The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: ufs-qcom: Fix ESI null     pointer dereference ESI/MSI is a performance optimization feature that provides dedicated interrupts per     MCQ hardware queue. This is optional feature and UFS MCQ should work with and without ESI feature. Commit     e46a28cea29a (scsi: ufs: qcom: Remove the MSI descriptor abuse) brings a regression in ESI (Enhanced     System Interrupt) configuration that causes a null pointer dereference when Platform MSI allocation fails.
    The issue occurs in when platform_device_msi_init_and_alloc_irqs() in ufs_qcom_config_esi() fails (returns
    -EINVAL) but the current code uses __free() macro for automatic cleanup free MSI resources that were never     successfully allocated. Unable to handle kernel NULL pointer dereference at virtual address     0000000000000008 Call trace: mutex_lock+0xc/0x54 (P) platform_device_msi_free_irqs_all+0x1c/0x40     ufs_qcom_config_esi+0x1d0/0x220 [ufs_qcom] ufshcd_config_mcq+0x28/0x104 ufshcd_init+0xa3c/0xf40     ufshcd_pltfrm_init+0x504/0x7d4 ufs_qcom_probe+0x20/0x58 [ufs_qcom] Fix by restructuring the ESI     configuration to try MSI allocation first, before any other resource allocation and instead use explicit     cleanup instead of __free() macro to avoid cleanup of unallocated resources. Tested on SM8750 platform     with MCQ enabled, both with and without Platform ESI support. (CVE-2025-39674)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-39674

medium Nessus Plugin ID 261648

Version 1.4

Version 1.1

Version 1.4 Sep 21, 2025, 8:29 AM CVSS metrics ("CVSSv2 score" set to 1.9) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P") CVSSv2 severity (based on CVE-2025-39674, severity decreased from "Medium" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509210829
Version 1.1 Sep 6, 2025, 7:55 PM New Plugin Feed: 202509061955