In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Prevent potential UAF in group creation This commit prevents the possibility of a use after free issue in the GROUP_CREATE ioctl function, which arose as pointer to the group is accessed in that ioctl function after storing it in the Xarray. A malicious userspace can second guess the handle of a group and try to call GROUP_DESTROY ioctl from another thread around the same time as GROUP_CREATE ioctl. To prevent the use after free exploit, this commit uses a mark on an entry of group pool Xarray which is added just before returning from the GROUP_CREATE ioctl function. The mark is checked for all ioctls that specify the group handle and so userspace won't be abe to delete a group that isn't marked yet. v2: Add R-bs and fixes tags

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0962-1 advisory.

    The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
    - CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
    - CVE-2025-39817: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998).
    - CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
    - CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
    - CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
    - CVE-2025-40201: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64()     paths
    - CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
    - CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
    - CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
    - CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
    - CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
    - CVE-2025-68736: landlock: Fix handling of disconnected directories (bsc#1255698).
    - CVE-2025-68778: btrfs: don't log conflicting inode if it's a dir moved in the current transaction     (bsc#1256683).
    - CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
    - CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
    - CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
    - CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer     (bsc#1256708).
    - CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
    - CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
    - CVE-2025-71126: mptcp: reset fallback status gracefully at disconnect() time (bsc#1256755).
    - CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).
    - CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).
    - CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type     (bsc#1257687).
    - CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
    - CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
    - CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).
    - CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
    - CVE-2026-23003: geneve: Fix incorrect inner network header offset when innerprotoinherit is set     (bsc#1257246).
    - CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
    - CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
    - CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
    - CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
    - CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
    - CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
    - CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
    - CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec     (bsc#1257735).
    - CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
    - CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
    - CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
    - CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
    - CVE-2026-23083: fou: Don't allow 0 for FOU_ATTR_IPPROTO (bsc#1257745).
    - CVE-2026-23084: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (bsc#1257830).
    - CVE-2026-23085: irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758).
    - CVE-2026-23086: vsock/virtio: cap TX credit to local buffer size (bsc#1257757).
    - CVE-2026-23088: tracing: Fix crash on synthetic stacktrace field usage (bsc#1257814).
    - CVE-2026-23089: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (bsc#1257790).
    - CVE-2026-23095: gue: Fix skb memleak with inner IP protocol 0 (bsc#1257808).
    - CVE-2026-23099: bonding: limit BOND_MODE_8023AD to Ethernet devices (bsc#1257816).
    - CVE-2026-23102: arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state (bsc#1257772).
    - CVE-2026-23104: ice: fix devlink reload call trace (bsc#1257763).
    - CVE-2026-23105: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag     (bsc#1257775).
    - CVE-2026-23107: arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (bsc#1257762).
    - CVE-2026-23110: scsi: core: Wake up the error handler when final completions race against each other     (bsc#1257761).
    - CVE-2026-23111: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()     (bsc#1258181).
    - CVE-2026-23112: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1258184).
    - CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
    - CVE-2026-23116: pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (bsc#1258277).
    - CVE-2026-23119: bonding: provide a net pointer to __skb_flow_dissect() (bsc#1258273).
    - CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
    - CVE-2026-23139: netfilter: nf_conncount: update last_gc only when GC has been performed (bsc#1258304).
    - CVE-2026-23141: btrfs: send: check for inline extents in range_is_hole_in_parent() (bsc#1258377).
    - CVE-2026-23154: net: fix segmentation of forwarding fraglist GRO (bsc#1258286).
    - CVE-2026-23166: ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (bsc#1258272).
    - CVE-2026-23169: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (bsc#1258389).
    - CVE-2026-23171: net: bonding: update the slave array for broadcast mode (bsc#1258349).
    - CVE-2026-23173: net/mlx5e: TC, delete flows only for existing peers (bsc#1258520).
    - CVE-2026-23179: nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (bsc#1258394).
    - CVE-2026-23191: ALSA: aloop: Fix racy access at PCM trigger (bsc#1258395).
    - CVE-2026-23198: KVM: Don't clobber irqfd routing type when deassigning irqfd (bsc#1258321).
    - CVE-2026-23204: net/sched: cls_u32: use skb_header_pointer_careful() (bsc#1258340).
    - CVE-2026-23208: ALSA: usb-audio: Prevent excessive number of frames (bsc#1258468).
    - CVE-2026-23209: macvlan: fix error recovery in macvlan_common_newlink() (bsc#1258518).
    - CVE-2026-23210: ice: Fix PTP NULL pointer dereference during VSI rebuild (bsc#1258517).
    - CVE-2026-23213: drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (bsc#1258465).
    - CVE-2026-23214: btrfs: reject new transactions if the fs is fully read-only (bsc#1258464).
    - CVE-2026-23268: apparmor: fix unprivileged local user can do privileged policy management
    - CVE-2026-23269: apparmor: validate DFA start states are in bounds in unpack_pdb


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8094-1 advisory.

    Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM).
    An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor     profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege     escalation, or possibly escape a container. (LP: #2143853)

    It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle     entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could     possibly use this issue to influence the values returned by the RDSEED instruction causing loss of     confidentiality and integrity. (CVE-2025-62626)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - S390 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Compute Acceleration Framework;

    - ATM drivers;

    - Network block device driver;

    - Bluetooth drivers;

    - Data acquisition framework and drivers;

    - Hardware crypto device drivers;

    - Device frequency scaling framework;

    - Intel Stratix 10 firmware drivers;

    - GPIO subsystem;

    - GPU drivers;

    - Microsoft Hyper-V drivers;

    - CoreSight HW tracing drivers;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Input Device (Tablet) drivers;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - Macintosh device drivers;

    - Multiple devices driver;

    - MOST (Media Oriented Systems Transport) drivers;

    - MTD block device drivers;

    - Network drivers;

    - Mellanox network drivers;

    - Texas Instruments network drivers;

    - Ethernet team driver;

    - MediaTek network drivers;

    - NVME drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - Voltage and Current Regulator drivers;

    - Real Time Clock drivers;

    - S/390 drivers;

    - SCSI subsystem;

    - Texas Instruments SoC drivers;

    - SPI subsystem;

    - Media Oriented Systems Transport (MOST) driver;

    - Realtek RTL8723BS SDIO drivers;

    - TCM subsystem;

    - UFS subsystem;

    - DesignWare USB3 driver;

    - USB Gadget drivers;

    - Renesas USBHS Controller drivers;

    - USB Mass Storage drivers;

    - USB Type-C Connector System Software Interface driver;

    - Backlight driver;

    - Framebuffer layer;

    - AFS file system;

    - BFS file system;

    - BTRFS file system;

    - EROFS file system;

    - Ext4 file system;

    - FAT file system;

    - GFS2 file system;

    - Journaling layer for block devices (JBD2);

    - File systems infrastructure;

    - Network file system (NFS) client;

    - NTFS3 file system;

    - OCFS2 file system;

    - SMB network file system;

    - XFS file system;

    - BPF subsystem;

    - MediaTek SoC drivers;

    - Bluetooth subsystem;

    - io_uring subsystem;

    - Locking primitives;

    - Scheduler infrastructure;

    - Timer subsystem;

    - Tracing infrastructure;

    - Kexec HandOver (KHO);

    - Memory management;

    - Ceph Core library;

    - Networking core;

    - Devlink API;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Open vSwitch;

    - Network traffic control;

    - VMware vSockets driver;

    - eXpress Data Path;

    - Integrity Measurement Architecture(IMA) framework;

    - Simplified Mandatory Access Control Kernel framework;

    - FireWire sound drivers;

    - HD-audio driver;

    - Turtle Beach Wavefront ALSA driver;

    - SoundWire (SDCA) ASoC drivers; (CVE-2025-40246, CVE-2025-40247, CVE-2025-40248, CVE-2025-40249,     CVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40255,     CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40260, CVE-2025-40261, CVE-2025-40262,     CVE-2025-40263, CVE-2025-40264, CVE-2025-40265, CVE-2025-40266, CVE-2025-40290, CVE-2025-40345,     CVE-2025-68212, CVE-2025-68213, CVE-2025-68214, CVE-2025-68215, CVE-2025-68217, CVE-2025-68218,     CVE-2025-68219, CVE-2025-68220, CVE-2025-68221, CVE-2025-68222, CVE-2025-68223, CVE-2025-68225,     CVE-2025-68227, CVE-2025-68228, CVE-2025-68229, CVE-2025-68230, CVE-2025-68231, CVE-2025-68232,     CVE-2025-68233, CVE-2025-68234, CVE-2025-68235, CVE-2025-68236, CVE-2025-68237, CVE-2025-68238,     CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259,     CVE-2025-68261, CVE-2025-68262, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266,     CVE-2025-68281, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286,     CVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290, CVE-2025-68292, CVE-2025-68293,     CVE-2025-68294, CVE-2025-68295, CVE-2025-68296, CVE-2025-68297, CVE-2025-68298, CVE-2025-68299,     CVE-2025-68300, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68304, CVE-2025-68305,     CVE-2025-68306, CVE-2025-68307, CVE-2025-68308, CVE-2025-68323, CVE-2025-68324, CVE-2025-68325,     CVE-2025-68326, CVE-2025-68327, CVE-2025-68328, CVE-2025-68329, CVE-2025-68330, CVE-2025-68331,     CVE-2025-68332, CVE-2025-68333, CVE-2025-68334, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337,     CVE-2025-68338, CVE-2025-68339, CVE-2025-68340, CVE-2025-68341, CVE-2025-68342, CVE-2025-68343,     CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68348, CVE-2025-68349,     CVE-2025-68352, CVE-2025-68354, CVE-2025-68356, CVE-2025-68358, CVE-2025-68359, CVE-2025-68360,     CVE-2025-68361, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,     CVE-2025-68369, CVE-2025-68370, CVE-2025-68371, CVE-2025-68372, CVE-2025-68373, CVE-2025-68374,     CVE-2025-68375, CVE-2025-68376, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,     CVE-2025-68726, CVE-2025-68727, CVE-2025-68728, CVE-2025-68729, CVE-2025-68730, CVE-2025-68732,     CVE-2025-68733, CVE-2025-68735, CVE-2025-68738, CVE-2025-68739, CVE-2025-68740, CVE-2025-68741,     CVE-2025-68742, CVE-2025-68743, CVE-2025-68744, CVE-2025-68746, CVE-2025-68747, CVE-2025-68748,     CVE-2025-68749, CVE-2025-68751, CVE-2025-68752, CVE-2025-68753, CVE-2025-68754, CVE-2025-68755,     CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68760, CVE-2025-68762,     CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-71128)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20287-1 advisory.

    The SUSE Linux Enterprise 16.0 and SL MIxro 6.2 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-40147: blk-throttle: fix access race during throttle policy activation (bsc#1253344).
    - CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
    - CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
    - CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
    - CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
    - CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
    - CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
    - CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
    - CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
    - CVE-2025-68211: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item     (bsc#1255319).
    - CVE-2025-68218: nvme-multipath: fix lockdep WARN due to partition scan work (bsc#1255245).
    - CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
    - CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
    - CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
    - CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
    - CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
    - CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
    - CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
    - CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
    - CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted     (bsc#1255482).
    - CVE-2025-68341: veth: reduce XDP no_direct return section to fix race (bsc#1255506).
    - CVE-2025-68348: block: fix memory leak in __blkdev_issue_zero_pages (bsc#1255694).
    - CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid     (bsc#1255544).
    - CVE-2025-68356: gfs2: Prevent recursive memory reclaim (bsc#1255593).
    - CVE-2025-68359: btrfs: fix double free of qgroup record after failure to add delayed ref head     (bsc#1255542).
    - CVE-2025-68360: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks (bsc#1255536).
    - CVE-2025-68361: erofs: limit the level of fs stacking for file-backed mounts (bsc#1255526).
    - CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
    - CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
    - CVE-2025-68368: md: init bioset in mddev_init (bsc#1255527).
    - CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
    - CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
    - CVE-2025-68376: coresight: ETR: Fix ETR buffer use-after-free issue (bsc#1255529).
    - CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
    - CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
    - CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
    - CVE-2025-68743: mshv: Fix create memory region overlap check (bsc#1255708).
    - CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
    - CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).
    - CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).
    - CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
    - CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).
    - CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659).
    - CVE-2025-68784: xfs: fix a UAF problem in xattr repair (bsc#1256793).
    - CVE-2025-68788: fsnotify: do not generate ACCESS/MODIFY events on child for special files (bsc#1256638).
    - CVE-2025-68792: tpm2-sessions: Fix out of range indexing in name_size (bsc#1256656).
    - CVE-2025-68795: ethtool: Avoid overflowing userspace buffer on stats query (bsc#1256688).
    - CVE-2025-68798: perf/x86/amd: Check event before enable to avoid GPF (bsc#1256689).
    - CVE-2025-68799: caif: fix integer underflow in cffrml_receive() (bsc#1256643).
    - CVE-2025-68800: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats     (bsc#1256646).
    - CVE-2025-68801: mlxsw: spectrum_router: Fix neighbour use-after-free (bsc#1256653).
    - CVE-2025-68803: NFSD: NFSv4 file creation neglects setting ACL (bsc#1256770).
    - CVE-2025-68811: svcrdma: use rc_pageoff for memcpy byte offset (bsc#1256677).
    - CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).
    - CVE-2025-68814: io_uring: fix filename leak in __io_openat_prep() (bsc#1256651).
    - CVE-2025-68815: net/sched: ets: Remove drr class from the active list if it changes to strict     (bsc#1256680).
    - CVE-2025-68816: net/mlx5: fw_tracer, Validate format string parameters (bsc#1256674).
    - CVE-2025-68820: ext4: xattr: fix null pointer deref in ext4_raw_inode() (bsc#1256754).
    - CVE-2025-68821: fuse: fix readahead reclaim deadlock (bsc#1256667).
    - CVE-2025-71064: net: hns3: using the num_tqps in the vf driver to apply for resources (bsc#1256654).
    - CVE-2025-71066: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change     (bsc#1256645).
    - CVE-2025-71077: tpm: Cap the number of PCR banks (bsc#1256613).
    - CVE-2025-71080: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (bsc#1256608).
    - CVE-2025-71084: RDMA/cm: Fix leaking the multicast GID table reference (bsc#1256622).
    - CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256623).
    - CVE-2025-71087: iavf: fix off-by-one issues in iavf_config_rss_reg() (bsc#1256628).
    - CVE-2025-71088: mptcp: fallback earlier on simult connection (bsc#1256630).
    - CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256612).
    - CVE-2025-71091: team: fix check for port enabled in team_queue_override_port_prio_changed()     (bsc#1256773).
    - CVE-2025-71093: e1000: fix OOB in e1000_tbi_should_accept() (bsc#1256777).
    - CVE-2025-71094: net: usb: asix: ax88772: Increase phy_name size (bsc#1256597).
    - CVE-2025-71095: net: stmmac: fix the crash issue for zero copy XDP_TX action (bsc#1256605).
    - CVE-2025-71097: ipv4: Fix reference count leak when using error routes with nexthop objects     (bsc#1256607).
    - CVE-2025-71098: ip6_gre: make ip6gre_header() robust (bsc#1256591).
    - CVE-2025-71112: net: hns3: add VLAN id validation before using (bsc#1256726).
    - CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744).
    - CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf     (bsc#1256779).
    - CVE-2025-71123: ext4: fix string copying in parse_apply_sb_mount_options() (bsc#1256757).
    - CVE-2025-71126: mptcp: avoid deadlock on fallback while reinjecting (bsc#1256755).
    - CVE-2025-71132: smc91x: fix broken irq-context in PREEMPT_RT (bsc#1256737).
    - CVE-2025-71133: RDMA/irdma: avoid invalid read in irdma_net_event (bsc#1256733).
    - CVE-2025-71135: md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt()     (bsc#1256761).
    - CVE-2025-71137: octeontx2-pf: fix UBSAN: shift-out-of-bounds error (bsc#1256760).
    - CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).
    - CVE-2025-71149: io_uring/poll: correctly handle io_poll_add() return value on update (bsc#1257164).
    - CVE-2025-71156: gve: defer interrupt enabling until NAPI registration (bsc#1257167).
    - CVE-2025-71157: RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (bsc#1257168).
    - CVE-2026-22976: net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset     (bsc#1257035).
    - CVE-2026-22977: net: sock: fix hardened usercopy panic in sock_recv_errqueue (bsc#1257053).
    - CVE-2026-22981: idpf: detach and close netdevs while handling a reset (bsc#1257225).
    - CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).
    - CVE-2026-22984: libceph: prevent potential out-of-bounds reads in handle_auth_done() (bsc#1257217).
    - CVE-2026-22986: gpiolib: fix race condition for gdev->srcu (bsc#1257276).
    - CVE-2026-22990: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (bsc#1257221).
    - CVE-2026-22991: libceph: make free_choose_arg_map() resilient to partial allocation (bsc#1257220).
    - CVE-2026-22992: libceph: return the handler error from mon_handle_auth_done() (bsc#1257218).
    - CVE-2026-22993: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations (bsc#1257180).
    - CVE-2026-22996: net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv.
    - CVE-2026-22999: net/sched: sch_qfq: do not free existing class in qfq_change_class() (bsc#1257236).
    - CVE-2026-23000: net/mlx5e: Fix crash on profile change rollback failure (bsc#1257234).
    - CVE-2026-23001: macvlan: fix possible UAF in macvlan_forward_source() (bsc#1257232).
    - CVE-2026-23005: x86/fpu: Clear XSTATE_BV in guest XSAVE state whenever XFD[i]=1 (bsc#1257245).
    - CVE-2026-23011: ipv4: ip_gre: make ipgre_header() robust (bsc#1257207).

    The following non security issues were fixed:

    - ALSA: usb-audio: Update for native DSD support quirks (stable-fixes).
    - Add bugnumber to an existing hv_netvsc change (bsc#1257473).
    - Fix locking issue introduced by a CVE backport (bsc#1256975 bsc#1254977).
    - Update config files: disable CONFIG_DEVPORT for arm64 (bsc#1256792)
    - arm64: Update config files. Disable DEVPORT (bsc#1256792)
    - bpf/selftests: test_select_reuseport_kern: Remove unused header (bsc#1257603).
    - bpf: Do not let BPF test infra emit invalid GSO types to stack (bsc#1255569).
    - btrfs: pass fs_info to btrfs_delete_ref_head() (git-fixes).
    - btrfs: scrub: always update btrfs_scrub_progress::last_physical (git-fixes).
    - bus: fsl-mc: Constify fsl_mc_device_match() (jsc#PED-10906 git-fixes).
    - drm/imagination: Wait for FW trace update command completion (git-fixes).
    - drm/msm/a6xx: fix bogus hwcg register updates (git-fixes).
    - ice: use netif_get_num_default_rss_queues() (bsc#1247712).
    - libbpf: Fix -Wdiscarded-qualifiers under C23 (bsc#1257309).
    - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (bsc#1254447 bsc#1253087).
    - net: mana: Fix incorrect speed reported by debugfs (bsc#1255232).
    - net: mana: Support HW link state events (bsc#1253049).
    - nfsd: adjust WARN_ON_ONCE in revoke_delegation (bsc#1257015).
    - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (git-fixes).
    - powerpc/addnote: Fix overflow on 32-bit builds (bsc#1215199).
    - sched/fair: Disable scheduler feature NEXT_BUDDY (bsc#1255459).
    - scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (bsc#1256864).
    - scsi: lpfc: Update lpfc version to 14.4.0.13 (bsc#1256864).
    - scsi: qla2xxx: Add Speed in SFP print information (bsc#1256865 bsc#1256867 jsc#PED-14156).
    - scsi: qla2xxx: Add bsg interface to support firmware img validation (bsc#1256865 bsc#1256867     jsc#PED-14156).
    - scsi: qla2xxx: Add load flash firmware mailbox support for 28xxx (bsc#1256865 bsc#1256867     jsc#PED-14156).
    - scsi: qla2xxx: Add support for 64G SFP speed (bsc#1256865 bsc#1256867 jsc#PED-14156).
    - scsi: qla2xxx: Allow recovery for tape devices (bsc#1256865 bsc#1256867 jsc#PED-14156).
    - scsi: qla2xxx: Delay module unload while fabric scan in progress (bsc#1256865 bsc#1256867     jsc#PED-14156).
    - scsi: qla2xxx: Fix bsg_done() causing double free (bsc#1256865 bsc#1256867 jsc#PED-14156).
    - scsi: qla2xxx: Free sp in error path to fix system crash (bsc#1256865 bsc#1256867 jsc#PED-14156).
    - scsi: qla2xxx: Query FW again before proceeding with login (bsc#1256865 bsc#1256867 jsc#PED-14156).
    - scsi: qla2xxx: Update version to 10.02.10.100-k (bsc#1256865 bsc#1256867 jsc#PED-14156).
    - scsi: qla2xxx: Validate MCU signature before executing MBC 03h (bsc#1256865 bsc#1256867 jsc#PED-14156).
    - scsi: qla2xxx: Validate sp before freeing associated memory (bsc#1256865 bsc#1256867 jsc#PED-14156).
    - scsi: storvsc: Process unsupported MODE_SENSE_10 (bsc#1257296).
    - selftests: net: fib-onlink-tests: Convert to use namespaces by default (bsc#1255346).
    - slimbus: core: Constify slim_eaddr_equal() (jsc#PED-10906 git-fixes).
    - smb: client: split cached_fid bitfields to avoid shared-byte RMW races (bsc#1250748,bsc#1257154).
    - smb: client: update cfid->last_access_time in open_cached_dir_by_dentry() (git-fixes).
    - smb: improve directory cache reuse for readdir operations (bsc#1252712).
    - tsm-mr: Add TVM Measurement Register support (bsc#1257504).
    - tsm-mr: Add tsm-mr sample code (bsc#1257504).
    - virt: tdx-guest: Expose TDX MRs as sysfs attributes (bsc#1257504).
    - virt: tdx-guest: Refactor and streamline TDREPORT generation (bsc#1257504).
    - virt: tdx-guest: Transition to scoped_cond_guard for mutex operations (bsc#1257504).
    - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (git-fixes).
    - x86/tdx: Add tdx_mcall_extend_rtmr() interface (bsc#1257504).
    - x86/tdx: tdx_mcall_get_report0: Return -EBUSY on TDCALL_OPERAND_BUSY error (bsc#1257504).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - drm/panthor: Prevent potential UAF in group creation This commit prevents the possibility of a use after     free issue in the GROUP_CREATE ioctl function, which arose as pointer to the group is accessed in that     ioctl function after storing it in the Xarray. A malicious userspace can second guess the handle of a     group and try to call GROUP_DESTROY ioctl from another thread around the same time as GROUP_CREATE ioctl.
    To prevent the use after free exploit, this commit uses a mark on an entry of group pool Xarray which is     added just before returning from the GROUP_CREATE ioctl function. The mark is checked for all ioctls that     specify the group handle and so userspace won't be abe to delete a group that isn't marked yet. v2: Add     R-bs and fixes tags (CVE-2025-68735)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
303965	SUSE SLED15 / SLES15 : Recommended update for initial livepatch (SUSE-SU-2026:1081-1)	Nessus	SuSE Local Security Checks	critical
303406	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0962-1)	Nessus	SuSE Local Security Checks	critical
302766	Ubuntu 24.04 LTS / 25.10 : Linux kernel vulnerabilities (USN-8094-1)	Nessus	Ubuntu Local Security Checks	high
300556	openSUSE 16 Security Update : kernel (openSUSE-SU-2026:20287-1)	Nessus	SuSE Local Security Checks	high
279764	Linux Distros Unpatched Vulnerability : CVE-2025-68735	Nessus	Misc.	high

Detections

Analytics

CVE-2025-68735

high

Tenable Plugins

critical

critical

high

high

high