The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ALSA: pcm: Fix race of buffer access at PCM OSS layer The PCM OSS layer tries to clear the buffer with the     silence data at initialization (or reconfiguration) of a stream with the explicit call of     snd_pcm_format_set_silence() with runtime->dma_area. But this may lead to a UAF because the accessed     runtime->dma_area might be freed concurrently, as it's performed outside the PCM ops. For avoiding it,     move the code into the PCM core and perform it inside the buffer access lock, so that it won't be changed     during the operation. (CVE-2025-38078)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-38078

high Nessus Plugin ID 246468

Version 1.2

Version 1.1

Version 1.2 Aug 18, 2025, 9:35 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202508180935
Version 1.1 Aug 9, 2025, 7:26 AM New Plugin Feed: 202508090726