The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1742806909 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: asix: fix uninit-value in     asix_mdio_read() asix_read_cmd() may read less than sizeof(smsr) bytes and in this case smsr will be     uninitialized. Fail log: BUG: KMSAN: uninit-value in asix_check_host_enable     drivers/net/usb/asix_common.c:82 [inline] BUG: KMSAN: uninit-value in asix_check_host_enable     drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497 BUG: KMSAN: uninit-value in     asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497     asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] asix_check_host_enable     drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497 asix_mdio_read+0x3c1/0xb00     drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497 (CVE-2021-47101)

  - In the Linux kernel, the following vulnerability has been resolved: vt_ioctl: fix array_index_nospec in     vt_setactivate array_index_nospec ensures that an out-of-bounds value is set to zero on the transient     path. Decreasing the value by one afterwards causes a transient integer underflow. vsa.console should be     decreased first and then sanitized with array_index_nospec. Kasper Acknowledgements: Jakob Koschel, Brian     Johannesmeyer, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida from the VUSec group at VU Amsterdam.
    (CVE-2022-48804)

  - In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) fix pci device     refcount leak in nv1a_ram_new() As comment of pci_get_domain_bus_and_slot() says, it returns a pci device     with refcount increment, when finish using it, the caller must decrement the reference count by calling     pci_dev_put(). So call it after using to avoid refcount leak. (CVE-2022-49011)

  - In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Add alignment check     for event ring read pointer Though we do check the event ring read pointer by is_valid_ring_ptr to make     sure it is in the buffer range, but there is another risk the pointer may be not aligned. Since we are     expecting event ring elements are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer     could lead to multiple issues like DoS or ring buffer memory corruption. So add a alignment check for     event ring read pointer. (CVE-2023-52494)

  - In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not attempt to read     past commit When iterating over the ring buffer while the ring buffer is active, the writer can corrupt     the reader. There's barriers to help detect this and handle it, but that code missed the case where the     last event was at the very end of the page and has only 4 bytes left. The checks to detect the corruption     by the writer to reads needs to see the length of the event. If the length in the first 4 bytes is zero     then the length is stored in the second 4 bytes. But if the writer is in the process of updating that     code, there's a small window where the length in the first 4 bytes could be zero even though the length is     only 4 bytes. That will cause rb_event_length() to read the next 4 bytes which could happen to be off the     allocated page. To protect against this, fail immediately if the next event pointer is less than 8 bytes     from the end of the commit (last byte of data), as all events must be a minimum of 8 bytes anyway.
    (CVE-2023-52501)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-461 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    lib/generic-radix-tree.c: Don't overflow in peek() (CVE-2021-47432)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (CVE-2023-52752)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix potential deadlock when releasing mids (CVE-2023-52757)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-blk: fix implicit overflow on virtio_max_dma_size (CVE-2023-52762)

    In the Linux kernel, the following vulnerability has been resolved:

    i3c: master: mipi-i3c-hci: Fix a kernel panic for accessing DAT_data. (CVE-2023-52763)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: fix use-after-free in unix_stream_read_actor() (CVE-2023-52772)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: deal with large GSO size (CVE-2023-52778)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (CVE-2023-52781)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: stop the device in bond_setup_by_slave() (CVE-2023-52784)

    In the Linux kernel, the following vulnerability has been resolved:

    i915/perf: Fix NULL deref bugs with drm_dbg() calls (CVE-2023-52788)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: Run atomic i2c xfer when !preemptible (CVE-2023-52791)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvlan: add ipvlan_route_v6_outbound() helper (CVE-2023-52796)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (CVE-2023-52803)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: pcrypt - Fix hungtask for PADATA_RESET (CVE-2023-52813)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Detect IP == ksym.end as part of BPF program (CVE-2023-52828)

    In the Linux kernel, the following vulnerability has been resolved:

    cpu/hotplug: Don't offline the last non-isolated CPU (CVE-2023-52831)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: fix uaf in nbd_open (CVE-2023-52837)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() (CVE-2023-52840)

    In the Linux kernel, the following vulnerability has been resolved:

    llc: verify mac len before reading mac header (CVE-2023-52843)

    In the Linux kernel, the following vulnerability has been resolved:

    hsr: Prevent use after free in prp_create_tagged_frame() (CVE-2023-52846)

    In the Linux kernel, the following vulnerability has been resolved:

    padata: Fix refcnt handling in padata_free_shell() (CVE-2023-52854)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: hisi: Fix use-after-free when register pmu fails (CVE-2023-52859)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process     (CVE-2023-52860)

    In the Linux kernel, the following vulnerability has been resolved:

    platform/x86: wmi: Fix opening of char device (CVE-2023-52864)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal: core: prevent potential string overflow (CVE-2023-52868)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore/platform: Add check for kstrdup (CVE-2023-52869)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Have trace_event_file have ref counters (CVE-2023-52879)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    The function nft_trans_gc_catchall did not remove the catchall set element from the catchall_list when the     argument sync is true, making it possible to free a catchall set element many times.

    We recommend upgrading past commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630. (CVE-2023-6111)

    A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in     nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to     trigger a denial of service. (CVE-2023-6622)

    A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation.

    A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object     which is freed by another thread.

    We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

    A use-after-free issue was found in igmp_start_timer in net/ipv4/igmp.c in the network sub-component in     the Linux Kernel. This flaw allows a local user to observe a refcnt use-after-free issue when receiving an     igmp query packet, leading to a kernel information leak. (CVE-2024-0584)

    netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() (CVE-2024-0607)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Red Hat Enterprise Linux - kernel: perf: hisi: Fix use-after-free when register pmu fails  Ubuntu Linux -     In the Linux kernel, the following vulnerability has been resolved: perf: hisi: Fix use-after-free when     register pmu fails When we fail to register the uncore pmu, the pmu context may not been allocated. The     error handing will call cpuhp_state_remove_instance() to call uncore pmu offline callback, which migrate     the pmu context. Since that's liable to lead to some kind of use-after-free. Use     cpuhp_state_remove_instance_nocalls() instead of cpuhp_state_remove_instance() so that the notifiers don't     execute after the PMU device has been failed to register. (CVE-2023-52859)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3483-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-44947: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454).
    - CVE-2024-36936: Touch soft lockup during memory accept (bsc#1225773).
    - CVE-2022-48706: Do proper cleanup if IFCVF init fails (bsc#1225524).
    - CVE-2024-43883: Do not drop references before new references are gained (bsc#1229707).
    - CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
    - CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229500).
    - CVE-2024-36270: Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch     (bsc#1226798)
    - CVE-2023-52489: Fix race in accessing memory_section->usage (bsc#1221326).
    - CVE-2024-43893: Check uartclk for zero to avoid divide by zero (bsc#1229759).
    - CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).
    - CVE-2024-43900: Avoid use-after-free in load_firmware_cb() (bsc#1229756).
    - CVE-2024-44938: Fix shift-out-of-bounds in dbDiscardAG (bsc#1229792).
    - CVE-2024-44939: Fix null ptr deref in dtInsertEntry (bsc#1229820).
    - CVE-2024-41087: Fix double free on error (CVE-2024-41087,bsc#1228466).
    - CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
    - CVE-2024-43902: Add null checker before passing variables (bsc#1229767).
    - CVE-2024-43904: Add null checks for 'stream' and 'plane' before dereferencing (bsc#1229768)
    - CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).
    - CVE-2024-43884: Add error handling to pair_device() (bsc#1229739)
    - CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
    - CVE-2022-48920: Get rid of warning on transaction commit when using flushoncommit (bsc#1229658).
    - CVE-2023-52906: Fix warning during failed attribute validation (bsc#1229527).
    - CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
    - CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
    - CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).
    - CVE-2022-48912: Fix use-after-free in __nf_register_net_hook() (bsc#1229641)
    - CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).
    - CVE-2022-48906: Correctly set DATA_FIN timeout when number of retransmits is large (bsc#1229605)
    - CVE-2024-42155: Wipe copies of protected- and secure-keys (bsc#1228733).
    - CVE-2024-42156: Wipe copies of clear-key structures on failure (bsc#1228722).
    - CVE-2023-52899: Add exception protection processing for vd in axi_chan_handle_err function     (bsc#1229569).
    - CVE-2024-42158: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).
    - CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
    - CVE-2024-43873: Always initialize seqpacket_allow (bsc#1229488)
    - CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
    - CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
    - CVE-2021-47106: Fix use-after-free in nft_set_catchall_destroy() (bsc#1220962)
    - CVE-2021-47517: Fix panic when interrupt coaleceing is set via ethtool (bsc#1225428).
    - CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)
    - CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
    - CVE-2024-27079: Fix NULL domain on device release (bsc#1223742).
    - CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).
    - CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).
    - CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
    - CVE-2024-43819: Reject memory region operations for ucontrol VMs (bsc#1229290 git-fixes).
    - CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
    - CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).
    - CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
    - CVE-2024-27016: Validate pppoe header (bsc#1223807).
    - CVE-2024-35945: Prevent nullptr exceptions on ISR (bsc#1224639).
    - CVE-2023-52581: Fix memleak when more than 255 elements expired (bsc#1220877).
    - CVE-2024-36013: Fix slab-use-after-free in l2cap_connect() (bsc#1225578).
    - CVE-2024-43837: Fix updating attached freplace prog in prog_array map (bsc#1229297).
    - CVE-2024-42291: Add a per-VF limit on number of FDIR filters (bsc#1229374).
    - CVE-2024-42268: Fix missing lock on sync reset reload (bsc#1229391).
    - CVE-2024-43834: Fix invalid wait context of page_pool_destroy() (bsc#1229314)
    - CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
    - CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)
    - CVE-2024-42157: Wipe sensitive data on failure (bsc#1228727 CVE-2024-42157 git-fixes).
    - CVE-2024-26677: Blacklist e7870cf13d20 (' Fix delayed ACKs to not set the reference serial number')     (bsc#1222387)
    - CVE-2024-36009: Blacklist 467324bcfe1a ('ax25: Fix netdev refcount issue') (bsc#1224542)
    - CVE-2023-52859: Fix use-after-free when register pmu fails (bsc#1225582).
    - CVE-2024-42280: Fix a use after free in hfcmulti_tx() (bsc#1229388)
    - CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
    - CVE-2024-42283: Initialize all fields in dumped nexthops (bsc#1229383)
    - CVE-2024-42312: Always initialize i_uid/i_gid (bsc#1229357)
    - CVE-2024-43854: Initialize integrity buffer to zero before writing it to media (bsc#1229345)
    - CVE-2024-42322: Properly dereference pe in ip_vs_add_service (bsc#1229347)
    - CVE-2024-42308: Update DRM patch reference (bsc#1229411)
    - CVE-2024-42301: Fix the array out-of-bounds risk (bsc#1229407).
    - CVE-2024-42318: Do not lose track of restrictions on cred_transfer (bsc#1229351).
    - CVE-2024-26669: Fix chain template offload (bsc#1222350).
    - CVE-2023-52889: Fix null pointer deref when receiving skb during sock creation (bsc#1229287,).
    - CVE-2022-48645: Move enetc_set_psfp() out of the common enetc_set_features() (bsc#1223508).
    - CVE-2024-41007: Use signed arithmetic in tcp_rtx_probe0_timed_out() (bsc#1227863).
    - CVE-2024-36933: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (bsc#1225832).
    - CVE-2024-42295: Handle inconsistent state in nilfs_btnode_create_block() (bsc#1229370).
    - CVE-2024-42319: Move devm_mbox_controller_register() after devm_pm_runtime_enable() (bsc#1229350).
    - CVE-2024-43860: Skip over memory region when node value is NULL (bsc#1229319).
    - CVE-2024-43831: Handle invalid decoder vsi (bsc#1229309).
    - CVE-2024-43849: Protect locator_addr with the main mutex (bsc#1229307).
    - CVE-2024-43841: Do not use strlen() in const context (bsc#1229304).
    - CVE-2024-43839: Adjust 'name' buf size of bna_tcb and bna_ccb structures (bsc#1229301).
    - CVE-2024-41088: Fix infinite loop when xmit fails (bsc#1228469).
    - CVE-2024-42281: Fix a segment issue when downgrading gso_size (bsc#1229386).
    - CVE-2024-42271: Fixed a use after free in iucv_sock_close(). (bsc#1229400)
    - CVE-2024-41080: Fix possible deadlock in io_register_iowq_max_workers() (bsc#1228616).
    - CVE-2024-42246: Remap EPERM in case of connection failure in xs_tcp_setup_socket (bsc#1228989).
    - CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)
    - CVE-2024-26735: Fix possible use-after-free and null-ptr-deref (bsc#1222372).
    - CVE-2024-42106: Initialize pad field in struct inet_diag_req_v2 (bsc#1228493).
    - CVE-2024-38662: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).
    - CVE-2024-42110: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (bsc#1228501).
    - CVE-2024-42247: Avoid unaligned 64-bit memory accesses (bsc#1228988).
    - CVE-2022-48865: Fix kernel panic when enabling bearer (bsc#1228065).
    - CVE-2023-52498: Fix possible deadlocks in core system-wide PM code (bsc#1221269).
    - CVE-2024-41068: Fix sclp_init() cleanup on failure (bsc#1228579).
    - CVE-2022-48808: Fix panic when DSA master device unbinds on shutdown (bsc#1227958).
    - CVE-2024-42095: Fix Errata i2310 with RX FIFO level check (bsc#1228446).
    - CVE-2024-40978: Fix crash while reading debugfs attribute (bsc#1227929).
    - CVE-2024-42107: Do not process extts if PTP is disabled (bsc#1228494).
    - CVE-2024-42139: Fix improper extts handling (bsc#1228503).
    - CVE-2024-42148: Fix multiple UBSAN array-index-out-of-bounds (bsc#1228487).
    - CVE-2024-42142: E-switch, Create ingress ACL when needed (bsc#1228491).
    - CVE-2024-42162: Account for stopped queues when reading NIC stats (bsc#1228706).
    - CVE-2024-42082: Remove WARN() from __xdp_reg_mem_model() (bsc#1228482).
    - CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).
    - CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local     privilege escalation (bsc#1213580).
    - CVE-2024-42228: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (bsc#1228667).
    - CVE-2024-40995: Fix possible infinite loop in tcf_idr_check_alloc() (bsc#1227830).
    - CVE-2024-38602: Merge repeat codes in ax25_dev_device_down() (git-fixes CVE-2024-38602 bsc#1226613).
    - CVE-2024-38554: Fix reference count leak issue of net_device (bsc#1226742).
    - CVE-2024-36929: Reject skb_copy(_expand) for fraglist GSO skbs (bsc#1225814).
    - CVE-2024-41009: Fix overrunning reservations in ringbuf (bsc#1228020).
    - CVE-2024-27024: Fix WARNING in rds_conn_connect_if_down (bsc#1223777).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

ID	Name	Product	Family	Published	Updated	Severity
361511	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1742806909)	Nessus	Alma Linux Local Security Checks	10/1/2026	10/1/2026	high
186974	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-461)	Nessus	Amazon Linux Local Security Checks	12/15/2023	2/24/2026	high
208330	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2024-2544)	Nessus	Huawei Local Security Checks	10/9/2024	1/6/2026	high
208351	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2024-2519)	Nessus	Huawei Local Security Checks	10/9/2024	1/6/2026	high
227267	Linux Distros Unpatched Vulnerability : CVE-2023-52859	Nessus	Misc.	3/5/2025	9/30/2026	high
207884	SUSE SLED15: cluster-md-kmp-64kb / cluster-md-kmp-default / dlm-kmp-64kb / etc (SUSE-SU-2024:3483-1)	Nessus	SuSE Local Security Checks	9/28/2024	6/26/2026	high
204441	Photon OS 5.0: Linux PHSA-2024-5.0-0187	Nessus	PhotonOS Local Security Checks	7/24/2024	10/13/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high