The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986402 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: netlink: af_netlink: Prevent empty skb by adding a check on len.

    Adding a check on len parameter to avoid empty skb. This prevents a     division error in netem_enqueue function which is caused when skb->len=0     and skb->data_len=0 in the randomized corruption step as shown below.

    skb->data[prandom_u32() % skb_headlen(skb)] ^= 1<<(prandom_u32() % 8);

    Crash Report:
    [  343.170349] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family     0 port 6081 - 0     [  343.216110] netem: version 1.3     [  343.235841] divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI     [  343.236680] CPU: 3 PID: 4288 Comm: reproducer Not tainted 5.16.0-rc1+     [  343.237569] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),     BIOS 1.11.0-2.el7 04/01/2014     [  343.238707] RIP: 0010:netem_enqueue+0x1590/0x33c0 [sch_netem]     [  343.239499] Code: 89 85 58 ff ff ff e8 5f 5d e9 d3 48 8b b5 48 ff ff     ff 8b 8d 50 ff ff ff 8b 85 58 ff ff ff 48 8b bd 70 ff ff ff 31 d2 2b 4f     74 <f7> f1 48 b8 00 00 00 00 00 fc ff df 49 01 d5 4c 89 e9 48 c1 e9 03     [  343.241883] RSP: 0018:ffff88800bcd7368 EFLAGS: 00010246     [  343.242589] RAX: 00000000ba7c0a9c RBX: 0000000000000001 RCX:
    0000000000000000     [  343.243542] RDX: 0000000000000000 RSI: ffff88800f8edb10 RDI:
    ffff88800f8eda40     [  343.244474] RBP: ffff88800bcd7458 R08: 0000000000000000 R09:
    ffffffff94fb8445     [  343.245403] R10: ffffffff94fb8336 R11: ffffffff94fb8445 R12:
    0000000000000000     [  343.246355] R13: ffff88800a5a7000 R14: ffff88800a5b5800 R15:
    0000000000000020     [  343.247291] FS:  00007fdde2bd7700(0000) GS:ffff888109780000(0000)     knlGS:0000000000000000     [  343.248350] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033     [  343.249120] CR2: 00000000200000c0 CR3: 000000000ef4c000 CR4:
    00000000000006e0     [  343.250076] Call Trace:
    [  343.250423]  <TASK>     [  343.250713]  ? memcpy+0x4d/0x60     [  343.251162]  ? netem_init+0xa0/0xa0 [sch_netem]     [  343.251795]  ? __sanitizer_cov_trace_pc+0x21/0x60     [  343.252443]  netem_enqueue+0xe28/0x33c0 [sch_netem]     [  343.253102]  ? stack_trace_save+0x87/0xb0     [  343.253655]  ? filter_irq_stacks+0xb0/0xb0     [  343.254220]  ? netem_init+0xa0/0xa0 [sch_netem]     [  343.254837]  ? __kasan_check_write+0x14/0x20     [  343.255418]  ? _raw_spin_lock+0x88/0xd6     [  343.255953]  dev_qdisc_enqueue+0x50/0x180     [  343.256508]  __dev_queue_xmit+0x1a7e/0x3090     [  343.257083]  ? netdev_core_pick_tx+0x300/0x300     [  343.257690]  ? check_kcov_mode+0x10/0x40     [  343.258219]  ? _raw_spin_unlock_irqrestore+0x29/0x40     [  343.258899]  ? __kasan_init_slab_obj+0x24/0x30     [  343.259529]  ? setup_object.isra.71+0x23/0x90     [  343.260121]  ? new_slab+0x26e/0x4b0     [  343.260609]  ? kasan_poison+0x3a/0x50     [  343.261118]  ? kasan_unpoison+0x28/0x50     [  343.261637]  ? __kasan_slab_alloc+0x71/0x90     [  343.262214]  ? memcpy+0x4d/0x60     [  343.262674]  ? write_comp_data+0x2f/0x90     [  343.263209]  ? __kasan_check_write+0x14/0x20     [  343.263802]  ? __skb_clone+0x5d6/0x840     [  343.264329]  ? __sanitizer_cov_trace_pc+0x21/0x60     [  343.264958]  dev_queue_xmit+0x1c/0x20     [  343.265470]  netlink_deliver_tap+0x652/0x9c0     [  343.266067]  netlink_unicast+0x5a0/0x7f0     [  343.266608]  ? netlink_attachskb+0x860/0x860     [  343.267183]  ? __sanitizer_cov_trace_pc+0x21/0x60     [  343.267820]  ? write_comp_data+0x2f/0x90     [  343.268367]  netlink_sendmsg+0x922/0xe80     [  343.268899]  ? netlink_unicast+0x7f0/0x7f0     [  343.269472]  ? __sanitizer_cov_trace_pc+0x21/0x60     [  343.270099]  ? write_comp_data+0x2f/0x90     [  343.270644]  ? netlink_unicast+0x7f0/0x7f0     [  343.271210]  sock_sendmsg+0x155/0x190     [  343.271721]  ____sys_sendmsg+0x75f/0x8f0     [  343.272262]  ? kernel_sendmsg+0x60/0x60     [  343.272788]  ? write_comp_data+0x2f/0x90     [  343.273332]  ? write_comp_data+0x2f/0x90     [  343.273869]  ___sys_sendmsg+0x10f/0x190     [  343.274405]  ? sendmsg_copy_msghdr+0x80/0x80     [  343.274984]  ? slab_post_alloc_hook+0x70/0x230     [  343.275597]  ? futex_wait_setup+0x240/0x240     [  343.276175]  ? security_file_alloc+0x3e/0x170     [  343.276779]  ? write_comp_d
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.262-200.489. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1749 advisory.

    A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was     found in the way users call some interrupts with high frequency from one of the guests.A local user could     use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28711)

    A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was     found in the way users call some interrupts with high frequency from one of the guests.A local user could     use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28712)

    A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was     found in the way users call some interrupts with high frequency from one of the guests.A local user could     use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28713)

    Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is     ready to process them. There are some measures taken for avoiding to pile up too much data, but those can     be bypassed by the guest: The timeout could even never trigger if the guest manages to have only one free     slot in its RX queue ring page and the next package would require more than one free slot, which may be     the case when using GSO, XDP, or software hashing. (CVE-2021-28714)

    Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is     ready to process them. There are some measures taken for avoiding to pile up too much data, but those can     be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming     new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default).
    Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time.
    (CVE-2021-28715)

    A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a     privileged local account can leak kernel stack information when issuing commands to the     /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it     can be further used to defeat existing kernel protection mechanisms. (CVE-2021-3923)

    A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    (CVE-2021-4083)

    A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size     increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS     filesystem otherwise not accessible to them. (CVE-2021-4155)

    A use-after-free flaw in the Linux kernel TEE (Trusted Execution Environment) subsystem was found in the     way user calls ioctl TEE_IOC_OPEN_SESSION or TEE_IOC_INVOKE. A local user could use this flaw to crash the     system or escalate their privileges on the system. If the Linux system non configured with the     CONFIG_PREEMPT option or CONFIG_CPU_SW_DOMAIN_PAN option enabled, then it is unlikely that a user can     trigger this issue. (CVE-2021-44733)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: use call_rcu to free endpoint (CVE-2021-46929)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix use-after-free in tw_timer_handler (CVE-2021-46936)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix use-after-free due to delegation race (CVE-2021-47506)

    In the Linux kernel, the following vulnerability has been resolved:

    seg6: fix the iif in the IPv6 socket control block (CVE-2021-47515)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: core: fix transmit-buffer reset and memleak (CVE-2021-47527)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() (CVE-2021-47541)

    In the Linux kernel, the following vulnerability has been resolved:

    ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()     (CVE-2021-47548)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpt3sas: Fix kernel panic during drive powercycle test (CVE-2021-47565)

    In the Linux kernel, the following vulnerability has been resolved:

    proc/vmcore: fix clearing user buffer by properly using clear_user() (CVE-2021-47566)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() (CVE-2021-47576)

    In the Linux kernel, the following vulnerability has been resolved:

    sit: do not call ipip6_dev_free() from sit_init_net() (CVE-2021-47588)

    In the Linux kernel, the following vulnerability has been resolved:

    igbvf: fix double free in `igbvf_probe` (CVE-2021-47589)

    In the Linux kernel, the following vulnerability has been resolved:

    dm btree remove: fix use after free in rebalance_children() (CVE-2021-47600)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: improve robustness of the audit queue handling (CVE-2021-47603)

    In the Linux kernel, the following vulnerability has been resolved:

    net: netlink: af_netlink: Prevent empty skb by adding a check on len. (CVE-2021-47606)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: arm_scpi: Fix string overflow in SCPI genpd driver (CVE-2021-47609)

    The cgroup release_agent is called with call_usermodehelper. The function call_usermodehelper starts the     release_agent with a full set of capabilities. Therefore require capabilities when setting the     release_agent. (CVE-2022-0492)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.93-87.444. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-009 advisory.

    A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was     found in the way users call some interrupts with high frequency from one of the guests.A local user could     use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28711)

    A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was     found in the way users call some interrupts with high frequency from one of the guests.A local user could     use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28712)

    A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was     found in the way users call some interrupts with high frequency from one of the guests.A local user could     use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28713)

    Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is     ready to process them. There are some measures taken for avoiding to pile up too much data, but those can     be bypassed by the guest: The timeout could even never trigger if the guest manages to have only one free     slot in its RX queue ring page and the next package would require more than one free slot, which may be     the case when using GSO, XDP, or software hashing. (CVE-2021-28714)

    Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is     ready to process them. There are some measures taken for avoiding to pile up too much data, but those can     be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming     new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default).
    Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time.
    (CVE-2021-28715)

    A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a     privileged local account can leak kernel stack information when issuing commands to the     /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it     can be further used to defeat existing kernel protection mechanisms. (CVE-2021-3923)

    A flaw memory leak in the Linux kernel's eBPF for the Simulated networking device driver in the way user     uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this     flaw to get unauthorized access to some data. (CVE-2021-4135)

    A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size     increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS     filesystem otherwise not accessible to them. (CVE-2021-4155)

    An out-of-bounds write flaw was found in the Linux kernel's Aquantia AQtion Ethernet card Atlantic driver     in the way the ethernet card provides malicious input to the driver. This flaw allows a local user to     emulate the networking device and crash the system. The highest threat from this vulnerability is to     confidentiality, integrity, as well as system availability. (CVE-2021-43975)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: use call_rcu to free endpoint (CVE-2021-46929)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Wrap the tx reporter dump callback to extract the sq (CVE-2021-46931)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: validate user data in compat ioctl

    Wrong user data may cause warning in i2c_transfer(), ex: zero msgs.Userspace should not be able to trigger     warnings, so this patch addsvalidation checks for user data in compact ioctl to prevent reportedwarnings     (CVE-2021-46934)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix use-after-free in tw_timer_handler (CVE-2021-46936)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page() (CVE-2021-47090)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: elantech - fix stack out of bound access in elantech_change_report_id() (CVE-2021-47097)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc (CVE-2021-47501)

    In the Linux kernel, the following vulnerability has been resolved:

    aio: fix use-after-free due to missing POLLFREE handling (CVE-2021-47505)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix use-after-free due to delegation race (CVE-2021-47506)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: Fix nsfd startup race (again) (CVE-2021-47507)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: fq_pie: prevent dismantle issue (CVE-2021-47512)

    In the Linux kernel, the following vulnerability has been resolved:

    devlink: fix netns refcount leak in devlink_nl_cmd_reload() (CVE-2021-47514)

    In the Linux kernel, the following vulnerability has been resolved:

    seg6: fix the iif in the IPv6 socket control block (CVE-2021-47515)

    In the Linux kernel, the following vulnerability has been resolved:

    ethtool: do not perform operations on net devices being unregistered (CVE-2021-47517)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: core: fix transmit-buffer reset and memleak (CVE-2021-47527)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (CVE-2021-47538)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (CVE-2021-47539)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() (CVE-2021-47541)

    In the Linux kernel, the following vulnerability has been resolved:

    net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings() (CVE-2021-47542)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: fix page frag corruption on page fault (CVE-2021-47544)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix memory leak in fib6_rule_suppress (CVE-2021-47546)

    In the Linux kernel, the following vulnerability has been resolved:

    ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()     (CVE-2021-47548)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amd/amdgpu: fix potential memleak (CVE-2021-47550)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/scs: Reset task stack state in bringup_cpu() (CVE-2021-47553)

    In the Linux kernel, the following vulnerability has been resolved:

    net: vlan: fix underflow for the real_dev refcnt (CVE-2021-47555)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_ets: don't peek at classes beyond 'nbands' (CVE-2021-47557)

    In the Linux kernel, the following vulnerability has been resolved:

    mlxsw: spectrum: Protect driver from buggy firmware (CVE-2021-47560)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpt3sas: Fix kernel panic during drive powercycle test (CVE-2021-47565)

    In the Linux kernel, the following vulnerability has been resolved:

    proc/vmcore: fix clearing user buffer by properly using clear_user() (CVE-2021-47566)

    In the Linux kernel, the following vulnerability has been resolved:

    net: nexthop: fix null pointer dereference when IPv6 is not enabled (CVE-2021-47572)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() (CVE-2021-47576)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: scsi_debug: Don't call kcalloc() if size arg is zero (CVE-2021-47578)

    In the Linux kernel, the following vulnerability has been resolved:

    ovl: fix warning in ovl_create_real() (CVE-2021-47579)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: scsi_debug: Fix type in min_t to avoid stack OOB (CVE-2021-47580)

    In the Linux kernel, the following vulnerability has been resolved:

    iocost: Fix divide-by-zero on donation from low hweight cgroup (CVE-2021-47584)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix memory leak in __add_inode_ref() (CVE-2021-47585)

    In the Linux kernel, the following vulnerability has been resolved:

    sit: do not call ipip6_dev_free() from sit_init_net() (CVE-2021-47588)

    In the Linux kernel, the following vulnerability has been resolved:

    igbvf: fix double free in `igbvf_probe` (CVE-2021-47589)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: clear 'kern' flag from fallback sockets (CVE-2021-47593)

    In the Linux kernel, the following vulnerability has been resolved:

    inet_diag: fix kernel-infoleak for UDP sockets (CVE-2021-47597)

    In the Linux kernel, the following vulnerability has been resolved:

    sch_cake: do not call cake_destroy() from cake_init() (CVE-2021-47598)

    In the Linux kernel, the following vulnerability has been resolved:

    dm btree remove: fix use after free in rebalance_children() (CVE-2021-47600)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: improve robustness of the audit queue handling (CVE-2021-47603)

    In the Linux kernel, the following vulnerability has been resolved:

    net: netlink: af_netlink: Prevent empty skb by adding a check on len. (CVE-2021-47606)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: arm_scpi: Fix string overflow in SCPI genpd driver (CVE-2021-47609)

    A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem     Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in     case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local     user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to     legacy handling) could use this flaw to escalate their privileges on the system. (CVE-2022-0185)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2901-1 advisory.

    The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
    - CVE-2024-42096: x86: stop playing stack games in profile_pc() (bsc#1228633).
    - CVE-2024-39506: liquidio: adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).
    - CVE-2021-47619: i40e: Fix queues reservation for XDP (bsc#1226645).
    - CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743).
    - CVE-2024-42124: scsi: qedf: Make qedf_execute_tmf() non-preemptible (bsc#1228705).
    - CVE-2024-42223: media: dvb-frontends: tda10048: Fix integer overflow (bsc#1228726).
    - CVE-2024-42119: drm/amd/display: Skip finding free audio for unknown engine_id (bsc#1228584).
    - CVE-2024-42120: drm/amd/display: Check pipe offset before setting vblank (bsc#1228588).
    - CVE-2024-41095: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes     (bsc#1228662).
    - CVE-2024-42224: net: dsa: mv88e6xxx: Correct check for empty list (bsc#1228723).
    - CVE-2024-41072: wifi: cfg80211: wext: add extra SIOCSIWSCAN data check (bsc#1228626).
    - CVE-2024-41048: skmsg: Skip zero length skb in sk_msg_recvmsg (bsc#1228565).
    - CVE-2024-40995: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (bsc#1227830).
    - CVE-2024-41044: ppp: reject claimed-as-LCP but actually malformed packets (bsc#1228530).
    - CVE-2024-41066: ibmvnic: add tx check to prevent skb leak (bsc#1228640).
    - CVE-2024-42093: net/dpaa2: Avoid explicit cpumask var allocation on stack (bsc#1228680).
    - CVE-2024-41089: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes     (bsc#1228658).
    - CVE-2024-41060: drm/radeon: check bo_va->bo is non-NULL before using it (bsc#1228567).
    - CVE-2022-48829: NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes (bsc#1228055).
    - CVE-2022-48828: NFSD: Fix ia_size underflow (bsc#1228054).
    - CVE-2022-48827: NFSD: Fix the behavior of READ near OFFSET_MAX (bsc#1228037).
    - CVE-2024-41078: btrfs: qgroup: fix quota root leak after quota disable failure (bsc#1228655).
    - CVE-2024-41071: wifi: mac80211: Avoid address calculations via out of bounds array indexing     (bsc#1228625).
    - CVE-2024-41064: powerpc/eeh: avoid possible crash when edev->pdev changes (bsc#1228599).
    - CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).
    - CVE-2024-41081: ila: block BH in ila_output() (bsc#1228617).
    - CVE-2024-40978: scsi: qedi: Fix crash while reading debugfs attribute (bsc#1227929).
    - CVE-2022-48792: scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task (bsc#1228013).
    - CVE-2022-48823: scsi: qedf: Fix refcount issue when LOGO is received during TMF (bsc#1228045).
    - CVE-2024-41076: NFSv4: Fix memory leak in nfs4_set_security_label (bsc#1228649).
    - CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()     (bsc#1227866).
    - CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228561).
    - CVE-2024-40987: drm/amdgpu: fix UBSAN warning in kv_dpm.c (bsc#1228235).
    - CVE-2022-48826: drm/vc4: Fix deadlock on DSI device attach error (bsc#1227975)
    - CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).
    - CVE-2024-41015: ocfs2: add bounds checking to ocfs2_check_dir_entry() (bsc#1228409).
    - CVE-2024-41016: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() (bsc#1228410).
    - CVE-2024-41063: bluetooth: hci_core: cancel all works upon hci_unregister_dev() (bsc#1228580).
    - CVE-2024-42070: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers     (bsc#1228470).
    - CVE-2024-41070: KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() (bsc#1228581).
    - CVE-2021-47405: HID: usbhid: free raw_report buffers in usbhid_stop (bsc#1225238).
    - CVE-2024-40988: drm/radeon: fix UBSAN warning in kv_dpm.c (bsc#1227957).
    - CVE-2024-40932: drm/exynos/vidi: fix memory leak in .get_modes() (bsc#1227828).
    - CVE-2021-47403: ipack: ipoctal: fix module reference leak (bsc#1225241).
    - CVE-2021-47388: mac80211: fix use-after-free in CCMP/GCMP RX (bsc#1225214).
    - CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
    - CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
    - CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
    - CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
    - CVE-2024-35837: net: mvpp2: clear BM pool before initialization (bsc#1224500).
    - CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
    - CVE-2022-48804: vt_ioctl: fix array_index_nospec in vt_setactivate (bsc#1227968).
    - CVE-2024-40967: serial: imx: Introduce timeout when waiting on transmitter empty (bsc#1227891).
    - CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
    - CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071).
    - CVE-2021-47582: usb: core: Do not hold the device lock while sleeping in do_proc_control()     (bsc#1226559).
    - CVE-2024-40982: ssb: fix potential NULL pointer dereference in ssb_device_uevent() (bsc#1227865).
    - CVE-2021-47468: isdn: mISDN: Fix sleeping function called from invalid context (bsc#1225346).
    - CVE-2021-47395: mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap (bsc#1225326).
    - CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path     (bsc#1227936).
    - CVE-2023-52594: Fixed potential array-index-out-of-bounds read in ath9k_htc_txstatus() (bsc#1221045).
    - CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
    - CVE-2021-47580: scsi: scsi_debug: Fix type in min_t to avoid stack OOB (bsc#1226550).
    - CVE-2024-26735: ipv6: sr: fix possible use-after-free and null-ptr-deref (bsc#1222372).
    - CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).
    - CVE-2022-48811: ibmvnic: do not release napi in __ibmvnic_open() (bsc#1227928).
    - CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially     enable information disclosure via adjacent access (bsc#1186463).
    - CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby     man-in-the-middle attacker to identify the Passkey used during pairing (bsc#1179610).
    - CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
    - CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
    - CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
    - CVE-2024-40941: wifi: iwlwifi: mvm: do not read past the mfuart notifcation (bsc#1227771).
    - CVE-2022-48860: ethernet: Fix error handling in xemaclite_of_probe (bsc#1228008).
    - CVE-2022-48863: mISDN: Fix memory leak in dsp_pipeline_build() (bsc#1228063).
    - CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
    - CVE-2024-39499: vmci: prevent speculation leaks by sanitizing event in event_deliver() (bsc#1227725).
    - CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
    - CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
    - CVE-2024-40959: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (bsc#1227884).
    - CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
    - CVE-2021-47441: mlxsw: thermal: Fix out-of-bounds memory accesses (bsc#1225224)
    - CVE-2021-47194: cfg80211: call cfg80211_stop_ap when switch from P2P_GO type (bsc#1222829).
    - CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
    - CVE-2022-48775: Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj (bsc#1227924).
    - CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
    - CVE-2024-40929: wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (bsc#1227774).
    - CVE-2024-40912: wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (bsc#1227790).
    - CVE-2024-40942: wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects (bsc#1227770).
    - CVE-2022-48857: NFC: port100: fix use-after-free in port100_send_complete (bsc#1228005).
    - CVE-2024-36902: ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (bsc#1225719).
    - CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len. (bsc#1226555).
    - CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
    - CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
    - CVE-2024-26830: Fixed i40e to not allow untrusted VF to remove administratively set MAC (bsc#1223012).
    - CVE-2021-47516: nfp: Fix memory leak in nfp_cpp_area_cache_add() (bsc#1225427).
    - CVE-2021-47501: i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc (bsc#1225361).
    - CVE-2024-39501: drivers: core: synchronize really_probe() and dev_uevent() (bsc#1227754).
    - CVE-2023-52743: ice: Do not use WQ_MEM_RECLAIM flag for workqueue (bsc#1225003)
    - CVE-2021-47542: net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings()     (bsc#1225455).
    - CVE-2024-36901: ipv6: prevent NULL dereference in ip6_output() (bsc#1225711)
    - CVE-2024-36004: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (bsc#1224545)
    - CVE-2024-27025: nbd: null check for nla_nest_start (bsc#1223778)
    - CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571).
    - CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
    - CVE-2024-26663: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() (bsc#1222326).
    - CVE-2021-47597: inet_diag: fix kernel-infoleak for UDP sockets (bsc#1226553).
    - CVE-2024-39490: ipv6: sr: fix missing sk_buff release in seg6_input_core (bsc#1227626).
    - CVE-2024-38558: net: openvswitch: fix overwriting ct original tuple for ICMPv6 (bsc#1226783).
    - CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
    - CVE-2023-52619: Fixed possible crash when setting number of cpus to an odd number in pstore/ram     (bsc#1221618).
    - CVE-2024-26659: Fixed wrong handling of isoc Babble and Buffer Overrun events in xhci (bsc#1222317).
    - CVE-2024-35978: Bluetooth: Fix memory leak in hci_req_sync_complete() (bsc#1224571).
    - CVE-2023-52669: crypto: s390/aes - Fix buffer overread in CTR mode (bsc#1224637).
    - CVE-2023-52615: Fixed page fault dead lock on mmap-ed hwrng (bsc#1221614).
    - CVE-2023-52612: Fixed req->dst buffer overflow in crypto/scomp (bsc#1221616).
    - CVE-2024-35995: ACPI: CPPC: Use access_width over bit_width for system memory accesses (bsc#1224557).
    - CVE-2023-52623: Fixed suspicious RCU usage in SUNRPC (bsc#1222060).
    - CVE-2021-47295: net: sched: fix memory leak in tcindex_partial_destroy_work (bsc#1224975)
    - CVE-2023-52693: ACPI: video: check for error while searching for backlight device parent (bsc#1224686).
    - CVE-2023-52683: ACPI: LPIT: Avoid u32 multiplication overflow (bsc#1224627).
    - CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve     local privilege escalation (bsc#1215420).
    - CVE-2024-39475: fbdev: savage: Handle err return when savagefb_check_var failed (bsc#1227435)
    - CVE-2021-47520: can: pch_can: pch_can_rx_normal: fix use after free (bsc#1225431).
    - CVE-2024-36941: wifi: nl80211: do not free NULL coalescing rule (bsc#1225835).
    - CVE-2021-47145: btrfs: do not BUG_ON in link_to_fixup_dir (bsc#1222005).
    - CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound     (bsc#1225505).
    - CVE-2023-52817: drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (bsc#1225569).
    - CVE-2023-52819: drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga (bsc#1225532).
    - CVE-2023-52818: drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 (bsc#1225530).
    - CVE-2023-52753: drm/amd/display: Avoid NULL dereference of timing generator (bsc#1225478).
    - CVE-2024-36014: drm/arm/malidp: fix a possible null pointer dereference (bsc#1225593).
    - CVE-2024-26636: llc: make llc_ui_sendmsg() more robust against bonding changes (bsc#1221659).
    - CVE-2024-26635: llc: Drop support for ETH_P_TR_802_2 (bsc#1221656).
    - CVE-2024-35828: wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() (bsc#1224622).
    - CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci (bsc#1220833).
    - CVE-2024-38598: md: fix resync softlockup when bitmap size is less than array size (bsc#1226757).
    - CVE-2024-35805: dm snapshot: fix lockup in dm_exception_table_exit (bsc#1224743).
    - CVE-2024-26880: dm: call the resume method on internal suspend (bsc#1223188).
    - CVE-2021-47498: dm rq: do not queue request to blk-mq during DM suspend (bsc#1225357).
    - CVE-2021-47275: bcache: avoid oversized read request in cache missing code path (bsc#1224965).
    - CVE-2024-38619: usb-storage: alauda: Check whether the media is initialized (bsc#1226861).
    - CVE-2021-47201: iavf: free q_vectors before queues in iavf_disable_vf (bsc#1222792).
    - CVE-2024-26863: hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021).
    - CVE-2024-38630: watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger (bsc#1226908).
    - CVE-2024-39301: net/9p: fix uninit-value in p9_client_rpc() (bsc#1226994).
    - CVE-2021-47559: net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk() (bsc#1225396).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5363 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.
    Security Fix(es):

    * kernel: phy: (CVE-2024-26600)

    * kernel: netfilter: multiple flaws (CVE-2024-26808, CVE-2024-27065, CVE-2024-35899, CVE-2024-36005)

    * kernel: cifs: (CVE-2024-26828)

    * kernel: wifi: multiple flaws (CVE-2024-26897, CVE-2024-27052, CVE-2024-27049, CVE-2023-52651,     CVE-2024-35789, CVE-2024-27434, CVE-2024-35845, CVE-2024-35937, CVE-2024-36941, CVE-2024-36922,     CVE-2024-36921, CVE-2024-38575)

    * kernel: nfs: (CVE-2024-26868)

    * kernel: igc: (CVE-2024-26853)

    * kernel: dmaengine/idxd: (CVE-2024-21823)

    * kernel: ipv6: multiple flaws (CVE-2024-27417, CVE-2024-35969, CVE-2024-36903, CVE-2024-40961)

    * kernel: vt: (CVE-2024-35823)

    * kernel: efi: (CVE-2024-35800)

    * kernel: mlxsw: (CVE-2024-35852)

    * kernel: eeprom: (CVE-2024-35848)

    * kernel: ice: (CVE-2024-35911)

    * kernel: platform/x86: (CVE-2023-52864)

    * kernel: i40e: (CVE-2024-36020)

    * kernel: rtnetlink: (CVE-2024-36017)

    * kernel: net: multiple flaws (CVE-2024-36929, CVE-2024-36971, CVE-2021-47606, CVE-2024-38558,     CVE-2024-40928, CVE-2024-40954)

    * kernel: ipvlan: (CVE-2024-33621)

    * kernel: tcp: (CVE-2024-37356)

    * kernel: virtio: (CVE-2024-37353)

    * kernel: tls: (CVE-2024-36489)

    * kernel: cxl/region: (CVE-2024-38391)

    * kernel: bonding: (CVE-2024-39487)

    * kernel: netns: (CVE-2024-40958)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7332-2 advisory.

    Attila Szsz discovered that the HFS+ file system implementation in the Linux Kernel contained a heap     overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted,     could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2025-0927)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - PowerPC architecture;

    - Block layer subsystem;

    - GPIO subsystem;

    - GPU drivers;

    - Media drivers;

    - Network drivers;

    - SCSI subsystem;

    - Direct Digital Synthesis drivers;

    - TTY drivers;

    - 9P distributed file system;

    - JFS file system;

    - NILFS2 file system;

    - File systems infrastructure;

    - BPF subsystem;

    - Netfilter;

    - Network sockets;

    - Memory management;

    - Amateur Radio drivers;

    - B.A.T.M.A.N. meshing protocol;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - Netlink;

    - TIPC protocol;

    - Wireless networking;

    - ALSA framework; (CVE-2024-26685, CVE-2024-50233, CVE-2024-41063, CVE-2024-42070, CVE-2024-40910,     CVE-2024-40911, CVE-2024-36886, CVE-2024-35896, CVE-2024-43863, CVE-2023-52522, CVE-2024-53156,     CVE-2023-52488, CVE-2024-43854, CVE-2024-44938, CVE-2024-53104, CVE-2024-44931, CVE-2024-50171,     CVE-2024-43892, CVE-2024-50148, CVE-2024-38567, CVE-2024-36964, CVE-2024-43893, CVE-2024-36952,     CVE-2022-48994, CVE-2021-47606, CVE-2023-52818, CVE-2024-41064, CVE-2024-40981, CVE-2024-40943,     CVE-2024-42068, CVE-2023-52880, CVE-2021-47103, CVE-2024-43900, CVE-2024-50117, CVE-2023-52799,     CVE-2024-49902)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989314 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: netlink: af_netlink: Prevent empty skb by adding a check on len.

    Adding a check on len parameter to avoid empty skb. This prevents a     division error in netem_enqueue function which is caused when skb->len=0     and skb->data_len=0 in the randomized corruption step as shown below.

    skb->data[prandom_u32() % skb_headlen(skb)] ^= 1<<(prandom_u32() % 8);

    Crash Report:
    [  343.170349] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family     0 port 6081 - 0     [  343.216110] netem: version 1.3     [  343.235841] divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI     [  343.236680] CPU: 3 PID: 4288 Comm: reproducer Not tainted 5.16.0-rc1+     [  343.237569] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),     BIOS 1.11.0-2.el7 04/01/2014     [  343.238707] RIP: 0010:netem_enqueue+0x1590/0x33c0 [sch_netem]     [  343.239499] Code: 89 85 58 ff ff ff e8 5f 5d e9 d3 48 8b b5 48 ff ff     ff 8b 8d 50 ff ff ff 8b 85 58 ff ff ff 48 8b bd 70 ff ff ff 31 d2 2b 4f     74 <f7> f1 48 b8 00 00 00 00 00 fc ff df 49 01 d5 4c 89 e9 48 c1 e9 03     [  343.241883] RSP: 0018:ffff88800bcd7368 EFLAGS: 00010246     [  343.242589] RAX: 00000000ba7c0a9c RBX: 0000000000000001 RCX:
    0000000000000000     [  343.243542] RDX: 0000000000000000 RSI: ffff88800f8edb10 RDI:
    ffff88800f8eda40     [  343.244474] RBP: ffff88800bcd7458 R08: 0000000000000000 R09:
    ffffffff94fb8445     [  343.245403] R10: ffffffff94fb8336 R11: ffffffff94fb8445 R12:
    0000000000000000     [  343.246355] R13: ffff88800a5a7000 R14: ffff88800a5b5800 R15:
    0000000000000020     [  343.247291] FS:  00007fdde2bd7700(0000) GS:ffff888109780000(0000)     knlGS:0000000000000000     [  343.248350] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033     [  343.249120] CR2: 00000000200000c0 CR3: 000000000ef4c000 CR4:
    00000000000006e0     [  343.250076] Call Trace:
    [  343.250423]  <TASK>     [  343.250713]  ? memcpy+0x4d/0x60     [  343.251162]  ? netem_init+0xa0/0xa0 [sch_netem]     [  343.251795]  ? __sanitizer_cov_trace_pc+0x21/0x60     [  343.252443]  netem_enqueue+0xe28/0x33c0 [sch_netem]     [  343.253102]  ? stack_trace_save+0x87/0xb0     [  343.253655]  ? filter_irq_stacks+0xb0/0xb0     [  343.254220]  ? netem_init+0xa0/0xa0 [sch_netem]     [  343.254837]  ? __kasan_check_write+0x14/0x20     [  343.255418]  ? _raw_spin_lock+0x88/0xd6     [  343.255953]  dev_qdisc_enqueue+0x50/0x180     [  343.256508]  __dev_queue_xmit+0x1a7e/0x3090     [  343.257083]  ? netdev_core_pick_tx+0x300/0x300     [  343.257690]  ? check_kcov_mode+0x10/0x40     [  343.258219]  ? _raw_spin_unlock_irqrestore+0x29/0x40     [  343.258899]  ? __kasan_init_slab_obj+0x24/0x30     [  343.259529]  ? setup_object.isra.71+0x23/0x90     [  343.260121]  ? new_slab+0x26e/0x4b0     [  343.260609]  ? kasan_poison+0x3a/0x50     [  343.261118]  ? kasan_unpoison+0x28/0x50     [  343.261637]  ? __kasan_slab_alloc+0x71/0x90     [  343.262214]  ? memcpy+0x4d/0x60     [  343.262674]  ? write_comp_data+0x2f/0x90     [  343.263209]  ? __kasan_check_write+0x14/0x20     [  343.263802]  ? __skb_clone+0x5d6/0x840     [  343.264329]  ? __sanitizer_cov_trace_pc+0x21/0x60     [  343.264958]  dev_queue_xmit+0x1c/0x20     [  343.265470]  netlink_deliver_tap+0x652/0x9c0     [  343.266067]  netlink_unicast+0x5a0/0x7f0     [  343.266608]  ? netlink_attachskb+0x860/0x860     [  343.267183]  ? __sanitizer_cov_trace_pc+0x21/0x60     [  343.267820]  ? write_comp_data+0x2f/0x90     [  343.268367]  netlink_sendmsg+0x922/0xe80     [  343.268899]  ? netlink_unicast+0x7f0/0x7f0     [  343.269472]  ? __sanitizer_cov_trace_pc+0x21/0x60     [  343.270099]  ? write_comp_data+0x2f/0x90     [  343.270644]  ? netlink_unicast+0x7f0/0x7f0     [  343.271210]  sock_sendmsg+0x155/0x190     [  343.271721]  ____sys_sendmsg+0x75f/0x8f0     [  343.272262]  ? kernel_sendmsg+0x60/0x60     [  343.272788]  ? write_comp_data+0x2f/0x90     [  343.273332]  ? write_comp_data+0x2f/0x90     [  343.273869]  ___sys_sendmsg+0x10f/0x190     [  343.274405]  ? sendmsg_copy_msghdr+0x80/0x80     [  343.274984]  ? slab_post_alloc_hook+0x70/0x230     [  343.275597]  ? futex_wait_setup+0x240/0x240     [  343.276175]  ? security_file_alloc+0x3e/0x170     [  343.276779]  ? write_comp_d
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986582 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: netlink: af_netlink: Prevent empty skb by adding a check on len.

    Adding a check on len parameter to avoid empty skb. This prevents a     division error in netem_enqueue function which is caused when skb->len=0     and skb->data_len=0 in the randomized corruption step as shown below.

    skb->data[prandom_u32() % skb_headlen(skb)] ^= 1<<(prandom_u32() % 8);

    Crash Report:
    [  343.170349] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family     0 port 6081 - 0     [  343.216110] netem: version 1.3     [  343.235841] divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI     [  343.236680] CPU: 3 PID: 4288 Comm: reproducer Not tainted 5.16.0-rc1+     [  343.237569] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),     BIOS 1.11.0-2.el7 04/01/2014     [  343.238707] RIP: 0010:netem_enqueue+0x1590/0x33c0 [sch_netem]     [  343.239499] Code: 89 85 58 ff ff ff e8 5f 5d e9 d3 48 8b b5 48 ff ff     ff 8b 8d 50 ff ff ff 8b 85 58 ff ff ff 48 8b bd 70 ff ff ff 31 d2 2b 4f     74 <f7> f1 48 b8 00 00 00 00 00 fc ff df 49 01 d5 4c 89 e9 48 c1 e9 03     [  343.241883] RSP: 0018:ffff88800bcd7368 EFLAGS: 00010246     [  343.242589] RAX: 00000000ba7c0a9c RBX: 0000000000000001 RCX:
    0000000000000000     [  343.243542] RDX: 0000000000000000 RSI: ffff88800f8edb10 RDI:
    ffff88800f8eda40     [  343.244474] RBP: ffff88800bcd7458 R08: 0000000000000000 R09:
    ffffffff94fb8445     [  343.245403] R10: ffffffff94fb8336 R11: ffffffff94fb8445 R12:
    0000000000000000     [  343.246355] R13: ffff88800a5a7000 R14: ffff88800a5b5800 R15:
    0000000000000020     [  343.247291] FS:  00007fdde2bd7700(0000) GS:ffff888109780000(0000)     knlGS:0000000000000000     [  343.248350] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033     [  343.249120] CR2: 00000000200000c0 CR3: 000000000ef4c000 CR4:
    00000000000006e0     [  343.250076] Call Trace:
    [  343.250423]  <TASK>     [  343.250713]  ? memcpy+0x4d/0x60     [  343.251162]  ? netem_init+0xa0/0xa0 [sch_netem]     [  343.251795]  ? __sanitizer_cov_trace_pc+0x21/0x60     [  343.252443]  netem_enqueue+0xe28/0x33c0 [sch_netem]     [  343.253102]  ? stack_trace_save+0x87/0xb0     [  343.253655]  ? filter_irq_stacks+0xb0/0xb0     [  343.254220]  ? netem_init+0xa0/0xa0 [sch_netem]     [  343.254837]  ? __kasan_check_write+0x14/0x20     [  343.255418]  ? _raw_spin_lock+0x88/0xd6     [  343.255953]  dev_qdisc_enqueue+0x50/0x180     [  343.256508]  __dev_queue_xmit+0x1a7e/0x3090     [  343.257083]  ? netdev_core_pick_tx+0x300/0x300     [  343.257690]  ? check_kcov_mode+0x10/0x40     [  343.258219]  ? _raw_spin_unlock_irqrestore+0x29/0x40     [  343.258899]  ? __kasan_init_slab_obj+0x24/0x30     [  343.259529]  ? setup_object.isra.71+0x23/0x90     [  343.260121]  ? new_slab+0x26e/0x4b0     [  343.260609]  ? kasan_poison+0x3a/0x50     [  343.261118]  ? kasan_unpoison+0x28/0x50     [  343.261637]  ? __kasan_slab_alloc+0x71/0x90     [  343.262214]  ? memcpy+0x4d/0x60     [  343.262674]  ? write_comp_data+0x2f/0x90     [  343.263209]  ? __kasan_check_write+0x14/0x20     [  343.263802]  ? __skb_clone+0x5d6/0x840     [  343.264329]  ? __sanitizer_cov_trace_pc+0x21/0x60     [  343.264958]  dev_queue_xmit+0x1c/0x20     [  343.265470]  netlink_deliver_tap+0x652/0x9c0     [  343.266067]  netlink_unicast+0x5a0/0x7f0     [  343.266608]  ? netlink_attachskb+0x860/0x860     [  343.267183]  ? __sanitizer_cov_trace_pc+0x21/0x60     [  343.267820]  ? write_comp_data+0x2f/0x90     [  343.268367]  netlink_sendmsg+0x922/0xe80     [  343.268899]  ? netlink_unicast+0x7f0/0x7f0     [  343.269472]  ? __sanitizer_cov_trace_pc+0x21/0x60     [  343.270099]  ? write_comp_data+0x2f/0x90     [  343.270644]  ? netlink_unicast+0x7f0/0x7f0     [  343.271210]  sock_sendmsg+0x155/0x190     [  343.271721]  ____sys_sendmsg+0x75f/0x8f0     [  343.272262]  ? kernel_sendmsg+0x60/0x60     [  343.272788]  ? write_comp_data+0x2f/0x90     [  343.273332]  ? write_comp_data+0x2f/0x90     [  343.273869]  ___sys_sendmsg+0x10f/0x190     [  343.274405]  ? sendmsg_copy_msghdr+0x80/0x80     [  343.274984]  ? slab_post_alloc_hook+0x70/0x230     [  343.275597]  ? futex_wait_setup+0x240/0x240     [  343.276175]  ? security_file_alloc+0x3e/0x170     [  343.276779]  ? write_comp_d
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
268398	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-986402)	Nessus	Unity Linux Local Security Checks	10/7/2025	10/15/2025	medium
293620	MiracleLinux 9 : kernel-5.14.0-427.31.1.el9_4 (AXSA:2024-8705:26)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high
157408	Amazon Linux 2 : kernel (ALAS-2022-1749)	Nessus	Amazon Linux Local Security Checks	2/7/2022	6/3/2026	high
160451	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-009)	Nessus	Amazon Linux Local Security Checks	5/2/2022	2/26/2026	high
205579	SUSE SLES12: kernel-azure / kernel-azure-base / kernel-azure-devel / etc (SUSE-SU-2024:2901-1)	Nessus	SuSE Local Security Checks	8/15/2024	6/26/2026	high
205633	RHEL 9 : kernel (RHSA-2024:5363)	Nessus	Red Hat Local Security Checks	8/15/2024	9/24/2025	high
232626	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-7332-2)	Nessus	Ubuntu Local Security Checks	3/11/2025	9/24/2025	high
273811	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989314)	Nessus	Unity Linux Local Security Checks	11/5/2025	11/5/2025	medium
267937	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986582)	Nessus	Unity Linux Local Security Checks	10/7/2025	10/15/2025	medium

Detections

Analytics

Plugins Search

medium

high

high

high

high

high

high

medium

medium