The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libnvdimm/labels: Fix divide error in nd_label_data_init() If a faulty CXL memory device returns a broken     zero LSA size in its memory device information (Identify Memory Device (Opcode 4000h), CXL spec. 3.1,     8.2.9.9.1.1), a divide error occurs in the libnvdimm driver: Oops: divide error: 0000 [#1] PREEMPT SMP     NOPTI RIP: 0010:nd_label_data_init+0x10e/0x800 [libnvdimm] Code and flow: 1) CXL Command 4000h returns LSA     size = 0 2) config_size is assigned to zero LSA size (CXL pmem driver): drivers/cxl/pmem.c: .config_size =     mds->lsa_size, 3) max_xfer is set to zero (nvdimm driver): drivers/nvdimm/label.c: max_xfer =     min_t(size_t, ndd->nsarea.max_xfer, config_size); 4) A subsequent DIV_ROUND_UP() causes a division by     zero: drivers/nvdimm/label.c: /* Make our initial read size a multiple of max_xfer size */     drivers/nvdimm/label.c: read_size = min(DIV_ROUND_UP(read_size, max_xfer) * max_xfer,     drivers/nvdimm/label.c- config_size); Fix this by checking the config size parameter by extending an     existing check. (CVE-2025-38072)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-38072

medium Nessus Plugin ID 249804

Version 1.6

Version 1.3

Version 1.2

Version 1.6 Sep 25, 2025, 11:29 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202509252329
Version 1.3 Sep 4, 2025, 5:30 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509041730
Version 1.2 Aug 31, 2025, 9:16 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202508310916