In the Linux kernel, the following vulnerability has been resolved: Input: imx_sc_key - fix memory corruption on unload This is supposed to be "priv" but we accidentally pass "&priv" which is an address in the stack and so it will lead to memory corruption when the imx_sc_key_action() function is called. Remove the &.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:20220-1 advisory.

    The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
    - CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
    - CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
    - CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference     (bsc#1252861).
    - CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
    - CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
    - CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
    - CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
    - CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
    - CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
    - CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
    - CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
    - CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
    - CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
    - CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
    - CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
    - CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
    - CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
    - CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
    - CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
    - CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
    - CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
    - CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
    - CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
    - CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
    - CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in       qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
    - CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
    - CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
    - CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
    - CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
    - CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
    - CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
    - CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
    - CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
    - CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak     (bsc#1254825).
    - CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
    - CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
    - CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
    - CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
    - CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
    - CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
    - CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
    - CVE-2025-40330: bnxt_en: Shutdown FW DMA in bnxt_shutdown() (bsc#1254616).
    - CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
    - CVE-2025-40338: ASoC: Intel: avs: Do not share the name pointer between components (bsc#1255273).
    - CVE-2025-40346: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (bsc#1255318).
    - CVE-2025-40347: net: enetc: fix the deadlock of enetc_mdio_lock (bsc#1255262).
    - CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ     (bsc#1255260).
    - CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).
    - CVE-2025-40357: net/smc: fix general protection fault in __smc_diag_dump (bsc#1255097).
    - CVE-2025-40359: perf/x86/intel: Fix KASAN global-out-of-bounds warning (bsc#1255087).
    - CVE-2025-40362: ceph: fix multifs mds auth caps issue (bsc#1255103).
    - CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).
    - CVE-2025-68197: bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (bsc#1255242).
    - CVE-2025-68198: crash: fix crashkernel resource shrink (bsc#1255243).
    - CVE-2025-68202: sched_ext: Fix unsafe locking in the scx_dump_state() (bsc#1255223).
    - CVE-2025-68206: netfilter: nft_ct: add seqadj extension for natted connections (bsc#1255142).
    - CVE-2025-68208: bpf: account for current allocated stack depth in widen_imprecise_scalars()     (bsc#1255227).
    - CVE-2025-68209: mlx5: Fix default values in create CQ (bsc#1255230).
    - CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).
    - CVE-2025-68239: binfmt_misc: restore write access before closing files opened by open_exec()     (bsc#1255272).
    - CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (bsc#1255199).
    - CVE-2025-68264: ext4: refresh inline data size before write operations (bsc#1255380).
    - CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
    - CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key()     (bsc#1255377).
    - CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
    - CVE-2025-68293: mm/huge_memory: fix NULL pointer deference when splitting folio (bsc#1255150).
    - CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).
    - CVE-2025-68302: net: sxgbe: fix potential NULL dereference in sxgbe_rx() (bsc#1255121).
    - CVE-2025-68317: io_uring/zctx: check chained notif contexts (bsc#1255354).
    - CVE-2025-68340: team: Move team device type change at the end of team_port_add (bsc#1255507).
    - CVE-2025-68353: net: vxlan: prevent NULL deref in vxlan_xmit_one (bsc#1255533).
    - CVE-2025-68363: bpf: Check skb->transport_header is set in bpf_skb_check_mtu (bsc#1255552).
    - CVE-2025-68378: bpf: Refactor stack map trace depth calculation into helper function (bsc#1255614).
    - CVE-2025-68736: landlock: Optimize file path walks and prepare for audit support (bsc#1255698).
    - CVE-2025-68742: bpf: Fix invalid prog->stats access when update_effective_progs fails (bsc#1255707).
    - CVE-2025-68744: bpf: Free special fields when update [lru_,]percpu_hash maps (bsc#1255709).
    - CVE-2025-71096: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (bsc#1256606).

    The following non security issues were fixed:

    - KVM: SEV: Drop GHCB_VERSION_DEFAULT and open code it (bsc#1255672).
    - Set HZ=1000 for ppc64 default configuration (jsc#PED-14344)
    - bpf: Do not limit bpf_cgroup_from_id to current's namespace (bsc#1255433).
    - btrfs: handle aligned EOF truncation correctly for subpage cases (bsc#1253238).
    - cgroup: rstat: use LOCK CMPXCHG in css_rstat_updated (bsc#1255434).
    - cifs: update dstaddr whenever channel iface is updated (git-fixes).
    - cpuidle: menu: Use residency threshold in polling state override decisions (bsc#1255026).
    - cpuset: fix warning when disabling remote partition (bsc#1256794).
    - ext4: use optimized mballoc scanning regardless of inode format (bsc#1254378).
    - net: usb: pegasus: fix memory leak in update_eth_regs_async() (git-fixes).
    - netdevsim: print human readable IP address (bsc#1255071).
    - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event       handling (bsc#1253262 ltc#216029).
    - powerpc/kexec: Enable SMT before waking offline CPUs (bsc#1214285       bsc#1205462 ltc#200161 ltc#200588 git-fixes bsc#1253739 ltc#211493       bsc#1254244 ltc#216496).
    - sched: Increase sched_tick_remote timeout (bsc#1254510).
    - selftests: net: fib-onlink-tests: Set high metric for default IPv6 route (bsc#1255346).
    - selftests: net: use slowwait to make sure IPv6 setup finished (bsc#1255349).
    - selftests: net: use slowwait to stabilize vrf_route_leaking test (bsc#1255349).
    - serial: xilinx_uartps: Use helper function hrtimer_update_function() (stable-fixes).
    - supported.conf: Mark lan 743x supported (jsc#PED-14571)
    - tick/sched: Limit non-timekeeper CPUs calling jiffies update (bsc#1254477).
    - wifi: ath10k: Avoid vdev delete timeout when firmware is already down (stable-fixes).
    - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256495).
    - x86/microcode/AMD: Make __verify_patch_size() return bool (bsc#1256495).
    - x86/microcode/AMD: Remove bogus comment from parse_container() (bsc#1256495).
    - x86/microcode/AMD: Select which microcode patch to load (bsc#1256495).
    - x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256495).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:20228-1 advisory.

    The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
    - CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
    - CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
    - CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference     (bsc#1252861).
    - CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
    - CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
    - CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
    - CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
    - CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
    - CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
    - CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
    - CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
    - CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
    - CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
    - CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
    - CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
    - CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
    - CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
    - CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
    - CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
    - CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
    - CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
    - CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
    - CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
    - CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
    - CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in       qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
    - CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
    - CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
    - CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
    - CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
    - CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
    - CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
    - CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
    - CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
    - CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak     (bsc#1254825).
    - CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
    - CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
    - CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
    - CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
    - CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
    - CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
    - CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
    - CVE-2025-40330: bnxt_en: Shutdown FW DMA in bnxt_shutdown() (bsc#1254616).
    - CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
    - CVE-2025-40338: ASoC: Intel: avs: Do not share the name pointer between components (bsc#1255273).
    - CVE-2025-40346: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (bsc#1255318).
    - CVE-2025-40347: net: enetc: fix the deadlock of enetc_mdio_lock (bsc#1255262).
    - CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ     (bsc#1255260).
    - CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).
    - CVE-2025-40357: net/smc: fix general protection fault in __smc_diag_dump (bsc#1255097).
    - CVE-2025-40359: perf/x86/intel: Fix KASAN global-out-of-bounds warning (bsc#1255087).
    - CVE-2025-40362: ceph: fix multifs mds auth caps issue (bsc#1255103).
    - CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).
    - CVE-2025-68197: bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (bsc#1255242).
    - CVE-2025-68198: crash: fix crashkernel resource shrink (bsc#1255243).
    - CVE-2025-68202: sched_ext: Fix unsafe locking in the scx_dump_state() (bsc#1255223).
    - CVE-2025-68206: netfilter: nft_ct: add seqadj extension for natted connections (bsc#1255142).
    - CVE-2025-68208: bpf: account for current allocated stack depth in widen_imprecise_scalars()     (bsc#1255227).
    - CVE-2025-68209: mlx5: Fix default values in create CQ (bsc#1255230).
    - CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).
    - CVE-2025-68239: binfmt_misc: restore write access before closing files opened by open_exec()     (bsc#1255272).
    - CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (bsc#1255199).
    - CVE-2025-68264: ext4: refresh inline data size before write operations (bsc#1255380).
    - CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
    - CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key()     (bsc#1255377).
    - CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
    - CVE-2025-68293: mm/huge_memory: fix NULL pointer deference when splitting folio (bsc#1255150).
    - CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).
    - CVE-2025-68302: net: sxgbe: fix potential NULL dereference in sxgbe_rx() (bsc#1255121).
    - CVE-2025-68317: io_uring/zctx: check chained notif contexts (bsc#1255354).
    - CVE-2025-68340: team: Move team device type change at the end of team_port_add (bsc#1255507).
    - CVE-2025-68353: net: vxlan: prevent NULL deref in vxlan_xmit_one (bsc#1255533).
    - CVE-2025-68363: bpf: Check skb->transport_header is set in bpf_skb_check_mtu (bsc#1255552).
    - CVE-2025-68378: bpf: Refactor stack map trace depth calculation into helper function (bsc#1255614).
    - CVE-2025-68736: landlock: Optimize file path walks and prepare for audit support (bsc#1255698).
    - CVE-2025-68742: bpf: Fix invalid prog->stats access when update_effective_progs fails (bsc#1255707).
    - CVE-2025-68744: bpf: Free special fields when update [lru_,]percpu_hash maps (bsc#1255709).
    - CVE-2025-71096: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (bsc#1256606).

    The following non security issues were fixed:

    - KVM: SEV: Drop GHCB_VERSION_DEFAULT and open code it (bsc#1255672).
    - Set HZ=1000 for ppc64 default configuration (jsc#PED-14344)
    - bpf: Do not limit bpf_cgroup_from_id to current's namespace (bsc#1255433).
    - btrfs: handle aligned EOF truncation correctly for subpage cases (bsc#1253238).
    - cgroup: rstat: use LOCK CMPXCHG in css_rstat_updated (bsc#1255434).
    - cifs: update dstaddr whenever channel iface is updated (git-fixes).
    - cpuidle: menu: Use residency threshold in polling state override decisions (bsc#1255026).
    - cpuset: fix warning when disabling remote partition (bsc#1256794).
    - ext4: use optimized mballoc scanning regardless of inode format (bsc#1254378).
    - net: usb: pegasus: fix memory leak in update_eth_regs_async() (git-fixes).
    - netdevsim: print human readable IP address (bsc#1255071).
    - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event       handling (bsc#1253262 ltc#216029).
    - powerpc/kexec: Enable SMT before waking offline CPUs (bsc#1214285       bsc#1205462 ltc#200161 ltc#200588 git-fixes bsc#1253739 ltc#211493       bsc#1254244 ltc#216496).
    - sched: Increase sched_tick_remote timeout (bsc#1254510).
    - selftests: net: fib-onlink-tests: Set high metric for default IPv6 route (bsc#1255346).
    - selftests: net: use slowwait to make sure IPv6 setup finished (bsc#1255349).
    - selftests: net: use slowwait to stabilize vrf_route_leaking test (bsc#1255349).
    - serial: xilinx_uartps: Use helper function hrtimer_update_function() (stable-fixes).
    - supported.conf: Mark lan 743x supported (jsc#PED-14571)
    - tick/sched: Limit non-timekeeper CPUs calling jiffies update (bsc#1254477).
    - wifi: ath10k: Avoid vdev delete timeout when firmware is already down (stable-fixes).
    - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256495).
    - x86/microcode/AMD: Make __verify_patch_size() return bool (bsc#1256495).
    - x86/microcode/AMD: Remove bogus comment from parse_container() (bsc#1256495).
    - x86/microcode/AMD: Select which microcode patch to load (bsc#1256495).
    - x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256495).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20145-1 advisory.

    The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
    - CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
    - CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
    - CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference     (bsc#1252861).
    - CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
    - CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
    - CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
    - CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
    - CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
    - CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
    - CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
    - CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
    - CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
    - CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
    - CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
    - CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
    - CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
    - CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
    - CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
    - CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
    - CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
    - CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
    - CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
    - CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
    - CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
    - CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in       qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
    - CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
    - CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
    - CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
    - CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
    - CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
    - CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
    - CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
    - CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
    - CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak     (bsc#1254825).
    - CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
    - CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
    - CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
    - CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
    - CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
    - CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
    - CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
    - CVE-2025-40330: bnxt_en: Shutdown FW DMA in bnxt_shutdown() (bsc#1254616).
    - CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
    - CVE-2025-40338: ASoC: Intel: avs: Do not share the name pointer between components (bsc#1255273).
    - CVE-2025-40346: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (bsc#1255318).
    - CVE-2025-40347: net: enetc: fix the deadlock of enetc_mdio_lock (bsc#1255262).
    - CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ     (bsc#1255260).
    - CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).
    - CVE-2025-40357: net/smc: fix general protection fault in __smc_diag_dump (bsc#1255097).
    - CVE-2025-40359: perf/x86/intel: Fix KASAN global-out-of-bounds warning (bsc#1255087).
    - CVE-2025-40362: ceph: fix multifs mds auth caps issue (bsc#1255103).
    - CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).
    - CVE-2025-68197: bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (bsc#1255242).
    - CVE-2025-68198: crash: fix crashkernel resource shrink (bsc#1255243).
    - CVE-2025-68202: sched_ext: Fix unsafe locking in the scx_dump_state() (bsc#1255223).
    - CVE-2025-68206: netfilter: nft_ct: add seqadj extension for natted connections (bsc#1255142).
    - CVE-2025-68208: bpf: account for current allocated stack depth in widen_imprecise_scalars()     (bsc#1255227).
    - CVE-2025-68209: mlx5: Fix default values in create CQ (bsc#1255230).
    - CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).
    - CVE-2025-68239: binfmt_misc: restore write access before closing files opened by open_exec()     (bsc#1255272).
    - CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (bsc#1255199).
    - CVE-2025-68264: ext4: refresh inline data size before write operations (bsc#1255380).
    - CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
    - CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key()     (bsc#1255377).
    - CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
    - CVE-2025-68293: mm/huge_memory: fix NULL pointer deference when splitting folio (bsc#1255150).
    - CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).
    - CVE-2025-68302: net: sxgbe: fix potential NULL dereference in sxgbe_rx() (bsc#1255121).
    - CVE-2025-68317: io_uring/zctx: check chained notif contexts (bsc#1255354).
    - CVE-2025-68340: team: Move team device type change at the end of team_port_add (bsc#1255507).
    - CVE-2025-68353: net: vxlan: prevent NULL deref in vxlan_xmit_one (bsc#1255533).
    - CVE-2025-68363: bpf: Check skb->transport_header is set in bpf_skb_check_mtu (bsc#1255552).
    - CVE-2025-68378: bpf: Refactor stack map trace depth calculation into helper function (bsc#1255614).
    - CVE-2025-68736: landlock: Optimize file path walks and prepare for audit support (bsc#1255698).
    - CVE-2025-68742: bpf: Fix invalid prog->stats access when update_effective_progs fails (bsc#1255707).
    - CVE-2025-68744: bpf: Free special fields when update [lru_,]percpu_hash maps (bsc#1255709).
    - CVE-2025-71096: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (bsc#1256606).

    The following non security issues were fixed:

    - KVM: SEV: Drop GHCB_VERSION_DEFAULT and open code it (bsc#1255672).
    - Set HZ=1000 for ppc64 default configuration (jsc#PED-14344)
    - bpf: Do not limit bpf_cgroup_from_id to current's namespace (bsc#1255433).
    - btrfs: handle aligned EOF truncation correctly for subpage cases (bsc#1253238).
    - cgroup: rstat: use LOCK CMPXCHG in css_rstat_updated (bsc#1255434).
    - cifs: update dstaddr whenever channel iface is updated (git-fixes).
    - cpuidle: menu: Use residency threshold in polling state override decisions (bsc#1255026).
    - cpuset: fix warning when disabling remote partition (bsc#1256794).
    - ext4: use optimized mballoc scanning regardless of inode format (bsc#1254378).
    - net: usb: pegasus: fix memory leak in update_eth_regs_async() (git-fixes).
    - netdevsim: print human readable IP address (bsc#1255071).
    - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event       handling (bsc#1253262 ltc#216029).
    - powerpc/kexec: Enable SMT before waking offline CPUs (bsc#1214285       bsc#1205462 ltc#200161 ltc#200588 git-fixes bsc#1253739 ltc#211493       bsc#1254244 ltc#216496).
    - sched: Increase sched_tick_remote timeout (bsc#1254510).
    - selftests: net: fib-onlink-tests: Set high metric for default IPv6 route (bsc#1255346).
    - selftests: net: use slowwait to make sure IPv6 setup finished (bsc#1255349).
    - selftests: net: use slowwait to stabilize vrf_route_leaking test (bsc#1255349).
    - serial: xilinx_uartps: Use helper function hrtimer_update_function() (stable-fixes).
    - supported.conf: Mark lan 743x supported (jsc#PED-14571)
    - tick/sched: Limit non-timekeeper CPUs calling jiffies update (bsc#1254477).
    - wifi: ath10k: Avoid vdev delete timeout when firmware is already down (stable-fixes).
    - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256495).
    - x86/microcode/AMD: Make __verify_patch_size() return bool (bsc#1256495).
    - x86/microcode/AMD: Remove bogus comment from parse_container() (bsc#1256495).
    - x86/microcode/AMD: Select which microcode patch to load (bsc#1256495).
    - x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256495).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4436 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4436-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     January 14, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.1     Version        : 6.1.159-1~deb11u1     CVE ID         : CVE-2024-47666 CVE-2025-37899 CVE-2025-38057 CVE-2025-38556                      CVE-2025-38593 CVE-2025-38678 CVE-2025-39805 CVE-2025-40083                      CVE-2025-40211 CVE-2025-40214 CVE-2025-40248 CVE-2025-40252                      CVE-2025-40253 CVE-2025-40254 CVE-2025-40257 CVE-2025-40258                      CVE-2025-40259 CVE-2025-40261 CVE-2025-40262 CVE-2025-40263                      CVE-2025-40264 CVE-2025-40269 CVE-2025-40271 CVE-2025-40272                      CVE-2025-40273 CVE-2025-40275 CVE-2025-40277 CVE-2025-40278                      CVE-2025-40279 CVE-2025-40280 CVE-2025-40281 CVE-2025-40282                      CVE-2025-40283 CVE-2025-40284 CVE-2025-40285 CVE-2025-40286                      CVE-2025-40288 CVE-2025-40292 CVE-2025-40293 CVE-2025-40294                      CVE-2025-40297 CVE-2025-40301 CVE-2025-40304 CVE-2025-40306                      CVE-2025-40308 CVE-2025-40309 CVE-2025-40312 CVE-2025-40313                      CVE-2025-40314 CVE-2025-40315 CVE-2025-40317 CVE-2025-40318                      CVE-2025-40319 CVE-2025-40321 CVE-2025-40322 CVE-2025-40323                      CVE-2025-40324 CVE-2025-40331 CVE-2025-40341 CVE-2025-40342                      CVE-2025-40343 CVE-2025-40345 CVE-2025-40360 CVE-2025-40363                      CVE-2025-68168 CVE-2025-68171 CVE-2025-68173 CVE-2025-68176                      CVE-2025-68177 CVE-2025-68185 CVE-2025-68191 CVE-2025-68192                      CVE-2025-68194 CVE-2025-68200 CVE-2025-68204 CVE-2025-68214                      CVE-2025-68217 CVE-2025-68218 CVE-2025-68220 CVE-2025-68227                      CVE-2025-68229 CVE-2025-68231 CVE-2025-68233 CVE-2025-68237                      CVE-2025-68238 CVE-2025-68241 CVE-2025-68244 CVE-2025-68245                      CVE-2025-68246 CVE-2025-68282 CVE-2025-68283 CVE-2025-68284                      CVE-2025-68285 CVE-2025-68286 CVE-2025-68287 CVE-2025-68288                      CVE-2025-68289 CVE-2025-68290 CVE-2025-68295 CVE-2025-68301                      CVE-2025-68302 CVE-2025-68303 CVE-2025-68307 CVE-2025-68308                      CVE-2025-68310 CVE-2025-68312 CVE-2025-68321 CVE-2025-68327                      CVE-2025-68328 CVE-2025-68330 CVE-2025-68331 CVE-2025-68339                      CVE-2025-68343 CVE-2025-68734     Debian Bug     : 919350 1106411 1114557 1119232 1120602 1120680

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 11 bullseye, these problems have been fixed in version     6.1.159-1~deb11u1.  This update also fixes several bugs reported to     Debian.  It additionally includes many more bug fixes from stable     update 6.1.159.

    We recommend that you upgrade your linux-6.1 packages.

    For the detailed security status of linux-6.1 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.1

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4404 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4404-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     December 12, 2025                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux     Version        : 5.10.247-1     CVE ID         : CVE-2023-53498 CVE-2024-47666 CVE-2024-50143 CVE-2024-57947                      CVE-2025-21861 CVE-2025-21887 CVE-2025-22058 CVE-2025-23143                      CVE-2025-38678 CVE-2025-39866 CVE-2025-39869 CVE-2025-39876                      CVE-2025-39883 CVE-2025-39885 CVE-2025-39907 CVE-2025-39911                      CVE-2025-39913 CVE-2025-39923 CVE-2025-39937 CVE-2025-39945                      CVE-2025-39949 CVE-2025-39951 CVE-2025-39953 CVE-2025-39955                      CVE-2025-39964 CVE-2025-39967 CVE-2025-39968 CVE-2025-39969                      CVE-2025-39970 CVE-2025-39971 CVE-2025-39972 CVE-2025-39973                      CVE-2025-39980 CVE-2025-39985 CVE-2025-39986 CVE-2025-39987                      CVE-2025-39993 CVE-2025-39994 CVE-2025-39995 CVE-2025-39996                      CVE-2025-39998 CVE-2025-40001 CVE-2025-40006 CVE-2025-40011                      CVE-2025-40018 CVE-2025-40019 CVE-2025-40020 CVE-2025-40021                      CVE-2025-40022 CVE-2025-40026 CVE-2025-40027 CVE-2025-40029                      CVE-2025-40030 CVE-2025-40035 CVE-2025-40042 CVE-2025-40044                      CVE-2025-40048 CVE-2025-40049 CVE-2025-40053 CVE-2025-40055                      CVE-2025-40070 CVE-2025-40078 CVE-2025-40081 CVE-2025-40083                      CVE-2025-40087 CVE-2025-40088 CVE-2025-40105 CVE-2025-40106                      CVE-2025-40109 CVE-2025-40111 CVE-2025-40115 CVE-2025-40116                      CVE-2025-40118 CVE-2025-40121 CVE-2025-40125 CVE-2025-40127                      CVE-2025-40134 CVE-2025-40140 CVE-2025-40153 CVE-2025-40154                      CVE-2025-40167 CVE-2025-40173 CVE-2025-40178 CVE-2025-40183                      CVE-2025-40186 CVE-2025-40187 CVE-2025-40188 CVE-2025-40190                      CVE-2025-40194 CVE-2025-40197 CVE-2025-40198 CVE-2025-40200                      CVE-2025-40204 CVE-2025-40205 CVE-2025-40211 CVE-2025-40219                      CVE-2025-40220 CVE-2025-40223 CVE-2025-40231 CVE-2025-40233                      CVE-2025-40240 CVE-2025-40243 CVE-2025-40244 CVE-2025-40248                      CVE-2025-40254 CVE-2025-40257 CVE-2025-40258 CVE-2025-40259                      CVE-2025-40261 CVE-2025-40262 CVE-2025-40263 CVE-2025-40264                      CVE-2025-40269 CVE-2025-40271 CVE-2025-40273 CVE-2025-40275                      CVE-2025-40277 CVE-2025-40278 CVE-2025-40280 CVE-2025-40281                      CVE-2025-40282 CVE-2025-40283 CVE-2025-40304 CVE-2025-40306                      CVE-2025-40308 CVE-2025-40309 CVE-2025-40312 CVE-2025-40315                      CVE-2025-40317 CVE-2025-40319 CVE-2025-40321 CVE-2025-40322                      CVE-2025-40324 CVE-2025-40331 CVE-2025-40342     Debian Bug     : 1107479 1114557

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 11 bullseye, these problems have been fixed in version     5.10.247-1.  This version additionally includes many more bug fixes     from stable updates 5.10.245-5.10.247.  The broken pktcdvd driver has     also been disabled.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Input: imx_sc_key - fix memory corruption on unload This is supposed to be priv but we accidentally pass     &priv which is an address in the stack and so it will lead to memory corruption when the     imx_sc_key_action() function is called. Remove the &. (CVE-2025-40262)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
298236	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:20220-1)	Nessus	SuSE Local Security Checks	high
298231	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:20228-1)	Nessus	SuSE Local Security Checks	high
297793	openSUSE 16 Security Update : kernel (openSUSE-SU-2026:20145-1)	Nessus	SuSE Local Security Checks	high
297194	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2026:0315-1)	Nessus	SuSE Local Security Checks	high
296680	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2026:0293-1)	Nessus	SuSE Local Security Checks	high
296676	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0281-1)	Nessus	SuSE Local Security Checks	high
296481	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0278-1)	Nessus	SuSE Local Security Checks	high
284514	Debian dla-4436 : linux-config-6.1 - security update	Nessus	Debian Local Security Checks	high
278559	Debian dla-4404 : ata-modules-5.10.0-35-armmp-di - security update	Nessus	Debian Local Security Checks	high
278313	Photon OS 4.0: Linux PHSA-2025-4.0-0924	Nessus	PhotonOS Local Security Checks	medium
278075	Photon OS 5.0: Linux PHSA-2025-5.0-0708	Nessus	PhotonOS Local Security Checks	high
277527	Linux Distros Unpatched Vulnerability : CVE-2025-40262	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-40262

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

medium

high

critical