The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rpmsg: core: fix race in driver_override_show() and use core helper The driver_override_show function     reads the driver_override string without holding the device_lock. However, the store function modifies and     frees the string while holding the device_lock. This creates a race condition where the string can be     freed by the store function while being read by the show function, leading to a use-after-free. To fix     this, replace the rpmsg_string_attr macro with explicit show and store functions. The new     driver_override_store uses the standard driver_set_override helper. Since the introduction of     driver_set_override, the comments in include/linux/rpmsg.h have stated that this helper must be used to     set or clear driver_override, but the implementation was not updated until now. Because     driver_set_override modifies and frees the string while holding the device_lock, the new     driver_override_show now correctly holds the device_lock during the read operation to prevent the race.
    Additionally, since rpmsg_string_attr has only ever been used for driver_override, removing the macro     simplifies the code. (CVE-2025-71274)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-71274

medium Nessus Plugin ID 312721

Version 1.4