The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2025:1757961506 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix use after free bugs     After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which     aliases skb memory is accessed after the peak_usb_netif_rx_ni(). Reordering the lines solves the issue.
    (CVE-2021-47670)

  - In the Linux kernel, the following vulnerability has been resolved: ext4: avoid resizing to a partial     cluster size This patch avoids an attempt to resize the filesystem to an unaligned cluster boundary. An     online resize to a size that is not integral to cluster size results in the last iteration attempting to     grow the fs by a negative amount, which trips a BUG_ON and leaves the fs with a corrupted in-memory     superblock. (CVE-2022-50020)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix error unwind in     rxe_create_qp() In the function rxe_create_qp(), rxe_qp_from_init() is called to initialize qp, internally     things like the spin locks are not setup until rxe_qp_init_req(). If an error occures before this point     then the unwind will call rxe_cleanup() and eventually to rxe_qp_do_cleanup()/rxe_cleanup_task() which     will oops when trying to access the uninitialized spinlock. Move the spinlock initializations earlier     before any failures. (CVE-2022-50127)

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: avoid     NFPROTO_UNSPEC where needed syzbot managed to call xt_cluster match via ebtables: WARNING: CPU: 0 PID: 11     at net/netfilter/xt_cluster.c:72 xt_cluster_mt+0x196/0x780 [..] ebt_do_table+0x174b/0x2a40 Module     registers to NFPROTO_UNSPEC, but it assumes ipv4/ipv6 packet processing. As this is only useful to     restrict locally terminating TCP/UDP traffic, register this for ipv4 and ipv6 family only. Pablo points     out that this is a general issue, direct users of the set/getsockopt interface can call into     targets/matches that were only intended for use with ip(6)tables. Check all UNSPEC matches and targets for     similar issues: - matches and targets are fine except if they assume skb_network_header() is valid -- this     is only true when called from inet layer: ip(6) stack pulls the ip/ipv6 header into linear data area. -     targets that return XT_CONTINUE or other xtables verdicts must be restricted too, they are incompatbile     with the ebtables traverser, e.g. EBT_CONTINUE is a completely different value than XT_CONTINUE. Most     matches/targets are changed to register for NFPROTO_IPV4/IPV6, as they are provided for use by     ip(6)tables. The MARK target is also used by arptables, so register for NFPROTO_ARP too. While at it, bail     out if connbytes fails to enable the corresponding conntrack family. This change passes the selftests in     iptables.git. (CVE-2024-50038)

  - In the Linux kernel, the following vulnerability has been resolved: nfsd: fix race between laundromat and     free_stateid There is a race between laundromat handling of revoked delegations and a client sending     free_stateid operation. Laundromat thread finds that delegation has expired and needs to be revoked so it     marks the delegation stid revoked and it puts it on a reaper list but then it unlock the state lock and     the actual delegation revocation happens without the lock. Once the stid is marked revoked a racing     free_stateid processing thread does the following (1) it calls list_del_init() which removes it from the     reaper list and (2) frees the delegation stid structure. The laundromat thread ends up not calling the     revoke_delegation() function for this particular delegation but that means it will no release the lock     lease that exists on the file. Now, a new open for this file comes in and ends up finding that lease list     isn't empty and calls nfsd_breaker_owns_lease() which ends up trying to derefence a freed delegation     stateid. Leading to the followint use-after-free KASAN warning: kernel:
    ================================================================== kernel: BUG: KASAN: slab-use-after-free     in nfsd_breaker_owns_lease+0x140/0x160 [nfsd] kernel: Read of size 8 at addr ffff0000e73cd0c8 by task     nfsd/6205 kernel: kernel: CPU: 2 UID: 0 PID: 6205 Comm: nfsd Kdump: loaded Not tainted 6.11.0-rc7+ #9     kernel: Hardware name: Apple Inc. Apple Virtualization Generic Platform, BIOS 2069.0.0.0.0 08/03/2024     kernel: Call trace: kernel: dump_backtrace+0x98/0x120 kernel: show_stack+0x1c/0x30 kernel:
    dump_stack_lvl+0x80/0xe8 kernel: print_address_description.constprop.0+0x84/0x390 kernel:
    print_report+0xa4/0x268 kernel: kasan_report+0xb4/0xf8 kernel: __asan_report_load8_noabort+0x1c/0x28     kernel: nfsd_breaker_owns_lease+0x140/0x160 [nfsd] kernel: nfsd_file_do_acquire+0xb3c/0x11d0 [nfsd]     kernel: nfsd_file_acquire_opened+0x84/0x110 [nfsd] kernel: nfs4_get_vfs_file+0x634/0x958 [nfsd] kernel:
    nfsd4_process_open2+0xa40/0x1a40 [nfsd] kernel: nfsd4_open+0xa08/0xe80 [nfsd] kernel:
    nfsd4_proc_compound+0xb8c/0x2130 [nfsd] kernel: nfsd_dispatch+0x22c/0x718 [nfsd] kernel:
    svc_process_common+0x8e8/0x1960 [sunrpc] kernel: svc_process+0x3d4/0x7e0 [sunrpc] kernel:
    svc_handle_xprt+0x828/0xe10 [sunrpc] kernel: svc_recv+0x2cc/0x6a8 [sunrpc] kernel: nfsd+0x270/0x400 [nfsd]     kernel: kthread+0x288/0x310 kernel: ret_from_fork+0x10/0x20 This patch proposes a fixed that's based on     adding 2 new additional stid's sc_status values that help coordinate between the laundromat and other     operations (nfsd4_free_stateid() and nfsd4_delegreturn()). First to make sure, that once the stid is     marked revoked, it is not removed by the nfsd4_free_stateid(), the laundromat take a reference on the     stateid. Then, coordinating whether the stid has been put on the cl_revoked list or we are processing     FREE_STATEID and need to make sure to remove it from the list, each check that state and act accordingly.
    If laundromat has added to the cl_revoke list before the arrival of FREE_STATEID, then     nfsd4_free_stateid() knows to remove it from the list. If nfsd4_free_stateid() finds that operations     arrived before laundromat has placed it on cl_revoke list, it marks the state freed and then laundromat     will no longer add it to the list. Also, for nfsd4_delegreturn() when looking for the specified stid, we     need to access stid that are marked removed or freeable, it means the laundromat has started processing it     but hasn't finished and this delegreturn needs to return nfserr_deleg_revoked and not nfserr_bad_stateid.
    The latter will not trigger a FREE_STATEID and the lack of it will leave this stid on the cl_revoked list     indefinitely. (CVE-2024-50106)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2025:1757961506)

high Nessus Plugin ID 360992

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.6 Oct 20, 2026, 8:26 AM Exploit attributes ("Exploited by malware" set to "True") Plugin Feed: 202610200826
Version 1.5 Oct 19, 2026, 6:13 PM Exploit attributes ("Exploited by malware" changed from "True" to none) CVE (set "CVE" coverage to "CVE-2021-47670,CVE-2022-50020,CVE-2022-50127,CVE-2024-50038,CVE-2024-50106,CVE-2024-57982,CVE-2025-21727,CVE-2025-22020,CVE-2025-22058,CVE-2025-37798,CVE-2025-37890,CVE-2025-37914,CVE-2025-37932,CVE-2025-38000,CVE-2025-38052,CVE-2025-38079,CVE-2025-38085,CVE-2025-38159,CVE-2025-38177,CVE-2025-38200,CVE-2025-38211,CVE-2025-38250,CVE-2025-38273,CVE-2025-38332,CVE-2025-38350,CVE-2025-38352,CVE-2025-38464,CVE-2025-38477") Plugin Feed: 202610191813
Version 1.4 Oct 19, 2026, 10:23 AM Exploit attributes ("Exploited by malware" set to "True") Plugin Feed: 202610191023
Version 1.3 Oct 18, 2026, 10:57 AM Detection (updated detection logic) Exploit attributes ("Exploited by malware" changed from "True" to none) CVE (set "CVE" coverage to "CVE-2021-47670,CVE-2022-50020,CVE-2022-50127,CVE-2024-50038,CVE-2024-50106,CVE-2024-57982,CVE-2025-21727,CVE-2025-22020,CVE-2025-22058,CVE-2025-37890,CVE-2025-37914,CVE-2025-37932,CVE-2025-38000,CVE-2025-38052,CVE-2025-38079,CVE-2025-38085,CVE-2025-38159,CVE-2025-38177,CVE-2025-38200,CVE-2025-38211,CVE-2025-38250,CVE-2025-38273,CVE-2025-38332,CVE-2025-38350,CVE-2025-38352,CVE-2025-38464,CVE-2025-38477") Plugin metadata Plugin Feed: 202610181057
Version 1.2 Oct 2, 2026, 8:05 AM Exploit attributes ("Exploited by malware" set to "True") Plugin Feed: 202610020805
Version 1.1 Oct 1, 2026, 9:59 PM New Plugin Feed: 202610012159