The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: acpi: typec: ucsi: Introduce a
    ->poll_cci method For the ACPI backend of UCSI the UCSI registers are just a memory copy of the register     values in an opregion. The ACPI implementation in the BIOS ensures that the opregion contents are synced     to the embedded controller and it ensures that the registers (in particular CCI) are synced back to the     opregion on notifications. While there is an ACPI call that syncs the actual registers to the opregion     there is rarely a need to do this and on some ACPI implementations it actually breaks in various     interesting ways. The only reason to force a sync from the embedded controller is to poll CCI while     notifications are disabled. Only the ucsi core knows if this is the case and guessing based on the current     command is suboptimal, i.e. leading to the following spurious assertion splat: WARNING: CPU: 3 PID: 76 at     drivers/usb/typec/ucsi/ucsi.c:1388 ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi] CPU: 3 UID: 0 PID: 76 Comm:
    kworker/3:0 Not tainted 6.12.11-200.fc41.x86_64 #1 Hardware name: LENOVO 21D0/LNVNB161216, BIOS J6CN45WW     03/17/2023 Workqueue: events_long ucsi_init_work [typec_ucsi] RIP: 0010:ucsi_reset_ppm+0x1b4/0x1c0     [typec_ucsi] Call Trace: <TASK> ucsi_init_work+0x3c/0xac0 [typec_ucsi] process_one_work+0x179/0x330     worker_thread+0x252/0x390 kthread+0xd2/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK>     Thus introduce a ->poll_cci() method that works like ->read_cci() with an additional forced sync and     document that this should be used when polling with notifications disabled. For all other backends that     presumably don't have this issue use the same implementation for both methods. (CVE-2025-21902)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-21902

medium Nessus Plugin ID 244261

Version 1.4

Version 1.3

Version 1.1

Version 1.4 Oct 29, 2025, 3:03 AM CVSS metrics ("CVSSv2 score" set to 6.3) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202510290303
Version 1.3 Oct 28, 2025, 5:56 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:U/RC:C") Detection (updated detection logic) Plugin Feed: 202510281756
Version 1.1 Aug 7, 2025, 10:03 AM New Plugin Feed: 202508071003