The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Bluetooth: MGMT: Fix possible UAFs This attemps to fix possible UAFs caused by struct mgmt_pending being     freed while still being processed like in the following trace, in order to fix mgmt_pending_valid is     introduce and use to check if the mgmt_pending hasn't been removed from the pending list, on the complete     callbacks it is used to check and in addtion remove the cmd from the list while holding mgmt_pending_lock     to avoid TOCTOU problems since if the cmd is left on the list it can still be accessed and freed. BUG:
    KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223 Read     of size 8 at addr ffff8880709d4dc0 by task kworker/u11:0/55 CPU: 0 UID: 0 PID: 55 Comm: kworker/u11:0 Not     tainted 6.16.4 #2 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS     1.10.2-1ubuntu1 04/01/2014 Workqueue: hci0 hci_cmd_sync_work Call Trace: <TASK> dump_stack_lvl+0x189/0x250     lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240     mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595     mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223 hci_cmd_sync_work+0x210/0x3a0     net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3238 [inline]     process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321 worker_thread+0x8a0/0xda0     kernel/workqueue.c:3402 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770     arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30     home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16.4/arch/x86/entry/entry_64.S:245 </TASK> Allocated by     task 12210: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68     poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394     kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4364     kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline]     mgmt_pending_new+0x65/0x1e0 net/bluetooth/mgmt_util.c:269 mgmt_pending_add+0x35/0x140     net/bluetooth/mgmt_util.c:296 __add_adv_patterns_monitor+0x130/0x200 net/bluetooth/mgmt.c:5247     add_adv_patterns_monitor+0x214/0x360 net/bluetooth/mgmt.c:5364 hci_mgmt_cmd+0x9c9/0xef0     net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839     sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729     sock_write_iter+0x258/0x330 net/socket.c:1133 new_sync_write fs/read_write.c:593 [inline]     vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64     arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94     entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 12221: kasan_save_stack mm/kasan/common.c:47     [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50     mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70     mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2381     [inline] slab_free mm/slub.c:4648 [inline] kfree+0x18e/0x440 mm/slub.c:4847 mgmt_pending_free     net/bluetooth/mgmt_util.c:311 [inline] mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257
    __mgmt_power_off+0x169/0x350 net/bluetooth/mgmt.c:9444 hci_dev_close_sync+0x754/0x1330     net/bluetooth/hci_sync.c:5290 hci_dev_do_close net/bluetooth/hci_core.c:501 [inline]     hci_dev_close+0x108/0x200 net/bluetooth/hci_core.c:526 sock_do_ioctl+0xd9/0x300 net/socket.c:1192     sock_ioctl+0x576/0x790 net/socket.c:1313 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907     [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]     do_syscall_64+0xf ---truncated--- (CVE-2025-39981)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - BluetoothMGMT潜在的な UAF を修正します。これは、mgmt_pending_valid が導入され、使用されて mgmt_pending から削除されていないことを確認するために、構造体 mgmt_pending が解放されるときに引き起こされる可能性のある UAF を修正しようとします。保留リストの中で、完全なコールバックでは、チェックに使用され、さらに、TOCTOU 問題を避けるために mgmt_pending_lock を保持する間、リストから cmd を削除します。「cmd」がリストに残る場合はアクセスおよび解放が可能であるためです。BUG：
    KASANmgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223 タスク kworker/u11:0/55 による addr ffff8880709d4dc0 でのサイズ 8 の読み取り CPU:0 UID:0 PID:55 Comm kworker/u11:0 汚染されていない 6.16.4 #2 PREEMPT(full) ハードウェア名 QEMU Standard PC (i440FX + PIIX、1996)、BIOS 1.10.2-1ubuntu1 04/01/2014 ワークキューhci0 hci_cmd_sync_work コールトレース <TASK> dump_stack_lvl+ 0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c 595 mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223 hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xade/0xade17ade/0.x :3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 home/kWqcheii /source/fuzzing/kernel/kasan/linux-6.16.4/arch/x86/entry/entry_64.S:245 </TASK> タスク 12210 により割り当てられていますkasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/ 0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4364 kmalloc_noprof include/linux/slab.h:905 [インライン] kzalloc_noprof include/linux/slab.h:1039 [インライン] mgmt_pending_new+0x65/0x1e0 net/bluetooth/mgmt_util.c :269 mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296 __add_adv_patterns_monitor+0x130/0x200 net/bluetooth/mgmt.c:5247 add_adv_patterns_monitor+0x214/0x360 net/bluetooth/mgmt_f90 net/bluetooth/mgmt.c:5364 hci0980 /bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729 sock_write_iter/0x308 net/socket.c:1133 new_sync_wri te fs/read_write.c:593 [インライン] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [インライン] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f タスク 12221 により解放されました kasan_save_stack mm/kasan/common.c:47 [インライン] kasan_save_track+0x3e/0x80 mm/kasan/common。 c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan .h:233 [インライン] slab_free_hook mm/slub.c:2381 [インライン] slab_free mm/slub.c:4648 [インライン] kfree+0x18e/0x440 mm/slub.c:4847 mgmt_pending_free net/bluetooth/mgmt_util. 311 [インライン] mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257
    __mgmt_power_off+0x169/0x350 net/bluetooth/mgmt.c:9444 hci_dev_close_sync+0x754/0x1330 net/bluetooth/hci_sync.c:5290 hci_dev_do_close net/bluetooth/hci_core.c:501 [inline] hci_dev_close+0x108/0x108/0x108/0x108/0x108/0x1409 hci_core.c:526 sock_do_ioctl+0xd9/0x300 net/socket.c:1192 sock_ioctl+0x576/0x790 net/socket.c:1313 vfs_ioctl fs/ioctl.c:51 [インライン] __do_sys_ioctl fs/ioctl.c:907 [インライン] ] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf ---truncated---CVE-2025-39981]

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 藍牙MGMT修正可能的 UAF此項目嘗試修正可能的 UAF這是因為 mgmt_pending 結構遭到釋放同時仍像在後續追踪中一樣仍在處理程序中所造成的問題以便修正引入並使用 mgmt_pending_valid 檢查是否尚未移除 mgmt_pending 的問題待處理清單上的完整回呼上會使用該清單進行檢查此外在按住 mgmt_pending_lock 的同時從清單中移除 cmd 以避免 TOCTOU 問題因為如果 cmd 留在清單上仍可存取和釋放該 cmd。錯誤：
    KASANmgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223 中的 slab 釋放後使用任務 kworker/u11:0/55 在 addr ffff8880709d4dc0 讀取大小 8 CPU: 0 UID: 0 PID: 55 Comm kworker/u11:0 未受污染 6.16.4 #2 PREEMPT(full) 硬體名稱QEMU Standard PC (i440FX + PIIX, 1996)BIOS 1.10.2-1ubuntu1 2014 年 4 月 1 日 工作佇列hci0 hci_cmd_sync_work 呼叫追踪 <TASK> dump_stack_lvl+ 0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [內嵌] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c 595 mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223 hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3238 [內嵌] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c: 3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 home/kwqcheii /source/fuzzing/kernel/kasan/linux-6.16.4/arch/x86/entry/entry_64.S:245 </TASK> 由工作 12210 分配 kasan_save_stack mm/kasan/common.c:47 [內嵌] kasan_save_track+0x3e/ 0x80 mm/kasan/common.c:68 pox_kmalloc_redzone mm/kasan/common.c:377 [內嵌] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [內嵌] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4364 kmalloc_noprof include/linux/slab.h:905 [內嵌] kzalloc_noprof include/linux/slab.h:1039 [內嵌] mgmt_pending_new+0x65/0x1e0 net/bluetooth/mgmt_util.c :269 mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296 __add_adv_patterns_monitor+0x130/0x200 net/bluetooth/mgmt.c:5247 add_adv_patterns_monitor+0x214/0x360 net/bluetooth/mgmt.c:5394 hci9/xmef0net_cmd+0 /bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:714 [內嵌] __sock_sendmsg+0x219/0x270 net/socket.c:729 sock_write_iter+0x258/0x258/0x258/0x330 net/socket.c:1133 new_sync_wri te fs/read_write.c:593 [內嵌] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [內嵌] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f 已由工作 12221 kasan_save_stack mm/kasan/common.c:47 [內嵌] kasan_save_track+0x3e/0x80 mm/kasan/common 釋放。 c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 pulp_slab_object mm/kasan/common.c:247 [內嵌] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan .h:233 [內嵌] slab_free_hook mm/slub.c:2381 [內嵌] slab_free mm/slub.c:4648 [內嵌] kfree+0x18e/0x440 mm/slub.c:4847 mgmt_pending_free net/bluetooth/mgmt_util.c 311 [內嵌] mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257
    __mgmt_power_off+0x169/0x350 net/bluetooth/mgmt.c:9444 hci_dev_close_sync+0x754/0x1330 net/bluetooth/hci_sync.c:5290 hci_dev_do_close net/bluetooth/hci_core.c:501 [內嵌] hci_dev_close+0x108/0x200 net/bluetooth/ hci_core.c:526 sock_do_ioctl+0xd9/0x300 net/socket.c:1192 sock_ioctl+0x576/0x790 net/socket.c:1313 vfs_ioctl fs/ioctl.c:51 [內嵌] __do_sys_ioctl fs/ioctl.c:907 [內嵌] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [內嵌] do_syscall_64+0xf ---truncated--- (CVE-2025-39981)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 蓝牙MGMT修复可能的 UAF此操作尝试修复可能的 UAF由结构 mgmt_pending 在仍在处理时被释放可能造成的 UAF如下跟踪中所示这是为了修复 mgmt_pending_valid 被引入和使用以检查 mgmt_pending 是否已从 移除待定列表在完整的回调中用于检查此外在保持 mgmt_pending_lock 时从列表中删除 cmd以避免 TOCTOU 问题因为如果 cmd 留在列表上仍然可访问和释放它。BUG：
    KASAN在 mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223 中在任务 kworker/u11:0/55 CPU: 0 UID: 0 PID: 55 Comm发生的对 addr ffff8880709d4dc0 上大小 8 的读取中存在 slab 使用后释放问题kworker/u11:0 未受感染 6.16.4 #2 PREEMPT(full) Hardware nameQEMU Standard PC (i440FX + PIIX, 1996)BIOS 1.10.2-1ubuntu1 04/01/2014 Workqueuehci0 hci_cmd_sync_work 调用追踪 <TASK> dump_stack_lvl+ 0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [内联] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c 595 mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223 hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xade/0x17queue.b0c kernel/workqueue.b0c :3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 home/kwqcheii /source/fuzzing/kernel/kasan/linux-6.16.4/arch/x86/entry/entry_64.S:245 </TASK> 由任务分配 12210kasan_save_stack mm/kasan/common.c:47 [内联] kasan_save_track+0x3e/ 0x80 mm/kasan/common.c:68毒害_kmalloc_redzone mm/kasan/common.c:377 [内联] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [内联] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4364 kmalloc_noprof include/linux/slab.h:905 [内联] kzalloc_noprof include/linux/slab.h:1039 [内联] mgmt_pending_new+0x65/0x1e0 net/bluetooth/mgmt_util.c ! /bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:714 [内联] __sock_sendmsg+0x219/0x270 net/socket.c:729 sock_write_iter+0x3258/0x3258/0x3258 net/socket.c:1133 new_sync_wri te fs/read_write.c:593 [内联] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [内联] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f 由任务释放 12221kasan_save_stack mm/kasan/common.c:47 [内联] kasan_save_track+0x3e/0x80 mm/kasan/common。 c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576毒害_slab_object mm/kasan/common.c:247 [内联] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan .h:233 [inline] slab_free_hook mm/slub.c:2381 [inline] slab_free mm/slub.c:4648 [inline] kfree+0x18e/0x440 mm/slub.c:4847 mgmt_pending_free net/bluetooth/mgmt_util.c 311 [inline] mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257
    __mgmt_power_off+0x169/0x350 net/bluetooth/mgmt.c:9444 hci_dev_close_sync+0x754/0x1330 net/bluetooth/hci_sync.c:5290 hci_dev_do_close net/bluetooth/hci_core.c:501 [inline] hci_dev_close+0x108/0x200 net/bluetooth/ hci_core.c:526 sock_do_ioctl+0xd9/0x300 net/socket.c:1192 sock_ioctl+0x576/0x790 net/socket.c:1313 vfs_ioctl fs/ioctl.c:51 [内联] __do_sys_ioctl fs/ioctl.c:907 [内联] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf ---truncated--- (CVE-2025-39981)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4057-1 advisory.

    The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
    - CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).
    - CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).
    - CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al     (bsc#1248630).
    - CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).
    - CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated     (bsc#1249182).
    - CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
    - CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).
    - CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).
    - CVE-2025-39683: tracing: Limit access to parser->buffer when trace_get_user failed (bsc#1249286).
    - CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).
    - CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).
    - CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).
    - CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).
    - CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
    - CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).
    - CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).
    - CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).
    - CVE-2025-39832: net/mlx5: Add sync reset drop mode support (bsc#1249901).
    - CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
    - CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
    - CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).
    - CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
    - CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
    - CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).
    - CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).
    - CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).
    - CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).
    - CVE-2025-39898: e1000e: fix heap overflow in e1000_set_eeprom (bsc#1250742).
    - CVE-2025-39900: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (bsc#1250758).
    - CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).
    - CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).
    - CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
    - CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).
    - CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).
    - CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).
    - CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).
    - CVE-2025-39955: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (bsc#1251804).
    - CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
    - CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).
    - CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).
    - CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052).
    - CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).
    - CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
    - CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).
    - CVE-2025-39984: net: tun: Update napi->skb after XDP process (bsc#1252081).
    - CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062).
    - CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349).
    - CVE-2025-40012: net/smc: fix warning in smc_rx_splice() when calling get_page() (bsc#1252330).
    - CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
    - CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858).
    - CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826).
    - CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848).
    - CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).
    - CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree     (bsc#1252918).

    The following non security issues were fixed:

    - ACPI/processor_idle: Add FFH state handling (jsc#PED-13815).
    - ACPI/processor_idle: Export acpi_processor_ffh_play_dead() (jsc#PED-13815).
    - ACPI: battery: Add synchronization between interface updates (git-fixes).
    - ACPI: processor: Rescan 'dead' SMT siblings during initialization (jsc#PED-13815).
    - KVM: PPC: Fix misleading interrupts comment in kvmppc_prepare_to_enter() (bsc#1215199).
    - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() (git-fixes).
    - KVM: x86: Process 'guest stopped request' once per guest time update (git-fixes).
    - PM: hibernate: Add pm_hibernation_mode_is_suspend() (bsc#1243112).
    - PM: hibernate: Add stub for pm_hibernate_is_recovering() (bsc#1243112).
    - PM: hibernate: Fix pm_hibernation_mode_is_suspend() build breakage (bsc#1243112).
    - PM: hibernate: add new api pm_hibernate_is_recovering() (bsc#1243112).
    - bpf: Allow helper bpf_get_[ns_]current_pid_tgid() for all prog types (bsc#1252364).
    - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (stable-fixes git-fixes).
    - cpuidle: Do not return from cpuidle_play_dead() on callback failures (jsc#PED-13815).
    - dpll: Make ZL3073X invisible (bsc#1252253).
    - dpll: zl3073x: Add firmware loading functionality (bsc#1252253).
    - dpll: zl3073x: Add functions to access hardware registers (bsc#1252253).
    - dpll: zl3073x: Add low-level flash functions (bsc#1252253).
    - dpll: zl3073x: Add support to get fractional frequency offset (bsc#1252253).
    - dpll: zl3073x: Add support to get phase offset on connected input pin (bsc#1252253).
    - dpll: zl3073x: Add support to get/set esync on pins (bsc#1252253).
    - dpll: zl3073x: Fix build failure (bsc#1252253).
    - dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() (bsc#1252253).
    - dpll: zl3073x: Handle missing or corrupted flash configuration (bsc#1252253).
    - dpll: zl3073x: Implement devlink flash callback (bsc#1252253).
    - dpll: zl3073x: Increase maximum size of flash utility (bsc#1252253).
    - dpll: zl3073x: Refactor DPLL initialization (bsc#1252253).
    - dpll: zl3073x: ZL3073X_I2C and ZL3073X_SPI should depend on NET (bsc#1252253).
    - drm/amd : Update MES API header file for v11 & v12 (stable-fixes).
    - drm/amd/amdgpu: Implement MES suspend/resume gang functionality for v12 (bsc#1243112).
    - drm/amd/display: Add NULL check for stream before dereference in 'dm_vupdate_high_irq' (bsc#1243112).
    - drm/amd/display: Enable Dynamic DTBCLK Switch (bsc#1243112).
    - drm/amd/display: Fix vupdate_offload_work doc (bsc#1243112).
    - drm/amd/display: fix dmub access race condition (bsc#1243112).
    - drm/amd/display: more liberal vmin/vmax update for freesync (bsc#1243112).
    - drm/amd/include : MES v11 and v12 API header update (stable-fixes).
    - drm/amd/include : Update MES v12 API for fence update (stable-fixes).
    - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes).
    - drm/amd: Avoid evicting resources at S5 (bsc#1243112).
    - drm/amd: Check whether secure display TA loaded successfully (bsc#1243112).
    - drm/amd: Fix hybrid sleep (bsc#1243112).
    - drm/amd: Only restore cached manual clock settings in restore if OD enabled (bsc#1243112).
    - drm/amd: Restore cached manual clock settings during resume (bsc#1243112).
    - drm/amdgpu/mes11: implement detect and reset callback (bsc#1243112).
    - drm/amdgpu/mes12: implement detect and reset callback (bsc#1243112).
    - drm/amdgpu/mes: add front end for detect and reset hung queue (bsc#1243112).
    - drm/amdgpu/vpe: cancel delayed work in hw_fini (bsc#1243112).
    - drm/amdgpu: Avoid rma causes GPU duplicate reset (bsc#1243112).
    - drm/amdgpu: Fix for GPU reset being blocked by KIQ I/O (bsc#1243112).
    - drm/amdgpu: Report individual reset error (bsc#1243112).
    - drm/amdgpu: do not resume device in thaw for normal hibernation (bsc#1243112).
    - drm/amdgpu: fix link error for !PM_SLEEP (bsc#1243112).
    - drm/amdkfd: Fix mmap write lock not release (bsc#1243112).
    - drm/xe/guc: Prepare GuC register list and update ADS size for error capture (stable-fixes).
    - ext4: fix checks for orphan inodes (bsc#1250119).
    - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (git-fixes).
    - intel_idle: Provide the default enter_dead() handler (jsc#PED-13815).
    - intel_idle: Rescan 'dead' SMT siblings during initialization (jsc#PED-13815).
    - intel_idle: Use subsys_initcall_sync() for initialization (jsc#PED-13815).
    - ixgbe: handle IXGBE_VF_FEATURES_NEGOTIATE mbox cmd (bsc#1247222).
    - ixgbe: handle IXGBE_VF_GET_PF_LINK_STATE mailbox operation (bsc#1247222).
    - ixgbevf: fix getting link speed data for E610 devices (bsc#1247222).
    - ixgbevf: fix mailbox API compatibility by negotiating supported features (bsc#1247222).
    - kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939).
    - net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency     (bsc#1248754).
    - netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237).
    - nvme-auth: update bi_directional flag (git-fixes bsc#1249735).
    - nvme-auth: update sc_c in host response (git-fixes bsc#1249397).
    - nvme-fc: use lock accessing port_state and rport state (bsc#1245193 bsc#1247500).
    - nvme-tcp: send only permitted commands for secure concat (git-fixes bsc#1247683).
    - nvmet-fc: avoid scheduling association deletion twice (bsc#1245193 bsc#1247500).
    - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (bsc#1245193 bsc#1247500).
    - nvmet-fcloop: call done callback even when remote port is gone (bsc#1245193 bsc#1247500).
    - perf/x86/intel: Allow to update user space GPRs from PEBS records (git-fixes).
    - perf/x86/intel: Fix crash in icl_update_topdown_event() (git-fixes).
    - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes).
    - platform/x86/amd/pmc: Add 1Ah family series to STB support list (bsc#1243112).
    - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (bsc#1243112).
    - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (bsc#1243112).
    - platform/x86/amd/pmc: Add VPE information for AMDI000A platform (bsc#1243112).
    - platform/x86/amd/pmc: Add idlemask support for 1Ah family (bsc#1243112).
    - platform/x86/amd/pmc: Extend support for PMC features on new AMD platform (bsc#1243112).
    - platform/x86/amd/pmc: Fix SMU command submission path on new AMD platform (bsc#1243112).
    - platform/x86/amd/pmc: Modify SMU message port for latest AMD platform (bsc#1243112).
    - platform/x86/amd/pmc: Notify user when platform does not support s0ix transition (bsc#1243112).
    - platform/x86/amd/pmc: Remove unnecessary line breaks (bsc#1243112).
    - platform/x86/amd/pmc: Send OS_HINT command for AMDI000A platform (bsc#1243112).
    - platform/x86/amd/pmc: Send OS_HINT command for new AMD platform (bsc#1243112).
    - platform/x86/amd/pmc: Update IP information structure for newer SoCs (bsc#1243112).
    - platform/x86/amd/pmc: Use ARRAY_SIZE() to fill num_ips information (bsc#1243112).
    - platform/x86/amd/pmc: call amd_pmc_get_ip_info() during driver probe (bsc#1243112).
    - platform/x86/amd: pmc: Add new ACPI ID AMDI000B (bsc#1243112).
    - platform/x86/amd: pmc: Drop SMU F/W match for Cezanne (bsc#1243112).
    - platform/x86/amd: pmc: Use guard(mutex) (bsc#1243112).
    - powerpc/boot: Fix build with gcc 15 (bsc#1215199).
    - powerpc/fadump: skip parameter area allocation when fadump is disabled (jsc#PED-9891 git-fixes).
    - powerpc/kvm: Fix ifdef to remove build warning (bsc#1215199).
    - powerpc/powernv/pci: Fix underflow and leak issue (bsc#1215199).
    - powerpc/pseries/msi: Fix potential underflow and leak issue (bsc#1215199).
    - powerpc: floppy: Add missing checks after DMA map (bsc#1215199).
    - proc: fix missing pde_set_flags() for net proc files (bsc#1248630)
    - proc: fix type confusion in pde_set_flags() (bsc#1248630)
    - sched/idle: Conditionally handle tick broadcast in default_idle_call() (bsc#1248517).
    - scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (bsc#1250519).
    - scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (bsc#1250519).
    - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (bsc#1250519).
    - scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (bsc#1250519).
    - scsi: lpfc: Copyright updates for 14.4.0.11 patches (bsc#1250519).
    - scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (bsc#1250519).
    - scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (bsc#1250519).
    - scsi: lpfc: Fix buffer free/clear order in deferred receive path (bsc#1250519).
    - scsi: lpfc: Fix wrong function reference in a comment (bsc#1250519).
    - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (bsc#1250519).
    - scsi: lpfc: Remove redundant assignment to avoid memory leak (bsc#1250519).
    - scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (bsc#1250519).
    - scsi: lpfc: Update lpfc version to 14.4.0.11 (bsc#1250519).
    - scsi: lpfc: Use int type to store negative error codes (bsc#1250519).
    - scsi: lpfc: use min() to improve code (bsc#1250519).
    - serial: sc16is7xx: rename Kconfig CONFIG_SERIAL_SC16IS7XX_CORE (bsc#1252469) Re-enable     CONFIG_SERIAL_SC16IS7X for aarch64 and x86_64 default configurations, but keep it disabled for kvmsmall     configurations. For ppc64 and s390x drivers was not enabled, so keep it that way. Add sc16is7xx_spi and     sc16is7xx_i2c drivers to supported list.
    - skmsg: Return copied bytes in sk_msg_memcopy_from_iter (bsc#1250650).
    - smb: client: fix crypto buffers in non-linear memory (bsc#1250491, bsc#1239206).
    - smb: client: fix potential cfid UAF in smb2_query_info_compound (bsc#1248886).
    - tcp_bpf: Fix copied value in tcp_bpf_sendmsg (bsc#1250650).
    - tracing: Remove unneeded goto out logic (bsc#1249286).
    - x86/idle: Sanitize X86_BUG_AMD_E400 handling (bsc#1248517).
    - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID     (bsc#1252734).
    - x86/resctrl: Refactor resctrl_arch_rmid_read() (bsc#1252734).
    - x86/smp: Allow calling mwait_play_dead with an arbitrary hint (jsc#PED-13815).
    - x86/smp: Fix mwait_play_dead() and acpi_processor_ffh_play_dead() noreturn behavior (jsc#PED-13815).
    - x86/smp: PM/hibernate: Split arch_resume_nosmt() (jsc#PED-13815).
    - x86/topology: Implement topology_is_core_online() to address SMT regression (jsc#PED-13815).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
271563	Linux Distros Unpatched Vulnerability : CVE-2025-39981	Nessus	Misc.	10/27/2025	10/27/2025	critical
271563	Linux Distros のパッチ未適用の脆弱性: CVE-2025-39981	Nessus	Misc.	10/27/2025	10/27/2025	critical
275294	SUSE SLED15 / SLES15 セキュリティ更新 : kernel (SUSE-SU-2025:4057-1)	Nessus	SuSE Local Security Checks	11/13/2025	11/13/2025	high
271563	Linux Distros 未修補的弱點：CVE-2025-39981	Nessus	Misc.	10/27/2025	10/27/2025	critical
271563	Linux Distros 未修补的漏洞：CVE-2025-39981	Nessus	Misc.	10/27/2025	10/27/2025	critical
275294	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2025:4057-1)	Nessus	SuSE Local Security Checks	11/13/2025	11/13/2025	high

Detections

Analytics

Plugins Search

critical

critical

high

critical

critical

high