The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: erofs: avoid using multiple devices     with different type For multiple devices, both primary and extra devices should be the same type.
    `erofs_init_device` has already guaranteed that if the primary is a file-backed device, extra devices     should also be regular files. However, if the primary is a block device while the extra device is a file-     backed device, `erofs_init_device` will get an ENOTBLK, which is not treated as an error in     `erofs_fc_get_tree`, and that leads to an UAF: erofs_fc_get_tree get_tree_bdev_flags(erofs_fc_fill_super)     erofs_read_superblock erofs_init_device // sbi->dif0 is not inited yet, // return -ENOTBLK     deactivate_locked_super free(sbi) if (err is -ENOTBLK) sbi->dif0.file = filp_open() // sbi UAF So if
    -ENOTBLK is hitted in `erofs_init_device`, it means the primary device must be a block device, and the     extra device is not a block device. The error can be converted to -EINVAL. (CVE-2025-38172)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-38172

high Nessus Plugin ID 247412

Version 1.10

Version 1.9

Version 1.8

Version 1.7

Version 1.6

Version 1.3

Version 1.10 Feb 2, 2026, 9:31 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602022131
Version 1.9 Jan 21, 2026, 5:00 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601211700
Version 1.8 Jan 15, 2026, 2:04 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601151404
Version 1.7 Jan 10, 2026, 7:58 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601101958
Version 1.6 Nov 26, 2025, 1:15 PM CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:U/RC:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202511261315
Version 1.3 Sep 4, 2025, 5:30 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509041730