The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-604.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: idpf: fix adapter NULL pointer     dereference on reboot With SRIOV enabled, idpf ends up calling into idpf_remove() twice. First via     idpf_shutdown() and then again when idpf_remove() calls into sriov_disable(), because the VF devices use     the idpf driver, hence the same remove routine. When that happens, it is possible for the adapter to be     NULL from the first call to idpf_remove(), leading to a NULL pointer dereference. echo 1 >     /sys/class/net/<netif>/device/sriov_numvfs reboot BUG: kernel NULL pointer dereference, address:
    0000000000000020 ... RIP: 0010:idpf_remove+0x22/0x1f0 [idpf] ... ? idpf_remove+0x22/0x1f0 [idpf] ?     idpf_remove+0x1e4/0x1f0 [idpf] pci_device_remove+0x3f/0xb0 device_release_driver_internal+0x19f/0x200     pci_stop_bus_device+0x6d/0x90 pci_stop_and_remove_bus_device+0x12/0x20 pci_iov_remove_virtfn+0xbe/0x120     sriov_disable+0x34/0xe0 idpf_sriov_configure+0x58/0x140 [idpf] idpf_remove+0x1b9/0x1f0 [idpf]     idpf_shutdown+0x12/0x30 [idpf] pci_device_shutdown+0x35/0x60 device_shutdown+0x156/0x200 ... Replace the     direct idpf_remove() call in idpf_shutdown() with idpf_vc_core_deinit() and idpf_deinit_dflt_mbx(), which     perform the bulk of the cleanup, such as stopping the init task, freeing IRQs, destroying the vports and     freeing the mailbox. This avoids the calls to sriov_disable() in addition to a small netdev cleanup, and     destroying workqueues, which don't seem to be required on shutdown. (CVE-2025-22065)

  - In the Linux kernel, the following vulnerability has been resolved: idpf: convert workqueues to unbound     When a workqueue is created with `WQ_UNBOUND`, its work items are served by special worker-pools, whose     host workers are not bound to any specific CPU. In the default configuration (i.e. when     `queue_delayed_work` and friends do not specify which CPU to run the work item on), `WQ_UNBOUND` allows     the work item to be executed on any CPU in the same node of the CPU it was enqueued on. While this     solution potentially sacrifices locality, it avoids contention with other processes that might dominate     the CPU time of the processor the work item was scheduled on. This is not just a theoretical problem: in a     particular scenario misconfigured process was hogging most of the time from CPU0, leaving less than 0.5%     of its CPU time to the kworker. The IDPF workqueues that were using the kworker on CPU0 suffered large     completion delays as a result, causing performance degradation, timeouts and eventual system crash. * I     have also run a manual test to gauge the performance improvement. The test consists of an antagonist     process (`./stress --cpu 2`) consuming as much of CPU 0 as possible. This process is run under `taskset     01` to bind it to CPU0, and its priority is changed with `chrt -pQ 9900 10000 ${pid}` and `renice -n -20     ${pid}` after start. Then, the IDPF driver is forced to prefer CPU0 by editing all calls to     `queue_delayed_work`, `mod_delayed_work`, etc... to use CPU 0. Finally, `ktraces` for the workqueue events     are collected. Without the current patch, the antagonist process can force arbitrary delays between     `workqueue_queue_work` and `workqueue_execute_start`, that in my tests were as high as `30ms`. With the     current patch applied, the workqueue can be migrated to another unloaded CPU in the same node, and,     keeping everything else equal, the maximum delay I could see was `6us`. (CVE-2024-58057)

  - In the Linux kernel, the following vulnerability has been resolved: idpf: fix checksums set in     idpf_rx_rsc() idpf_rx_rsc() uses skb_transport_offset(skb) while the transport header is not set yet. This     triggers the following warning for CONFIG_DEBUG_NET=y builds.
    DEBUG_NET_WARN_ON_ONCE(!skb_transport_header_was_set(skb)) [ 69.261620] WARNING: CPU: 7 PID: 0 at     ./include/linux/skbuff.h:3020 idpf_vport_splitq_napi_poll (include/linux/skbuff.h:3020) idpf [ 69.261629]     Modules linked in: vfat fat dummy bridge intel_uncore_frequency_tpmi intel_uncore_frequency_common     intel_vsec_tpmi idpf intel_vsec cdc_ncm cdc_eem cdc_ether usbnet mii xhci_pci xhci_hcd ehci_pci ehci_hcd     libeth [ 69.261644] CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Tainted: G S W 6.14.0-smp-DEV #1697 [ 69.261648]     Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN [ 69.261650] RIP: 0010:idpf_vport_splitq_napi_poll     (include/linux/skbuff.h:3020) idpf [ 69.261677] ? __warn (kernel/panic.c:242 kernel/panic.c:748) [     69.261682] ? idpf_vport_splitq_napi_poll (include/linux/skbuff.h:3020) idpf [ 69.261687] ? report_bug     (lib/bug.c:?) [ 69.261690] ? handle_bug (arch/x86/kernel/traps.c:285) [ 69.261694] ? exc_invalid_op     (arch/x86/kernel/traps.c:309) [ 69.261697] ? asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:621) [     69.261700] ? __pfx_idpf_vport_splitq_napi_poll (drivers/net/ethernet/intel/idpf/idpf_txrx.c:4011) idpf [     69.261704] ? idpf_vport_splitq_napi_poll (include/linux/skbuff.h:3020) idpf [ 69.261708] ?     idpf_vport_splitq_napi_poll (drivers/net/ethernet/intel/idpf/idpf_txrx.c:3072) idpf [ 69.261712]
    __napi_poll (net/core/dev.c:7194) [ 69.261716] net_rx_action (net/core/dev.c:7265) [ 69.261718] ?
    __qdisc_run (net/sched/sch_generic.c:293) [ 69.261721] ? sched_clock (arch/x86/include/asm/preempt.h:84     arch/x86/kernel/tsc.c:288) [ 69.261726] handle_softirqs (kernel/softirq.c:561) (CVE-2025-21890)

  - In the Linux kernel, the following vulnerability has been resolved: idpf: check error for     register_netdev() on init Current init logic ignores the error code from register_netdev(), which will     cause WARN_ON() on attempt to unregister it, if there was one, and there is no info for the user that the     creation of the netdev failed. WARNING: CPU: 89 PID: 6902 at net/core/dev.c:11512     unregister_netdevice_many_notify+0x211/0x1a10 ... [ 3707.563641] unregister_netdev+0x1c/0x30 [     3707.563656] idpf_vport_dealloc+0x5cf/0xce0 [idpf] [ 3707.563684] idpf_deinit_task+0xef/0x160 [idpf] [     3707.563712] idpf_vc_core_deinit+0x84/0x320 [idpf] [ 3707.563739] idpf_remove+0xbf/0x780 [idpf] [     3707.563769] pci_device_remove+0xab/0x1e0 [ 3707.563786] device_release_driver_internal+0x371/0x530 [     3707.563803] driver_detach+0xbf/0x180 [ 3707.563816] bus_remove_driver+0x11b/0x2a0 [ 3707.563829]     pci_unregister_driver+0x2a/0x250 Introduce an error check and log the vport number and error code. On     removal make sure to check VPORT_REG_NETDEV flag prior to calling unregister and free on the netdev. Add     local variables for idx, vport_config and netdev for readability. (CVE-2025-22116)

  - In the Linux kernel, the following vulnerability has been resolved: idpf: fix null-ptr-deref in     idpf_features_check idpf_features_check is used to validate the TX packet. skb header length is compared     with the hardware supported value received from the device control plane. The value is stored in the     adapter structure and to access it, vport pointer is used. During reset all the vports are released and     the vport pointer that the netdev private structure points to is NULL. To avoid null-ptr-deref, store the     max header length value in netdev private structure. This also helps to cache the value and avoid     accessing adapter pointer in hot path. BUG: kernel NULL pointer dereference, address: 0000000000000068 ...
    RIP: 0010:idpf_features_check+0x6d/0xe0 [idpf] Call Trace: <TASK> ? __die+0x23/0x70 ?     page_fault_oops+0x154/0x520 ? exc_page_fault+0x76/0x190 ? asm_exc_page_fault+0x26/0x30 ?     idpf_features_check+0x6d/0xe0 [idpf] netif_skb_features+0x88/0x310 validate_xmit_skb+0x2a/0x2b0     validate_xmit_skb_list+0x4c/0x70 sch_direct_xmit+0x19d/0x3a0 __dev_queue_xmit+0xb74/0xe70 ...
    (CVE-2025-38053)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:13602 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: crypto: algif_hash - fix double free in hash_accept (CVE-2025-38079)

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: crypto: algif_hash - fix double free in hash_accept (CVE-2025-38079)

    * kernel: wifi: ath12k: fix invalid access to memory (CVE-2025-38292)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - wifi: ath12k: fix invalid access to memory In ath12k_dp_rx_msdu_coalesce(), rxcb is fetched from skb and     boolean is_continuation is part of rxcb. Currently, after freeing the skb, the rxcb->is_continuation     accessed again which is wrong since the memory is already freed. This might lead use-after-free error.
    Hence, fix by locally defining bool is_continuation from rxcb, so that after freeing skb, is_continuation     can be used. Compile tested only. (CVE-2025-38292)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
249174	CentOS 9 : kernel-5.14.0-604.el9	Nessus	CentOS Local Security Checks	8/12/2025	8/12/2025	medium
248465	RHEL 9 : kernel (RHSA-2025:13602)	Nessus	Red Hat Local Security Checks	8/12/2025	8/12/2025	high
247031	Linux Distros Unpatched Vulnerability : CVE-2025-38292	Nessus	Misc.	8/9/2025	8/9/2025	high
247832	RHEL 10 : kernel (RHSA-2025:13598)	Nessus	Red Hat Local Security Checks	8/11/2025	8/11/2025	high

Detections

Analytics

Plugins Search

medium

high

high

high