The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - hfsplus: remove mutex_lock check in hfsplus_free_extents Syzbot reported an issue in hfsplus filesystem:
    ------------[ cut here ]------------ WARNING: CPU: 0 PID: 4400 at fs/hfsplus/extents.c:346     hfsplus_free_extents+0x700/0xad0 Call Trace: <TASK> hfsplus_file_truncate+0x768/0xbb0     fs/hfsplus/extents.c:606 hfsplus_write_begin+0xc2/0xd0 fs/hfsplus/inode.c:56 cont_expand_zero     fs/buffer.c:2383 [inline] cont_write_begin+0x2cf/0x860 fs/buffer.c:2446 hfsplus_write_begin+0x86/0xd0     fs/hfsplus/inode.c:52 generic_cont_expand_simple+0x151/0x250 fs/buffer.c:2347 hfsplus_setattr+0x168/0x280     fs/hfsplus/inode.c:263 notify_change+0xe38/0x10f0 fs/attr.c:420 do_truncate+0x1fb/0x2e0 fs/open.c:65     do_sys_ftruncate+0x2eb/0x380 fs/open.c:193 do_syscall_x64 arch/x86/entry/common.c:50 [inline]     do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd To avoid     deadlock, Commit 31651c607151 (hfsplus: avoid deadlock on file truncation) unlock extree before     hfsplus_free_extents(), and add check wheather extree is locked in hfsplus_free_extents(). However, when     operations such as hfsplus_file_release, hfsplus_setattr, hfsplus_unlink, and hfsplus_get_block are     executed concurrently in different files, it is very likely to trigger the WARN_ON, which will lead syzbot     and xfstest to consider it as an abnormality. The comment above this warning also describes one of the     easy triggering situations, which can easily trigger and cause xfstest&syzbot to report errors. [task A]     [task B] ->hfsplus_file_release ->hfsplus_file_truncate ->hfs_find_init ->mutex_lock ->mutex_unlock
    ->hfsplus_write_begin ->hfsplus_get_block ->hfsplus_file_extend ->hfsplus_ext_read_extent ->hfs_find_init
    ->mutex_lock ->hfsplus_free_extents WARN_ON(mutex_is_locked) !!! Several threads could try to lock the     shared extents tree. And warning can be triggered in one thread when another thread has locked the tree.
    This is the wrong behavior of the code and we need to remove the warning. (CVE-2025-38650)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-38650

medium Nessus Plugin ID 260269

Version 1.19

Version 1.18

Version 1.17

Version 1.15

Version 1.14

Version 1.13

Version 1.12

Version 1.11

Version 1.10

Version 1.9

Version 1.8

Version 1.7

Version 1.19 Jan 21, 2026, 5:00 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601211700
Version 1.18 Jan 10, 2026, 7:58 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601101958
Version 1.17 Dec 17, 2025, 4:56 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512171656
Version 1.15 Dec 15, 2025, 9:39 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512152139
Version 1.14 Dec 9, 2025, 2:31 AM Detection (updated detection logic) Plugin Feed: 202512090231
Version 1.13 Dec 5, 2025, 1:34 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512051334
Version 1.12 Dec 4, 2025, 7:43 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512041943
Version 1.11 Dec 2, 2025, 7:12 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512020712
Version 1.10 Nov 26, 2025, 1:15 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202511261315
Version 1.9 Nov 24, 2025, 10:08 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202511242208
Version 1.8 Oct 28, 2025, 5:56 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202510281756
Version 1.7 Oct 27, 2025, 11:56 PM Detection (updated detection logic) Plugin Feed: 202510272356