net_rcu() (bsc#1252794).
    - CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
    - CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
    - CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
    - CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
    - CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state()     (bsc#1252917).
    - CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST     (bsc#1252901).
    - CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
    - CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
    - CVE-2025-40133: mptcp: Call dst_release() in mptcp_active_enable() (bsc#1253328).
    - CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
    - CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
    - CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
    - CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
    - CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
    - CVE-2025-40157: EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (bsc#1253423).
    - CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
    - CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).
    - CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
    - CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).
    - CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).
    - CVE-2025-40175: idpf: cleanup remaining SKBs in PTP flows (bsc#1253426).
    - CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).
    - CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
    - CVE-2025-40185: ice: ice_adapter: release xa entry on adapter allocation failure (bsc#1253394).
    - CVE-2025-40201: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64()     paths (bsc#1253455).
    - CVE-2025-40203: listmount: don't call path_put() under namespace semaphore (bsc#1253457).

    The following non security issues were fixed:

    - ACPI: scan: Update honor list for RPMI System MSI (stable-fixes).
    - ACPICA: Update dsmethod.c to get rid of unused variable warning (stable-fixes).
    - Disable CONFIG_CPU5_WDT The cpu5wdt driver doesn't implement a       proper watchdog interface and has many code issues. It only handles       obscure and obsolete hardware. Stop building and supporting this driver       (jsc#PED-14062).
    - Fix drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923)
    - KVM: SVM: Delete IRTE link from previous vCPU before setting new IRTE (git-fixes).
    - KVM: SVM: Delete IRTE link from previous vCPU irrespective of new routing (git-fixes).
    - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (git-fixes).
    - KVM: s390: improve interrupt cpu for wakeup (bsc#1235463).
    - KVM: s390: kABI backport for 'last_sleep_cpu' (bsc#1252352).
    - KVM: x86/mmu: Return -EAGAIN if userspace deletes/moves memslot during prefault (git-fixes).
    - PCI/ERR: Update device error_state already after reset (stable-fixes).
    - PM: EM: Slightly reduce em_check_capacity_update() overhead (stable-fixes).
    - Revert net/mlx5e: Update and set Xon/Xoff upon MTU set (git-fixes).
    - Revert net/mlx5e: Update and set Xon/Xoff upon port speed set (git-fixes).
    - Update config files: enable zstd module decompression (jsc#PED-14115).
    - bpf/selftests: Fix test_tcpnotify_user (bsc#1253635).
    - btrfs: do not clear read-only when adding sprout device (bsc#1253238).
    - btrfs: do not update last_log_commit when logging inode due to a new name (git-fixes).
    - dm: fix queue start/stop imbalance under suspend/load/resume races (bsc#1253386)
    - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (stable-fixes).
    - drm/amd/display: update color on atomic commit time (stable-fixes).
    - drm/amd/display: update dpp/disp clock from smu clock table (stable-fixes).
    - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (stable-fixes).
    - hwmon: (lenovo-ec-sensors) Update P8 supprt (stable-fixes).
    - media: amphion: Delete v4l2_fh synchronously in .release() (stable-fixes).
    - mount: handle NULL values in mnt_ns_release() (bsc#1254308)
    - net/smc: Remove validation of reserved bits in CLC Decline (bsc#1252357).
    - net: phy: move realtek PHY driver to its own subdirectory (jsc#PED-14353).
    - net: phy: realtek: add defines for shadowed c45 standard registers (jsc#PED-14353).
    - net: phy: realtek: add helper RTL822X_VND2_C22_REG (jsc#PED-14353).
    - net: phy: realtek: change order of calls in C22 read_status() (jsc#PED-14353).
    - net: phy: realtek: clear 1000Base-T link partner advertisement (jsc#PED-14353).
    - net: phy: realtek: improve mmd register access for internal PHY's (jsc#PED-14353).
    - net: phy: realtek: read duplex and gbit master from PHYSR register (jsc#PED-14353).
    - net: phy: realtek: switch from paged to MMD ops in rtl822x functions (jsc#PED-14353).
    - net: phy: realtek: use string choices helpers (jsc#PED-14353).
    - net: xilinx: axienet: Fix IRQ coalescing packet count overflow (bsc#1250746)
    - net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (bsc#1250746)
    - net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (bsc#1250746)
    - nvmet-auth: update sc_c in host response (git-fixes bsc#1249397).
    - nvmet-auth: update sc_c in target host hash calculation (git-fixes).
    - perf list: Add IBM z17 event descriptions (jsc#PED-13611).
    - platform/x86:intel/pmc: Update Arrow Lake telemetry GUID (git-fixes).
    - powercap: intel_rapl: Add support for Panther Lake platform (jsc#PED-13949).
    - pwm: pca9685: Use bulk write to atomicially update registers (stable-fixes).
    - r8169: add PHY c45 ops for MDIO_MMD_VENDOR2 registers (jsc#PED-14353).
    - r8169: add support for Intel Killer E5000 (jsc#PED-14353).
    - r8169: add support for RTL8125BP rev.b (jsc#PED-14353).
    - r8169: add support for RTL8125D rev.b (jsc#PED-14353).
    - r8169: adjust version numbering for RTL8126 (jsc#PED-14353).
    - r8169: align RTL8125 EEE config with vendor driver (jsc#PED-14353).
    - r8169: align RTL8125/RTL8126 PHY config with vendor driver (jsc#PED-14353).
    - r8169: align RTL8126 EEE config with vendor driver (jsc#PED-14353).
    - r8169: align WAKE_PHY handling with r8125/r8126 vendor drivers (jsc#PED-14353).
    - r8169: avoid duplicated messages if loading firmware fails and switch to warn level (jsc#PED-14353).
    - r8169: don't take RTNL lock in rtl_task() (jsc#PED-14353).
    - r8169: enable EEE at 2.5G per default on RTL8125B (jsc#PED-14353).
    - r8169: enable RTL8168H/RTL8168EP/RTL8168FP ASPM support (jsc#PED-14353).
    - r8169: fix inconsistent indenting in rtl8169_get_eth_mac_stats (jsc#PED-14353).
    - r8169: implement additional ethtool stats ops (jsc#PED-14353).
    - r8169: improve __rtl8169_set_wol (jsc#PED-14353).
    - r8169: improve initialization of RSS registers on RTL8125/RTL8126 (jsc#PED-14353).
    - r8169: improve rtl_set_d3_pll_down (jsc#PED-14353).
    - r8169: increase max jumbo packet size on RTL8125/RTL8126 (jsc#PED-14353).
    - r8169: remove leftover locks after reverted change (jsc#PED-14353).
    - r8169: remove original workaround for RTL8125 broken rx issue (jsc#PED-14353).
    - r8169: remove rtl_dash_loop_wait_high/low (jsc#PED-14353).
    - r8169: remove support for chip version 11 (jsc#PED-14353).
    - r8169: remove unused flag RTL_FLAG_TASK_RESET_NO_QUEUE_WAKE (jsc#PED-14353).
    - r8169: replace custom flag with disable_work() et al (jsc#PED-14353).
    - r8169: switch away from deprecated pcim_iomap_table (jsc#PED-14353).
    - r8169: use helper r8169_mod_reg8_cond to simplify rtl_jumbo_config (jsc#PED-14353).
    - ring-buffer: Update pages_touched to reflect persistent buffer content (git-fixes).
    - s390/mm: Fix __ptep_rdp() inline assembly (bsc#1253643).
    - sched/fair: Get rid of sched_domains_curr_level hack for tl->cpumask() (bsc#1246843).
    - sched/fair: Have SD_SERIALIZE affect newidle balancing (bsc#1248792).
    - sched/fair: Proportional newidle balance (bsc#1248792).
    - sched/fair: Proportional newidle balance -KABI (bsc#1248792).
    - sched/fair: Revert max_newidle_lb_cost bump (bsc#1248792).
    - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (bsc#1248792).
    - sched/fair: Small cleanup to sched_balance_newidle() (bsc#1248792).
    - sched/fair: Small cleanup to update_newidle_cost() (bsc#1248792).
    - scsi: lpfc: Add capability to register Platform Name ID to fabric (bsc#1254119).
    - scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (bsc#1254119).
    - scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (bsc#1254119).
    - scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (bsc#1254119).
    - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (bsc#1254119).
    - scsi: lpfc: Modify kref handling for Fabric Controller ndlps (bsc#1254119).
    - scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (bsc#1254119).
    - scsi: lpfc: Revise discovery related function headers and comments (bsc#1254119).
    - scsi: lpfc: Update lpfc version to 14.4.0.12 (bsc#1254119).
    - scsi: lpfc: Update various NPIV diagnostic log messaging (bsc#1254119).
    - selftests/run_kselftest.sh: Add `--skip` argument option (bsc#1254221).
    - smpboot: introduce SDTL_INIT() helper to tidy sched topology setup (bsc#1246843).
    - soc/tegra: fuse: speedo-tegra210: Update speedo IDs (git-fixes).
    - spi: tegra210-quad: Check hardware status on timeout (bsc#1253155)
    - spi: tegra210-quad: Fix timeout handling (bsc#1253155)
    - spi: tegra210-quad: Refactor error handling into helper functions (bsc#1253155)
    - spi: tegra210-quad: Update dummy sequence configuration (git-fixes)
    - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork (bsc#1250705).
    - wifi: ath11k: Add quirk entries for Thinkpad T14s Gen3 AMD (bsc#1254181).
    - wifi: mt76: do not add wcid entries to sta poll list during MCU reset (bsc#1254315).
    - wifi: mt76: introduce mt792x_config_mac_addr_list routine (bsc#1254315).
    - wifi: mt76: mt7925: Fix logical vs bitwise typo (bsc#1254315).
    - wifi: mt76: mt7925: Remove unnecessary if-check (bsc#1254315).
    - wifi: mt76: mt7925: Simplify HIF suspend handling to avoid suspend fail (bsc#1254315).
    - wifi: mt76: mt7925: add EHT control support based on the CLC data (bsc#1254315).
    - wifi: mt76: mt7925: add handler to hif suspend/resume event (bsc#1254315).
    - wifi: mt76: mt7925: add pci restore for hibernate (bsc#1254315).
    - wifi: mt76: mt7925: config the dwell time by firmware (bsc#1254315).
    - wifi: mt76: mt7925: extend MCU support for testmode (bsc#1254315).
    - wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (bsc#1254315).
    - wifi: mt76: mt7925: fix missing hdr_trans_tlv command for broadcast wtbl (bsc#1254315).
    - wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (bsc#1254315).
    - wifi: mt76: mt7925: refine the txpower initialization flow (bsc#1254315).
    - wifi: mt76: mt7925: replace zero-length array with flexible-array member (bsc#1254315).
    - wifi: mt76: mt7925: update the channel usage when the regd domain changed (bsc#1254315).
    - wifi: mt76: mt7925e: fix too long of wifi resume time (bsc#1254315).
    - x86/smpboot: avoid SMT domain attach/destroy if SMT is not enabled (bsc#1246843).
    - x86/smpboot: moves x86_topology to static initialize and truncate (bsc#1246843).
    - x86/smpboot: remove redundant CONFIG_SCHED_SMT (bsc#1246843).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4505-1 advisory.

    The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
    - CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).
    - CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).
    - CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
    - CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).
    - CVE-2025-38361: drm/amd/display: Check dce_hwseq before dereferencing it (bsc#1247079).
    - CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).
    - CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
    - CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
    - CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
    - CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
    - CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
    - CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
    - CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
    - CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
    - CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).
    - CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
    - CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).
    - CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).
    - CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
    - CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
    - CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
    - CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
    - CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).
    - CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
    - CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
    - CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state()     (bsc#1252917).
    - CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
    - CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
    - CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
    - CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).
    - CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
    - CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).
    - CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).
    - CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).
    - CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23463 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ethtool: check device is present when getting link settings (CVE-2024-46679)

    * kernel: ALSA: usb-audio: Validate UAC3 power domain descriptors, too (CVE-2025-38729)

    * kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

    * kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724)

    * kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757)

    * kernel: wifi: mwifiex: Fix OOB and integer underflow when rx packets (CVE-2023-53226)

    * kernel: Bluetooth: L2CAP: fix bad unlock balance in l2cap_disconnect_rsp (CVE-2023-53297)

    * kernel: scsi: qla2xxx: Wait for io return on terminate rport (CVE-2023-53322)

    * kernel: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (CVE-2023-53365)

    * kernel: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device (CVE-2023-53393)

    * kernel: iomap: iomap: fix memory corruption when recording errors during writeback (CVE-2022-50406)

    * kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path (CVE-2025-39841)

    * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955)

    * kernel: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request() (CVE-2025-40186)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23422 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: scsi: qla2xxx: Wait for io return on terminate rport (CVE-2023-53322)

    * kernel: wifi: cfg80211: fix use-after-free in cmp_bss() (CVE-2025-39864)

    * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955)

    * kernel: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request() (CVE-2025-40186)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23425 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: smb: client: fix race with concurrent opens in rename(2) (CVE-2025-39825)

    * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955)

    * kernel: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request() (CVE-2025-40186)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23450 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: wifi: cfg80211: fix use-after-free in cmp_bss() (CVE-2025-39864)

    * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955)

    * kernel: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request() (CVE-2025-40186)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23445 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ALSA: usb-audio: ALSA USB Audio Out-of-Bounds Bug (CVE-2022-48701)

    * kernel: ethtool: check device is present when getting link settings (CVE-2024-46679)

    * kernel: ALSA: usb-audio: Validate UAC3 power domain descriptors, too (CVE-2025-38729)

    * kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

    * kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724)

    * kernel: NFS: Fix a race when updating an existing write (CVE-2025-39697)

    * kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757)

    * kernel: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (CVE-2023-53213)

    * kernel: mm: fix zswap writeback race condition (CVE-2023-53178)

    * kernel: wifi: mwifiex: Fix OOB and integer underflow when rx packets (CVE-2023-53226)

    * kernel: Bluetooth: L2CAP: fix bad unlock balance in l2cap_disconnect_rsp (CVE-2023-53297)

    * kernel: smb: client: fix race with concurrent opens in rename(2) (CVE-2025-39825)

    * kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)

    * kernel: Bluetooth: L2CAP: Fix use-after-free (CVE-2023-53305)

    * kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367)

    * kernel: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (CVE-2023-53365)

    * kernel: net: sched: sfb: fix null pointer access issue when sfb_init() fails (CVE-2022-50356)

    * kernel: skbuff: skb_segment, Call zero copy functions before using skbuff frags (CVE-2023-53354)

    * kernel: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device (CVE-2023-53393)

    * kernel: crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)

    * kernel: Bluetooth: L2CAP: Fix user-after-free (CVE-2022-50386)

    * kernel: ext4: fix undefined behavior in bit shift for ext4_check_flag_values (CVE-2022-50403)

    * kernel: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (CVE-2022-50408)

    * kernel: NFSD: Protect against send buffer overflow in NFSv2 READ (CVE-2022-50410)

    * kernel: iomap: iomap: fix memory corruption when recording errors during writeback (CVE-2022-50406)

    * kernel: wifi: cfg80211: fix use-after-free in cmp_bss() (CVE-2025-39864)

    * kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path (CVE-2025-39841)

    * kernel: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CVE-2025-39883)

    * kernel: NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL (CVE-2023-53680)

    * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955)

    * kernel: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request() (CVE-2025-40186)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23426 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: scsi: qla2xxx: Wait for io return on terminate rport (CVE-2023-53322)

    * kernel: wifi: cfg80211: fix use-after-free in cmp_bss() (CVE-2025-39864)

    * kernel: nbd: fix incomplete validation of ioctl arg (CVE-2023-53513)

    * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955)

    * kernel: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request() (CVE-2025-40186)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23424 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: scsi: qla2xxx: Wait for io return on terminate rport (CVE-2023-53322)

    * kernel: wifi: cfg80211: fix use-after-free in cmp_bss() (CVE-2025-39864)

    * kernel: nbd: fix incomplete validation of ioctl arg (CVE-2023-53513)

    * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955)

    * kernel: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request() (CVE-2025-40186)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23423 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: scsi: qla2xxx: Wait for io return on terminate rport (CVE-2023-53322)

    * kernel: wifi: cfg80211: fix use-after-free in cmp_bss() (CVE-2025-39864)

    * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955)

    * kernel: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request() (CVE-2025-40186)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23427 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (CVE-2023-53401)

    * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955)

    * kernel: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request() (CVE-2025-40186)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-28048 advisory.

    - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38744086]     {CVE-2025-38678}
    - PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup() (Marek Vasut) [Orabug:
    38641258] {CVE-2024-43876}
    - usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai) [Orabug: 38601854]     {CVE-2025-40094}
    - usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai) [Orabug: 38601837]     {CVE-2025-40092}
    - NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601818]     {CVE-2025-40087}
    - vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601923] {CVE-2025-40105}
    - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597093]     {CVE-2025-40085}
    - net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov) [Orabug: 38649259] {CVE-2025-40173}
    - ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey) [Orabug: 38649222]     {CVE-2025-40167}
    - media: pci: ivtv: Add check for DMA map result (Mikhail Kobuk) [Orabug: 38641260] {CVE-2024-43877}
    - pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17) [Orabug: 38649275] {CVE-2025-40178}
    - dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing) [Orabug: 38649056] {CVE-2025-40134}
    - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen)     [Orabug: 38592032] {CVE-2025-40042}
    - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel) [Orabug: 38649002]     {CVE-2025-40120}
    - media: mc: Clear minor number before put device (Edward Adam Davis) [Orabug: 38649397] {CVE-2025-40197}
    - Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher) [Orabug: 38649424]     {CVE-2025-40200}
    - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug:
    38591958] {CVE-2025-40026}
    - ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag) [Orabug: 38649329]     {CVE-2025-40190}
    - ext4: verify orphan file size is not too big (Jan Kara) [Orabug: 38649284] {CVE-2025-40179}
    - sctp: Fix MAC comparison to be constant-time (Eric Biggers) [Orabug: 38649450] {CVE-2025-40204}
    - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki) [Orabug:
    38649365] {CVE-2025-40194}
    - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento) [Orabug: 38649461]     {CVE-2025-40205}
    - crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581454]     {CVE-2025-40019}
    - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann) [Orabug: 38649299]     {CVE-2025-40183}
    - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima) [Orabug: 38649578]     {CVE-2025-40186}
    - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)     [Orabug: 38649311] {CVE-2025-40187}
    - drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes) [Orabug: 38643545] {CVE-2025-40111}
    - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557653]     {CVE-2025-40001}
    - pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug:
    38591980] {CVE-2025-40030}
    - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38592000]     {CVE-2025-40035}
    - mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi) [Orabug: 38649149]     {CVE-2025-40153}
    - fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592047] {CVE-2025-40044}
    - uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592066]     {CVE-2025-40048}
    - Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592076] {CVE-2025-40049}
    - net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592097] {CVE-2025-40053}
    - ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592109] {CVE-2025-40055}
    - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath) [Orabug: 38649095]     {CVE-2025-40140}
    - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar) [Orabug: 38648980]     {CVE-2025-40115}
    - ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581444] {CVE-2025-40018}
    - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai) [Orabug: 38649006]     {CVE-2025-40121}
    - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai) [Orabug: 38649156]     {CVE-2025-40154}
    - pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592169]     {CVE-2025-40070}
    - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel) [Orabug: 38649566]     {CVE-2025-40118}
    - bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592204] {CVE-2025-40078}
    - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner) [Orabug: 38649248] {CVE-2025-40171}
    - blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan) [Orabug:
    38649025] {CVE-2025-40125}
    - perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592220] {CVE-2025-40081}
    - net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591964] {CVE-2025-40027}
    - crypto: rng - Ensure set_ent is always present (Herbert Xu) [Orabug: 38643530] {CVE-2025-40109}
    - media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548036]     {CVE-2025-39994}
    - udp: Fix memory accounting leak. (Kuniyuki Iwashima) [Orabug: 37844324] {CVE-2025-22058}
    - media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548026] {CVE-2025-39993}
    - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug:
    38548050] {CVE-2025-39996}
    - scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug:
    38548058] {CVE-2025-39998}
    - i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547951,38603025,38607608]     {CVE-2025-39973}
    - i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547937] {CVE-2025-39971}
    - i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547928] {CVE-2025-39969}
    - mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560480] {CVE-2025-40006}
    - fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547912]     {CVE-2025-39967}
    - tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581470]     {CVE-2025-40021}
    - i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547922] {CVE-2025-39968}
    - i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547932] {CVE-2025-39970}
    - i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547945] {CVE-2025-39972}
    - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38641289]     {CVE-2025-40022}
    - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug:
    38537468,38575792,38575804] {CVE-2025-39964}
    - drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560495] {CVE-2025-40011}
    - nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547971]     {CVE-2025-39980}
    - can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581461] {CVE-2025-40020}
    - cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503848] {CVE-2025-39945}
    - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526387]     {CVE-2025-39955}
    - qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503869]     {CVE-2025-39949}
    - cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503891] {CVE-2025-39953}
    - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug:
    38461847] {CVE-2025-39883}
    - dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug:
    38494821] {CVE-2025-39923}
    - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494786]     {CVE-2025-39911}
    - libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461836]     {CVE-2025-39880}
    - ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461858]     {CVE-2025-39885}
    - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. (Kuniyuki     Iwashima) [Orabug: 38494796] {CVE-2025-39913}
    - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. (Kuniyuki Iwashima) [Orabug:
    37901603] {CVE-2025-23143}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4404 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4404-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     December 12, 2025                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux     Version        : 5.10.247-1     CVE ID         : CVE-2023-53498 CVE-2024-47666 CVE-2024-50143 CVE-2024-57947                      CVE-2025-21861 CVE-2025-21887 CVE-2025-22058 CVE-2025-23143                      CVE-2025-38678 CVE-2025-39866 CVE-2025-39869 CVE-2025-39876                      CVE-2025-39883 CVE-2025-39885 CVE-2025-39907 CVE-2025-39911                      CVE-2025-39913 CVE-2025-39923 CVE-2025-39937 CVE-2025-39945                      CVE-2025-39949 CVE-2025-39951 CVE-2025-39953 CVE-2025-39955                      CVE-2025-39964 CVE-2025-39967 CVE-2025-39968 CVE-2025-39969                      CVE-2025-39970 CVE-2025-39971 CVE-2025-39972 CVE-2025-39973                      CVE-2025-39980 CVE-2025-39985 CVE-2025-39986 CVE-2025-39987                      CVE-2025-39993 CVE-2025-39994 CVE-2025-39995 CVE-2025-39996                      CVE-2025-39998 CVE-2025-40001 CVE-2025-40006 CVE-2025-40011                      CVE-2025-40018 CVE-2025-40019 CVE-2025-40020 CVE-2025-40021                      CVE-2025-40022 CVE-2025-40026 CVE-2025-40027 CVE-2025-40029                      CVE-2025-40030 CVE-2025-40035 CVE-2025-40042 CVE-2025-40044                      CVE-2025-40048 CVE-2025-40049 CVE-2025-40053 CVE-2025-40055                      CVE-2025-40070 CVE-2025-40078 CVE-2025-40081 CVE-2025-40083                      CVE-2025-40087 CVE-2025-40088 CVE-2025-40105 CVE-2025-40106                      CVE-2025-40109 CVE-2025-40111 CVE-2025-40115 CVE-2025-40116                      CVE-2025-40118 CVE-2025-40121 CVE-2025-40125 CVE-2025-40127                      CVE-2025-40134 CVE-2025-40140 CVE-2025-40153 CVE-2025-40154                      CVE-2025-40167 CVE-2025-40173 CVE-2025-40178 CVE-2025-40183                      CVE-2025-40186 CVE-2025-40187 CVE-2025-40188 CVE-2025-40190                      CVE-2025-40194 CVE-2025-40197 CVE-2025-40198 CVE-2025-40200                      CVE-2025-40204 CVE-2025-40205 CVE-2025-40211 CVE-2025-40219                      CVE-2025-40220 CVE-2025-40223 CVE-2025-40231 CVE-2025-40233                      CVE-2025-40240 CVE-2025-40243 CVE-2025-40244 CVE-2025-40248                      CVE-2025-40254 CVE-2025-40257 CVE-2025-40258 CVE-2025-40259                      CVE-2025-40261 CVE-2025-40262 CVE-2025-40263 CVE-2025-40264                      CVE-2025-40269 CVE-2025-40271 CVE-2025-40273 CVE-2025-40275                      CVE-2025-40277 CVE-2025-40278 CVE-2025-40280 CVE-2025-40281                      CVE-2025-40282 CVE-2025-40283 CVE-2025-40304 CVE-2025-40306                      CVE-2025-40308 CVE-2025-40309 CVE-2025-40312 CVE-2025-40315                      CVE-2025-40317 CVE-2025-40319 CVE-2025-40321 CVE-2025-40322                      CVE-2025-40324 CVE-2025-40331 CVE-2025-40342     Debian Bug     : 1107479 1114557

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 11 bullseye, these problems have been fixed in version     5.10.247-1.  This version additionally includes many more bug fixes     from stable updates 5.10.245-5.10.247.  The broken pktcdvd driver has     also been disabled.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22392 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724)

    * kernel: wifi: cfg80211: fix use-after-free in cmp_bss() (CVE-2025-39864)

    * kernel: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CVE-2025-39883)

    * kernel: kernfs: Fix UAF in polling when open file is released (CVE-2025-39881)

    * kernel: wifi: mt76: fix linked list corruption (CVE-2025-39918)

    * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955)

    * kernel: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request() (CVE-2025-40186)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4379 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4379-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     November 25, 2025                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.1     Version        : 6.1.158-1~deb11u1     CVE ID         : CVE-2025-21861 CVE-2025-39929 CVE-2025-39931 CVE-2025-39934                      CVE-2025-39937 CVE-2025-39938 CVE-2025-39942 CVE-2025-39943                      CVE-2025-39944 CVE-2025-39945 CVE-2025-39946 CVE-2025-39949                      CVE-2025-39951 CVE-2025-39953 CVE-2025-39955 CVE-2025-39957                      CVE-2025-39964 CVE-2025-39967 CVE-2025-39968 CVE-2025-39969                      CVE-2025-39970 CVE-2025-39971 CVE-2025-39972 CVE-2025-39973                      CVE-2025-39977 CVE-2025-39978 CVE-2025-39980 CVE-2025-39982                      CVE-2025-39985 CVE-2025-39986 CVE-2025-39987 CVE-2025-39988                      CVE-2025-39993 CVE-2025-39994 CVE-2025-39995 CVE-2025-39996                      CVE-2025-39998 CVE-2025-40001 CVE-2025-40006 CVE-2025-40008                      CVE-2025-40010 CVE-2025-40011 CVE-2025-40013 CVE-2025-40018                      CVE-2025-40019 CVE-2025-40020 CVE-2025-40021 CVE-2025-40022                      CVE-2025-40026 CVE-2025-40027 CVE-2025-40029 CVE-2025-40030                      CVE-2025-40032 CVE-2025-40035 CVE-2025-40036 CVE-2025-40040                      CVE-2025-40042 CVE-2025-40043 CVE-2025-40044 CVE-2025-40048                      CVE-2025-40049 CVE-2025-40051 CVE-2025-40053 CVE-2025-40055                      CVE-2025-40056 CVE-2025-40060 CVE-2025-40062 CVE-2025-40068                      CVE-2025-40070 CVE-2025-40078 CVE-2025-40080 CVE-2025-40081                      CVE-2025-40084 CVE-2025-40085 CVE-2025-40087 CVE-2025-40088                      CVE-2025-40092 CVE-2025-40093 CVE-2025-40094 CVE-2025-40095                      CVE-2025-40096 CVE-2025-40099 CVE-2025-40100 CVE-2025-40103                      CVE-2025-40104 CVE-2025-40105 CVE-2025-40106 CVE-2025-40107                      CVE-2025-40109 CVE-2025-40111 CVE-2025-40112 CVE-2025-40115                      CVE-2025-40116 CVE-2025-40118 CVE-2025-40120 CVE-2025-40121                      CVE-2025-40123 CVE-2025-40124 CVE-2025-40125 CVE-2025-40126                      CVE-2025-40127 CVE-2025-40134 CVE-2025-40140 CVE-2025-40141                      CVE-2025-40153 CVE-2025-40154 CVE-2025-40156 CVE-2025-40167                      CVE-2025-40171 CVE-2025-40173 CVE-2025-40176 CVE-2025-40178                      CVE-2025-40179 CVE-2025-40183 CVE-2025-40186 CVE-2025-40187                      CVE-2025-40188 CVE-2025-40190 CVE-2025-40193 CVE-2025-40194                      CVE-2025-40197 CVE-2025-40198 CVE-2025-40200 CVE-2025-40201                      CVE-2025-40202 CVE-2025-40204 CVE-2025-40205 CVE-2025-40207

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 11 bullseye, these problems have been fixed in version     6.1.158-1~deb11u1.  This version additionally includes many more bug     fixes from stable updates 6.1.154-6.1.158.

    We recommend that you upgrade your linux-6.1 packages.

    For the detailed security status of linux-6.1 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.1

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in     tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in     tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which     calls tcp_disconnect() for the TFO socket. After the cited commit, tcp_disconnect() calls     reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk. Then, reqsk_fastopen_remove() in     tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the     drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk. Let's     remove reqsk_fastopen_remove() in tcp_conn_request(). Note that other callers make sure tp->fastopen_rsk     is not NULL. [0]: refcount_t: underflow; use-after-free. WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28     refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor     Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine,     BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b     c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f>     0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246     RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 RDX: 0000000000000000 RSI:
    00000000ffff7fff RDI: ffffffffac78a280 RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280     R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 R13: ffff9f65c7d23c00 R14:
    ffff9f65c7d26000 R15: ffff9f65c7a64ef8 FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000)     knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000180 CR3:
    000000000dbbe006 CR4: 0000000000372ef0 Call Trace: <IRQ> tcp_conn_request (./include/linux/refcount.h:400     ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965     ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) tcp_rcv_state_process     (net/ipv4/tcp_input.c:6708) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906)     ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input (net/ipv6/ip6_input.c:500) ipv6_rcv     (net/ipv6/ip6_input.c:311) __netif_receive_skb (net/core/dev.c:6104) process_backlog (net/core/dev.c:6456)
    __napi_poll (net/core/dev.c:7506) net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) handle_softirqs     (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480) </IRQ> (CVE-2025-40186)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1253 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: target_core_configfs: Add length check to avoid buffer overflow (CVE-2025-39998)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvs: Defer ip_vs_ftp unregister during netns cleanup (CVE-2025-40018)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (CVE-2025-40035)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: udf: fix OOB read in lengthAllocDescs handling (CVE-2025-40044)

    In the Linux kernel, the following vulnerability has been resolved:

    uio_hv_generic: Let userspace take care of interrupt mask (CVE-2025-40048)

    In the Linux kernel, the following vulnerability has been resolved:

    Squashfs: fix uninit-value in squashfs_get_parent (CVE-2025-40049)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: ntfs3: Fix integer overflow in run_unpack() (CVE-2025-40068)

    In the Linux kernel, the following vulnerability has been resolved:

    pps: fix warning in pps_register_cdev when register device fail (CVE-2025-40070)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Explicitly check accesses to bpf_sock_addr (CVE-2025-40078)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: restrict sockets to TCP and UDP (CVE-2025-40080)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (CVE-2025-40081)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: rng - Ensure set_ent is always present (CVE-2025-40109)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (CVE-2025-40115)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Enforce expected_attach_type for tailcall compatibility (CVE-2025-40123)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (CVE-2025-40125)

    In the Linux kernel, the following vulnerability has been resolved:

    dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: hugetlb: avoid soft lockup when mprotect to large memory area (CVE-2025-40153)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (CVE-2025-40186)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
279908	SUSE SLES12 Security Update : kernel (SUSE-SU-2025:4515-1)	Nessus	SuSE Local Security Checks	high
279907	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:4521-1)	Nessus	SuSE Local Security Checks	high
279906	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:4517-1)	Nessus	SuSE Local Security Checks	high
279905	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:4516-1)	Nessus	SuSE Local Security Checks	high
279677	openSUSE 16 Security Update : kernel (openSUSE-SU-2025:20172-1)	Nessus	SuSE Local Security Checks	high
279673	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:4505-1)	Nessus	SuSE Local Security Checks	high
279063	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:4422-1)	Nessus	SuSE Local Security Checks	high
279030	RHEL 8 : kernel (RHSA-2025:23463)	Nessus	Red Hat Local Security Checks	high
278993	RHEL 9 : kernel-rt (RHSA-2025:23422)	Nessus	Red Hat Local Security Checks	high
278991	RHEL 8 : kernel (RHSA-2025:23425)	Nessus	Red Hat Local Security Checks	high
278990	RHEL 9 : kernel (RHSA-2025:23450)	Nessus	Red Hat Local Security Checks	high
278950	RHEL 8 : kernel (RHSA-2025:23445)	Nessus	Red Hat Local Security Checks	high
278924	RHEL 9 : kernel (RHSA-2025:23426)	Nessus	Red Hat Local Security Checks	high
278923	RHEL 9 : kernel-rt (RHSA-2025:23424)	Nessus	Red Hat Local Security Checks	high
278922	RHEL 9 : kernel (RHSA-2025:23423)	Nessus	Red Hat Local Security Checks	high
278921	RHEL 8 : kernel (RHSA-2025:23427)	Nessus	Red Hat Local Security Checks	medium
278769	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2025:4393-1)	Nessus	SuSE Local Security Checks	high
278563	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2025-28048)	Nessus	Oracle Linux Local Security Checks	high
278560	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2025-28049)	Nessus	Oracle Linux Local Security Checks	medium
278559	Debian dla-4404 : ata-modules-5.10.0-35-armmp-di - security update	Nessus	Debian Local Security Checks	high
277213	RHEL 9 : kernel (RHSA-2025:22392)	Nessus	Red Hat Local Security Checks	high
276782	Debian dla-4379 : linux-config-6.1 - security update	Nessus	Debian Local Security Checks	medium
275333	Linux Distros Unpatched Vulnerability : CVE-2025-40186	Nessus	Misc.	high
271758	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1253)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2025-40186

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high

high

medium

high

high

medium

high

high