The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the     node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the erased node to EMPTY,     then pde_subdir_next() will return NULL to avoid uaf access. We found an uaf issue while using stress-ng     testing, need to run testcase getdent and tun in the same time. The steps of the issue is as follows: 1)     use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current pde is tun3; 2) in the [time windows]     unregister netdevice tun3 and tun2, and erase them from rbtree. erase tun3 first, and then erase tun2. the     pde(tun2) will be released to slab; 3) continue to getdent process, then pde_subdir_next() will return     pde(tun2) which is released, it will case uaf access. CPU 0 | CPU 1
    ------------------------------------------------------------------------- traverse dir     /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2 sys_getdents64() | iterate_dir() |     proc_readdir() | proc_readdir_de() | snmp6_unregister_dev() pde_get(de); | proc_remove()     read_unlock(&proc_subdir_lock); | remove_proc_subtree() | write_lock(&proc_subdir_lock); [time window] |     rb_erase(&root->subdir_node, &parent->subdir); | write_unlock(&proc_subdir_lock);
    read_lock(&proc_subdir_lock); | next = pde_subdir_next(de); | pde_put(de); | de = next; //UAF | rbtree of     dev_snmp6 | pde(tun3) / \ NULL pde(tun2) (CVE-2025-40271)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-40271

high Nessus Plugin ID 277698

Version 1.10

Version 1.9

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.10 Jan 21, 2026, 5:00 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601211700
Version 1.9 Jan 17, 2026, 7:48 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601170748
Version 1.8 Jan 13, 2026, 2:35 AM CVSS metrics ("CVSSv3 score" set to 7.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202601130235
Version 1.7 Jan 10, 2026, 7:58 PM Detection (updated detection logic) Plugin Feed: 202601101958
Version 1.6 Dec 19, 2025, 2:41 AM CVSS metrics ("CVSSv2 score" set to 7.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 7.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H") CVSSv2 severity (based on CVE-2025-40271, severity increased from "Medium" to "High") CVSSv3 severity (based on None, severity increased from "Medium" to "High") Detection (updated detection logic) Plugin metadata Plugin Feed: 202512190241
Version 1.5 Dec 15, 2025, 9:39 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512152139
Version 1.4 Dec 13, 2025, 1:08 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512130108
Version 1.3 Dec 11, 2025, 12:59 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512111259
Version 1.2 Dec 10, 2025, 9:29 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512100929
Version 1.1 Dec 9, 2025, 2:31 AM New Plugin Feed: 202512090231