The version of kernel installed on the remote host is prior to 5.10.157-139.675. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-024 advisory.

    A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request     of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting     in a PCIe link disconnect. (CVE-2022-3169)

    An incorrect TLB flush issue was found in the Linux kernel's GPU i915 kernel driver, potentially leading     to random memory corruption or data leaks. This flaw could allow a local user to crash the system or     escalate their privileges on the system. (CVE-2022-4139)

    An issue was discovered in the Linux kernel 5.10.x before 5.10.155. A use-after-free in io_sqpoll_wait_sq     in fs/io_uring.c allows an attacker to crash the kernel, resulting in denial of service. finish_wait can     be skipped. An attack can occur in some situations by forking a process and then quickly terminating it.
    NOTE: later kernel versions, such as the 5.15 longterm series, substantially changed the implementation of     io_sqpoll_wait_sq. (CVE-2022-47946)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/sysfs: fix wrong empty schemes assumption under online tuning in damon_sysfs_set_schemes()     (CVE-2022-48996)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: Check sb_bsize_shift after reading superblock (CVE-2022-49769)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: avoid putting the realm twice when decoding snaps fails (CVE-2022-49770)

    In the Linux kernel, the following vulnerability has been resolved:

    dm ioctl: fix misbehavior if list_versions races with module loading (CVE-2022-49771)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: enforce a consistent minimal mtu (CVE-2022-49776)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: i8042 - fix leaking of platform device on module removal (CVE-2022-49777)

    In the Linux kernel, the following vulnerability has been resolved:

    kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case (CVE-2022-49779)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() (CVE-2022-49780)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (CVE-2022-49787)

    In the Linux kernel, the following vulnerability has been resolved:

    misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CVE-2022-49788)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix null pointer dereference in ftrace_add_mod() (CVE-2022-49802)

    In the Linux kernel, the following vulnerability has been resolved:

    drbd: use after free in drbd_create_device() (CVE-2022-49811)

    In the Linux kernel, the following vulnerability has been resolved:

    bridge: switchdev: Fix memory leaks when changing VLAN protocol (CVE-2022-49812)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: close race conditions on sk_receive_queue (CVE-2022-49814)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-transport: fix error handling in ata_tdev_add() (CVE-2022-49823)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-transport: fix error handling in ata_tlink_add() (CVE-2022-49824)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-transport: fix error handling in ata_tport_add() (CVE-2022-49825)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-transport: fix double ata_host_put() in ata_tport_add() (CVE-2022-49826)

    In the Linux kernel, the following vulnerability has been resolved:

    drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker() (CVE-2022-49827)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/drv: Fix potential memory leak in drm_dev_init() (CVE-2022-49830)

    In the Linux kernel, the following vulnerability has been resolved:

    pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (CVE-2022-49832)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: clear out_curr if all frag chunks of current msg are pruned (CVE-2022-49838)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: scsi_transport_sas: Fix error handling in sas_phy_add() (CVE-2022-49839)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() (CVE-2022-49840)

    In the Linux kernel, the following vulnerability has been resolved:

    ASoC: core: Fix use-after-free in snd_soc_exit() (CVE-2022-49842)

    A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This     issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc     protocol in the Linux kernel. (CVE-2023-1382)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1771078945 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: pid: take a reference when     initializing `cad_pid` During boot, kernel_init_freeable() initializes `cad_pid` to the init task's struct     pid. Later on, we may change `cad_pid` via a sysctl, and when this happens proc_do_cad_pid() will     increment the refcount on the new pid via get_pid(), and will decrement the refcount on the old pid via     put_pid(). As we never called get_pid() when we initialized `cad_pid`, we decrement a reference we never     incremented, can therefore free the init task's struct pid early. As there can be dangling references to     the struct pid, we can later encounter a use-after-free (e.g. when delivering signals). This was spotted     when fuzzing v5.13-rc3 with Syzkaller, but seems to have been around since the conversion of `cad_pid` to     struct pid in commit 9ec52099e4b8 ([PATCH] replace cad_pid by a struct pid) from the pre-KASAN stone age     of v2.6.19. Fix this by getting a reference to the init task's struct pid when we assign it to `cad_pid`.
    Full KASAN splat below. ================================================================== BUG: KASAN:
    use-after-free in ns_of_pid include/linux/pid.h:153 [inline] BUG: KASAN: use-after-free in     task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 Read of size 4 at addr ffff23794dda0004 by task syz-     executor.0/273 CPU: 1 PID: 273 Comm: syz-executor.0 Not tainted 5.12.0-00001-g9aef892b2d15 #1 Hardware     name: linux,dummy-virt (DT) Call trace: ns_of_pid include/linux/pid.h:153 [inline]     task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 do_notify_parent+0x308/0xe60 kernel/signal.c:1950     exit_notify kernel/exit.c:682 [inline] do_exit+0x2334/0x2bd0 kernel/exit.c:845 do_group_exit+0x108/0x2c8     kernel/exit.c:922 get_signal+0x4e4/0x2a88 kernel/signal.c:2781 do_signal arch/arm64/kernel/signal.c:882     [inline] do_notify_resume+0x300/0x970 arch/arm64/kernel/signal.c:936 work_pending+0xc/0x2dc Allocated by     task 0: slab_post_alloc_hook+0x50/0x5c0 mm/slab.h:516 slab_alloc_node mm/slub.c:2907 [inline] slab_alloc     mm/slub.c:2915 [inline] kmem_cache_alloc+0x1f4/0x4c0 mm/slub.c:2920 alloc_pid+0xdc/0xc00 kernel/pid.c:180     copy_process+0x2794/0x5e18 kernel/fork.c:2129 kernel_clone+0x194/0x13c8 kernel/fork.c:2500     kernel_thread+0xd4/0x110 kernel/fork.c:2552 rest_init+0x44/0x4a0 init/main.c:687     arch_call_rest_init+0x1c/0x28 start_kernel+0x520/0x554 init/main.c:1064 0x0 Freed by task 270:
    slab_free_hook mm/slub.c:1562 [inline] slab_free_freelist_hook+0x98/0x260 mm/slub.c:1600 slab_free     mm/slub.c:3161 [inline] kmem_cache_free+0x224/0x8e0 mm/slub.c:3177 put_pid.part.4+0xe0/0x1a8     kernel/pid.c:114 put_pid+0x30/0x48 kernel/pid.c:109 proc_do_cad_pid+0x190/0x1b0 kernel/sysctl.c:1401     proc_sys_call_handler+0x338/0x4b0 fs/proc/proc_sysctl.c:591 proc_sys_write+0x34/0x48     fs/proc/proc_sysctl.c:617 call_write_iter include/linux/fs.h:1977 [inline] new_sync_write+0x3ac/0x510     fs/read_write.c:518 vfs_write fs/read_write.c:605 [inline] vfs_write+0x9c4/0x1018 fs/read_write.c:585     ksys_write+0x124/0x240 fs/read_write.c:658 __do_sys_write fs/read_write.c:670 [inline] __se_sys_write     fs/read_write.c:667 [inline] __arm64_sys_write+0x78/0xb0 fs/read_write.c:667 __invoke_syscall     arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall arch/arm64/kernel/syscall.c:49 [inline]     el0_svc_common.constprop.1+0x16c/0x388 arch/arm64/kernel/syscall.c:129 do_el0_svc+0xf8/0x150     arch/arm64/kernel/syscall.c:168 el0_svc+0x28/0x38 arch/arm64/kernel/entry-common.c:416     el0_sync_handler+0x134/0x180 arch/arm64/kernel/entry-common.c:432 el0_sync+0x154/0x180     arch/arm64/kernel/entry.S:701 The buggy address belongs to the object at ffff23794dda0000 which belongs to     the cache pid of size 224 The buggy address is located 4 bytes inside of 224-byte region [ff
    ---truncated--- (CVE-2021-47118)

  - In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Don't generate an interrupt     on bus reset Now that the i2c-i801 driver supports interrupts, setting the KILL bit in a attempt to     recover from a timed out transaction triggers an interrupt. Unfortunately, the interrupt handler     (i801_isr) is not prepared for this situation and will try to process the interrupt as if it was signaling     the end of a successful transaction. In the case of a block transaction, this can result in an out-of-     range memory access. This condition was reproduced several times by syzbot:
    https://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e     https://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e     https://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e     https://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb     https://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a     https://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79 So disable interrupts while trying to reset     the bus. Interrupts will be enabled again for the following transaction. (CVE-2021-47153)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITE_SAME No Data     Buffer crash In newer version of the SBC specs, we have a NDOB bit that indicates there is no data buffer     that gets written out. If this bit is set using commands like sg_write_same --ndob we will crash in     target_core_iblock/file's execute_write_same handlers when we go to access the se_cmd->t_data_sg because     its NULL. This patch adds a check for the NDOB bit in the common WRITE SAME code because we don't support     it. And, it adds a check for zero SG elements in each handler in case the initiator tries to send a normal     WRITE SAME with no data buffer. (CVE-2022-21546)

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: IPoIB, Block PKEY     interfaces with less rx queues than parent A user is able to configure an arbitrary number of rx queues     when creating an interface via netlink. This doesn't work for child PKEY interfaces because the child     interface uses the parent receive channels. Although the child shares the parent's receive channels, the     number of rx queues is important for the channel_stats array: the parent's rx channel index is used to     access the child's channel_stats. So the array has to be at least as large as the parent's rx queue size     for the counting to work correctly and to prevent out of bound accesses. This patch checks for the     mentioned scenario and returns an error when trying to create the interface. The error is propagated to     the user. (CVE-2022-48883)

  - In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix potential out of bounds     access with invalid rxstatus->rs_keyix The rxstatus->rs_keyix eventually gets passed to test_bit() so we     need to ensure that it is within the bitmap. drivers/net/wireless/ath/ath9k/common.c:46     ath9k_cmn_rx_accept() error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()' (CVE-2022-49503)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
265107	EulerOS Virtualization 2.13.0 : kernel (EulerOS-SA-2025-2169)	Nessus	Huawei Local Security Checks	9/16/2025	9/16/2025	high
168728	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2022-024 (ALASKERNEL-5.10-2022-024)	Nessus	Amazon Linux Local Security Checks	12/14/2022	6/4/2026	high
361173	CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1771078945)	Nessus	CentOS Local Security Checks	10/1/2026	10/1/2026	high

Detections

Analytics

Plugins Search

high

high

high