The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt to encode extents.
    When function ext_tree_prepare_commit() reallocates a larger buffer to retry encoding extents, the     layoutupdate_pages page array is initialized only after the retry loop. But ext_tree_free_commitdata()     is called on every iteration and tries to put pages in the array, thus dereferencing uninitialized     pointers. An additional problem is that there is no limit on the maximum possible buffer_size. When there     are too many extents, the client may create a layoutcommit that is larger than the maximum possible RPC     size accepted by the server. During testing, we observed two typical scenarios. First, one memory page for     extents is enough when we work with small files, append data to the end of the file, or preallocate     extents before writing. But when we fill a new large file without preallocating, the number of extents can     be huge, and counting the number of written extents in ext_tree_encode_commit() does not help much. Since     this number increases even more between unlocking and locking of ext_tree, the reallocated buffer may not     be large enough again and again. (CVE-2025-38691)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-38691

medium Nessus Plugin ID 261584

Version 1.11

Version 1.10

Version 1.9

Version 1.8

Version 1.4

Version 1.3

Version 1.2

Version 1.11 Dec 4, 2025, 7:43 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512041943
Version 1.10 Nov 21, 2025, 2:12 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202511211412
Version 1.9 Oct 28, 2025, 5:56 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202510281756
Version 1.8 Oct 27, 2025, 11:56 PM Detection (updated detection logic) Plugin Feed: 202510272356
Version 1.4 Sep 25, 2025, 11:29 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202509252329
Version 1.3 Sep 14, 2025, 2:50 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202509141450
Version 1.2 Sep 7, 2025, 7:21 AM CVSS metrics ("CVSSv2 score" set to 4.7) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C") CVSS metrics ("CVSSv3 score" set to 5.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H") CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509070721