The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - memblock: Accept allocated memory before use in memblock_double_array() When increasing the array size in     memblock_double_array() and the slab is not yet available, a call to memblock_find_in_range() is used to     reserve/allocate memory. However, the range returned may not have been accepted, which can result in a     crash when booting an SNP guest: RIP: 0010:memcpy_orig+0x68/0x130 Code: ... RSP: 0000:ffffffff9cc03ce8     EFLAGS: 00010006 RAX: ff11001ff83e5000 RBX: 0000000000000000 RCX: fffffffffffff000 RDX: 0000000000000bc0     RSI: ffffffff9dba8860 RDI: ff11001ff83e5c00 RBP: 0000000000002000 R08: 0000000000000000 R09:
    0000000000002000 R10: 000000207fffe000 R11: 0000040000000000 R12: ffffffff9d06ef78 R13: ff11001ff83e5000     R14: ffffffff9dba7c60 R15: 0000000000000c00 memblock_double_array+0xff/0x310     memblock_add_range+0x1fb/0x2f0 memblock_reserve+0x4f/0xa0 memblock_alloc_range_nid+0xac/0x130     memblock_alloc_internal+0x53/0xc0 memblock_alloc_try_nid+0x3d/0xa0 swiotlb_init_remap+0x149/0x2f0     mem_init+0xb/0xb0 mm_core_init+0x8f/0x350 start_kernel+0x17e/0x5d0 x86_64_start_reservations+0x14/0x30     x86_64_start_kernel+0x92/0xa0 secondary_startup_64_no_verify+0x194/0x19b Mitigate this by calling     accept_memory() on the memory range returned before the slab is available. Prior to v6.12, the     accept_memory() interface used a 'start' and 'end' parameter instead of 'start' and 'size', therefore the     accept_memory() call must be adjusted to specify 'start + size' for 'end' when applying to kernels prior     to v6.12. (CVE-2025-37960)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-37960

high Nessus Plugin ID 245325

Version 1.3

Version 1.2

Version 1.3 Sep 1, 2025, 10:01 PM CVSS metrics ("CVSSv3 score" set to 7.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H") CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") CVSSv3 severity (based on None, severity increased from "Medium" to "High") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509012201
Version 1.2 Aug 22, 2025, 7:29 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202508220729