The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - scsi: lpfc: Use memcpy() for BIOS version The strlcat() with FORTIFY support is triggering a panic because     it thinks the target buffer will overflow although the correct target buffer size is passed in. Anyway,     instead of memset() with 0 followed by a strlcat(), just use memcpy() and ensure that the resulting buffer     is NULL terminated. BIOSVersion is only used for the lpfc_printf_log() which expects a properly terminated     string. (CVE-2025-38332)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-38332

high Nessus Plugin ID 246664

Version 1.3

Version 1.2

Version 1.3 Sep 1, 2025, 10:01 PM CVSS metrics ("CVSSv3 score" set to 7.0) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509012201
Version 1.2 Aug 22, 2025, 7:29 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202508220729