The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - md/raid1: Fix stack memory use after return in raid1_reshape In the raid1_reshape function, newpool is     allocated on the stack and assigned to conf->r1bio_pool. This results in conf->r1bio_pool.wait.head     pointing to a stack address. Accessing this address later can lead to a kernel panic. Example access path:
    raid1_reshape() { // newpool is on the stack mempool_t newpool, oldpool; // initialize newpool.wait.head     to stack address mempool_init(&newpool, ...); conf->r1bio_pool = newpool; } raid1_read_request() or     raid1_write_request() { alloc_r1bio() { mempool_alloc() { // if pool->alloc fails remove_element() {
    --pool->curr_nr; } } } } mempool_free() { if (pool->curr_nr < pool->min_nr) { // pool->wait.head is a     stack address // wake_up() will try to access this invalid address // which leads to a kernel panic     return; wake_up(&pool->wait); } } Fix: reinit conf->r1bio_pool.wait after assigning newpool.
    (CVE-2025-38445)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-38445

high Nessus Plugin ID 247542

Version 1.7

Version 1.3

Version 1.1

Version 1.7 Oct 1, 2025, 4:14 AM Detection (updated detection logic) Plugin Feed: 202510010414
Version 1.3 Sep 4, 2025, 5:30 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509041730
Version 1.1 Aug 11, 2025, 1:02 AM New Plugin Feed: 202508110102