The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - perf/core: Fix data race between perf_event_set_output() and perf_mmap_close() Yang Jihing reported a race     between perf_event_set_output() and perf_mmap_close(): CPU1 CPU2 perf_mmap_close(e2) if     (atomic_dec_and_test(&e2->rb->mmap_count)) // 1 - > 0 detach_rest = true ioctl(e1, IOC_SET_OUTPUT, e2)     perf_event_set_output(e1, e2) ... list_for_each_entry_rcu(e, &e2->rb->event_list, rb_entry)     ring_buffer_attach(e, NULL); // e1 isn't yet added and // therefore not detached ring_buffer_attach(e1,     e2->rb) list_add_rcu(&e1->rb_entry, &e2->rb->event_list) After this; e1 is attached to an unmapped rb and     a subsequent perf_mmap() will loop forever more: again: mutex_lock(&e->mmap_mutex); if (event->rb) { ...
    if (!atomic_inc_not_zero(&e->rb->mmap_count)) { ... mutex_unlock(&e->mmap_mutex); goto again; } } The loop     in perf_mmap_close() holds e2->mmap_mutex, while the attach in perf_event_set_output() holds     e1->mmap_mutex. As such there is no serialization to avoid this race. Change perf_event_set_output() to     take both e1->mmap_mutex and e2->mmap_mutex to alleviate that problem. Additionally, have the loop in     perf_mmap() detach the rb directly, this avoids having to wait for the concurrent perf_mmap_close() to get     around to doing it to make progress. (CVE-2022-49607)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2022-49607

medium Nessus Plugin ID 226343

Version 1.11

Version 1.10

Version 1.3

Version 1.1

Version 1.11 Oct 28, 2025, 5:56 PM Detection (updated detection logic) Plugin Feed: 202510281756
Version 1.10 Oct 27, 2025, 11:56 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:U/RC:C") Detection (updated detection logic) Plugin Feed: 202510272356
Version 1.3 Aug 21, 2025, 7:41 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202508210741
Version 1.1 Mar 5, 2025, 4:35 PM New Plugin Feed: 202503051635