In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: make sure the cdev fd is still active before emitting events With the final call to fput() on a file descriptor, the release action may be deferred and scheduled on a work queue. The reference count of that descriptor is still zero and it must not be used. It's possible that a GPIO change, we want to notify the user-space about, happens AFTER the reference count on the file descriptor associated with the character device went down to zero but BEFORE the .release() callback was called from the workqueue and so BEFORE we unregistered from the notifier. Using the regular get_file() routine in this situation triggers the following warning: struct file::f_count incremented from zero; use-after-free condition present! So use the get_file_active() variant that will return NULL on file descriptors that have been or are being released.

The remote Ubuntu 24.04 LTS / 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8094-1 advisory.

    Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM).
    An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor     profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege     escalation, or possibly escape a container. (LP: #2143853)

    It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle     entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could     possibly use this issue to influence the values returned by the RDSEED instruction causing loss of     confidentiality and integrity. (CVE-2025-62626)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - S390 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Compute Acceleration Framework;

    - ATM drivers;

    - Network block device driver;

    - Bluetooth drivers;

    - Data acquisition framework and drivers;

    - Hardware crypto device drivers;

    - Device frequency scaling framework;

    - Intel Stratix 10 firmware drivers;

    - GPIO subsystem;

    - GPU drivers;

    - Microsoft Hyper-V drivers;

    - CoreSight HW tracing drivers;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Input Device (Tablet) drivers;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - Macintosh device drivers;

    - Multiple devices driver;

    - MOST (Media Oriented Systems Transport) drivers;

    - MTD block device drivers;

    - Network drivers;

    - Mellanox network drivers;

    - Texas Instruments network drivers;

    - Ethernet team driver;

    - MediaTek network drivers;

    - NVME drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - Voltage and Current Regulator drivers;

    - Real Time Clock drivers;

    - S/390 drivers;

    - SCSI subsystem;

    - Texas Instruments SoC drivers;

    - SPI subsystem;

    - Media Oriented Systems Transport (MOST) driver;

    - Realtek RTL8723BS SDIO drivers;

    - TCM subsystem;

    - UFS subsystem;

    - DesignWare USB3 driver;

    - USB Gadget drivers;

    - Renesas USBHS Controller drivers;

    - USB Mass Storage drivers;

    - USB Type-C Connector System Software Interface driver;

    - Backlight driver;

    - Framebuffer layer;

    - AFS file system;

    - BFS file system;

    - BTRFS file system;

    - EROFS file system;

    - Ext4 file system;

    - FAT file system;

    - GFS2 file system;

    - Journaling layer for block devices (JBD2);

    - File systems infrastructure;

    - Network file system (NFS) client;

    - NTFS3 file system;

    - OCFS2 file system;

    - SMB network file system;

    - XFS file system;

    - BPF subsystem;

    - MediaTek SoC drivers;

    - Bluetooth subsystem;

    - io_uring subsystem;

    - Locking primitives;

    - Scheduler infrastructure;

    - Timer subsystem;

    - Tracing infrastructure;

    - Kexec HandOver (KHO);

    - Memory management;

    - Ceph Core library;

    - Networking core;

    - Devlink API;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Open vSwitch;

    - Network traffic control;

    - VMware vSockets driver;

    - eXpress Data Path;

    - Integrity Measurement Architecture(IMA) framework;

    - Simplified Mandatory Access Control Kernel framework;

    - FireWire sound drivers;

    - HD-audio driver;

    - Turtle Beach Wavefront ALSA driver;

    - SoundWire (SDCA) ASoC drivers; (CVE-2025-40246, CVE-2025-40247, CVE-2025-40248, CVE-2025-40249,     CVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40255,     CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40260, CVE-2025-40261, CVE-2025-40262,     CVE-2025-40263, CVE-2025-40264, CVE-2025-40265, CVE-2025-40266, CVE-2025-40290, CVE-2025-40345,     CVE-2025-68212, CVE-2025-68213, CVE-2025-68214, CVE-2025-68215, CVE-2025-68217, CVE-2025-68218,     CVE-2025-68219, CVE-2025-68220, CVE-2025-68221, CVE-2025-68222, CVE-2025-68223, CVE-2025-68225,     CVE-2025-68227, CVE-2025-68228, CVE-2025-68229, CVE-2025-68230, CVE-2025-68231, CVE-2025-68232,     CVE-2025-68233, CVE-2025-68234, CVE-2025-68235, CVE-2025-68236, CVE-2025-68237, CVE-2025-68238,     CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259,     CVE-2025-68261, CVE-2025-68262, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266,     CVE-2025-68281, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286,     CVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290, CVE-2025-68292, CVE-2025-68293,     CVE-2025-68294, CVE-2025-68295, CVE-2025-68296, CVE-2025-68297, CVE-2025-68298, CVE-2025-68299,     CVE-2025-68300, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68304, CVE-2025-68305,     CVE-2025-68306, CVE-2025-68307, CVE-2025-68308, CVE-2025-68323, CVE-2025-68324, CVE-2025-68325,     CVE-2025-68326, CVE-2025-68327, CVE-2025-68328, CVE-2025-68329, CVE-2025-68330, CVE-2025-68331,     CVE-2025-68332, CVE-2025-68333, CVE-2025-68334, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337,     CVE-2025-68338, CVE-2025-68339, CVE-2025-68340, CVE-2025-68341, CVE-2025-68342, CVE-2025-68343,     CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68348, CVE-2025-68349,     CVE-2025-68352, CVE-2025-68354, CVE-2025-68356, CVE-2025-68358, CVE-2025-68359, CVE-2025-68360,     CVE-2025-68361, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,     CVE-2025-68369, CVE-2025-68370, CVE-2025-68371, CVE-2025-68372, CVE-2025-68373, CVE-2025-68374,     CVE-2025-68375, CVE-2025-68376, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,     CVE-2025-68726, CVE-2025-68727, CVE-2025-68728, CVE-2025-68729, CVE-2025-68730, CVE-2025-68732,     CVE-2025-68733, CVE-2025-68735, CVE-2025-68738, CVE-2025-68739, CVE-2025-68740, CVE-2025-68741,     CVE-2025-68742, CVE-2025-68743, CVE-2025-68744, CVE-2025-68746, CVE-2025-68747, CVE-2025-68748,     CVE-2025-68749, CVE-2025-68751, CVE-2025-68752, CVE-2025-68753, CVE-2025-68754, CVE-2025-68755,     CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68760, CVE-2025-68762,     CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-71128)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:4012 advisory.

    * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting     (CVE-2025-38141)
      * kernel: Linux kernel io_uring: Local privilege escalation, information disclosure, or denial of     service via use-after-free (CVE-2025-38106)
      * kernel: drm/xe: Make dma-fences compliant with the safe access rules (CVE-2025-38703)
      * kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing     (CVE-2025-39760)
      * kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save     (CVE-2025-39818)
      * kernel: Kernel: Use-after-free in GPIO character device allows privilege escalation or denial of     service (CVE-2025-40249)
      * kernel: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CVE-2025-71085)
      * kernel: macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001)
      * kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration (CVE-2026-23097)
      * kernel: Linux kernel: Information disclosure in efivarfs via incorrect error propagation     (CVE-2026-23156)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-4012 advisory.

    - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (CKI Backport Bot)     [RHEL-142253] {CVE-2025-39818}
    - drm/xe: Make dma-fences compliant with the safe access rules (Mika Penttila) [RHEL-122272]     {CVE-2025-38703}
    - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143548]     {CVE-2025-71085}
    - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137370]     {CVE-2025-39760}
    - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150116] {CVE-2026-23156}
    - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147270] {CVE-2026-23097}
    - io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() (Jeff Moyer) [RHEL-137992]     {CVE-2025-38106}
    - gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify() (CKI Backport Bot) [RHEL-145597]     {CVE-2025-40249}
    - gpio: cdev: make sure the cdev fd is still active before emitting events (CKI Backport Bot)     [RHEL-145597] {CVE-2025-40249}
    - macvlan: fix possible UAF in macvlan_forward_source() (CKI Backport Bot) [RHEL-144128] {CVE-2026-23001}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4012 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting     (CVE-2025-38141)

    * kernel: Linux kernel io_uring: Local privilege escalation, information disclosure, or denial of service     via use-after-free (CVE-2025-38106)

    * kernel: drm/xe: Make dma-fences compliant with the safe access rules (CVE-2025-38703)

    * kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing     (CVE-2025-39760)

    * kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save     (CVE-2025-39818)

    * kernel: Kernel: Use-after-free in GPIO character device allows privilege escalation or denial of service     (CVE-2025-40249)

    * kernel: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CVE-2025-71085)

    * kernel: macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001)

    * kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration (CVE-2026-23097)

    * kernel: Linux kernel: Information disclosure in efivarfs via incorrect error propagation     (CVE-2026-23156)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - gpio: cdev: make sure the cdev fd is still active before emitting events With the final call to fput() on     a file descriptor, the release action may be deferred and scheduled on a work queue. The reference count     of that descriptor is still zero and it must not be used. It's possible that a GPIO change, we want to     notify the user-space about, happens AFTER the reference count on the file descriptor associated with the     character device went down to zero but BEFORE the .release() callback was called from the workqueue and so     BEFORE we unregistered from the notifier. Using the regular get_file() routine in this situation triggers     the following warning: struct file::f_count incremented from zero; use-after-free condition present! So     use the get_file_active() variant that will return NULL on file descriptors that have been or are being     released. (CVE-2025-40249)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
302766	Ubuntu 24.04 LTS / 25.10 : Linux kernel vulnerabilities (USN-8094-1)	Nessus	Ubuntu Local Security Checks	high
302183	AlmaLinux 10 : kernel (ALSA-2026:4012)	Nessus	Alma Linux Local Security Checks	high
301787	Oracle Linux 10 : kernel (ELSA-2026-4012)	Nessus	Oracle Linux Local Security Checks	high
301548	RHEL 10 : kernel (RHSA-2026:4012)	Nessus	Red Hat Local Security Checks	high
277522	Linux Distros Unpatched Vulnerability : CVE-2025-40249	Nessus	Misc.	high

Detections

Analytics

CVE-2025-40249

high

Tenable Plugins

high

high

high

high

high