The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation When btrfs_add_qgroup_relation() is     called with invalid qgroup levels (src >= dst), the function returns -EINVAL directly without freeing the     preallocated qgroup_list structure passed by the caller. This causes a memory leak because the caller     unconditionally sets the pointer to NULL after the call, preventing any cleanup. The issue occurs because     the level validation check happens before the mutex is acquired and before any error handling path that     would free the prealloc pointer. On this early return, the cleanup code at the 'out' label (which includes     kfree(prealloc)) is never reached. In btrfs_ioctl_qgroup_assign(), the code pattern is: prealloc =     kzalloc(sizeof(*prealloc), GFP_KERNEL); ret = btrfs_add_qgroup_relation(trans, sa->src, sa->dst,     prealloc); prealloc = NULL; // Always set to NULL regardless of return value ... kfree(prealloc); // This     becomes kfree(NULL), does nothing When the level check fails, 'prealloc' is never freed by either the     callee or the caller, resulting in a 64-byte memory leak per failed operation. This can be triggered     repeatedly by an unprivileged user with access to a writable btrfs mount, potentially exhausting kernel     memory. Fix this by freeing prealloc before the early return, ensuring prealloc is always freed on all     error paths. (CVE-2025-40209)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-40209

medium Nessus Plugin ID 276580

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.5 Dec 15, 2025, 9:39 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512152139
Version 1.4 Dec 5, 2025, 1:34 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512051334
Version 1.3 Dec 2, 2025, 7:12 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512020712
Version 1.2 Nov 25, 2025, 6:58 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202511251858
Version 1.1 Nov 23, 2025, 4:41 AM New Plugin Feed: 202511230441