The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1747725447 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Prevent integer     overflow/underflow in hysteresis calculations Commit b50aa49638c7 (hwmon: (lm90) Prevent integer     underflows of temperature calculations) addressed a number of underflow situations when writing     temperature limits. However, it missed one situation, seen when an attempt is made to set the hysteresis     value to MAX_LONG and the critical temperature limit is negative. Use clamp_val() when setting the     hysteresis temperature to ensure that the provided value can never overflow or underflow. (CVE-2021-47098)

  - In the Linux kernel, the following vulnerability has been resolved: aio: fix use-after-free due to missing     POLLFREE handling signalfd_poll() and binder_poll() are special in that they use a waitqueue whose     lifetime is the current task, rather than the struct file as is normally the case. This is okay for     blocking polls, since a blocking poll occurs within one task; however, non-blocking polls require another     solution. This solution is for the queue to be cleared before it is freed, by sending a POLLFREE     notification to all waiters. Unfortunately, only eventpoll handles POLLFREE. A second type of non-blocking     poll, aio poll, was added in kernel v4.18, and it doesn't handle POLLFREE. This allows a use-after-free to     occur if a signalfd or binder fd is polled with aio poll, and the waitqueue gets freed. Fix this by making     aio poll handle POLLFREE. A patch by Ramji Jiyani <ramjiyani@google.com>     (https://lore.kernel.org/r/20211027011834.2497484-1-ramjiyani@google.com) tried to do this by making     aio_poll_wake() always complete the request inline if POLLFREE is seen. However, that solution had two     bugs. First, it introduced a deadlock, as it unconditionally locked the aio context while holding the     waitqueue lock, which inverts the normal locking order. Second, it didn't consider that POLLFREE     notifications are missed while the request has been temporarily de-queued. The second problem was solved     by my previous patch. This patch then properly fixes the use-after-free by handling POLLFREE in a     deadlock-free way. It does this by taking advantage of the fact that freeing of the waitqueue is RCU-     delayed, similar to what eventpoll does. (CVE-2021-47505)

  - When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the     sibling thread after an SMT mode switch potentially resulting in information disclosure. (CVE-2022-27672)

  - In the Linux kernel, the following vulnerability has been resolved: watch_queue: Actually free the watch     free_watch() does everything barring actually freeing the watch object. Fix this by adding the missing     kfree. kmemleak produces a report something like the following. Note that as an address can be seen in the     first word, the watch would appear to have gone through call_rcu(). BUG: memory leak unreferenced object     0xffff88810ce4a200 (size 96): comm syz-executor352, pid 3605, jiffies 4294947473 (age 13.720s) hex dump     (first 32 bytes): e0 82 48 0d 81 88 ff ff 00 00 00 00 00 00 00 00 ..H............. 80 a2 e4 0c 81 88 ff ff     00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff8214e6cc>] kmalloc include/linux/slab.h:581     [inline] [<ffffffff8214e6cc>] kzalloc include/linux/slab.h:714 [inline] [<ffffffff8214e6cc>]     keyctl_watch_key+0xec/0x2e0 security/keys/keyctl.c:1800 [<ffffffff8214ec84>] __do_sys_keyctl+0x3c4/0x490     security/keys/keyctl.c:2016 [<ffffffff84493a25>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]     [<ffffffff84493a25>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [<ffffffff84600068>]     entry_SYSCALL_64_after_hwframe+0x44/0xae (CVE-2022-49256)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. Flaw in the error handling of bound chains causes a use-after-free in     the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered. We recommend     upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795. (CVE-2023-3610)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1747725447)

high Nessus Plugin ID 351518

Version 1.2