The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - usb: gadget : fix use-after-free in composite_dev_cleanup() 1. In func configfs_composite_bind() ->     composite_os_desc_req_prepare(): if kmalloc fails, the pointer cdev->os_desc_req will be freed but not set     to NULL. Then it will return a failure to the upper-level function. 2. in func configfs_composite_bind()
    -> composite_dev_cleanup(): it will checks whether cdev->os_desc_req is NULL. If it is not NULL, it will     attempt to use it.This will lead to a use-after-free issue. BUG: KASAN: use-after-free in     composite_dev_cleanup+0xf4/0x2c0 Read of size 8 at addr 0000004827837a00 by task init/1 CPU: 10 PID: 1     Comm: init Tainted: G O 5.10.97-oh #1 kasan_report+0x188/0x1cc __asan_load8+0xb4/0xbc     composite_dev_cleanup+0xf4/0x2c0 configfs_composite_bind+0x210/0x7ac udc_bind_to_driver+0xb4/0x1ec     usb_gadget_probe_driver+0xec/0x21c gadget_dev_desc_UDC_store+0x264/0x27c (CVE-2025-38555)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-38555

high Nessus Plugin ID 260127

Version 1.11

Version 1.10

Version 1.9

Version 1.8

Version 1.7

Version 1.1

Version 1.11 Nov 26, 2025, 1:15 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202511261315
Version 1.10 Nov 24, 2025, 10:08 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202511242208
Version 1.9 Nov 21, 2025, 2:12 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202511211412
Version 1.8 Oct 29, 2025, 3:03 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202510290303
Version 1.7 Oct 27, 2025, 11:56 PM Detection (updated detection logic) Plugin Feed: 202510272356
Version 1.1 Sep 1, 2025, 4:30 AM New Plugin Feed: 202509010430