The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - bpf: Reject %p% format string in bprintf-like helpers static const char fmt[] = %p%;
    bpf_trace_printk(fmt, sizeof(fmt)); The above BPF program isn't rejected and causes a kernel warning at     runtime: Please remove unsupported %\x00 in format string WARNING: CPU: 1 PID: 7244 at lib/vsprintf.c:2680     format_decode+0x49c/0x5d0 This happens because bpf_bprintf_prepare skips over the second %, detected as     punctuation, while processing %p. This patch fixes it by not skipping over punctuation. %\x00 is then     processed in the next iteration and rejected. (CVE-2025-38528)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-38528

medium Nessus Plugin ID 259982

Version 1.7

Version 1.6

Version 1.1

Version 1.7 Oct 29, 2025, 3:03 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202510290303
Version 1.6 Oct 28, 2025, 9:02 AM Detection (updated detection logic) Plugin Feed: 202510280902
Version 1.1 Aug 31, 2025, 7:32 PM New Plugin Feed: 202508311932