The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - configfs-tsm-report: Fix NULL dereference of tsm_ops Unlike sysfs, the lifetime of configfs objects is     controlled by userspace. There is no mechanism for the kernel to find and delete all created config-items.
    Instead, the configfs-tsm-report mechanism has an expectation that tsm_unregister() can happen at any time     and cause established config-item access to start failing. That expectation is not fully satisfied. While     tsm_report_read(), tsm_report_{is,is_bin}_visible(), and tsm_report_make_item() safely fail if tsm_ops     have been unregistered, tsm_report_privlevel_store() tsm_report_provider_show() fail to check for ops     registration. Add the missing checks for tsm_ops having been removed. Now, in supporting the ability for     tsm_unregister() to always succeed, it leaves the problem of what to do with lingering config-items. The     expectation is that the admin that arranges for the ->remove() (unbind) of the ${tsm_arch}-guest driver is     also responsible for deletion of all open config-items. Until that deletion happens, ->probe() (reload /     bind) of the ${tsm_arch}-guest driver fails. This allows for emergency shutdown / revocation of     attestation interfaces, and requires coordinated restart. (CVE-2025-38210)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-38210

medium Nessus Plugin ID 248055

Version 1.7

Version 1.3

Version 1.7 Oct 27, 2025, 3:15 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202510271515
Version 1.3 Sep 4, 2025, 5:30 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509041730