The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix suspicious RCU usage     Commit <d74169ceb0d2> (iommu/vt-d: Allocate DMAR fault interrupts locally) moved the call to     enable_drhd_fault_handling() to a code path that does not hold any lock while traversing the drhd list.
    Fix it by ensuring the dmar_global_lock lock is held when traversing the drhd list. Without this fix, the     following warning is triggered: ============================= WARNING: suspicious RCU usage 6.14.0-rc3 #55     Not tainted ----------------------------- drivers/iommu/intel/dmar.c:2046 RCU-list traversed in non-reader     section!! other info that might help us debug this: rcu_scheduler_active = 1, debug_locks = 1 2 locks held     by cpuhp/1/23: #0: ffffffff84a67c50 (cpu_hotplug_lock){++++}-{0:0}, at: cpuhp_thread_fun+0x87/0x2c0 #1:
    ffffffff84a6a380 (cpuhp_state-up){+.+.}-{0:0}, at: cpuhp_thread_fun+0x87/0x2c0 stack backtrace: CPU: 1     UID: 0 PID: 23 Comm: cpuhp/1 Not tainted 6.14.0-rc3 #55 Call Trace: <TASK> dump_stack_lvl+0xb7/0xd0     lockdep_rcu_suspicious+0x159/0x1f0 ? __pfx_enable_drhd_fault_handling+0x10/0x10     enable_drhd_fault_handling+0x151/0x180 cpuhp_invoke_callback+0x1df/0x990 cpuhp_thread_fun+0x1ea/0x2c0     smpboot_thread_fn+0x1f5/0x2e0 ? __pfx_smpboot_thread_fn+0x10/0x10 kthread+0x12a/0x2d0 ?
    __pfx_kthread+0x10/0x10 ret_from_fork+0x4a/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30     </TASK> Holding the lock in enable_drhd_fault_handling() triggers a lockdep splat about a possible     deadlock between dmar_global_lock and cpu_hotplug_lock. This is avoided by not holding dmar_global_lock     when calling iommu_device_register(), which initiates the device probe process. (CVE-2025-21876)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-21876

medium Nessus Plugin ID 248646

Version 1.7

Version 1.6

Version 1.2

Version 1.7 Oct 29, 2025, 3:03 AM Detection (updated detection logic) Plugin Feed: 202510290303
Version 1.6 Oct 28, 2025, 9:02 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:U/RC:C") Detection (updated detection logic) Plugin Feed: 202510280902
Version 1.2 Sep 2, 2025, 6:30 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509020630