The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w When retrieving the FW coredump using ethtool, it can     sometimes cause memory corruption: BUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670     [bnxt_en] Corrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45):
    __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] ethtool_get_dump_data+0xdc/0x1a0 __dev_ethtool+0xa1e/0x1af0     dev_ethtool+0xa8/0x170 dev_ioctl+0x1b5/0x580 sock_do_ioctl+0xab/0xf0 sock_ioctl+0x1ce/0x2e0
    __x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x78/0x80 ... This     happens when copying the coredump segment list in bnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST     FW command. The info->dest_buf buffer is allocated based on the number of coredump segments returned by     the FW. The segment list is then DMA'ed by the FW and the length of the DMA is returned by FW. The driver     then copies this DMA'ed segment list to info->dest_buf. In some cases, this DMA length may exceed the     info->dest_buf length and cause the above BUG condition. Fix it by capping the copy length to not exceed     the length of info->dest_buf. The extra DMA data contains no useful information. This code path is shared     for the HWRM_DBG_COREDUMP_LIST and the HWRM_DBG_COREDUMP_RETRIEVE FW commands. The buffering is different     for these 2 FW commands. To simplify the logic, we need to move the line to adjust the buffer length for     HWRM_DBG_COREDUMP_RETRIEVE up, so that the new check to cap the copy length will work for both commands.
    (CVE-2025-37911)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-37911

medium Nessus Plugin ID 260508

Version 1.10

Version 1.9

Version 1.8

Version 1.7

Version 1.3

Version 1.2

Version 1.1

Version 1.10 Dec 15, 2025, 9:39 PM CVSS metrics ("CVSSv3 score" set to 5.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202512152139
Version 1.9 Nov 18, 2025, 4:27 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202511180427
Version 1.8 Oct 28, 2025, 5:56 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202510281756
Version 1.7 Oct 27, 2025, 11:56 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:U/RC:C") Detection (updated detection logic) Plugin Feed: 202510272356
Version 1.3 Sep 6, 2025, 7:55 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509061955
Version 1.2 Sep 5, 2025, 4:38 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509051638
Version 1.1 Sep 3, 2025, 6:28 AM New Plugin Feed: 202509030628