The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Revert drm/prime: Use dma_buf from GEM object instance This reverts commit     f83a9b8c7fd0557b0c50784bfdc1bbe9140c9bf8. The dma_buf field in struct drm_gem_object is not stable over     the object instance's lifetime. The field becomes NULL when user space releases the final GEM handle on     the buffer object. This resulted in a NULL-pointer deref. Workarounds in commit 5307dce878d4 (drm/gem:
    Acquire references on GEM handles for framebuffers) and commit f6bfc9afc751 (drm/framebuffer: Acquire     internal references on GEM handles) only solved the problem partially. They especially don't work for     buffer objects without a DRM framebuffer associated. Hence, this revert to going back to using     .import_attach->dmabuf. v3: - cc stable (CVE-2025-38674)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-38674

high Nessus Plugin ID 260427

Version 1.2

Version 1.1

Version 1.2 Sep 14, 2025, 2:50 PM CVSS metrics ("CVSSv2 score" set to 7.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C") CVSS metrics ("CVSSv3 score" set to 7.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:O/RC:C") CVSSv2 score source (set to "CVE-2025-38674") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509141450
Version 1.1 Sep 2, 2025, 3:13 PM New Plugin Feed: 202509021513