The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: fs/erofs/fileio: call     erofs_onlinefolio_split() after bio_add_folio() If bio_add_folio() fails (because it is full),     erofs_fileio_scan_folio() needs to submit the I/O request via erofs_fileio_rq_submit() and allocate a new     I/O request with an empty `struct bio`. Then it retries the bio_add_folio() call. However, at this point,     erofs_onlinefolio_split() has already been called which increments `folio->private`; the retry will call     erofs_onlinefolio_split() again, but there will never be a matching erofs_onlinefolio_end() call. This     leaves the folio locked forever and all waiters will be stuck in folio_wait_bit_common(). This bug has     been added by commit ce63cb62d794 (erofs: support unencoded inodes for fileio), but was practically     unreachable because there was room for 256 folios in the `struct bio` - until commit 9f74ae8c9ac9 (erofs:
    shorten bvecs[] for file-backed mounts) which reduced the array capacity to 16 folios. It was now trivial     to trigger the bug by manually invoking readahead from userspace, e.g.: posix_fadvise(fd, 0, st.st_size,     POSIX_FADV_WILLNEED); This should be fixed by invoking erofs_onlinefolio_split() only after     bio_add_folio() has succeeded. This is safe: asynchronous completions invoking erofs_onlinefolio_end()     will not unlock the folio because erofs_fileio_scan_folio() is still holding a reference to be released by     erofs_onlinefolio_end() at the end. (CVE-2025-37999)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-37999

medium Nessus Plugin ID 248096

Version 1.9

Version 1.8

Version 1.7

Version 1.6

Version 1.3

Version 1.9 Jan 15, 2026, 2:04 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601151404
Version 1.8 Jan 10, 2026, 7:58 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601101958
Version 1.7 Dec 9, 2025, 2:31 AM CVSS metrics ("CVSSv2 score" set to 4.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202512090231
Version 1.6 Nov 15, 2025, 1:05 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:U/RC:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202511150105
Version 1.3 Sep 4, 2025, 5:30 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509041730