The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced When re-injecting a soft interrupt     from an INT3, INT0, or (select) INTn instruction, discard the exception and retry the instruction if the     code stream is changed (e.g. by a different vCPU) between when the CPU executes the instruction and when     KVM decodes the instruction to get the next RIP. As effectively predicted by commit 6ef88d6e36c2 (KVM:
    SVM: Re-inject INT3/INTO instead of retrying the instruction), failure to verify that the correct INTn     instruction was decoded can effectively clobber guest state due to decoding the wrong instruction and thus     specifying the wrong next RIP. The bug most often manifests as Oops: int3 panics on static branch checks     in Linux guests. Enabling or disabling a static branch in Linux uses the kernel's text poke code     patching mechanism. To modify code while other CPUs may be executing that code, Linux (temporarily)     replaces the first byte of the original instruction with an int3 (opcode 0xcc), then patches in the new     code stream except for the first byte, and finally replaces the int3 with the first byte of the new code     stream. If a CPU hits the int3, i.e. executes the code while it's being modified, then the guest kernel     must look up the RIP to determine how to handle the #BP, e.g. by emulating the new instruction. If the RIP     is incorrect, then this lookup fails and the guest kernel panics. The bug reproduces almost instantly by     hacking the guest kernel to repeatedly check a static branch[1] while running a drgn script[2] on the host     to constantly swap out the memory containing the guest's TSS. [1]:
    https://gist.github.com/osandov/44d17c51c28c0ac998ea0334edf90b5a [2]:
    https://gist.github.com/osandov/10e45e45afa29b11e0c7209247afc00b (CVE-2025-68259)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-68259

high Nessus Plugin ID 278898

Version 1.7