The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - block: fix race between set_blocksize and read paths With the new large sector size support, it's now the     case that set_blocksize can change i_blksize and the folio order in a manner that conflicts with a     concurrent reader and causes a kernel crash. Specifically, let's say that udev-worker calls libblkid to     detect the labels on a block device. The read call can create an order-0 folio to read the first 4096     bytes from the disk. But then udev is preempted. Next, someone tries to mount an 8k-sectorsize filesystem     from the same block device. The filesystem calls set_blksize, which sets i_blksize to 8192 and the minimum     folio order to 1. Now udev resumes, still holding the order-0 folio it allocated. It then tries to     schedule a read bio and do_mpage_readahead tries to create bufferheads for the folio. Unfortunately,     blocks_per_folio == 0 because the page size is 4096 but the blocksize is 8192 so no bufferheads are     attached and the bh walk never sets bdev. We then submit the bio with a NULL block device and crash.
    Therefore, truncate the page cache after flushing but before updating i_blksize. However, that's not     enough -- we also need to lock out file IO and page faults during the update. Take both the i_rwsem and     the invalidate_lock in exclusive mode for invalidations, and in shared mode for read/write operations. I     don't know if this is the correct fix, but xfs/259 found it. (CVE-2025-38073)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-38073

medium Nessus Plugin ID 244958

Version 1.12

Version 1.11

Version 1.8

Version 1.3

Version 1.2

Version 1.12 Oct 29, 2025, 3:03 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202510290303
Version 1.11 Oct 27, 2025, 11:56 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:U/RC:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202510272356
Version 1.8 Sep 30, 2025, 5:08 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202509301708
Version 1.3 Sep 1, 2025, 10:01 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509012201
Version 1.2 Aug 22, 2025, 7:29 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202508220729