The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice Savino says: We are writing to     report that this recent patch (141d34391abbb315d68556b7c67ad97885407547) [1] can be bypassed, and a UAF     can still occur when HFSC is utilized with NETEM. The patch only checks the cl->cl_nactive field to     determine whether it is the first insertion or not [2], but this field is only incremented by init_vf [3].
    By using HFSC_RSC (which uses init_ed) [4], it is possible to bypass the check and insert the class twice     in the eltree. Under normal conditions, this would lead to an infinite loop in hfsc_dequeue for the     reasons we already explained in this report [5]. However, if TBF is added as root qdisc and it is     configured with a very low rate, it can be utilized to prevent packets from being dequeued. This behavior     can be exploited to perform subsequent insertions in the HFSC eltree and cause a UAF. To fix both the UAF     and the infinite loop, with netem as an hfsc child, check explicitly in hfsc_enqueue whether the class is     already in the eltree whenever the HFSC_RSC flag is set. [1] https://web.git.kernel.org/pub/scm/linux/kern     el/git/torvalds/linux.git/commit/?id=141d34391abbb315d68556b7c67ad97885407547 [2]     https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1572 [3]     https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L677 [4]     https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1574 [5] https://lore.kernel.org/n     etdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis
    _0G7VEk=@willsroot.io/T/#u (CVE-2025-38001)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-38001

high Nessus Plugin ID 249384

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Sep 6, 2025, 10:42 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509061042
Version 1.2 Aug 31, 2025, 7:32 PM CVSS metrics ("CVSSv3 score" set to 7.0) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") CVSSv3 severity (based on None, severity increased from "Medium" to "High") Detection (updated detection logic) Plugin metadata Plugin Feed: 202508311932
Version 1.1 Aug 15, 2025, 7:38 PM New Plugin Feed: 202508151938