The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mm/memfd: fix information leak in hugetlb folios When allocating hugetlb folios for memfd, three     initialization steps are missing: 1. Folios are not zeroed, leading to kernel memory disclosure to     userspace 2. Folios are not marked uptodate before adding to page cache 3. hugetlb_fault_mutex is not     taken before hugetlb_add_to_page_cache() The memfd allocation path bypasses the normal page fault handler     (hugetlb_no_page) which would handle all of these initialization steps. This is problematic especially for     udmabuf use cases where folios are pinned and directly accessed by userspace via DMA. Fix by matching the     initialization pattern used in hugetlb_no_page(): - Zero the folio using folio_zero_user() which is     optimized for huge pages - Mark it uptodate with folio_mark_uptodate() - Take hugetlb_fault_mutex before     adding to page cache to prevent races The folio_zero_user() change also fixes a potential security issue     where uninitialized kernel memory could be disclosed to userspace through read() or mmap() operations on     the memfd. (CVE-2025-68292)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-68292

medium Nessus Plugin ID 278849

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Dec 19, 2025, 2:41 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512190241
Version 1.2 Dec 18, 2025, 1:27 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512180127
Version 1.1 Dec 17, 2025, 4:56 PM New Plugin Feed: 202512171656