In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header The driver expects to receive a struct gs_host_frame in gs_usb_receive_bulk_callback(). Use struct_group to describe the header of the struct gs_host_frame and check that we have at least received the header before accessing any members of it. To resubmit the URB, do not dereference the pointer chain "dev->parent->hf_size_rx" but use "parent->hf_size_rx" instead. Since "urb->context" contains "parent", it is always defined, while "dev" is not defined if the URB it too short.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20145-1 advisory.

    The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
    - CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
    - CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
    - CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference     (bsc#1252861).
    - CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
    - CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
    - CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
    - CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
    - CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
    - CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
    - CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
    - CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
    - CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
    - CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
    - CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
    - CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
    - CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
    - CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
    - CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
    - CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
    - CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
    - CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
    - CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
    - CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
    - CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
    - CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in       qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
    - CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
    - CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
    - CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
    - CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
    - CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
    - CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
    - CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
    - CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
    - CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak     (bsc#1254825).
    - CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
    - CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
    - CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
    - CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
    - CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
    - CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
    - CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
    - CVE-2025-40330: bnxt_en: Shutdown FW DMA in bnxt_shutdown() (bsc#1254616).
    - CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
    - CVE-2025-40338: ASoC: Intel: avs: Do not share the name pointer between components (bsc#1255273).
    - CVE-2025-40346: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (bsc#1255318).
    - CVE-2025-40347: net: enetc: fix the deadlock of enetc_mdio_lock (bsc#1255262).
    - CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ     (bsc#1255260).
    - CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).
    - CVE-2025-40357: net/smc: fix general protection fault in __smc_diag_dump (bsc#1255097).
    - CVE-2025-40359: perf/x86/intel: Fix KASAN global-out-of-bounds warning (bsc#1255087).
    - CVE-2025-40362: ceph: fix multifs mds auth caps issue (bsc#1255103).
    - CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).
    - CVE-2025-68197: bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (bsc#1255242).
    - CVE-2025-68198: crash: fix crashkernel resource shrink (bsc#1255243).
    - CVE-2025-68202: sched_ext: Fix unsafe locking in the scx_dump_state() (bsc#1255223).
    - CVE-2025-68206: netfilter: nft_ct: add seqadj extension for natted connections (bsc#1255142).
    - CVE-2025-68208: bpf: account for current allocated stack depth in widen_imprecise_scalars()     (bsc#1255227).
    - CVE-2025-68209: mlx5: Fix default values in create CQ (bsc#1255230).
    - CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).
    - CVE-2025-68239: binfmt_misc: restore write access before closing files opened by open_exec()     (bsc#1255272).
    - CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (bsc#1255199).
    - CVE-2025-68264: ext4: refresh inline data size before write operations (bsc#1255380).
    - CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
    - CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key()     (bsc#1255377).
    - CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
    - CVE-2025-68293: mm/huge_memory: fix NULL pointer deference when splitting folio (bsc#1255150).
    - CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).
    - CVE-2025-68302: net: sxgbe: fix potential NULL dereference in sxgbe_rx() (bsc#1255121).
    - CVE-2025-68317: io_uring/zctx: check chained notif contexts (bsc#1255354).
    - CVE-2025-68340: team: Move team device type change at the end of team_port_add (bsc#1255507).
    - CVE-2025-68353: net: vxlan: prevent NULL deref in vxlan_xmit_one (bsc#1255533).
    - CVE-2025-68363: bpf: Check skb->transport_header is set in bpf_skb_check_mtu (bsc#1255552).
    - CVE-2025-68378: bpf: Refactor stack map trace depth calculation into helper function (bsc#1255614).
    - CVE-2025-68736: landlock: Optimize file path walks and prepare for audit support (bsc#1255698).
    - CVE-2025-68742: bpf: Fix invalid prog->stats access when update_effective_progs fails (bsc#1255707).
    - CVE-2025-68744: bpf: Free special fields when update [lru_,]percpu_hash maps (bsc#1255709).
    - CVE-2025-71096: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (bsc#1256606).

    The following non security issues were fixed:

    - KVM: SEV: Drop GHCB_VERSION_DEFAULT and open code it (bsc#1255672).
    - Set HZ=1000 for ppc64 default configuration (jsc#PED-14344)
    - bpf: Do not limit bpf_cgroup_from_id to current's namespace (bsc#1255433).
    - btrfs: handle aligned EOF truncation correctly for subpage cases (bsc#1253238).
    - cgroup: rstat: use LOCK CMPXCHG in css_rstat_updated (bsc#1255434).
    - cifs: update dstaddr whenever channel iface is updated (git-fixes).
    - cpuidle: menu: Use residency threshold in polling state override decisions (bsc#1255026).
    - cpuset: fix warning when disabling remote partition (bsc#1256794).
    - ext4: use optimized mballoc scanning regardless of inode format (bsc#1254378).
    - net: usb: pegasus: fix memory leak in update_eth_regs_async() (git-fixes).
    - netdevsim: print human readable IP address (bsc#1255071).
    - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event       handling (bsc#1253262 ltc#216029).
    - powerpc/kexec: Enable SMT before waking offline CPUs (bsc#1214285       bsc#1205462 ltc#200161 ltc#200588 git-fixes bsc#1253739 ltc#211493       bsc#1254244 ltc#216496).
    - sched: Increase sched_tick_remote timeout (bsc#1254510).
    - selftests: net: fib-onlink-tests: Set high metric for default IPv6 route (bsc#1255346).
    - selftests: net: use slowwait to make sure IPv6 setup finished (bsc#1255349).
    - selftests: net: use slowwait to stabilize vrf_route_leaking test (bsc#1255349).
    - serial: xilinx_uartps: Use helper function hrtimer_update_function() (stable-fixes).
    - supported.conf: Mark lan 743x supported (jsc#PED-14571)
    - tick/sched: Limit non-timekeeper CPUs calling jiffies update (bsc#1254477).
    - wifi: ath10k: Avoid vdev delete timeout when firmware is already down (stable-fixes).
    - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256495).
    - x86/microcode/AMD: Make __verify_patch_size() return bool (bsc#1256495).
    - x86/microcode/AMD: Remove bogus comment from parse_container() (bsc#1256495).
    - x86/microcode/AMD: Select which microcode patch to load (bsc#1256495).
    - x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256495).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4436 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4436-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     January 14, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.1     Version        : 6.1.159-1~deb11u1     CVE ID         : CVE-2024-47666 CVE-2025-37899 CVE-2025-38057 CVE-2025-38556                      CVE-2025-38593 CVE-2025-38678 CVE-2025-39805 CVE-2025-40083                      CVE-2025-40211 CVE-2025-40214 CVE-2025-40248 CVE-2025-40252                      CVE-2025-40253 CVE-2025-40254 CVE-2025-40257 CVE-2025-40258                      CVE-2025-40259 CVE-2025-40261 CVE-2025-40262 CVE-2025-40263                      CVE-2025-40264 CVE-2025-40269 CVE-2025-40271 CVE-2025-40272                      CVE-2025-40273 CVE-2025-40275 CVE-2025-40277 CVE-2025-40278                      CVE-2025-40279 CVE-2025-40280 CVE-2025-40281 CVE-2025-40282                      CVE-2025-40283 CVE-2025-40284 CVE-2025-40285 CVE-2025-40286                      CVE-2025-40288 CVE-2025-40292 CVE-2025-40293 CVE-2025-40294                      CVE-2025-40297 CVE-2025-40301 CVE-2025-40304 CVE-2025-40306                      CVE-2025-40308 CVE-2025-40309 CVE-2025-40312 CVE-2025-40313                      CVE-2025-40314 CVE-2025-40315 CVE-2025-40317 CVE-2025-40318                      CVE-2025-40319 CVE-2025-40321 CVE-2025-40322 CVE-2025-40323                      CVE-2025-40324 CVE-2025-40331 CVE-2025-40341 CVE-2025-40342                      CVE-2025-40343 CVE-2025-40345 CVE-2025-40360 CVE-2025-40363                      CVE-2025-68168 CVE-2025-68171 CVE-2025-68173 CVE-2025-68176                      CVE-2025-68177 CVE-2025-68185 CVE-2025-68191 CVE-2025-68192                      CVE-2025-68194 CVE-2025-68200 CVE-2025-68204 CVE-2025-68214                      CVE-2025-68217 CVE-2025-68218 CVE-2025-68220 CVE-2025-68227                      CVE-2025-68229 CVE-2025-68231 CVE-2025-68233 CVE-2025-68237                      CVE-2025-68238 CVE-2025-68241 CVE-2025-68244 CVE-2025-68245                      CVE-2025-68246 CVE-2025-68282 CVE-2025-68283 CVE-2025-68284                      CVE-2025-68285 CVE-2025-68286 CVE-2025-68287 CVE-2025-68288                      CVE-2025-68289 CVE-2025-68290 CVE-2025-68295 CVE-2025-68301                      CVE-2025-68302 CVE-2025-68303 CVE-2025-68307 CVE-2025-68308                      CVE-2025-68310 CVE-2025-68312 CVE-2025-68321 CVE-2025-68327                      CVE-2025-68328 CVE-2025-68330 CVE-2025-68331 CVE-2025-68339                      CVE-2025-68343 CVE-2025-68734     Debian Bug     : 919350 1106411 1114557 1119232 1120602 1120680

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 11 bullseye, these problems have been fixed in version     6.1.159-1~deb11u1.  This update also fixes several bugs reported to     Debian.  It additionally includes many more bug fixes from stable     update 6.1.159.

    We recommend that you upgrade your linux-6.1 packages.

    For the detailed security status of linux-6.1 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.1

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header The driver     expects to receive a struct gs_host_frame in gs_usb_receive_bulk_callback(). Use struct_group to describe     the header of the struct gs_host_frame and check that we have at least received the header before     accessing any members of it. To resubmit the URB, do not dereference the pointer chain     dev->parent->hf_size_rx but use parent->hf_size_rx instead. Since urb->context contains parent, it     is always defined, while dev is not defined if the URB it too short. (CVE-2025-68343)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
297793	openSUSE 16 Security Update : kernel (openSUSE-SU-2026:20145-1)	Nessus	SuSE Local Security Checks	high
284514	Debian dla-4436 : linux-config-6.1 - security update	Nessus	Debian Local Security Checks	high
279641	Linux Distros Unpatched Vulnerability : CVE-2025-68343	Nessus	Misc.	medium
278075	Photon OS 5.0: Linux PHSA-2025-5.0-0708	Nessus	PhotonOS Local Security Checks	high
277560	Photon OS 4.0: Linux PHSA-2025-4.0-0919	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2025-68343

medium

Tenable Plugins

high

high

medium

high

high