The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-12746 advisory.

    - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Davide Caratti) [RHEL-97522]     {CVE-2025-38001 CVE-2025-37890}
    - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Davide Caratti) [RHEL-97522]     {CVE-2025-38000}
    - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Davide Caratti)     [RHEL-97522] {CVE-2025-37890}
    - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98847]     {CVE-2025-21928}
    - HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() (CKI Backport Bot) [RHEL-98871]     {CVE-2025-21929}
    - Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (David Marlin) [RHEL-95324]     {CVE-2025-37918}
    - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Desnes Nunes) [RHEL-99029]     {CVE-2025-22020}
    - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (John W. Linville) [RHEL-97499]     {CVE-2022-49788}
    - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103087]     {CVE-2025-38052}
    - net/sched: fix use-after-free in taprio_dev_notifier (CKI Backport Bot) [RHEL-101317] {CVE-2025-38087}
    - padata: avoid UAF for reorder_work (Rafael Aquini) [RHEL-97031] {CVE-2025-21727 CVE-2025-21726}
    - padata: fix UAF in padata_reorder (Rafael Aquini) [RHEL-97031] {CVE-2025-21727}
    - padata: add pd get/put refcnt helper (Rafael Aquini) [RHEL-97031] {CVE-2025-21727}
    - padata: fix sysfs store callback check (Rafael Aquini) [RHEL-97031] {CVE-2025-21727}
    - padata: Clean up in padata_do_multithreaded() (Rafael Aquini) [RHEL-97031] {CVE-2025-21727}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 9 : kernel (ELSA-2025-12746)

high Nessus Plugin ID 244361

Version 1.2

Version 1.1

Version 1.2 Feb 10, 2026, 11:15 AM Detection (updated detection logic) Plugin Feed: 202602101115
Version 1.1 Aug 7, 2025, 10:03 AM New Plugin Feed: 202508071003