The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe The state->timer is a cyclic     timer that schedules work_i2c_poll and delayed_work_enable_hotplug, while rearming itself. Using     timer_delete() fails to guarantee the timer isn't still running when destroyed, similarly     cancel_delayed_work() cannot ensure delayed_work_enable_hotplug has terminated if already executing.
    During probe failure after timer initialization, these may continue running as orphans and reference the     already-freed tc358743_state object through tc358743_irq_poll_timer. The following is the trace captured     by KASAN. BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0 Write of size 8 at addr     ffff88800ded83c8 by task swapper/1/0 ... Call Trace: <IRQ> dump_stack_lvl+0x55/0x70     print_report+0xcf/0x610 ? __pfx_sched_balance_find_src_group+0x10/0x10 ?
    __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_base.part.0+0x7d7/0x8c0
    __run_timer_base.part.0+0x7d7/0x8c0 ? rcu_sched_clock_irq+0xb06/0x27d0 ?
    __pfx___run_timer_base.part.0+0x10/0x10 ? try_to_wake_up+0xb15/0x1960 ? tmigr_update_events+0x280/0x740 ?
    _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 tmigr_handle_remote_up+0x603/0x7e0 ?
    __pfx_tmigr_handle_remote_up+0x10/0x10 ? sched_balance_trigger+0x98/0x9f0 ? sched_tick+0x221/0x5a0 ?
    _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 ? tick_nohz_handler+0x339/0x440 ?
    __pfx_tmigr_handle_remote_up+0x10/0x10 __walk_groups.isra.0+0x42/0x150 tmigr_handle_remote+0x1f4/0x2e0 ?
    __pfx_tmigr_handle_remote+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ?     clockevents_program_event+0x1d4/0x2a0 ? hrtimer_interrupt+0x322/0x780 handle_softirqs+0x16a/0x550     irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 </IRQ> ... Allocated by task 141:
    kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90
    __kmalloc_node_track_caller_noprof+0x198/0x430 devm_kmalloc+0x7b/0x1e0 tc358743_probe+0xb7/0x610     i2c_device_probe+0x51d/0x880 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310     driver_probe_device+0x44/0x120 __device_attach_driver+0x174/0x220 bus_for_each_drv+0x100/0x190
    __device_attach+0x206/0x370 bus_probe_device+0x123/0x170 device_add+0xd25/0x1470     i2c_new_client_device+0x7a0/0xcd0 do_one_initcall+0x89/0x300 do_init_module+0x29d/0x7f0     load_module+0x4f48/0x69e0 init_module_from_file+0xe4/0x150 idempotent_init_module+0x320/0x670
    __x64_sys_finit_module+0xbd/0x120 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed     by task 141: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60
    __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 release_nodes+0xa4/0x100 devres_release_group+0x1b2/0x380     i2c_device_probe+0x694/0x880 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310     driver_probe_device+0x44/0x120 __device_attach_driver+0x174/0x220 bus_for_each_drv+0x100/0x190
    __device_attach+0x206/0x370 bus_probe_device+0x123/0x170 device_add+0xd25/0x1470     i2c_new_client_device+0x7a0/0xcd0 do_one_initcall+0x89/0x300 do_init_module+0x29d/0x7f0     load_module+0x4f48/0x69e0 init_module_from_file+0xe4/0x150 idempotent_init_module+0x320/0x670
    __x64_sys_finit_module+0xbd/0x120 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f ...
    Replace timer_delete() with timer_delete_sync() and cancel_delayed_work() with cancel_delayed_work_sync()     to ensure proper termination of timer and work items before resource cleanup. This bug was initially     identified through static analysis. For reproduction and testing, I created a functional emulation of the     tc358743 device via a kernel module and introduced faults through the debugfs interface. (CVE-2025-39995)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - メディアi2ctc358743プローブのオーファンタイマーにより引き起こされる use-after-free バグを修正します。state->timer は自身を再起動する際に work_i2c_poll と delayed_work_enable_hotplug をスケジュールする循環タイマーです。timer_delete() を使用しても、タイマーが破壊されたときにまだ実行されていないことを保証できません。同様に、cancel_delayed_work() は、すでに実行中の場合、delayed_work_enable_hotplug が終了したことを確認できません。
    タイマー初期化後のプローブ障害の間、これらはオーファンとして実行し続け、tc358743_irq_poll_timer を通じて既に解放された tc358743_state オブジェクトを参照する可能性があります。以下は KASAN によってキャプチャされたトレースです。BUGKASANタスク swapper/1/0 による addr ffff88800ded83c8 におけるサイズ 8 の書き込み __run_timer_base.part.0+0x7d7/0x8c0 の slab-use-after-free Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ? __pfx_sched_balance_find_src_group+0x10/0x10 ?
    __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_base.part.0+0x7d7/0x8c0
    __run_timer_base.part.0+0x7d7/0x8c0 ? rcu_sched_clock_irq+0xb06/0x27d0 ?
    __pfx__run_timer_base.part.0+0x10/0x10 ? try_to_wake_up+0xb15/0x1960 ? tmigr_update_events+0x280/0x740 ?
    _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 tmigr_handle_remote_up+0x603/0x7e0 ?
    __pfx_tmigr_handle_remote_up+0x10/0x10 ? sched_balance_trigger+0x98/0x9f0 ? sched_tick+0x221/0x5a0 ?
    _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 ? tic_nohz_handler+0x339/0x440 ?
    __pfx_tmigr_handle_remote_up+0x10/0x10 __walk_groups.isra.0+0x42/0x150 tmigr_handle_remote+0x1f4/0x2e0 ?
    __pfx_tmigr_handle_remote+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 ? hrtimer_interrupt+0x322/0x780 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 </IRQ>... タスク 141 により割り当てられる
    kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90
    __kmalloc_node_track_caller_noprof+0x198/0x430 devm_kmalloc+0x7b/0x1e0 tc358743_probe+0xb7/0x610 i2c_device_probe+0x51d/0x880 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __device_attach_driver+0x174/0x220 bus_for_each_drv+0x100/0x190
    __device_attach+0x206/0x370 bus_probe_device+0x123/0x170 device_add+0xd25/0x1470 i2c_new_client_device+0x7a0/0xcd0 do_one_initcall+0x89/0x300 do_init_module+0x29d/0x7f0 load_module+0x4f48/0x69e0 init_module_from_file+0xe4/0x150 idempotent_init_module+0x320/0x670
    __x64_sys_finit_module+0xbd/0x120 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f タスク 141 により解放されました kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+060606
    __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 release_nodes+0xa4/0x100 devres_release_group+0x1b2/0x380 i2c_device_probe+0x694/0x880 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __device_attach_driver+0x174/0x220 bus_for_each_drv+0x100/0x190
    __device_attach+0x206/0x370 bus_probe_device+0x123/0x170 device_add+0xd25/0x1470 i2c_new_client_device+0x7a0/0xcd0 do_one_initcall+0x89/0x300 do_init_module+0x29d/0x7f0 load_module+0x4f48/0x69e0 init_module_from_file+0xe4/0x150 idempotent_init_module+0x320/0x670
    __x64_sys_finit_module+0xbd/0x120 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f ...
    timer_delete() を timer_delete_sync() で、cancel_delayed_work() をCancel_delayed_work_sync() で置換し、リソースのクリーンアップ前にタイマーと作業項目が適切に終了するようにします。このバグは当初、静的分析によって特定されました。再生とテストのために、カーネルモジュールから tc358743 デバイスの機能的エミュレーションを作成し、debugfs インターフェイスを通じて障害を導入しました。CVE-2025-39995

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - mediai2ctc358743修复由探测中的孤立定时器造成的释放后使用缺陷 state->timer 是循环定时器在重新配置自身时会计划 work_i2c_poll 和 delayed_work_enable_hotplug。使用 timer_delete() 无法保证定时器在遭到破坏时不再运行同样如果已经在执行cancel_delayed_work() 也无法确保 delayed_work_enable_hotplug 终止。
    在定时器初始化之后探测失败期间这些对象可作为孤立对象继续运行并通过 tc358743_irq_poll_timer 引用已释放的 tc358743_state 对象。以下是 KASAN 捕获的跟踪信息。缺陷KASAN任务 swapper/1/0 ... 调用跟踪 <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ? __pfx_sched_balance_find_src_group+0x10/0x10 ?
    __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 __run_timer_base.part.0+0x7d7/0x8c0
    __run_timer_base.part.0+0x7d7/0x8c0 ? rcu_sched_clock_irq+0xb06/0x27d0 ?
    __pfx___run_timer_base.part.0+0x10/0x10 ? try_to_wake_up+0xb15/0x1960 tmigr_update_events+0x280/0x740
    _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 tmigr_handle_remote_up+0x603/0x7e0 ?
    __pfx_tmigr_handle_remote_up+0x10/0x10 ? sched_balance_trigger+0x98/0x9f0 ? sched_tick+0x221/0x5a0 ?
    _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 ? tick_nohz_handler+0x339/0x440
    __pfx_tmigr_handle_remote_up+0x10/0x10 __walk_groups.isra.0+0x42/0x150 tmigr_handle_remote+0x1f4/0x2e0 ?
    __pfx_tmigr_handle_remote+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 clockevents_program_event+0x1d4/0x2a0 ? hrtimer_interrupt+0x322/0x780 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 </IRQ>... 由任务 141 分配
    kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90
    __kmalloc_node_track_caller_noprof+0x198/0x430 devm_kmalloc+0x7b/0x1e0 tc358743_probe+0xb7/0x610 i2c_device_probe+0x51d/0x880 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __device_attach_driver+0x174/0x220 bus_for_each_drv+0x100/0x190
    __device_attach+0x206/0x370 bus_probe_device+0x123/0x170 device_add+0xd25/0x1470 i2c_new_client_device+0x7a0/0xcd0 do_one_initcall+0x89/0x300 do_init_module+0x29d/0x7f0 load_module+0x4f48/0x69e0 init_module_from_file+0xe4/0x150 idempotent_init_module+0x320/0x670
    __x64_sys_finit_module+0xbd/0x120 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f 由任务 141: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60
    __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 release_nodes+0xa4/0x100 devres_release_group+0x1b2/0x380 i2c_device_probe+0x694/0x880 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __device_attach_driver+0x174/0x220 bus_for_each_drv+0x100/0x190
    __device_attach+0x206/0x370 bus_probe_device+0x123/0x170 device_add+0xd25/0x1470 i2c_new_client_device+0x7a0/0xcd0 do_one_initcall+0x89/0x300 do_init_module+0x29d/0x7f0 load_module+0x4f48/0x69e0 init_module_from_file+0xe4/0x150 idempotent_init_module+0x320/0x670
    __x64_sys_finit_module+0xbd/0x120 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f ...
    将 timer_delete() 替换为 timer_delete_sync()并将 cancel_delayed_work() 替换为 cancel_delayed_work_sync() 以确保在清理资源之前正确终止定时器和工作项目。最初通过静态分析发现此缺陷。为了重现和测试，我通过内核模块创建了 tc358743 设备的功能仿真，并通过 debugfs 接口引入了错误。 (CVE-2025-39995)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

An update of the linux package has been released.

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - mediai2ctc358743修正探查中的孤立計時器所造成的釋放後使用錯誤。state->timer 是一個循環計時器會在自行重新準備時排程 work_i2c_poll 和 delayed_work_enable_hotplug。使用 timer_delete() 無法保證計時器在損毀時不會仍在執行同樣的若已執行cancel_delayed_work() 也無法確保 delayed_work_enable_hotplug 已終止。
    在計時器初始化後探查失敗期間這些項目可能會繼續作為孤立項目執行並透過 tc358743_irq_poll_timer 參照已釋放的 tc358743_state 物件。以下是 KASAN 擷取的追踪記錄。BUG: KASAN在 __run_timer_base.part.0+0x7d7/0x8c0 中發生大小為 8 的寫入 (由 swapper/1/0 工作在 addr ffff88800ded83c8 ... 呼叫追踪 <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 __pfx_sched_balance_find_src_group+0x10/0x10 ?
    __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 __run_timer_base.part.0+0x7d7/0x8c0
    __run_timer_base.part.0+0x7d7/0x8c0 ? rcu_sched_clock_irq+0xb06/0x27d0
    __pfx___run_timer_base.part.0+0x10/0x10 ? try_to_wake_up+0xb15/0x1960 ? tmigr_update_events+0x280/0x740
    _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 tmigr_handle_remote_up+0x603/0x7e0
    __pfx_tmigr_handle_remote_up+0x10/0x10 ? sched_balance_trigger+0x98/0x9f0 ? sched_tick+0x221/0x5a0 ?
    _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 ? tick_nohz_handler+0x339/0x440 ?
    __pfx_tmigr_handle_remote_up+0x10/0x10 __walk_groups.isra.0+0x42/0x150 tmigr_handle_remote+0x1f4/0x2e0 ?
    __pfx_tmigr_handle_remote+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 hrtimer_interrupt+0x322/0x780 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 </IRQ>... 由工作 141 配置
    kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90
    __kmalloc_node_track_caller_noprof+0x198/0x430 devm_kmalloc+0x7b/0x1e0 tc358743_probe+0xb7/0x610 i2c_device_probe+0x51d/0x880 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __device_attach_driver+0x174/0x220 bus_for_each_drv+0x100/0x190
    __device_attach+0x206/0x370 bus_probe_device+0x123/0x170 device_add+0xd25/0x1470 i2c_new_client_device+0x7a0/0xcd0 do_one_initcall+0x89/0x300 do_init_module+0x29d/0x7f0 load_module+0x4f48/0x69e0 init_module_from_file+0xe4/0x150 idempotent_init_module+0x320/0x670
    __x64_sys_finit_module+0xbd/0x120 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f 已由工作 141 kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x釋放
    __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 release_nodes+0xa4/0x100 devres_release_group+0x1b2/0x380 i2c_device_probe+0x694/0x880 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __device_attach_driver+0x174/0x220 bus_for_each_drv+0x100/0x190
    __device_attach+0x206/0x370 bus_probe_device+0x123/0x170 device_add+0xd25/0x1470 i2c_new_client_device+0x7a0/0xcd0 do_one_initcall+0x89/0x300 do_init_module+0x29d/0x7f0 load_module+0x4f48/0x69e0 init_module_from_file+0xe4/0x150 idempotent_init_module+0x320/0x670
    __x64_sys_finit_module+0xbd/0x120 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f ...
    將 timer_delete() 取代為 timer_delete_sync()並以 cancel_delayed_work_sync() 取代 cancel_delayed_work()確保在資源清理前正確終止計時器及工作項目。此錯誤最初是透過靜態分析發現的。針對複制和測試我透過核心模組建立了 tc358743 裝置的功能模擬並透過 debugfs 介面引入了錯誤。 (CVE-2025-39995)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

ID	Name	Product	Family	Published	Updated	Severity
271549	Linux Distros Unpatched Vulnerability : CVE-2025-39995	Nessus	Misc.	10/27/2025	10/27/2025	critical
271549	Linux Distros のパッチ未適用の脆弱性: CVE-2025-39995	Nessus	Misc.	10/27/2025	10/27/2025	critical
271549	Linux Distros 未修补的漏洞：CVE-2025-39995	Nessus	Misc.	10/27/2025	10/27/2025	critical
271366	Photon OS 5.0: Linux PHSA-2025-5.0-0655	Nessus	PhotonOS Local Security Checks	10/24/2025	10/24/2025	high
271549	Linux Distros 未修補的弱點：CVE-2025-39995	Nessus	Misc.	10/27/2025	10/27/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

high

critical