In the Linux kernel, the following vulnerability has been resolved: fuse: fix livelock in synchronous file put from fuseblk workers I observed a hang when running generic/323 against a fuseblk server. This test opens a file, initiates a lot of AIO writes to that file descriptor, and closes the file descriptor before the writes complete. Unsurprisingly, the AIO exerciser threads are mostly stuck waiting for responses from the fuseblk server: # cat /proc/372265/task/372313/stack [<0>] request_wait_answer+0x1fe/0x2a0 [fuse] [<0>] __fuse_simple_request+0xd3/0x2b0 [fuse] [<0>] fuse_do_getattr+0xfc/0x1f0 [fuse] [<0>] fuse_file_read_iter+0xbe/0x1c0 [fuse] [<0>] aio_read+0x130/0x1e0 [<0>] io_submit_one+0x542/0x860 [<0>] __x64_sys_io_submit+0x98/0x1a0 [<0>] do_syscall_64+0x37/0xf0 [<0>] entry_SYSCALL_64_after_hwframe+0x4b/0x53 But the /weird/ part is that the fuseblk server threads are waiting for responses from itself: # cat /proc/372210/task/372232/stack [<0>] request_wait_answer+0x1fe/0x2a0 [fuse] [<0>] __fuse_simple_request+0xd3/0x2b0 [fuse] [<0>] fuse_file_put+0x9a/0xd0 [fuse] [<0>] fuse_release+0x36/0x50 [fuse] [<0>] __fput+0xec/0x2b0 [<0>] task_work_run+0x55/0x90 [<0>] syscall_exit_to_user_mode+0xe9/0x100 [<0>] do_syscall_64+0x43/0xf0 [<0>] entry_SYSCALL_64_after_hwframe+0x4b/0x53 The fuseblk server is fuse2fs so there's nothing all that exciting in the server itself. So why is the fuse server calling fuse_file_put? The commit message for the fstest sheds some light on that: "By closing the file descriptor before calling io_destroy, you pretty much guarantee that the last put on the ioctx will be done in interrupt context (during I/O completion). Aha. AIO fgets a new struct file from the fd when it queues the ioctx. The completion of the FUSE_WRITE command from userspace causes the fuse server to call the AIO completion function. The completion puts the struct file, queuing a delayed fput to the fuse server task. When the fuse server task returns to userspace, it has to run the delayed fput, which in the case of a fuseblk server, it does synchronously. Sending the FUSE_RELEASE command sychronously from fuse server threads is a bad idea because a client program can initiate enough simultaneous AIOs such that all the fuse server threads end up in delayed_fput, and now there aren't any threads left to handle the queued fuse commands. Fix this by only using asynchronous fputs when closing files, and leave a comment explaining why.

The remote Ubuntu 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8029-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - MIPS architecture;

    - Nios II architecture;

    - PA-RISC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - Sun Sparc architecture;

    - x86 architecture;

    - Xtensa architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Compute Acceleration Framework;

    - ACPI drivers;

    - Drivers core;

    - Network block device driver;

    - Bluetooth drivers;

    - Bus devices;

    - Hardware random number generator core;

    - Character device driver;

    - Clock framework and drivers;

    - Data acquisition framework and drivers;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - CXL (Compute Express Link) drivers;

    - Device frequency scaling framework;

    - ARM SCMI message protocol;

    - GPIO subsystem;

    - GPU drivers;

    - Hardware monitoring drivers;

    - HW tracing;

    - InfiniBand drivers;

    - Input Device (Miscellaneous) drivers;

    - IOMMU subsystem;

    - ISDN/mISDN subsystem;

    - Mailbox framework;

    - Multiple devices driver;

    - Media drivers;

    - Fastrpc Driver;

    - PCI Endpoint Test driver;

    - VMware Balloon Driver;

    - MOST (Media Oriented Systems Transport) drivers;

    - Network drivers;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - NVME drivers;

    - PCI subsystem;

    - Performance monitor drivers;

    - Pin controllers subsystem;

    - Mellanox platform drivers;

    - x86 platform drivers;

    - ARM PM domains;

    - PPS (Pulse Per Second) driver;

    - PTP clock framework;

    - PWM drivers;

    - Remote Processor subsystem;

    - SCSI subsystem;

    - SPI subsystem;

    - Trusted Execution Environment drivers;

    - Thunderbolt and USB4 drivers;

    - TTY drivers;

    - UFS subsystem;

    - Userspace I/O drivers;

    - Cadence USB3 driver;

    - USB Gadget drivers;

    - USB Host Controller drivers;

    - vDPA drivers;

    - Virtio Host (VHOST) subsystem;

    - Framebuffer layer;

    - Xen hypervisor drivers;

    - File systems infrastructure;

    - BTRFS file system;

    - Ceph distributed file system;

    - EROFS file system;

    - Ext4 file system;

    - F2FS file system;

    - GFS2 file system;

    - JFS file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - File system notification infrastructure;

    - NTFS3 file system;

    - Proc file system;

    - Diskquota system;

    - SMB network file system;

    - BPF subsystem;

    - Mellanox drivers;

    - Memory management;

    - Virtio network driver;

    - Bluetooth subsystem;

    - IP tunnels definitions;

    - io_uring subsystem;

    - Kernel crash support code;

    - Perf events;

    - Kernel futex primitives;

    - PID allocator;

    - Scheduler infrastructure;

    - Syscalls implementation;

    - Timer subsystem;

    - Tracing infrastructure;

    - 9P file system network protocol;

    - Ethernet bridge;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Netfilter;

    - NFC subsystem;

    - Network traffic control;

    - SCTP protocol;

    - SMC sockets;

    - Sun RPC protocol;

    - TIPC protocol;

    - TLS protocol;

    - VMware vSockets driver;

    - eXpress Data Path;

    - XFRM subsystem;

    - Integrity Measurement Architecture(IMA) framework;

    - ALSA framework;

    - HD-audio driver;

    - AMD SoC Alsa drivers;

    - WCD audio codecs;

    - Intel ASoC drivers;

    - USB sound devices;

    - KVM subsystem; (CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004, CVE-2025-40029,     CVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033, CVE-2025-40034, CVE-2025-40035,     CVE-2025-40036, CVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040, CVE-2025-40042,     CVE-2025-40043, CVE-2025-40044, CVE-2025-40045, CVE-2025-40046, CVE-2025-40047, CVE-2025-40048,     CVE-2025-40049, CVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053, CVE-2025-40054,     CVE-2025-40055, CVE-2025-40056, CVE-2025-40057, CVE-2025-40058, CVE-2025-40059, CVE-2025-40060,     CVE-2025-40061, CVE-2025-40062, CVE-2025-40063, CVE-2025-40064, CVE-2025-40065, CVE-2025-40066,     CVE-2025-40067, CVE-2025-40068, CVE-2025-40069, CVE-2025-40070, CVE-2025-40071, CVE-2025-40072,     CVE-2025-40073, CVE-2025-40074, CVE-2025-40075, CVE-2025-40076, CVE-2025-40077, CVE-2025-40078,     CVE-2025-40079, CVE-2025-40080, CVE-2025-40081, CVE-2025-40082, CVE-2025-40084, CVE-2025-40085,     CVE-2025-40086, CVE-2025-40087, CVE-2025-40088, CVE-2025-40089, CVE-2025-40091, CVE-2025-40092,     CVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096, CVE-2025-40097, CVE-2025-40098,     CVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40102, CVE-2025-40103, CVE-2025-40104,     CVE-2025-40105, CVE-2025-40106, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112, CVE-2025-40113,     CVE-2025-40115, CVE-2025-40116, CVE-2025-40117, CVE-2025-40118, CVE-2025-40119, CVE-2025-40120,     CVE-2025-40121, CVE-2025-40122, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126,     CVE-2025-40127, CVE-2025-40129, CVE-2025-40130, CVE-2025-40131, CVE-2025-40132, CVE-2025-40133,     CVE-2025-40134, CVE-2025-40135, CVE-2025-40136, CVE-2025-40137, CVE-2025-40138, CVE-2025-40139,     CVE-2025-40140, CVE-2025-40141, CVE-2025-40142, CVE-2025-40143, CVE-2025-40145, CVE-2025-40146,     CVE-2025-40147, CVE-2025-40148, CVE-2025-40149, CVE-2025-40150, CVE-2025-40152, CVE-2025-40153,     CVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40158, CVE-2025-40159, CVE-2025-40160,     CVE-2025-40161, CVE-2025-40162, CVE-2025-40163, CVE-2025-40164, CVE-2025-40165, CVE-2025-40166,     CVE-2025-40167, CVE-2025-40168, CVE-2025-40169, CVE-2025-40170, CVE-2025-40171, CVE-2025-40172,     CVE-2025-40173, CVE-2025-40174, CVE-2025-40175, CVE-2025-40176, CVE-2025-40177, CVE-2025-40178,     CVE-2025-40179, CVE-2025-40180, CVE-2025-40181, CVE-2025-40182, CVE-2025-40183, CVE-2025-40184,     CVE-2025-40185, CVE-2025-40186, CVE-2025-40187, CVE-2025-40188, CVE-2025-40189, CVE-2025-40191,     CVE-2025-40192, CVE-2025-40193, CVE-2025-40194, CVE-2025-40195, CVE-2025-40196, CVE-2025-40198,     CVE-2025-40199, CVE-2025-40200, CVE-2025-40201, CVE-2025-40203, CVE-2025-40204, CVE-2025-40205,     CVE-2025-40206, CVE-2025-40207, CVE-2025-40208, CVE-2025-40209, CVE-2025-40210, CVE-2025-40211,     CVE-2025-40212, CVE-2025-40213, CVE-2025-40217, CVE-2025-40218, CVE-2025-40219, CVE-2025-40220,     CVE-2025-40221, CVE-2025-40222, CVE-2025-40223, CVE-2025-40224, CVE-2025-40225, CVE-2025-40226,     CVE-2025-40227, CVE-2025-40228, CVE-2025-40229, CVE-2025-40230, CVE-2025-40231, CVE-2025-40233,     CVE-2025-40234, CVE-2025-40235, CVE-2025-40236, CVE-2025-40237, CVE-2025-40238, CVE-2025-40239,     CVE-2025-40240, CVE-2025-40241, CVE-2025-40242, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245,     CVE-2025-40256, CVE-2025-40267, CVE-2025-40268, CVE-2025-40269, CVE-2025-40270, CVE-2025-40271,     CVE-2025-40272, CVE-2025-40273, CVE-2025-40274, CVE-2025-40275, CVE-2025-40276, CVE-2025-40277,     CVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283,     CVE-2025-40284, CVE-2025-40285, CVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289,     CVE-2025-40291, CVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40295, CVE-2025-40296,     CVE-2025-40297, CVE-2025-40298, CVE-2025-40299, CVE-2025-40301, CVE-2025-40302, CVE-2025-40303,     CVE-2025-40304, CVE-2025-40305, CVE-2025-40306, CVE-2025-40307, CVE-2025-40308, CVE-2025-40309,     CVE-2025-40310, CVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314, CVE-2025-40315,     CVE-2025-40316, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319, CVE-2025-40320, CVE-2025-40321,     CVE-2025-40322, CVE-2025-40323, CVE-2025-40324, CVE-2025-40326, CVE-2025-40327, CVE-2025-40328,     CVE-2025-40329, CVE-2025-40330, CVE-2025-40331, CVE-2025-40332, CVE-2025-40333, CVE-2025-40334,     CVE-2025-40335, CVE-2025-40336, CVE-2025-40337, CVE-2025-40338, CVE-2025-40339, CVE-2025-40340,     CVE-2025-40341, CVE-2025-40342, CVE-2025-40343, CVE-2025-40344, CVE-2025-40346, CVE-2025-40347,     CVE-2025-40349, CVE-2025-40350, CVE-2025-40351, CVE-2025-40352, CVE-2025-40353, CVE-2025-40354,     CVE-2025-40355, CVE-2025-40356, CVE-2025-40357, CVE-2025-40358, CVE-2025-40359, CVE-2025-40360,     CVE-2025-40362, CVE-2025-40363, CVE-2025-68167, CVE-2025-68168, CVE-2025-68169, CVE-2025-68170,     CVE-2025-68171, CVE-2025-68172, CVE-2025-68173, CVE-2025-68174, CVE-2025-68175, CVE-2025-68176,     CVE-2025-68177, CVE-2025-68178, CVE-2025-68179, CVE-2025-68180, CVE-2025-68181, CVE-2025-68182,     CVE-2025-68183, CVE-2025-68184, CVE-2025-68185, CVE-2025-68186, CVE-2025-68187, CVE-2025-68188,     CVE-2025-68189, CVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68193, CVE-2025-68194,     CVE-2025-68196, CVE-2025-68197, CVE-2025-68198, CVE-2025-68199, CVE-2025-68200, CVE-2025-68201,     CVE-2025-68202, CVE-2025-68204, CVE-2025-68205, CVE-2025-68206, CVE-2025-68207, CVE-2025-68208,     CVE-2025-68209, CVE-2025-68210, CVE-2025-68211, CVE-2025-68239, CVE-2025-68240, CVE-2025-68241,     CVE-2025-68242, CVE-2025-68243, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246, CVE-2025-68247,     CVE-2025-68248, CVE-2025-68249, CVE-2025-68250, CVE-2025-68251, CVE-2025-68253, CVE-2025-68309,     CVE-2025-68310, CVE-2025-68311, CVE-2025-68312, CVE-2025-68313, CVE-2025-68314, CVE-2025-68315,     CVE-2025-68316, CVE-2025-68317, CVE-2025-68318, CVE-2025-68319, CVE-2025-68320, CVE-2025-68321,     CVE-2025-68322, CVE-2025-68734)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8034-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - Nios II architecture;

    - Sun Sparc architecture;

    - User-Mode Linux (UML);

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Drivers core;

    - Bus devices;

    - Hardware random number generator core;

    - Data acquisition framework and drivers;

    - CPU frequency scaling framework;

    - DMA engine subsystem;

    - GPU drivers;

    - HW tracing;

    - Input Device (Miscellaneous) drivers;

    - Multiple devices driver;

    - Media drivers;

    - MOST (Media Oriented Systems Transport) drivers;

    - MTD block device drivers;

    - Network drivers;

    - NVME drivers;

    - PCI subsystem;

    - Performance monitor drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - PPS (Pulse Per Second) driver;

    - PWM drivers;

    - SCSI subsystem;

    - TCM subsystem;

    - Userspace I/O drivers;

    - USB Gadget drivers;

    - USB Host Controller drivers;

    - Framebuffer layer;

    - BTRFS file system;

    - File systems infrastructure;

    - Ext4 file system;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - SMB network file system;

    - padata parallel execution mechanism;

    - IP tunnels definitions;

    - Network sockets;

    - XFRM subsystem;

    - Control group (cgroup);

    - Padata parallel execution mechanism;

    - PID allocator;

    - Tracing infrastructure;

    - Memory management;

    - 9P file system network protocol;

    - Ethernet bridge;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - NFC subsystem;

    - RF switch subsystem;

    - SCTP protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Intel ASoC drivers;

    - USB sound devices; (CVE-2024-53114, CVE-2024-56538, CVE-2024-58011, CVE-2025-21861, CVE-2025-22058,     CVE-2025-23143, CVE-2025-38236, CVE-2025-38248, CVE-2025-38584, CVE-2025-39869, CVE-2025-39873,     CVE-2025-39876, CVE-2025-39880, CVE-2025-39883, CVE-2025-39885, CVE-2025-39907, CVE-2025-39911,     CVE-2025-39913, CVE-2025-39923, CVE-2025-39934, CVE-2025-39937, CVE-2025-39943, CVE-2025-39945,     CVE-2025-39949, CVE-2025-39951, CVE-2025-39953, CVE-2025-39955, CVE-2025-39967, CVE-2025-39968,     CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39980,     CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39994, CVE-2025-39995,     CVE-2025-39996, CVE-2025-39998, CVE-2025-40001, CVE-2025-40006, CVE-2025-40011, CVE-2025-40020,     CVE-2025-40021, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40035,     CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40048, CVE-2025-40049, CVE-2025-40053,     CVE-2025-40055, CVE-2025-40060, CVE-2025-40068, CVE-2025-40070, CVE-2025-40078, CVE-2025-40081,     CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40094, CVE-2025-40105,     CVE-2025-40106, CVE-2025-40109, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116,     CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126,     CVE-2025-40127, CVE-2025-40134, CVE-2025-40140, CVE-2025-40153, CVE-2025-40154, CVE-2025-40167,     CVE-2025-40171, CVE-2025-40173, CVE-2025-40178, CVE-2025-40179, CVE-2025-40183, CVE-2025-40187,     CVE-2025-40188, CVE-2025-40194, CVE-2025-40200, CVE-2025-40204, CVE-2025-40205, CVE-2025-40215,     CVE-2025-40219, CVE-2025-40220, CVE-2025-40223, CVE-2025-40231, CVE-2025-40233, CVE-2025-40240,     CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40346, CVE-2025-40349, CVE-2025-40351,     CVE-2025-68249, CVE-2025-71162)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8030-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - MIPS architecture;

    - Nios II architecture;

    - PA-RISC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - Sun Sparc architecture;

    - x86 architecture;

    - Xtensa architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Compute Acceleration Framework;

    - ACPI drivers;

    - Drivers core;

    - Network block device driver;

    - Bluetooth drivers;

    - Bus devices;

    - Hardware random number generator core;

    - Character device driver;

    - Clock framework and drivers;

    - Data acquisition framework and drivers;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - CXL (Compute Express Link) drivers;

    - Device frequency scaling framework;

    - ARM SCMI message protocol;

    - GPIO subsystem;

    - GPU drivers;

    - Hardware monitoring drivers;

    - HW tracing;

    - InfiniBand drivers;

    - Input Device (Miscellaneous) drivers;

    - IOMMU subsystem;

    - ISDN/mISDN subsystem;

    - Mailbox framework;

    - Multiple devices driver;

    - Media drivers;

    - Fastrpc Driver;

    - PCI Endpoint Test driver;

    - VMware Balloon Driver;

    - MOST (Media Oriented Systems Transport) drivers;

    - Network drivers;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - NVME drivers;

    - PCI subsystem;

    - Performance monitor drivers;

    - Pin controllers subsystem;

    - Mellanox platform drivers;

    - x86 platform drivers;

    - ARM PM domains;

    - PPS (Pulse Per Second) driver;

    - PTP clock framework;

    - PWM drivers;

    - Remote Processor subsystem;

    - SCSI subsystem;

    - SPI subsystem;

    - Trusted Execution Environment drivers;

    - Thunderbolt and USB4 drivers;

    - TTY drivers;

    - UFS subsystem;

    - Userspace I/O drivers;

    - Cadence USB3 driver;

    - USB Gadget drivers;

    - USB Host Controller drivers;

    - vDPA drivers;

    - Virtio Host (VHOST) subsystem;

    - Framebuffer layer;

    - Xen hypervisor drivers;

    - File systems infrastructure;

    - BTRFS file system;

    - Ceph distributed file system;

    - EROFS file system;

    - Ext4 file system;

    - F2FS file system;

    - GFS2 file system;

    - JFS file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - File system notification infrastructure;

    - NTFS3 file system;

    - Proc file system;

    - Diskquota system;

    - SMB network file system;

    - BPF subsystem;

    - Mellanox drivers;

    - Memory management;

    - Virtio network driver;

    - Bluetooth subsystem;

    - IP tunnels definitions;

    - io_uring subsystem;

    - Kernel crash support code;

    - Perf events;

    - Kernel futex primitives;

    - PID allocator;

    - Scheduler infrastructure;

    - Syscalls implementation;

    - Timer subsystem;

    - Tracing infrastructure;

    - 9P file system network protocol;

    - Ethernet bridge;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Netfilter;

    - NFC subsystem;

    - Network traffic control;

    - SCTP protocol;

    - SMC sockets;

    - Sun RPC protocol;

    - TIPC protocol;

    - TLS protocol;

    - VMware vSockets driver;

    - eXpress Data Path;

    - XFRM subsystem;

    - Integrity Measurement Architecture(IMA) framework;

    - ALSA framework;

    - HD-audio driver;

    - AMD SoC Alsa drivers;

    - WCD audio codecs;

    - Intel ASoC drivers;

    - USB sound devices;

    - KVM subsystem; (CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004, CVE-2025-40029,     CVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033, CVE-2025-40034, CVE-2025-40035,     CVE-2025-40036, CVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040, CVE-2025-40042,     CVE-2025-40043, CVE-2025-40044, CVE-2025-40045, CVE-2025-40046, CVE-2025-40047, CVE-2025-40048,     CVE-2025-40049, CVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053, CVE-2025-40054,     CVE-2025-40055, CVE-2025-40056, CVE-2025-40057, CVE-2025-40058, CVE-2025-40059, CVE-2025-40060,     CVE-2025-40061, CVE-2025-40062, CVE-2025-40063, CVE-2025-40064, CVE-2025-40065, CVE-2025-40066,     CVE-2025-40067, CVE-2025-40068, CVE-2025-40069, CVE-2025-40070, CVE-2025-40071, CVE-2025-40072,     CVE-2025-40073, CVE-2025-40074, CVE-2025-40075, CVE-2025-40076, CVE-2025-40077, CVE-2025-40078,     CVE-2025-40079, CVE-2025-40080, CVE-2025-40081, CVE-2025-40082, CVE-2025-40084, CVE-2025-40085,     CVE-2025-40086, CVE-2025-40087, CVE-2025-40088, CVE-2025-40089, CVE-2025-40091, CVE-2025-40092,     CVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096, CVE-2025-40097, CVE-2025-40098,     CVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40102, CVE-2025-40103, CVE-2025-40104,     CVE-2025-40105, CVE-2025-40106, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112, CVE-2025-40113,     CVE-2025-40115, CVE-2025-40116, CVE-2025-40117, CVE-2025-40118, CVE-2025-40119, CVE-2025-40120,     CVE-2025-40121, CVE-2025-40122, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126,     CVE-2025-40127, CVE-2025-40129, CVE-2025-40130, CVE-2025-40131, CVE-2025-40132, CVE-2025-40133,     CVE-2025-40134, CVE-2025-40135, CVE-2025-40136, CVE-2025-40137, CVE-2025-40138, CVE-2025-40139,     CVE-2025-40140, CVE-2025-40141, CVE-2025-40142, CVE-2025-40143, CVE-2025-40145, CVE-2025-40146,     CVE-2025-40147, CVE-2025-40148, CVE-2025-40149, CVE-2025-40150, CVE-2025-40152, CVE-2025-40153,     CVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40158, CVE-2025-40159, CVE-2025-40160,     CVE-2025-40161, CVE-2025-40162, CVE-2025-40163, CVE-2025-40164, CVE-2025-40165, CVE-2025-40166,     CVE-2025-40167, CVE-2025-40168, CVE-2025-40169, CVE-2025-40170, CVE-2025-40171, CVE-2025-40172,     CVE-2025-40173, CVE-2025-40174, CVE-2025-40175, CVE-2025-40176, CVE-2025-40177, CVE-2025-40178,     CVE-2025-40179, CVE-2025-40180, CVE-2025-40182, CVE-2025-40183, CVE-2025-40184, CVE-2025-40185,     CVE-2025-40186, CVE-2025-40187, CVE-2025-40188, CVE-2025-40189, CVE-2025-40191, CVE-2025-40192,     CVE-2025-40193, CVE-2025-40194, CVE-2025-40195, CVE-2025-40196, CVE-2025-40198, CVE-2025-40199,     CVE-2025-40200, CVE-2025-40201, CVE-2025-40203, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206,     CVE-2025-40207, CVE-2025-40208, CVE-2025-40209, CVE-2025-40210, CVE-2025-40211, CVE-2025-40212,     CVE-2025-40213, CVE-2025-40217, CVE-2025-40218, CVE-2025-40219, CVE-2025-40220, CVE-2025-40221,     CVE-2025-40222, CVE-2025-40223, CVE-2025-40224, CVE-2025-40225, CVE-2025-40226, CVE-2025-40227,     CVE-2025-40228, CVE-2025-40229, CVE-2025-40230, CVE-2025-40231, CVE-2025-40233, CVE-2025-40234,     CVE-2025-40235, CVE-2025-40236, CVE-2025-40237, CVE-2025-40238, CVE-2025-40239, CVE-2025-40240,     CVE-2025-40241, CVE-2025-40242, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40256,     CVE-2025-40267, CVE-2025-40268, CVE-2025-40269, CVE-2025-40270, CVE-2025-40271, CVE-2025-40272,     CVE-2025-40273, CVE-2025-40274, CVE-2025-40275, CVE-2025-40276, CVE-2025-40277, CVE-2025-40278,     CVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283, CVE-2025-40284,     CVE-2025-40285, CVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40291,     CVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40295, CVE-2025-40296, CVE-2025-40297,     CVE-2025-40298, CVE-2025-40299, CVE-2025-40301, CVE-2025-40302, CVE-2025-40303, CVE-2025-40304,     CVE-2025-40305, CVE-2025-40306, CVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310,     CVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40316,     CVE-2025-40317, CVE-2025-40318, CVE-2025-40319, CVE-2025-40320, CVE-2025-40321, CVE-2025-40322,     CVE-2025-40323, CVE-2025-40324, CVE-2025-40326, CVE-2025-40327, CVE-2025-40328, CVE-2025-40329,     CVE-2025-40330, CVE-2025-40331, CVE-2025-40332, CVE-2025-40333, CVE-2025-40334, CVE-2025-40335,     CVE-2025-40336, CVE-2025-40337, CVE-2025-40338, CVE-2025-40339, CVE-2025-40340, CVE-2025-40341,     CVE-2025-40342, CVE-2025-40343, CVE-2025-40344, CVE-2025-40346, CVE-2025-40347, CVE-2025-40349,     CVE-2025-40350, CVE-2025-40351, CVE-2025-40352, CVE-2025-40353, CVE-2025-40354, CVE-2025-40355,     CVE-2025-40356, CVE-2025-40357, CVE-2025-40358, CVE-2025-40359, CVE-2025-40360, CVE-2025-40362,     CVE-2025-40363, CVE-2025-68167, CVE-2025-68168, CVE-2025-68169, CVE-2025-68170, CVE-2025-68171,     CVE-2025-68172, CVE-2025-68173, CVE-2025-68174, CVE-2025-68175, CVE-2025-68176, CVE-2025-68177,     CVE-2025-68178, CVE-2025-68179, CVE-2025-68180, CVE-2025-68181, CVE-2025-68182, CVE-2025-68183,     CVE-2025-68184, CVE-2025-68185, CVE-2025-68186, CVE-2025-68187, CVE-2025-68188, CVE-2025-68189,     CVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68193, CVE-2025-68194, CVE-2025-68196,     CVE-2025-68197, CVE-2025-68198, CVE-2025-68199, CVE-2025-68200, CVE-2025-68201, CVE-2025-68202,     CVE-2025-68204, CVE-2025-68205, CVE-2025-68206, CVE-2025-68207, CVE-2025-68208, CVE-2025-68209,     CVE-2025-68210, CVE-2025-68211, CVE-2025-68239, CVE-2025-68240, CVE-2025-68241, CVE-2025-68242,     CVE-2025-68243, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246, CVE-2025-68247, CVE-2025-68248,     CVE-2025-68249, CVE-2025-68250, CVE-2025-68251, CVE-2025-68253, CVE-2025-68309, CVE-2025-68310,     CVE-2025-68311, CVE-2025-68312, CVE-2025-68313, CVE-2025-68314, CVE-2025-68315, CVE-2025-68316,     CVE-2025-68317, CVE-2025-68318, CVE-2025-68319, CVE-2025-68320, CVE-2025-68321, CVE-2025-68322,     CVE-2025-68734)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8033-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - Nios II architecture;

    - Sun Sparc architecture;

    - User-Mode Linux (UML);

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Drivers core;

    - Bus devices;

    - Hardware random number generator core;

    - Data acquisition framework and drivers;

    - CPU frequency scaling framework;

    - DMA engine subsystem;

    - GPU drivers;

    - HW tracing;

    - Input Device (Miscellaneous) drivers;

    - Multiple devices driver;

    - Media drivers;

    - MOST (Media Oriented Systems Transport) drivers;

    - MTD block device drivers;

    - Network drivers;

    - NVME drivers;

    - PCI subsystem;

    - Performance monitor drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - PPS (Pulse Per Second) driver;

    - PWM drivers;

    - SCSI subsystem;

    - TCM subsystem;

    - Userspace I/O drivers;

    - USB Gadget drivers;

    - USB Host Controller drivers;

    - Framebuffer layer;

    - BTRFS file system;

    - File systems infrastructure;

    - Ext4 file system;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - SMB network file system;

    - padata parallel execution mechanism;

    - IP tunnels definitions;

    - Network sockets;

    - XFRM subsystem;

    - Control group (cgroup);

    - Padata parallel execution mechanism;

    - PID allocator;

    - Tracing infrastructure;

    - Memory management;

    - 9P file system network protocol;

    - Ethernet bridge;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - NFC subsystem;

    - RF switch subsystem;

    - SCTP protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Intel ASoC drivers;

    - USB sound devices; (CVE-2024-53114, CVE-2024-56538, CVE-2024-58011, CVE-2025-21861, CVE-2025-22058,     CVE-2025-23143, CVE-2025-38236, CVE-2025-38248, CVE-2025-38584, CVE-2025-39869, CVE-2025-39873,     CVE-2025-39876, CVE-2025-39880, CVE-2025-39883, CVE-2025-39885, CVE-2025-39907, CVE-2025-39911,     CVE-2025-39913, CVE-2025-39923, CVE-2025-39934, CVE-2025-39937, CVE-2025-39943, CVE-2025-39945,     CVE-2025-39949, CVE-2025-39951, CVE-2025-39953, CVE-2025-39955, CVE-2025-39967, CVE-2025-39968,     CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39980,     CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39994, CVE-2025-39995,     CVE-2025-39996, CVE-2025-39998, CVE-2025-40001, CVE-2025-40006, CVE-2025-40011, CVE-2025-40020,     CVE-2025-40021, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40035,     CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40048, CVE-2025-40049, CVE-2025-40053,     CVE-2025-40055, CVE-2025-40060, CVE-2025-40068, CVE-2025-40070, CVE-2025-40078, CVE-2025-40081,     CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40094, CVE-2025-40105,     CVE-2025-40106, CVE-2025-40109, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116,     CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126,     CVE-2025-40127, CVE-2025-40134, CVE-2025-40140, CVE-2025-40153, CVE-2025-40154, CVE-2025-40167,     CVE-2025-40171, CVE-2025-40173, CVE-2025-40178, CVE-2025-40179, CVE-2025-40183, CVE-2025-40187,     CVE-2025-40188, CVE-2025-40194, CVE-2025-40200, CVE-2025-40204, CVE-2025-40205, CVE-2025-40215,     CVE-2025-40219, CVE-2025-40220, CVE-2025-40223, CVE-2025-40231, CVE-2025-40233, CVE-2025-40240,     CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40346, CVE-2025-40349, CVE-2025-40351,     CVE-2025-68249)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:20220-1 advisory.

    The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
    - CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
    - CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
    - CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference     (bsc#1252861).
    - CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
    - CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
    - CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
    - CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
    - CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
    - CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
    - CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
    - CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
    - CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
    - CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
    - CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
    - CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
    - CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
    - CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
    - CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
    - CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
    - CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
    - CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
    - CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
    - CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
    - CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
    - CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in       qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
    - CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
    - CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
    - CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
    - CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
    - CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
    - CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
    - CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
    - CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
    - CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak     (bsc#1254825).
    - CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
    - CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
    - CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
    - CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
    - CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
    - CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
    - CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
    - CVE-2025-40330: bnxt_en: Shutdown FW DMA in bnxt_shutdown() (bsc#1254616).
    - CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
    - CVE-2025-40338: ASoC: Intel: avs: Do not share the name pointer between components (bsc#1255273).
    - CVE-2025-40346: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (bsc#1255318).
    - CVE-2025-40347: net: enetc: fix the deadlock of enetc_mdio_lock (bsc#1255262).
    - CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ     (bsc#1255260).
    - CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).
    - CVE-2025-40357: net/smc: fix general protection fault in __smc_diag_dump (bsc#1255097).
    - CVE-2025-40359: perf/x86/intel: Fix KASAN global-out-of-bounds warning (bsc#1255087).
    - CVE-2025-40362: ceph: fix multifs mds auth caps issue (bsc#1255103).
    - CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).
    - CVE-2025-68197: bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (bsc#1255242).
    - CVE-2025-68198: crash: fix crashkernel resource shrink (bsc#1255243).
    - CVE-2025-68202: sched_ext: Fix unsafe locking in the scx_dump_state() (bsc#1255223).
    - CVE-2025-68206: netfilter: nft_ct: add seqadj extension for natted connections (bsc#1255142).
    - CVE-2025-68208: bpf: account for current allocated stack depth in widen_imprecise_scalars()     (bsc#1255227).
    - CVE-2025-68209: mlx5: Fix default values in create CQ (bsc#1255230).
    - CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).
    - CVE-2025-68239: binfmt_misc: restore write access before closing files opened by open_exec()     (bsc#1255272).
    - CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (bsc#1255199).
    - CVE-2025-68264: ext4: refresh inline data size before write operations (bsc#1255380).
    - CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
    - CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key()     (bsc#1255377).
    - CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
    - CVE-2025-68293: mm/huge_memory: fix NULL pointer deference when splitting folio (bsc#1255150).
    - CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).
    - CVE-2025-68302: net: sxgbe: fix potential NULL dereference in sxgbe_rx() (bsc#1255121).
    - CVE-2025-68317: io_uring/zctx: check chained notif contexts (bsc#1255354).
    - CVE-2025-68340: team: Move team device type change at the end of team_port_add (bsc#1255507).
    - CVE-2025-68353: net: vxlan: prevent NULL deref in vxlan_xmit_one (bsc#1255533).
    - CVE-2025-68363: bpf: Check skb->transport_header is set in bpf_skb_check_mtu (bsc#1255552).
    - CVE-2025-68378: bpf: Refactor stack map trace depth calculation into helper function (bsc#1255614).
    - CVE-2025-68736: landlock: Optimize file path walks and prepare for audit support (bsc#1255698).
    - CVE-2025-68742: bpf: Fix invalid prog->stats access when update_effective_progs fails (bsc#1255707).
    - CVE-2025-68744: bpf: Free special fields when update [lru_,]percpu_hash maps (bsc#1255709).
    - CVE-2025-71096: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (bsc#1256606).

    The following non security issues were fixed:

    - KVM: SEV: Drop GHCB_VERSION_DEFAULT and open code it (bsc#1255672).
    - Set HZ=1000 for ppc64 default configuration (jsc#PED-14344)
    - bpf: Do not limit bpf_cgroup_from_id to current's namespace (bsc#1255433).
    - btrfs: handle aligned EOF truncation correctly for subpage cases (bsc#1253238).
    - cgroup: rstat: use LOCK CMPXCHG in css_rstat_updated (bsc#1255434).
    - cifs: update dstaddr whenever channel iface is updated (git-fixes).
    - cpuidle: menu: Use residency threshold in polling state override decisions (bsc#1255026).
    - cpuset: fix warning when disabling remote partition (bsc#1256794).
    - ext4: use optimized mballoc scanning regardless of inode format (bsc#1254378).
    - net: usb: pegasus: fix memory leak in update_eth_regs_async() (git-fixes).
    - netdevsim: print human readable IP address (bsc#1255071).
    - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event       handling (bsc#1253262 ltc#216029).
    - powerpc/kexec: Enable SMT before waking offline CPUs (bsc#1214285       bsc#1205462 ltc#200161 ltc#200588 git-fixes bsc#1253739 ltc#211493       bsc#1254244 ltc#216496).
    - sched: Increase sched_tick_remote timeout (bsc#1254510).
    - selftests: net: fib-onlink-tests: Set high metric for default IPv6 route (bsc#1255346).
    - selftests: net: use slowwait to make sure IPv6 setup finished (bsc#1255349).
    - selftests: net: use slowwait to stabilize vrf_route_leaking test (bsc#1255349).
    - serial: xilinx_uartps: Use helper function hrtimer_update_function() (stable-fixes).
    - supported.conf: Mark lan 743x supported (jsc#PED-14571)
    - tick/sched: Limit non-timekeeper CPUs calling jiffies update (bsc#1254477).
    - wifi: ath10k: Avoid vdev delete timeout when firmware is already down (stable-fixes).
    - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256495).
    - x86/microcode/AMD: Make __verify_patch_size() return bool (bsc#1256495).
    - x86/microcode/AMD: Remove bogus comment from parse_container() (bsc#1256495).
    - x86/microcode/AMD: Select which microcode patch to load (bsc#1256495).
    - x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256495).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:20228-1 advisory.

    The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
    - CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
    - CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
    - CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference     (bsc#1252861).
    - CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
    - CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
    - CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
    - CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
    - CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
    - CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
    - CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
    - CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
    - CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
    - CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
    - CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
    - CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
    - CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
    - CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
    - CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
    - CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
    - CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
    - CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
    - CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
    - CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
    - CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
    - CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in       qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
    - CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
    - CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
    - CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
    - CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
    - CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
    - CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
    - CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
    - CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
    - CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak     (bsc#1254825).
    - CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
    - CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
    - CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
    - CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
    - CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
    - CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
    - CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
    - CVE-2025-40330: bnxt_en: Shutdown FW DMA in bnxt_shutdown() (bsc#1254616).
    - CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
    - CVE-2025-40338: ASoC: Intel: avs: Do not share the name pointer between components (bsc#1255273).
    - CVE-2025-40346: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (bsc#1255318).
    - CVE-2025-40347: net: enetc: fix the deadlock of enetc_mdio_lock (bsc#1255262).
    - CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ     (bsc#1255260).
    - CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).
    - CVE-2025-40357: net/smc: fix general protection fault in __smc_diag_dump (bsc#1255097).
    - CVE-2025-40359: perf/x86/intel: Fix KASAN global-out-of-bounds warning (bsc#1255087).
    - CVE-2025-40362: ceph: fix multifs mds auth caps issue (bsc#1255103).
    - CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).
    - CVE-2025-68197: bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (bsc#1255242).
    - CVE-2025-68198: crash: fix crashkernel resource shrink (bsc#1255243).
    - CVE-2025-68202: sched_ext: Fix unsafe locking in the scx_dump_state() (bsc#1255223).
    - CVE-2025-68206: netfilter: nft_ct: add seqadj extension for natted connections (bsc#1255142).
    - CVE-2025-68208: bpf: account for current allocated stack depth in widen_imprecise_scalars()     (bsc#1255227).
    - CVE-2025-68209: mlx5: Fix default values in create CQ (bsc#1255230).
    - CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).
    - CVE-2025-68239: binfmt_misc: restore write access before closing files opened by open_exec()     (bsc#1255272).
    - CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (bsc#1255199).
    - CVE-2025-68264: ext4: refresh inline data size before write operations (bsc#1255380).
    - CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
    - CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key()     (bsc#1255377).
    - CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
    - CVE-2025-68293: mm/huge_memory: fix NULL pointer deference when splitting folio (bsc#1255150).
    - CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).
    - CVE-2025-68302: net: sxgbe: fix potential NULL dereference in sxgbe_rx() (bsc#1255121).
    - CVE-2025-68317: io_uring/zctx: check chained notif contexts (bsc#1255354).
    - CVE-2025-68340: team: Move team device type change at the end of team_port_add (bsc#1255507).
    - CVE-2025-68353: net: vxlan: prevent NULL deref in vxlan_xmit_one (bsc#1255533).
    - CVE-2025-68363: bpf: Check skb->transport_header is set in bpf_skb_check_mtu (bsc#1255552).
    - CVE-2025-68378: bpf: Refactor stack map trace depth calculation into helper function (bsc#1255614).
    - CVE-2025-68736: landlock: Optimize file path walks and prepare for audit support (bsc#1255698).
    - CVE-2025-68742: bpf: Fix invalid prog->stats access when update_effective_progs fails (bsc#1255707).
    - CVE-2025-68744: bpf: Free special fields when update [lru_,]percpu_hash maps (bsc#1255709).
    - CVE-2025-71096: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (bsc#1256606).

    The following non security issues were fixed:

    - KVM: SEV: Drop GHCB_VERSION_DEFAULT and open code it (bsc#1255672).
    - Set HZ=1000 for ppc64 default configuration (jsc#PED-14344)
    - bpf: Do not limit bpf_cgroup_from_id to current's namespace (bsc#1255433).
    - btrfs: handle aligned EOF truncation correctly for subpage cases (bsc#1253238).
    - cgroup: rstat: use LOCK CMPXCHG in css_rstat_updated (bsc#1255434).
    - cifs: update dstaddr whenever channel iface is updated (git-fixes).
    - cpuidle: menu: Use residency threshold in polling state override decisions (bsc#1255026).
    - cpuset: fix warning when disabling remote partition (bsc#1256794).
    - ext4: use optimized mballoc scanning regardless of inode format (bsc#1254378).
    - net: usb: pegasus: fix memory leak in update_eth_regs_async() (git-fixes).
    - netdevsim: print human readable IP address (bsc#1255071).
    - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event       handling (bsc#1253262 ltc#216029).
    - powerpc/kexec: Enable SMT before waking offline CPUs (bsc#1214285       bsc#1205462 ltc#200161 ltc#200588 git-fixes bsc#1253739 ltc#211493       bsc#1254244 ltc#216496).
    - sched: Increase sched_tick_remote timeout (bsc#1254510).
    - selftests: net: fib-onlink-tests: Set high metric for default IPv6 route (bsc#1255346).
    - selftests: net: use slowwait to make sure IPv6 setup finished (bsc#1255349).
    - selftests: net: use slowwait to stabilize vrf_route_leaking test (bsc#1255349).
    - serial: xilinx_uartps: Use helper function hrtimer_update_function() (stable-fixes).
    - supported.conf: Mark lan 743x supported (jsc#PED-14571)
    - tick/sched: Limit non-timekeeper CPUs calling jiffies update (bsc#1254477).
    - wifi: ath10k: Avoid vdev delete timeout when firmware is already down (stable-fixes).
    - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256495).
    - x86/microcode/AMD: Make __verify_patch_size() return bool (bsc#1256495).
    - x86/microcode/AMD: Remove bogus comment from parse_container() (bsc#1256495).
    - x86/microcode/AMD: Select which microcode patch to load (bsc#1256495).
    - x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256495).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20145-1 advisory.

    The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
    - CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
    - CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
    - CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference     (bsc#1252861).
    - CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
    - CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
    - CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
    - CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
    - CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
    - CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
    - CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
    - CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
    - CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
    - CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
    - CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
    - CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
    - CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
    - CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
    - CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
    - CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
    - CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
    - CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
    - CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
    - CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
    - CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
    - CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in       qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
    - CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
    - CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
    - CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
    - CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
    - CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
    - CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
    - CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
    - CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
    - CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak     (bsc#1254825).
    - CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
    - CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
    - CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
    - CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
    - CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
    - CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
    - CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
    - CVE-2025-40330: bnxt_en: Shutdown FW DMA in bnxt_shutdown() (bsc#1254616).
    - CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
    - CVE-2025-40338: ASoC: Intel: avs: Do not share the name pointer between components (bsc#1255273).
    - CVE-2025-40346: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (bsc#1255318).
    - CVE-2025-40347: net: enetc: fix the deadlock of enetc_mdio_lock (bsc#1255262).
    - CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ     (bsc#1255260).
    - CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).
    - CVE-2025-40357: net/smc: fix general protection fault in __smc_diag_dump (bsc#1255097).
    - CVE-2025-40359: perf/x86/intel: Fix KASAN global-out-of-bounds warning (bsc#1255087).
    - CVE-2025-40362: ceph: fix multifs mds auth caps issue (bsc#1255103).
    - CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).
    - CVE-2025-68197: bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (bsc#1255242).
    - CVE-2025-68198: crash: fix crashkernel resource shrink (bsc#1255243).
    - CVE-2025-68202: sched_ext: Fix unsafe locking in the scx_dump_state() (bsc#1255223).
    - CVE-2025-68206: netfilter: nft_ct: add seqadj extension for natted connections (bsc#1255142).
    - CVE-2025-68208: bpf: account for current allocated stack depth in widen_imprecise_scalars()     (bsc#1255227).
    - CVE-2025-68209: mlx5: Fix default values in create CQ (bsc#1255230).
    - CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).
    - CVE-2025-68239: binfmt_misc: restore write access before closing files opened by open_exec()     (bsc#1255272).
    - CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (bsc#1255199).
    - CVE-2025-68264: ext4: refresh inline data size before write operations (bsc#1255380).
    - CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
    - CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key()     (bsc#1255377).
    - CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
    - CVE-2025-68293: mm/huge_memory: fix NULL pointer deference when splitting folio (bsc#1255150).
    - CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).
    - CVE-2025-68302: net: sxgbe: fix potential NULL dereference in sxgbe_rx() (bsc#1255121).
    - CVE-2025-68317: io_uring/zctx: check chained notif contexts (bsc#1255354).
    - CVE-2025-68340: team: Move team device type change at the end of team_port_add (bsc#1255507).
    - CVE-2025-68353: net: vxlan: prevent NULL deref in vxlan_xmit_one (bsc#1255533).
    - CVE-2025-68363: bpf: Check skb->transport_header is set in bpf_skb_check_mtu (bsc#1255552).
    - CVE-2025-68378: bpf: Refactor stack map trace depth calculation into helper function (bsc#1255614).
    - CVE-2025-68736: landlock: Optimize file path walks and prepare for audit support (bsc#1255698).
    - CVE-2025-68742: bpf: Fix invalid prog->stats access when update_effective_progs fails (bsc#1255707).
    - CVE-2025-68744: bpf: Free special fields when update [lru_,]percpu_hash maps (bsc#1255709).
    - CVE-2025-71096: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (bsc#1256606).

    The following non security issues were fixed:

    - KVM: SEV: Drop GHCB_VERSION_DEFAULT and open code it (bsc#1255672).
    - Set HZ=1000 for ppc64 default configuration (jsc#PED-14344)
    - bpf: Do not limit bpf_cgroup_from_id to current's namespace (bsc#1255433).
    - btrfs: handle aligned EOF truncation correctly for subpage cases (bsc#1253238).
    - cgroup: rstat: use LOCK CMPXCHG in css_rstat_updated (bsc#1255434).
    - cifs: update dstaddr whenever channel iface is updated (git-fixes).
    - cpuidle: menu: Use residency threshold in polling state override decisions (bsc#1255026).
    - cpuset: fix warning when disabling remote partition (bsc#1256794).
    - ext4: use optimized mballoc scanning regardless of inode format (bsc#1254378).
    - net: usb: pegasus: fix memory leak in update_eth_regs_async() (git-fixes).
    - netdevsim: print human readable IP address (bsc#1255071).
    - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event       handling (bsc#1253262 ltc#216029).
    - powerpc/kexec: Enable SMT before waking offline CPUs (bsc#1214285       bsc#1205462 ltc#200161 ltc#200588 git-fixes bsc#1253739 ltc#211493       bsc#1254244 ltc#216496).
    - sched: Increase sched_tick_remote timeout (bsc#1254510).
    - selftests: net: fib-onlink-tests: Set high metric for default IPv6 route (bsc#1255346).
    - selftests: net: use slowwait to make sure IPv6 setup finished (bsc#1255349).
    - selftests: net: use slowwait to stabilize vrf_route_leaking test (bsc#1255349).
    - serial: xilinx_uartps: Use helper function hrtimer_update_function() (stable-fixes).
    - supported.conf: Mark lan 743x supported (jsc#PED-14571)
    - tick/sched: Limit non-timekeeper CPUs calling jiffies update (bsc#1254477).
    - wifi: ath10k: Avoid vdev delete timeout when firmware is already down (stable-fixes).
    - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256495).
    - x86/microcode/AMD: Make __verify_patch_size() return bool (bsc#1256495).
    - x86/microcode/AMD: Remove bogus comment from parse_container() (bsc#1256495).
    - x86/microcode/AMD: Select which microcode patch to load (bsc#1256495).
    - x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256495).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0317-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
    - CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
    - CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
    - CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
    - CVE-2024-56590: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (bsc#1235038).
    - CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
    - CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
    - CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
    - CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
    - CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
    - CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
    - CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
    - CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
    - CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
    - CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
    - CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).

    The following non security issues were fixed:

    - ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (git-fixes).
    - ACPI: PRM: Remove unnecessary strict handler address checks (git-fixes).
    - ACPI: property: Do not pass NULL handles to acpi_attach_data() (git-fixes).
    - ACPI: property: Fix buffer properties extraction for subnodes (git-fixes).
    - KVM: SVM: Fix TSC_AUX virtualization setup (git-fixes).
    - RDMA/cm: Rate limit destroy CM ID timeout error message (git-fixes).
    - RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes).
    - RDMA/hns: Fix the modification of max_send_sge (git-fixes).
    - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes).
    - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes).
    - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
    - RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes).
    - RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes).
    - RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes).
    - RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes).
    - RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes).
    - RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
    - arch/idle: Change arch_cpu_idle() behavior: always exit with IRQs disabled (git-fixes).
    - cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls (git-fixes).
    - cpuidle: Move IRQ state validation (git-fixes).
    - cpuidle: haltpoll: Do not enable interrupts when entering idle (git-fixes).
    - dm: free table mempools if not used in __bind (git-fixes).
    - padata: Honor the caller's alignment in case of chunk_size 0 (bsc#1237563).
    - platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (git-fixes).
    - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (git-fixes).
    - x86/bugs: Use SBPB in write_ibpb() if applicable (git-fixes).
    - x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (git-fixes).
    - x86/tdx: Drop flags from __tdx_hypercall() (git-fixes).
    - x86/tdx: Dynamically disable SEPT violations from causing #VEs (git-fixes).
    - x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (git-fixes).
    - x86/tdx: Extend TDX_MODULE_CALL to support more TDCALL/SEAMCALL leafs (git-fixes).
    - x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed() (git-fixes).
    - x86/tdx: Fix arch_safe_halt() execution for TDX VMs (git-fixes).
    - x86/tdx: Introduce wrappers to read and write TD metadata (git-fixes).
    - x86/tdx: Make TDX_HYPERCALL asm similar to TDX_MODULE_CALL (git-fixes).
    - x86/tdx: Make macros of TDCALLs consistent with the spec (git-fixes).
    - x86/tdx: Pass TDCALL/SEAMCALL input/output registers via a structure (git-fixes).
    - x86/tdx: Reimplement __tdx_hypercall() using TDX_MODULE_CALL asm (git-fixes).
    - x86/tdx: Remove 'struct tdx_hypercall_args' (git-fixes).
    - x86/tdx: Remove TDX_HCALL_ISSUE_STI (git-fixes).
    - x86/tdx: Rename __tdx_module_call() to __tdcall() (git-fixes).
    - x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup() (git-fixes).
    - x86/tdx: Retry partially-completed page conversion hypercalls (git-fixes).
    - x86/tdx: Skip saving output regs when SEAMCALL fails with VMFailInvalid (git-fixes).
    - x86/tdx: Zero out the missing RSI in TDX_HYPERCALL macro (git-fixes).
    - x86/virt/tdx: Make TDX_MODULE_CALL handle SEAMCALL #UD and #GP (git-fixes).
    - x86/virt/tdx: Wire up basic SEAMCALL functions (git-fixes).
    - xfs: fix sparse inode limits on runt AG (bsc#1254392).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4404 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4404-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     December 12, 2025                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux     Version        : 5.10.247-1     CVE ID         : CVE-2023-53498 CVE-2024-47666 CVE-2024-50143 CVE-2024-57947                      CVE-2025-21861 CVE-2025-21887 CVE-2025-22058 CVE-2025-23143                      CVE-2025-38678 CVE-2025-39866 CVE-2025-39869 CVE-2025-39876                      CVE-2025-39883 CVE-2025-39885 CVE-2025-39907 CVE-2025-39911                      CVE-2025-39913 CVE-2025-39923 CVE-2025-39937 CVE-2025-39945                      CVE-2025-39949 CVE-2025-39951 CVE-2025-39953 CVE-2025-39955                      CVE-2025-39964 CVE-2025-39967 CVE-2025-39968 CVE-2025-39969                      CVE-2025-39970 CVE-2025-39971 CVE-2025-39972 CVE-2025-39973                      CVE-2025-39980 CVE-2025-39985 CVE-2025-39986 CVE-2025-39987                      CVE-2025-39993 CVE-2025-39994 CVE-2025-39995 CVE-2025-39996                      CVE-2025-39998 CVE-2025-40001 CVE-2025-40006 CVE-2025-40011                      CVE-2025-40018 CVE-2025-40019 CVE-2025-40020 CVE-2025-40021                      CVE-2025-40022 CVE-2025-40026 CVE-2025-40027 CVE-2025-40029                      CVE-2025-40030 CVE-2025-40035 CVE-2025-40042 CVE-2025-40044                      CVE-2025-40048 CVE-2025-40049 CVE-2025-40053 CVE-2025-40055                      CVE-2025-40070 CVE-2025-40078 CVE-2025-40081 CVE-2025-40083                      CVE-2025-40087 CVE-2025-40088 CVE-2025-40105 CVE-2025-40106                      CVE-2025-40109 CVE-2025-40111 CVE-2025-40115 CVE-2025-40116                      CVE-2025-40118 CVE-2025-40121 CVE-2025-40125 CVE-2025-40127                      CVE-2025-40134 CVE-2025-40140 CVE-2025-40153 CVE-2025-40154                      CVE-2025-40167 CVE-2025-40173 CVE-2025-40178 CVE-2025-40183                      CVE-2025-40186 CVE-2025-40187 CVE-2025-40188 CVE-2025-40190                      CVE-2025-40194 CVE-2025-40197 CVE-2025-40198 CVE-2025-40200                      CVE-2025-40204 CVE-2025-40205 CVE-2025-40211 CVE-2025-40219                      CVE-2025-40220 CVE-2025-40223 CVE-2025-40231 CVE-2025-40233                      CVE-2025-40240 CVE-2025-40243 CVE-2025-40244 CVE-2025-40248                      CVE-2025-40254 CVE-2025-40257 CVE-2025-40258 CVE-2025-40259                      CVE-2025-40261 CVE-2025-40262 CVE-2025-40263 CVE-2025-40264                      CVE-2025-40269 CVE-2025-40271 CVE-2025-40273 CVE-2025-40275                      CVE-2025-40277 CVE-2025-40278 CVE-2025-40280 CVE-2025-40281                      CVE-2025-40282 CVE-2025-40283 CVE-2025-40304 CVE-2025-40306                      CVE-2025-40308 CVE-2025-40309 CVE-2025-40312 CVE-2025-40315                      CVE-2025-40317 CVE-2025-40319 CVE-2025-40321 CVE-2025-40322                      CVE-2025-40324 CVE-2025-40331 CVE-2025-40342     Debian Bug     : 1107479 1114557

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 11 bullseye, these problems have been fixed in version     5.10.247-1.  This version additionally includes many more bug fixes     from stable updates 5.10.245-5.10.247.  The broken pktcdvd driver has     also been disabled.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1297 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: essiv - Check ssize for decryption and in-place encryption (CVE-2025-40019)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/ksm: fix flag-dropping behavior in ksm_madvise (CVE-2025-40040)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (CVE-2025-40042)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: parse_dfs_referrals: prevent oob on malformed input (CVE-2025-40099)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not assert we found block group item when creating free space tree (CVE-2025-40100)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: Fix refcount leak for cifs_sb_tlink (CVE-2025-40103)

    In the Linux kernel, the following vulnerability has been resolved:

    ixgbevf: fix mailbox API compatibility by negotiating supported features (CVE-2025-40104)

    In the Linux kernel, the following vulnerability has been resolved:

    vfs: Don't leak disconnected dentries on umount (CVE-2025-40105)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/vmwgfx: Fix Use-after-free in validation (CVE-2025-40111)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: detect invalid INLINE_DATA + EXTENTS flag combination (CVE-2025-40167)

    In the Linux kernel, the following vulnerability has been resolved:

    net/ip6_tunnel: Prevent perpetual tunnel growth (CVE-2025-40173)

    In the Linux kernel, the following vulnerability has been resolved:

    tls: wait for pending async decryptions if tls_strp_msg_hold fails (CVE-2025-40176)

    In the Linux kernel, the following vulnerability has been resolved:

    pid: Add a judgment for ns null in pid_nr_ns (CVE-2025-40178)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: verify orphan file size is not too big (CVE-2025-40179)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (CVE-2025-40183)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (CVE-2025-40187)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: guard against EA inode refcount underflow in xattr update (CVE-2025-40190)

    In the Linux kernel, the following vulnerability has been resolved:

    cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (CVE-2025-40194)

    In the Linux kernel, the following vulnerability has been resolved:

    media: mc: Clear minor number before put device (CVE-2025-40197)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (CVE-2025-40198)

    In the Linux kernel, the following vulnerability has been resolved:

    Squashfs: reject negative file sizes in squashfs_read_inode() (CVE-2025-40200)

    In the Linux kernel, the following vulnerability has been resolved:

    kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths (CVE-2025-40201)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: Fix MAC comparison to be constant-time (CVE-2025-40204)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (CVE-2025-40205)

    In the Linux kernel, the following vulnerability has been resolved:

    media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (CVE-2025-40207)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (CVE-2025-40219)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: fix livelock in synchronous file put from fuseblk workers (CVE-2025-40220)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: fix lock inversion in vsock_assign_transport() (CVE-2025-40231)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: avoid NULL dereference when chunk data buffer is missing (CVE-2025-40240)

    In the Linux kernel, the following vulnerability has been resolved:

    arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (CVE-2025-40346)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.196-137.219. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2025-094 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    vfs: Don't leak disconnected dentries on umount (CVE-2025-40105)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: detect invalid INLINE_DATA + EXTENTS flag combination (CVE-2025-40167)

    In the Linux kernel, the following vulnerability has been resolved:

    net/ip6_tunnel: Prevent perpetual tunnel growth (CVE-2025-40173)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: fix livelock in synchronous file put from fuseblk workers (CVE-2025-40220)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: fix lock inversion in vsock_assign_transport() (CVE-2025-40231)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: avoid NULL dereference when chunk data buffer is missing (CVE-2025-40240)

    In the Linux kernel, the following vulnerability has been resolved:

    arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (CVE-2025-40346)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - fuse: fix livelock in synchronous file put from fuseblk workers I observed a hang when running generic/323     against a fuseblk server. This test opens a file, initiates a lot of AIO writes to that file descriptor,     and closes the file descriptor before the writes complete. Unsurprisingly, the AIO exerciser threads are     mostly stuck waiting for responses from the fuseblk server: # cat /proc/372265/task/372313/stack [<0>]     request_wait_answer+0x1fe/0x2a0 [fuse] [<0>] __fuse_simple_request+0xd3/0x2b0 [fuse] [<0>]     fuse_do_getattr+0xfc/0x1f0 [fuse] [<0>] fuse_file_read_iter+0xbe/0x1c0 [fuse] [<0>] aio_read+0x130/0x1e0     [<0>] io_submit_one+0x542/0x860 [<0>] __x64_sys_io_submit+0x98/0x1a0 [<0>] do_syscall_64+0x37/0xf0 [<0>]     entry_SYSCALL_64_after_hwframe+0x4b/0x53 But the /weird/ part is that the fuseblk server threads are     waiting for responses from itself: # cat /proc/372210/task/372232/stack [<0>]     request_wait_answer+0x1fe/0x2a0 [fuse] [<0>] __fuse_simple_request+0xd3/0x2b0 [fuse] [<0>]     fuse_file_put+0x9a/0xd0 [fuse] [<0>] fuse_release+0x36/0x50 [fuse] [<0>] __fput+0xec/0x2b0 [<0>]     task_work_run+0x55/0x90 [<0>] syscall_exit_to_user_mode+0xe9/0x100 [<0>] do_syscall_64+0x43/0xf0 [<0>]     entry_SYSCALL_64_after_hwframe+0x4b/0x53 The fuseblk server is fuse2fs so there's nothing all that     exciting in the server itself. So why is the fuse server calling fuse_file_put? The commit message for the     fstest sheds some light on that: By closing the file descriptor before calling io_destroy, you pretty     much guarantee that the last put on the ioctx will be done in interrupt context (during I/O completion).
    Aha. AIO fgets a new struct file from the fd when it queues the ioctx. The completion of the FUSE_WRITE     command from userspace causes the fuse server to call the AIO completion function. The completion puts the     struct file, queuing a delayed fput to the fuse server task. When the fuse server task returns to     userspace, it has to run the delayed fput, which in the case of a fuseblk server, it does synchronously.
    Sending the FUSE_RELEASE command sychronously from fuse server threads is a bad idea because a client     program can initiate enough simultaneous AIOs such that all the fuse server threads end up in     delayed_fput, and now there aren't any threads left to handle the queued fuse commands. Fix this by only     using asynchronous fputs when closing files, and leave a comment explaining why. (CVE-2025-40220)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
298897	Ubuntu 25.10 : Linux kernel vulnerabilities (USN-8029-1)	Nessus	Ubuntu Local Security Checks	critical
298895	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (NVIDIA Tegra) vulnerabilities (USN-8034-1)	Nessus	Ubuntu Local Security Checks	high
298894	Ubuntu 25.10 : Linux kernel (GCP) vulnerabilities (USN-8030-1)	Nessus	Ubuntu Local Security Checks	critical
298893	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-8033-1)	Nessus	Ubuntu Local Security Checks	high
298236	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:20220-1)	Nessus	SuSE Local Security Checks	high
298231	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:20228-1)	Nessus	SuSE Local Security Checks	high
297793	openSUSE 16 Security Update : kernel (openSUSE-SU-2026:20145-1)	Nessus	SuSE Local Security Checks	high
297194	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2026:0315-1)	Nessus	SuSE Local Security Checks	high
297191	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0317-1)	Nessus	SuSE Local Security Checks	high
296680	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2026:0293-1)	Nessus	SuSE Local Security Checks	high
296676	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0281-1)	Nessus	SuSE Local Security Checks	high
296481	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0278-1)	Nessus	SuSE Local Security Checks	high
278559	Debian dla-4404 : ata-modules-5.10.0-35-armmp-di - security update	Nessus	Debian Local Security Checks	high
277795	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1297)	Nessus	Amazon Linux Local Security Checks	high
277768	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2025-094 (ALASKERNEL-5.15-2025-094)	Nessus	Amazon Linux Local Security Checks	high
277496	Linux Distros Unpatched Vulnerability : CVE-2025-40220	Nessus	Misc.	medium
275495	Photon OS 5.0: Linux PHSA-2025-5.0-0677	Nessus	PhotonOS Local Security Checks	critical

Detections

Analytics

CVE-2025-40220

medium

Tenable Plugins

critical

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

medium

critical