The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0724 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

    * kernel: improper input validation may lead to privilege escalation (CVE-2021-4204)

    * kernel: memory leak for large arguments in video_usercopy function in     drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)

    * kernel: eBPF verification flaw (CVE-2021-34866)

    * kernel: smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)

    * kernel: Linux ebpf logic vulnerability leads to critical memory read and write gaining root privileges     (CVE-2022-0500)

    * kernel: NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

    * kernel: possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)

    * kernel: buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

    * kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation     (CVE-2022-2586)

    * kernel: netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)

    * kernel: memory leak in ipv6_renew_options() (CVE-2022-3524)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)

    * kernel: memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)

    * kernel: denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)

    * kernel: Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed     (CVE-2022-3707)

    * kernel: possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

    * kernel: local privileges escalation in kernel/bpf/verifier.c (CVE-2022-23222)

    * kernel: Executable Space Protection Bypass (CVE-2022-25265)

    * kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)

    * kernel: double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6385-1 advisory.

    It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute     instructions using a return address from a sibling thread. A local attacker could possibly use this to     expose sensitive information. (CVE-2022-27672)

    William Zhao discovered that the Traffic Control (TC) subsystem in the Linux kernel did not properly     handle network packet retransmission in certain situations. A local attacker could use this to cause a     denial of service (kernel deadlock). (CVE-2022-4269)

    Jordy Zomer and Alexandra Sandulescu discovered that syscalls invoking the do_prlimit() function in the     Linux kernel did not properly handle speculative execution barriers. A local attacker could use this to     expose sensitive information (kernel memory). (CVE-2023-0458)

    It was discovered that the TLS subsystem in the Linux kernel contained a type confusion vulnerability in     some situations. A local attacker could use this to cause a denial of service (system crash) or possibly     expose sensitive information. (CVE-2023-1075)

    It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A     local attacker could use this to cause a denial of service (system crash). (CVE-2023-1076, CVE-2023-4194)

    It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash     collisions in connection lookup table. A remote attacker could use this to cause a denial of service     (excessive CPU consumption). (CVE-2023-1206)

    It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform     data buffer size validation in some situations. A physically proximate attacker could use this to craft a     malicious USB device that when inserted, could cause a denial of service (system crash) or possibly expose     sensitive information. (CVE-2023-1380)

    It was discovered that a race condition existed in the btrfs file system implementation in the Linux     kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly expose sensitive information. (CVE-2023-1611)

    Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions     checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of     service (bluetooth communication). (CVE-2023-2002)

    Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain     vector register instructions. A local attacker could use this to expose sensitive information.
    (CVE-2023-20593)

    It was discovered that a use-after-free vulnerability existed in the iSCSI TCP implementation in the Linux     kernel. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2023-2162)

    Juan Jose Lopez Jaimez, Meador Inge, Simon Scannell, and Nenad Stojanovski discovered that the BPF     verifier in the Linux kernel did not properly mark registers for precision tracking in certain situations,     leading to an out- of-bounds access vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-2163)

    It was discovered that the perf subsystem in the Linux kernel contained a use-after-free vulnerability. A     privileged local attacker could possibly use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-2235)

    Zheng Zhang discovered that the device-mapper implementation in the Linux kernel did not properly handle     locking during table_clear() operations. A local attacker could use this to cause a denial of service     (kernel deadlock). (CVE-2023-2269)

    Wei Chen discovered that the DVB USB AZ6027 driver in the Linux kernel contained a null pointer     dereference when handling certain messages from user space. A local attacker could use this to cause a     denial of service (system crash). (CVE-2023-28328)

    It was discovered that a race condition existed in the TLS subsystem in the Linux kernel, leading to a     use-after-free or a null pointer dereference vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-28466)

    It was discovered that a race condition existed in the f2fs file system in the Linux kernel, leading to a     null pointer dereference vulnerability. An attacker could use this to construct a malicious f2fs image     that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2023-2898)

    It was discovered that the IP-VLAN network driver for the Linux kernel did not properly initialize memory     in some situations, leading to an out-of- bounds write vulnerability. An attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3090)

    It was discovered that the Ricoh R5C592 MemoryStick card reader driver in the Linux kernel contained a     race condition during module unload, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3141)

    Gwangun Jung discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel     contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-31436)

    It was discovered that the Qualcomm MSM DPU driver in the Linux kernel did not properly validate memory     allocations in certain situations, leading to a null pointer dereference vulnerability. A local attacker     could use this to cause a denial of service (system crash). (CVE-2023-3220)

    It was discovered that the NET/ROM protocol implementation in the Linux kernel contained a race condition     in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32269)

    It was discovered that the netfilter subsystem in the Linux kernel did not properly handle some error     conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-3390)

    It was discovered that the universal 32bit network packet classifier implementation in the Linux kernel     did not properly perform reference counting in some situations, leading to a use-after-free vulnerability.
    A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2023-3609)

    It was discovered that the netfilter subsystem in the Linux kernel did not properly handle certain error     conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-3610)

    It was discovered that the Quick Fair Queueing network scheduler implementation in the Linux kernel     contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-3611)

    It was discovered that the network packet classifier with netfilter/firewall marks implementation in the     Linux kernel did not properly handle reference counting, leading to a use-after-free vulnerability. A     local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2023-3776)

    Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle table rules     flush in certain circumstances. A local attacker could possibly use this to cause a denial of service     (system crash) or execute arbitrary code. (CVE-2023-3777)

    It was discovered that the NFC implementation in the Linux kernel contained a use-after-free vulnerability     when performing peer-to-peer communication in certain conditions. A privileged attacker could use this to     cause a denial of service (system crash) or possibly expose sensitive information (kernel memory).
    (CVE-2023-3863)

    Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle rule     additions to bound chains in certain circumstances. A local attacker could possibly use this to cause a     denial of service (system crash) or execute arbitrary code. (CVE-2023-3995)

    It was discovered that the netfilter subsystem in the Linux kernel did not properly handle PIPAPO element     removal, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a     denial of service (system crash) or execute arbitrary code. (CVE-2023-4004)

    Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle bound chain     deactivation in certain circumstances. A local attacker could possibly use this to cause a denial of     service (system crash) or execute arbitrary code. (CVE-2023-4015)

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle L2CAP socket     release, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-40283)

    It was discovered that some network classifier implementations in the Linux kernel contained use-after-     free vulnerabilities. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2023-4128)

    Maxim Suhanov discovered that the exFAT file system implementation in the Linux kernel did not properly     check a file name length, leading to an out- of-bounds write vulnerability. An attacker could use this to     construct a malicious exFAT image that, when mounted and operated on, could cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-4273)

    Lonial Con discovered that the netfilter subsystem in the Linux kernel contained a memory leak when     handling certain element flush operations. A local attacker could use this to expose sensitive information     (kernel memory). (CVE-2023-4569)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-7313:32 advisory.

    * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)
      * kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-3611, CVE-2023-4128,     CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)
      * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)
      * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975)
      * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)
      * kernel: use after free flaw in l2cap_conn_del (CVE-2022-3640)
      * kernel: double free in usb_8dev_start_xmit (CVE-2022-28388)
      * kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951,     CVE-2023-33952)
      * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)
      * kernel: Information leak in l2cap_parse_conf_req (CVE-2022-42895)
      * kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456)
      * kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887)
      * kernel: speculative pointer dereference in do_prlimit (CVE-2023-0458)
      * kernel: use-after-free due to race condition in qdisc_graft (CVE-2023-0590)
      * kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597)
      * kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073)
      * kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)
      * kernel: hid: Use After Free in asus_remove (CVE-2023-1079)
      * kernel: use-after-free in drivers/media/rc/ene_ir.c (CVE-2023-1118)
      * kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206)
      * kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252)
      * kernel: denial of service in tipc_conn_close (CVE-2023-1382)
      * kernel: Use after free bug in btsdio_remove due to race condition (CVE-2023-1989)
      * kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)
      * kernel: ext4: use-after-free in ext4_xattr_set_entry (CVE-2023-2513)
      * kernel: fbcon: shift-out-of-bounds in fbcon_set_font (CVE-2023-3161)
      * kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)
      * kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params (CVE-2023-3772)
      * kernel: smsusb: use-after-free caused by do_submit_urb (CVE-2023-4132)
      * kernel: Race between task migrating pages and another task calling exit_mmap (CVE-2023-4732)
      * Kernel: denial of service in atm_tc_enqueue due to type confusion (CVE-2023-23455)
      * kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)
      * kernel: Denial of service issue in az6027 driver (CVE-2023-28328)
      * kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)
      * kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible (CVE-2023-31084)
      * kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove (CVE-2023-33203)
      * kernel: saa7134: race condition leading to use-after-free in saa7134_finidev (CVE-2023-35823)
      * kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c (CVE-2023-35824)
      * kernel: r592: race condition leading to use-after-free in r592_remove (CVE-2023-35825)
      * kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075)
      * kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)
      * kernel: Use after free bug in r592_remove (CVE-2023-3141)
      * kernel: gfs2: NULL pointer dereference in gfs2_evict_inode (CVE-2023-3212)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1848-1 advisory.

    The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
    - CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
    - CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in     infiniband RDMA (bsc#1209778).
    - CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due     to SO_PEERCRED and SO_PEERGROUPS race with listen() (bsc#1194535).
    - CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create     of l2tp_ppp.c (bsc#1208850).
    - CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel     which could lead to system crash (bsc#1207168).
    - CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
    - CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
    - CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
    - CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
    - CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
    - CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to     userspace, causing an information leak (bsc#1209532).
    - CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
    - CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type     confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid     classification results) (bsc#1207125).
    - CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c     (bsc#1209291).
    - CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in     net/bluetooth/hci_conn.c (bsc#1209052).
    - CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03615-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
    - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
    - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
    - CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
    - CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
    - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
    - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
    - CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
    - CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
    - CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree     (bsc#1248255).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
    - CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
    - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
    - CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
    - CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
    - CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
190110	RHEL 8 : kernel (RHSA-2024:0724)	Nessus	Red Hat Local Security Checks	2/7/2024	9/25/2025	high
181636	Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerabilities (USN-6385-1)	Nessus	Ubuntu Local Security Checks	9/19/2023	9/24/2025	high
292841	MiracleLinux 8 : kernel-4.18.0-513.5.1.el8_9 (AXSA:2023-7313:32)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high
174373	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2023:1848-1)	Nessus	SuSE Local Security Checks	4/15/2023	6/25/2026	high
270837	SUSE SLES15 : Security update for the Linux Kernel (SUSE-SU-2025:03615-1)	Nessus	SuSE Local Security Checks	10/21/2025	9/29/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high