The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto syzbot reported a possible shift-     out-of-bounds [1] Blamed commit added rto_alpha_max and rto_beta_max set to 1000. It is unclear if some     sctp users are setting very large rto_alpha and/or rto_beta. In order to prevent user regression, perform     the test at run time. Also add READ_ONCE() annotations as sysctl values can change under us. [1] UBSAN:
    shift-out-of-bounds in net/sctp/transport.c:509:41 shift exponent 64 is too large for 32-bit type     'unsigned int' CPU: 0 UID: 0 PID: 16704 Comm: syz.2.2320 Not tainted syzkaller #0 PREEMPT(full) Hardware     name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Call Trace: <TASK>
    __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 ubsan_epilogue     lib/ubsan.c:233 [inline] __ubsan_handle_shift_out_of_bounds+0x27f/0x420 lib/ubsan.c:494     sctp_transport_update_rto.cold+0x1c/0x34b net/sctp/transport.c:509 sctp_check_transmitted+0x11c4/0x1c30     net/sctp/outqueue.c:1502 sctp_outq_sack+0x4ef/0x1b20 net/sctp/outqueue.c:1338 sctp_cmd_process_sack     net/sctp/sm_sideeffect.c:840 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1372 [inline]     (CVE-2025-40281)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-40281

high Nessus Plugin ID 277727

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.6 Dec 15, 2025, 9:39 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512152139
Version 1.5 Dec 13, 2025, 1:08 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512130108
Version 1.4 Dec 11, 2025, 12:59 PM CVSS metrics ("CVSSv3 score" set to 7.0) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSSv3 severity (based on None, severity increased from "Medium" to "High") Detection (updated detection logic) Plugin metadata Plugin Feed: 202512111259
Version 1.3 Dec 10, 2025, 9:29 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512100929
Version 1.2 Dec 9, 2025, 2:31 AM CVSS metrics ("CVSSv2 score" set to 6.6. "CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C") CVSSv2 severity (based on CVE-2025-40281, severity decreased from "High" to "Medium") Detection (updated detection logic) New Plugin metadata Plugin Feed: 202512090231