The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mm/damon/sysfs: fix use-after-free in state_show() state_show() reads kdamond->damon_ctx without holding     damon_sysfs_lock. This allows a use-after-free race: CPU 0 CPU 1 ----- ----- state_show()     damon_sysfs_turn_damon_on() ctx = kdamond->damon_ctx; mutex_lock(&damon_sysfs_lock);
    damon_destroy_ctx(kdamond->damon_ctx); kdamond->damon_ctx = NULL; mutex_unlock(&damon_sysfs_lock);
    damon_is_running(ctx); /* ctx is freed */ mutex_lock(&ctx->kdamond_lock); /* UAF */ (The race can also     occur with damon_sysfs_kdamonds_rm_dirs() and damon_sysfs_kdamond_release(), which free or replace the     context under damon_sysfs_lock.) Fix by taking damon_sysfs_lock before dereferencing the context,     mirroring the locking used in pid_show(). The bug has existed since state_show() first accessed     kdamond->damon_ctx. (CVE-2025-39877)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-39877

high Nessus Plugin ID 265875

Version 1.6

Version 1.5

Version 1.4

Version 1.1

Version 1.6 Jan 10, 2026, 7:58 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601101958
Version 1.5 Dec 15, 2025, 9:39 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512152139
Version 1.4 Nov 26, 2025, 1:15 PM CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:U/RC:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202511261315
Version 1.1 Sep 25, 2025, 11:29 PM New Plugin Feed: 202509252329