The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - tracing: Fix bad hist from corrupting named_triggers list The following commands causes a crash: ~# cd     /sys/kernel/tracing/events/rcu/rcu_callback ~# echo     'hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)' > trigger bash: echo: write error: Invalid     argument ~# echo 'hist:name=bad:keys=common_pid' > trigger Because the following occurs:
    event_trigger_write() { trigger_process_regex() { event_hist_trigger_parse() { data =     event_trigger_alloc(..); event_trigger_register(.., data) { cmd_ops->reg(.., data, ..)     [hist_register_trigger()] { data->ops->init() [event_hist_trigger_init()] { save_named_trigger(name, data)     { list_add(&data->named_list, &named_triggers); } } } } ret = create_actions(); (return -EINVAL) if (ret)     goto out_unreg; [..] ret = hist_trigger_enable(data, ...) { list_add_tail_rcu(&data->list,     &file->triggers); <<<---- SKIPPED!!! (this is important!) [..] out_unreg: event_hist_unregister(.., data)     { cmd_ops->unreg(.., data, ..) [hist_unregister_trigger()] { list_for_each_entry(iter, &file->triggers,     list) { if (!hist_trigger_match(data, iter, named_data, false)) <- never matches continue; [..] test =     iter; } if (test && test->ops->free) <<<-- test is NULL test->ops->free(test) [event_hist_trigger_free()]     { [..] if (data->name) del_named_trigger(data) { list_del(&data->named_list); <<<<-- NEVER gets removed! }     } } } [..] kfree(data); <<<-- frees item but it is still on list The next time a hist with name is     registered, it causes an u-a-f bug and the kernel can crash. Move the code around such that if     event_trigger_register() succeeds, the next thing called is hist_trigger_enable() which adds it to the     list. A bunch of actions is called if get_named_trigger_data() returns false. But that doesn't need to be     called after event_trigger_register(), so it can be moved up, allowing event_trigger_register() to be     called just before hist_trigger_enable() keeping them together and allowing the file->triggers to be     properly populated. (CVE-2025-21899)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-21899

medium Nessus Plugin ID 243902

Version 1.10

Version 1.9

Version 1.8

Version 1.3

Version 1.2

Version 1.10 Nov 26, 2025, 1:15 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202511261315
Version 1.9 Oct 27, 2025, 3:15 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:U/RC:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202510271515
Version 1.8 Oct 14, 2025, 8:03 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202510140803
Version 1.3 Sep 6, 2025, 2:03 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509060203
Version 1.2 Aug 28, 2025, 1:38 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202508280138