According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    x86/mce: Work around an erratum on fast string copy instructions(CVE-2022-49124)

    net: preserve skb_end_offset() in skb_unclone_keeptruesize()(CVE-2022-49142)

    scsi: qla2xxx: Fix premature hw access after PCI error(CVE-2022-49157)

    scsi: qla2xxx: Fix warning message due to adisc being flushed(CVE-2022-49158)

    scsi: qla2xxx: Implement ref count for SRB(CVE-2022-49159)

    USB: core: Prevent nested device-reset calls(CVE-2022-49936)

    mmc: vub300: fix return value check of mmc_add_host()(CVE-2022-50251)

    tracing: Fix reading strings from synthetic events(CVE-2022-50255)

    kprobes: Fix check for probe enabled in kill_kprobe()(CVE-2022-50266)

    mmc: rtsx_pci: fix return value check of mmc_add_host()(CVE-2022-50267)

    pnode: terminate at peers of source(CVE-2022-50280)

    ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline(CVE-2022-50286)

    ext4: fix potential out of bound read in ext4_fc_replay_scan()(CVE-2022-50306)

    drivers: serial: jsm: fix some leaks in probe(CVE-2022-50312)

    erofs: fix order = MAX_ORDER warning due to crafted negative i_size(CVE-2022-50313)

    ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS(CVE-2022-50315)

    perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox()(CVE-2022-50318)

    net: do not sense pfmemalloc status in skb_append_pagefrags()(CVE-2022-50323)

    jbd2: fix potential use-after-free in jbd2_fc_wait_bufs(CVE-2022-50328)

    crypto: cavium - prevent integer overflow loading firmware(CVE-2022-50330)

    ext4: fix null-ptr-deref in ext4_write_info(CVE-2022-50344)

    ext4: init quota for 'old.inode' in 'ext4_rename'(CVE-2022-50346)

    scsi: target: iscsi: Fix a race condition between login_work and the login thread(CVE-2022-50350)

    Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering     Authority.(CVE-2022-50377)

    padata: Always leave BHs disabled when running -parallel()(CVE-2022-50382)

    nvme: fix multipath crash caused by flush request when blktrace is enabled(CVE-2022-50388)

    tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak(CVE-2022-50389)

    drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED(CVE-2022-50390)

    i2c: ismt: Fix an out-of-bounds bug in ismt_access()(CVE-2022-50394)

    ACPICA: Fix error code path in acpi_ds_call_control_method()(CVE-2022-50411)

    x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly(CVE-2022-50425)

    mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING(CVE-2022-50430)

    drm/vmwgfx: Validate the box size for the snooped cursor(CVE-2022-50440)

    cpufreq: Init completion before kobject_init_and_add()(CVE-2022-50473)

    ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode(CVE-2022-50485)

    scsi: qla2xxx: Fix crash when I/O abort times out(CVE-2022-50493)

    binfmt_misc: fix shift-out-of-bounds in check_special_flags(CVE-2022-50497)

    perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()(CVE-2022-50510)

    tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'(CVE-2022-50553)

    ext4: avoid deadlock in fs reclaim with page writeback(CVE-2023-53149)

    tracing: Fix null pointer dereference in tracing_err_log_open()(CVE-2023-53167)

    vfio/type1: prevent underflow of locked_vm via exec()(CVE-2023-53171)

    serial: 8250: Reinit port-pm on port specific driver unbind(CVE-2023-53176)

    mm: fix zswap writeback race condition(CVE-2023-53178)

    sched/fair: Don't balance task to its current running CPU(CVE-2023-53215)

    arm64: efi: Make efi_rt_lock a raw_spinlock(CVE-2023-53216)

    media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()(CVE-2023-53220)

    bpf: Fix memleak due to fentry attach failure(CVE-2023-53221)

    thermal/drivers/hisi: Drop second sensor hi3660(CVE-2023-53242)

    firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle(CVE-2023-53250)

    VMCI: check context-notify_page after call to get_user_pages_fast() to avoid GPF(CVE-2023-53259)

    ext4: fix i_disksize exceeding i_size problem in paritally written case(CVE-2023-53270)

    scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue(CVE-2023-53280)

    ext4: add bounds checking in get_max_inline_xattr_value_size()(CVE-2023-53285)

    drm/client: Fix memory leak in drm_client_modeset_probe(CVE-2023-53288)

    ext4: fix WARNING in mb_find_extent(CVE-2023-53317)

    recordmcount: Fix memory leaks in the uwrite function(CVE-2023-53318)

    genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()(CVE-2023-53332)

    tracing: Fix race issue between cpu buffer write and swap(CVE-2023-53368)

    crypto: seqiv - Handle EBUSY correctly(CVE-2023-53373)

    tracing: Free error logs of tracing instances(CVE-2023-53375)

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer(CVE-2023-53395)

    mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()(CVE-2023-53401)

    blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()(CVE-2023-53421)

    media: uvcvideo: Handle cameras with invalid descriptors(CVE-2023-53437)

    bpf: cpumap: Fix memory leak in cpu_map_update_elem(CVE-2023-53441)

    ext4: remove a BUG_ON in ext4_mb_release_group_pa()(CVE-2023-53450)

    scsi: qla4xxx: Add length check when parsing nlattrs(CVE-2023-53456)

    kobject: Add sanity check for kset-kobj.ktype in kset_register()(CVE-2023-53480)

    ext4: allow ext4_get_group_info() to fail(CVE-2023-53503)

    udf: Do not bother merging very long extents(CVE-2023-53506)

    virtio-mmio: don't break lifecycle of vm_dev(CVE-2023-53515)

    scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()(CVE-2023-53521)

    scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()(CVE-2023-53530)

    tracing/histograms: Add histograms to hist_vars if they have referenced variables(CVE-2023-53560)

    null_blk: Always check queue mode setting from configfs(CVE-2023-53576)

    bpf, cpumap: Make sure kthread is running before map update returns(CVE-2023-53577)

    ring-buffer: Sync IRQ works before buffer destruction(CVE-2023-53587)

    ipmi_si: fix a memleak in try_smi_init()(CVE-2023-53611)

    ext4: fix possible double unlock when moving a directory(CVE-2023-53626)

    bnxt: avoid overflow in bnxt_get_nvram_directory()(CVE-2023-53661)

    ring-buffer: Fix deadloop issue on reading trace_pipe(CVE-2023-53668)

    A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D     cache, potentially resulting in the leakage of sensitive information across privileged     boundaries.(CVE-2024-36357)

    drm/dp_mst: Fix MST sideband message body length check(CVE-2024-56616)

    tls: stop recv() if initial process_rx_list gave us non-DATA(CVE-2024-58239)

    crypto: algif_hash - fix double free in hash_accept(CVE-2025-38079)

    thunderbolt: Do not double dequeue a configuration request(CVE-2025-38174)

    mm: fix uprobe pte be overwritten when expanding vma(CVE-2025-38207)

    scsi: lpfc: Use memcpy() for BIOS version(CVE-2025-38332)

    x86/sgx: Prevent attempts to reclaim poisoned pages(CVE-2025-38334)

    HID: core: do not bypass hid_hw_raw_request(CVE-2025-38494)

    clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns(CVE-2025-38499)

    bpf: Fix oob access in cgroup local storage(CVE-2025-38502)

    drm/sched: Increment job count before swapping tail spsc queue(CVE-2025-38515)

    pinctrl: qcom: msm: mark certain pins as invalid for interrupts(CVE-2025-38516)

    HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras(CVE-2025-38540)

    net/sched: Restrict conditions for adding duplicating netems to qdisc tree(CVE-2025-38553)

    crypto: ccp - Fix crash when rebind ccp device for ccp.ko(CVE-2025-38581)

    padata: Fix pd UAF once and for all(CVE-2025-38584)

    net: drop UFO packets in udp_rcv_segment()(CVE-2025-38622)

    regulator: core: fix NULL dereference on unbind due to stale coupling data(CVE-2025-38668)

    media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()(CVE-2025-38680)

    fbdev: Fix vmalloc out-of-bounds write in fast_imageblit(CVE-2025-38685)

    media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and     w7090p_tuner_read_serpar(CVE-2025-38693)

    scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure(CVE-2025-38695)

    ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr(CVE-2025-38701)

    x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper(CVE-2025-39681)

    tracing: Limit access to parser-buffer when trace_get_user failed(CVE-2025-39683)

    ftrace: Also allocate and copy hash for reading of filter files(CVE-2025-39689)

    fs/buffer: fix use-after-free when call bh_read() helper(CVE-2025-39691)

    serial: 8250: fix panic due to PSLVERR(CVE-2025-39724)

    rcu: Fix rcu_read_unlock() deadloop due to IRQ work(CVE-2025-39744)

    rcu: Protect -defer_qs_iw_pending from data race(CVE-2025-39749)

    usb: core: config: Prevent OOB read in SS endpoint companion parsing(CVE-2025-39760)

    jbd2: prevent softlockup in jbd2_log_do_checkpoint()(CVE-2025-39782)

    ftrace: Fix potential warning in trace_printk_seq during ftrace_dump(CVE-2025-39813)

    trace/fgraph: Fix the warning caused by missing unregister notifier(CVE-2025-39829)

    vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects(CVE-2025-39850)

    vxlan: Fix NPD when refreshing an FDB entry with a nexthop object(CVE-2025-39851)

    tee: fix NULL pointer dereference in tee_shm_put(CVE-2025-39865)

    fs: writeback: fix use-after-free in __mark_inode_dirty()(CVE-2025-39866)

    cgroup: split cgroup_destroy_wq into 3 workqueues(CVE-2025-39953)

    fbcon: fix integer overflow in fbcon_do_set_font(CVE-2025-39967)

    i40e: add max boundary check for VF filters(CVE-2025-39968)

    i40e: fix idx validation in config queues msg(CVE-2025-39971)

    i40e: add validation for ring_len param(CVE-2025-39973)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    x86/mce: Work around an erratum on fast string copy instructions(CVE-2022-49124)

    net: preserve skb_end_offset() in skb_unclone_keeptruesize()(CVE-2022-49142)

    scsi: qla2xxx: Fix premature hw access after PCI error(CVE-2022-49157)

    scsi: qla2xxx: Fix warning message due to adisc being flushed(CVE-2022-49158)

    scsi: qla2xxx: Implement ref count for SRB(CVE-2022-49159)

    USB: core: Prevent nested device-reset calls(CVE-2022-49936)

    mmc: vub300: fix return value check of mmc_add_host()(CVE-2022-50251)

    tracing: Fix reading strings from synthetic events(CVE-2022-50255)

    kprobes: Fix check for probe enabled in kill_kprobe()(CVE-2022-50266)

    mmc: rtsx_pci: fix return value check of mmc_add_host()(CVE-2022-50267)

    pnode: terminate at peers of source(CVE-2022-50280)

    ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline(CVE-2022-50286)

    ext4: fix potential out of bound read in ext4_fc_replay_scan()(CVE-2022-50306)

    drivers: serial: jsm: fix some leaks in probe(CVE-2022-50312)

    erofs: fix order = MAX_ORDER warning due to crafted negative i_size(CVE-2022-50313)

    ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS(CVE-2022-50315)

    perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox()(CVE-2022-50318)

    net: do not sense pfmemalloc status in skb_append_pagefrags()(CVE-2022-50323)

    jbd2: fix potential use-after-free in jbd2_fc_wait_bufs(CVE-2022-50328)

    crypto: cavium - prevent integer overflow loading firmware(CVE-2022-50330)

    ext4: fix null-ptr-deref in ext4_write_info(CVE-2022-50344)

    ext4: init quota for 'old.inode' in 'ext4_rename'(CVE-2022-50346)

    scsi: target: iscsi: Fix a race condition between login_work and the login thread(CVE-2022-50350)

    Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering     Authority.(CVE-2022-50377)

    padata: Always leave BHs disabled when running -parallel()(CVE-2022-50382)

    nvme: fix multipath crash caused by flush request when blktrace is enabled(CVE-2022-50388)

    tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak(CVE-2022-50389)

    drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED(CVE-2022-50390)

    i2c: ismt: Fix an out-of-bounds bug in ismt_access()(CVE-2022-50394)

    ACPICA: Fix error code path in acpi_ds_call_control_method()(CVE-2022-50411)

    x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly(CVE-2022-50425)

    mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING(CVE-2022-50430)

    drm/vmwgfx: Validate the box size for the snooped cursor(CVE-2022-50440)

    cpufreq: Init completion before kobject_init_and_add()(CVE-2022-50473)

    ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode(CVE-2022-50485)

    scsi: qla2xxx: Fix crash when I/O abort times out(CVE-2022-50493)

    binfmt_misc: fix shift-out-of-bounds in check_special_flags(CVE-2022-50497)

    perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()(CVE-2022-50510)

    tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'(CVE-2022-50553)

    ext4: avoid deadlock in fs reclaim with page writeback(CVE-2023-53149)

    tracing: Fix null pointer dereference in tracing_err_log_open()(CVE-2023-53167)

    vfio/type1: prevent underflow of locked_vm via exec()(CVE-2023-53171)

    serial: 8250: Reinit port-pm on port specific driver unbind(CVE-2023-53176)

    mm: fix zswap writeback race condition(CVE-2023-53178)

    sched/fair: Don't balance task to its current running CPU(CVE-2023-53215)

    arm64: efi: Make efi_rt_lock a raw_spinlock(CVE-2023-53216)

    media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()(CVE-2023-53220)

    bpf: Fix memleak due to fentry attach failure(CVE-2023-53221)

    thermal/drivers/hisi: Drop second sensor hi3660(CVE-2023-53242)

    firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle(CVE-2023-53250)

    VMCI: check context-notify_page after call to get_user_pages_fast() to avoid GPF(CVE-2023-53259)

    ext4: fix i_disksize exceeding i_size problem in paritally written case(CVE-2023-53270)

    scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue(CVE-2023-53280)

    ext4: add bounds checking in get_max_inline_xattr_value_size()(CVE-2023-53285)

    drm/client: Fix memory leak in drm_client_modeset_probe(CVE-2023-53288)

    ext4: fix WARNING in mb_find_extent(CVE-2023-53317)

    recordmcount: Fix memory leaks in the uwrite function(CVE-2023-53318)

    genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()(CVE-2023-53332)

    tracing: Fix race issue between cpu buffer write and swap(CVE-2023-53368)

    crypto: seqiv - Handle EBUSY correctly(CVE-2023-53373)

    tracing: Free error logs of tracing instances(CVE-2023-53375)

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer(CVE-2023-53395)

    mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()(CVE-2023-53401)

    blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()(CVE-2023-53421)

    media: uvcvideo: Handle cameras with invalid descriptors(CVE-2023-53437)

    bpf: cpumap: Fix memory leak in cpu_map_update_elem(CVE-2023-53441)

    ext4: remove a BUG_ON in ext4_mb_release_group_pa()(CVE-2023-53450)

    scsi: qla4xxx: Add length check when parsing nlattrs(CVE-2023-53456)

    kobject: Add sanity check for kset-kobj.ktype in kset_register()(CVE-2023-53480)

    ext4: allow ext4_get_group_info() to fail(CVE-2023-53503)

    udf: Do not bother merging very long extents(CVE-2023-53506)

    virtio-mmio: don't break lifecycle of vm_dev(CVE-2023-53515)

    scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()(CVE-2023-53521)

    scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()(CVE-2023-53530)

    tracing/histograms: Add histograms to hist_vars if they have referenced variables(CVE-2023-53560)

    null_blk: Always check queue mode setting from configfs(CVE-2023-53576)

    bpf, cpumap: Make sure kthread is running before map update returns(CVE-2023-53577)

    ring-buffer: Sync IRQ works before buffer destruction(CVE-2023-53587)

    ipmi_si: fix a memleak in try_smi_init()(CVE-2023-53611)

    ext4: fix possible double unlock when moving a directory(CVE-2023-53626)

    bnxt: avoid overflow in bnxt_get_nvram_directory()(CVE-2023-53661)

    ring-buffer: Fix deadloop issue on reading trace_pipe(CVE-2023-53668)

    A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D     cache, potentially resulting in the leakage of sensitive information across privileged     boundaries.(CVE-2024-36357)

    drm/dp_mst: Fix MST sideband message body length check(CVE-2024-56616)

    tls: stop recv() if initial process_rx_list gave us non-DATA(CVE-2024-58239)

    crypto: algif_hash - fix double free in hash_accept(CVE-2025-38079)

    thunderbolt: Do not double dequeue a configuration request(CVE-2025-38174)

    mm: fix uprobe pte be overwritten when expanding vma(CVE-2025-38207)

    scsi: lpfc: Use memcpy() for BIOS version(CVE-2025-38332)

    x86/sgx: Prevent attempts to reclaim poisoned pages(CVE-2025-38334)

    HID: core: do not bypass hid_hw_raw_request(CVE-2025-38494)

    clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns(CVE-2025-38499)

    bpf: Fix oob access in cgroup local storage(CVE-2025-38502)

    drm/sched: Increment job count before swapping tail spsc queue(CVE-2025-38515)

    pinctrl: qcom: msm: mark certain pins as invalid for interrupts(CVE-2025-38516)

    HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras(CVE-2025-38540)

    net/sched: Restrict conditions for adding duplicating netems to qdisc tree(CVE-2025-38553)

    crypto: ccp - Fix crash when rebind ccp device for ccp.ko(CVE-2025-38581)

    padata: Fix pd UAF once and for all(CVE-2025-38584)

    net: drop UFO packets in udp_rcv_segment()(CVE-2025-38622)

    regulator: core: fix NULL dereference on unbind due to stale coupling data(CVE-2025-38668)

    media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()(CVE-2025-38680)

    fbdev: Fix vmalloc out-of-bounds write in fast_imageblit(CVE-2025-38685)

    media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and     w7090p_tuner_read_serpar(CVE-2025-38693)

    scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure(CVE-2025-38695)

    ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr(CVE-2025-38701)

    x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper(CVE-2025-39681)

    tracing: Limit access to parser-buffer when trace_get_user failed(CVE-2025-39683)

    ftrace: Also allocate and copy hash for reading of filter files(CVE-2025-39689)

    fs/buffer: fix use-after-free when call bh_read() helper(CVE-2025-39691)

    serial: 8250: fix panic due to PSLVERR(CVE-2025-39724)

    rcu: Fix rcu_read_unlock() deadloop due to IRQ work(CVE-2025-39744)

    rcu: Protect -defer_qs_iw_pending from data race(CVE-2025-39749)

    usb: core: config: Prevent OOB read in SS endpoint companion parsing(CVE-2025-39760)

    jbd2: prevent softlockup in jbd2_log_do_checkpoint()(CVE-2025-39782)

    ftrace: Fix potential warning in trace_printk_seq during ftrace_dump(CVE-2025-39813)

    trace/fgraph: Fix the warning caused by missing unregister notifier(CVE-2025-39829)

    vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects(CVE-2025-39850)

    vxlan: Fix NPD when refreshing an FDB entry with a nexthop object(CVE-2025-39851)

    tee: fix NULL pointer dereference in tee_shm_put(CVE-2025-39865)

    fs: writeback: fix use-after-free in __mark_inode_dirty()(CVE-2025-39866)

    cgroup: split cgroup_destroy_wq into 3 workqueues(CVE-2025-39953)

    fbcon: fix integer overflow in fbcon_do_set_font(CVE-2025-39967)

    i40e: add max boundary check for VF filters(CVE-2025-39968)

    i40e: fix idx validation in config queues msg(CVE-2025-39971)

    i40e: add validation for ring_len param(CVE-2025-39973)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    cifs: Fix UAF in cifs_demultiplex_thread()(CVE-2023-52572)

    net: fix data-races around sk-sk_forward_alloc(CVE-2024-53124)

    quota: flush quota_release_work upon quota writeback(CVE-2024-56780)

    af_packet: avoid erroring out after sock_init_data() in packet_create()(CVE-2024-56606)

    net: defer final 'struct net' free in netns dismantle(CVE-2024-56658)

    netfilter: x_tables: fix LED ID check in led_tg_check()(CVE-2024-56650)

    mm: hugetlb: independent PMD page table shared count(CVE-2024-57883)

    NFSv4.0: Fix a use-after-free problem in the asynchronous open()(CVE-2024-53173)

    NFSD: Prevent NULL dereference in nfsd4_process_cb_update()(CVE-2024-53217)

    netfilter: conntrack: clamp maximum hashtable size to INT_MAX(CVE-2025-21648)

    vfio/platform: check the bounds of read/write syscalls(CVE-2025-21687)

    mm: fix unexpected zeroed page mapping with zram swap(CVE-2022-49052)

    ext4: fix race condition between ext4_write and ext4_convert_inline_data(CVE-2022-49414)

    block: Fix handling of offline queues in blk_mq_alloc_request_hctx()(CVE-2022-49720)

    scsi: libfc: Fix use after free in fc_exch_abts_resp()(CVE-2022-49114)

    nbd: don't allow reconnect after disconnect(CVE-2025-21731)

    md/bitmap: don't set sb values if can't pass sanity check(CVE-2022-49526)

    ARM: hisi: Add missing of_node_put after of_find_compatible_node(CVE-2022-49447)

    bpf, arm64: Clear prog-jited_len along prog-jited(CVE-2022-49341)

    extcon: Modify extcon device to be created after driver data is set(CVE-2022-49308)

    scsi: target: tcmu: Fix possible page UAF(CVE-2022-49053)

    drm/plane: Move range check for format_count earlier(CVE-2021-47659)

    trace_events_hist: add check for return value of 'create_hist_field'(CVE-2023-53005)

    tracing: Make sure trace_printk() can output as soon as it can be used(CVE-2023-53007)

    bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation(CVE-2023-53024)

    sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket(CVE-2024-53168)

    tracing/histograms: Fix memory leak problem(CVE-2022-49648)

    vrf: use RCU protection in l3mdev_l3_out()(CVE-2025-21791)

    net_sched: sch_sfq: don't allow 1 packet limit(CVE-2024-57996)

    net: sched: Disallow replacing of child qdisc from one parent to another(CVE-2025-21700)

    geneve: Fix use-after-free in geneve_find_dev().(CVE-2025-21858)

    macsec: fix UAF bug for real_dev(CVE-2022-49390)

    net: let net.core.dev_weight always be non-zero(CVE-2025-21806)

    net: mdio: unexport __init-annotated mdio_bus_init()(CVE-2022-49350)

    ip: Fix data-races around sysctl_ip_fwd_update_priority.(CVE-2022-49603)

    mmc: sdio: fix possible resource leaks in some error paths(CVE-2023-52730)

    ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()(CVE-2023-52997)

    pfifo_tail_enqueue: Drop new packet when sch-limit == 0(CVE-2025-21702)

    net/sched: act_skbmod: prevent kernel-infoleak(CVE-2024-35893)

    netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.(CVE-2023-53032)

    net: openvswitch: fix leak of nested actions(CVE-2022-49086)

    net: mdio: validate parameter addr in mdiobus_get_phy()(CVE-2023-53019)

    selinux: ignore unknown extended permissions(CVE-2024-57931)

    vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF(CVE-2023-52973)

    driver: base: fix UAF when driver_attach failed(CVE-2022-49385)

    scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()(CVE-2022-48758)

    sch_hfsc: make hfsc_qlen_notify() idempotent hfsc_qlen_notify() is not idempotent either and not friendly     to its callers, like fq_codel_dequeue().(CVE-2025-38177)

    ftrace: Fix UAF when lookup kallsym after ftrace disabled(CVE-2025-38346)

    net/sched: Always pass notifications when child class becomes empty(CVE-2025-38350)

    loop: Check for overflow while configuring loop(CVE-2022-49993)

    NFSv4/pnfs: Fix a use-after-free bug in open(CVE-2022-50072)

    rxrpc: Fix listen() setting the bar too high for the prealloc rings(CVE-2022-49450)

    ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl(CVE-2021-47634)

    media: uvcvideo: Fix double free in error path(CVE-2024-57980)

    scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI(CVE-2022-49535)

    dmaengine: Fix double increment of client_count in dma_chan_get()(CVE-2022-49753)

    memcg: fix soft lockup in the OOM process(CVE-2024-57977)

    firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle(CVE-2022-49370)

    dm raid: fix accesses beyond end of raid member array(CVE-2022-49674)

    nfsd: clear acl_access/acl_default after releasing them(CVE-2025-21796)

    Input: MT - limit max slots(CVE-2024-45008)

    ubi: ubi_create_volume: Fix use-after-free when volume creation failed(CVE-2022-49388)

    drivers: core: synchronize really_probe() and dev_uevent()(CVE-2024-39501)

    scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()(CVE-2022-49155)

    NFSD: prevent underflow in nfssvc_decode_writeargs()(CVE-2022-49280)

    dm integrity: fix memory corruption when tag_size is less than digest size(CVE-2022-49044)

    cpufreq: governor: Use kobject release() method to free dbs_data(CVE-2022-49513)

    virtio_console: eliminate anonymous module_init  module_exit(CVE-2022-49100)

    mm/khugepaged: fix -anon_vma race(CVE-2023-52935)

    tty: fix deadlock caused by calling printk() under tty_port-lock(CVE-2022-49441)

    tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()(CVE-2022-49307)

    dyndbg: fix old BUG_ON in control parser(CVE-2024-35947)

    ext4: fix OOB read when checking dotdot dir(CVE-2025-37785)

    arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array(CVE-2025-21785)

    net_sched: sch_sfq: move the limit validation(CVE-2025-37752)

    ext4: update s_journal_inum if it changes after journal replay(CVE-2023-53091)

    arp: use RCU protection in arp_xmit()(CVE-2025-21762)

    io_uring: prevent opcode speculation(CVE-2025-21863)

    jbd2: remove wrong sb-s_sequence check(CVE-2025-37839)

    udf: Fix a slab-out-of-bounds write bug in udf_find_entry()(CVE-2022-49846)

    udp: Fix memory accounting leak.(CVE-2025-22058)

    nvmet: avoid potential UAF in nvmet_req_complete()(CVE-2023-53116)

    ext4: fix off-by-one error in do_split(CVE-2025-23150)

    cgroup: Use separate src/dst nodes when preloading css_sets for migration(CVE-2022-49647)

    PM: hibernate: defer device probing when resuming from hibernation(CVE-2022-50202)

    video: fbdev: amba-clcd: Fix refcount leak bugs(CVE-2022-50109)

    mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()(CVE-2022-49787)

    capabilities: fix undefined behavior in bit shift for CAP_TO_MASK(CVE-2022-49870)

    tty: vt: initialize unicode screen buffer(CVE-2022-50222)

    ndisc: extend RCU protection in ndisc_send_skb()(CVE-2025-21760)

    ndisc: use RCU protection in ndisc_alloc_skb()(CVE-2025-21764)

    ata: libata-transport: fix double ata_host_put() in ata_tport_add()(CVE-2022-49826)

    proc: fix UAF in proc_get_inode()(CVE-2025-21999)

    vt: Clear selection before changing the font(CVE-2022-49948)

    module: ensure that kobject_put() is safe for module type kobjects(CVE-2025-37995)

    openvswitch: use RCU protection in ovs_vport_cmd_fill_info()(CVE-2025-21761)

    arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level(CVE-2022-49964)

    neighbour: use RCU protection in __neigh_notify()(CVE-2025-21763)

    ipv6: mcast: extend RCU protection in igmp6_send()(CVE-2025-21759)

    bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()(CVE-2022-49840)

    ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network(CVE-2022-49865)

    ftrace: Fix use-after-free for dynamic ftrace_ops(CVE-2022-49892)

    ipv6: fix WARNING in ip6_route_net_exit_late()(CVE-2022-49903)

    net: mdio: fix undefined behavior in bit shift for __mdiobus_register(CVE-2022-49907)

     ipvs: fix WARNING in ip_vs_app_net_cleanup() (CVE-2022-49917)

    ipvs: fix WARNING in __ip_vs_cleanup_batch()(CVE-2022-49918)

    net: sched: Fix use after free in red_enqueue()(CVE-2022-49921)

    drivers:md:fix a potential use-after-free bug(CVE-2022-50022)

    scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts(CVE-2022-50098)

    sched, cpuset: Fix dl_cpu_busy() panic due to empty cs-cpus_allowed(CVE-2022-50103)

    dm crypt: add cond_resched() to dmcrypt_write()(CVE-2023-53051)

    erspan: do not use skb_mac_header() in ndo_start_xmit()(CVE-2023-53053)

    net: usb: smsc95xx: Limit packet length to skb-len(CVE-2023-53062)

    qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info(CVE-2023-53066)

    net: tunnels: annotate lockless accesses to dev-needed_headroom(CVE-2023-53109)

    net: usb: smsc75xx: Limit packet length to skb-len(CVE-2023-53125)

    xfrm: state: fix out-of-bounds read during lookup(CVE-2024-57982)

    net: fix geneve_opt length integer overflow(CVE-2025-22055)

    sch_htb: make htb_qlen_notify() idempotent(CVE-2025-37932)

    sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()(CVE-2025-38000)

    dm: fix unconditional IO throttle caused by REQ_PREFLUSH(CVE-2025-38063)

    crypto: algif_hash - fix double free in hash_accept(CVE-2025-38079)

    net: ch9200: fix uninitialised access during mii_nway_restart(CVE-2025-38086)

    ipc: fix to protect IPCS lookups using RCU(CVE-2025-38212)

    ext4: inline: fix len overflow in ext4_prepare_inline_data(CVE-2025-38222)

    bpf: Fix WARN() in get_bpf_raw_tp_regs(CVE-2025-38285)

    fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()(CVE-2025-38312)

    jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()(CVE-2025-38337)

    ACPICA: Refuse to evaluate a method if arguments are missing(CVE-2025-38386)

    perf: Fix sample vs do_exit()(CVE-2025-38424)

    clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns(CVE-2025-38499)

    tracing: Fix race issue between cpu buffer write and swap(CVE-2023-53368)

    ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS(CVE-2022-50315)

    usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()(CVE-2022-50544)

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer(CVE-2023-53395)

    usb: net: sierra: check for no status endpoint(CVE-2025-38474)

    mtd: Fix device name leak when register device failed in add_mtd_device()(CVE-2022-50566)

    ext4: add bounds checking in get_max_inline_xattr_value_size()(CVE-2023-53285)

    posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()(CVE-2025-38352)

    tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak(CVE-2022-50389)

    scsi: qla4xxx: Add length check when parsing nlattrs(CVE-2023-53456)

    ext4: avoid deadlock in fs reclaim with page writeback(CVE-2023-53149)

    kobject: Add sanity check for kset-kobj.ktype in kset_register()(CVE-2023-53480)

    virtio-mmio: don't break lifecycle of vm_dev(CVE-2023-53515)

    PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free(CVE-2023-53446)

    tracing: Limit access to parser-buffer when trace_get_user failed(CVE-2025-39683)

    binfmt_misc: fix shift-out-of-bounds in check_special_flags(CVE-2022-50497)

    arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()(CVE-2025-38320)

    tee: fix NULL pointer dereference in tee_shm_put(CVE-2025-39865)

    udf: Fix uninitialized array access for some pathnames(CVE-2023-53165)

    media: uvcvideo: Handle cameras with invalid descriptors(CVE-2023-53437)

    ext4: avoid crash when inline data creation follows DIO write(CVE-2022-50435)

    serial: 8250: Reinit port-pm on port specific driver unbind(CVE-2023-53176)

    rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails(CVE-2023-53307)

    HID: core: do not bypass hid_hw_raw_request(CVE-2025-38494)

    udf: Do not bother merging very long extents(CVE-2023-53506)

    crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg(CVE-2025-39964)

    do_change_type(): refuse to operate on unmounted/not ours mounts(CVE-2025-38498)

    spi: qup: Don't skip cleanup in remove's error path(CVE-2023-53567)

    calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().(CVE-2025-38181)

    scsi: qla2xxx: Pointer may be dereferenced(CVE-2023-53150)

    ftrace: Also allocate and copy hash for reading of filter files(CVE-2025-39689)

    xhci: Remove device endpoints from bandwidth list when freeing the device(CVE-2022-50470)

    tracing/histograms: Add histograms to hist_vars if they have referenced variables(CVE-2023-53560)

    fs: writeback: fix use-after-free in __mark_inode_dirty()(CVE-2025-39866)

    drm/gem: Acquire references on GEM handles for framebuffers(CVE-2025-38449)

    usbnet: Fix linkwatch use-after-free on disconnect(CVE-2022-50220)

    dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path(CVE-2023-53604)

    qede: confirm skb is allocated before using(CVE-2022-49084)

    fs: udf: fix OOB read in lengthAllocDescs handling(CVE-2025-40044)

    scsi: target: iscsi: Fix a race condition between login_work and the login thread(CVE-2022-50350)

    crypto: cavium - prevent integer overflow loading firmware(CVE-2022-50330)

    recordmcount: Fix memory leaks in the uwrite function(CVE-2023-53318)

    blk-mq: use quiesced elevator switch when reinitializing queues(CVE-2022-50552)

    pnode: terminate at peers of source(CVE-2022-50280)

    ext4: fix WARNING in mb_find_extent(CVE-2023-53317)

    drm/sched: Increment job count before swapping tail spsc queue(CVE-2025-38515)

    posix-timers: Ensure timer ID search-loop limit is valid(CVE-2023-53728)

    net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb(CVE-2023-53548)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-184 advisory.

    There is a potential deadlock in the eBPF subsystem in the Linux kernel.

    The default sysctl configuration kernel.unprivileged_bpf_disabled on Amazon Linux does not allow     unprivileged users to use eBPF. (CVE-2023-0160)

    A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component. (CVE-2023-2269)

    In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled. (CVE-2023-32233)

    An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in     lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an     offset. (CVE-2023-34256)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix i_disksize exceeding i_size problem in paritally written case (CVE-2023-53270)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add bounds checking in get_max_inline_xattr_value_size() (CVE-2023-53285)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup() (CVE-2023-53294)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix leak of 'r10bio->remaining' for recovery (CVE-2023-53299)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix WARNING in mb_find_extent (CVE-2023-53317)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: remove a BUG_ON in ext4_mb_release_group_pa() (CVE-2023-53450)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: improve error handling from ext4_dirhash() (CVE-2023-53473)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/MCE/AMD: Use an u64 for bank_map (CVE-2023-53474)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. (CVE-2023-53489)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-crypto: make blk_crypto_evict_key() more robust (CVE-2023-53536)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: Make intel_get_crtc_new_encoder() less oopsy (CVE-2023-53571)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: Fix multiple LUN_RESET handling (CVE-2023-53586)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Sync IRQ works before buffer destruction (CVE-2023-53587)

    In the Linux kernel, the following vulnerability has been resolved:

    dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (CVE-2023-53604)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_fq: fix integer overflow of credit (CVE-2023-53624)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: fix wrong ct->timeout value (CVE-2023-53635)

    In the Linux kernel, the following vulnerability has been resolved:

    x86: fix clear_user_rep_good() exception handling annotation (CVE-2023-53642)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed (CVE-2023-53655)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: fix skb_copy_ubufs() vs BIG TCP (CVE-2023-53669)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline (CVE-2023-53692)

    In the Linux kernel, the following vulnerability has been resolved:

    x86: fix clear_user_rep_good() exception handling annotation (CVE-2023-53749)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (CVE-2023-53751)

    In the Linux kernel, the following vulnerability has been resolved:

    virt/coco/sev-guest: Double-buffer messages (CVE-2023-53769)

    In the Linux kernel, the following vulnerability has been resolved:

    dm flakey: fix a crash with invalid table line (CVE-2023-53786)

    In the Linux kernel, the following vulnerability has been resolved:

    ethtool: Fix uninitialized number of lanes (CVE-2023-53798)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-mq: release crypto keyslot before reporting I/O complete (CVE-2023-53810)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix null-ptr-deref in raid10_sync_request (CVE-2023-53832)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix potential use-after-free bug when trimming caps (CVE-2023-53867)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix slab-out-of-bounds read in hdr_delete_de() (CVE-2023-53988)

    In the Linux kernel, the following vulnerability has been resolved:

    SMB3: Add missing locks to protect deferred close file list (CVE-2023-53990)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix assertion of exclop condition when starting balance (CVE-2023-54002)

    In the Linux kernel, the following vulnerability has been resolved:

    vmci_host: fix a race condition in vmci_host_poll() causing GPF (CVE-2023-54007)

    In the Linux kernel, the following vulnerability has been resolved:

    spmi: Add a check for remove callback when removing a SPMI driver (CVE-2023-54044)

    In the Linux kernel, the following vulnerability has been resolved:

    kheaders: Use array declaration instead of char (CVE-2023-54056)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix invalid free tracking in ext4_xattr_move_to_block() (CVE-2023-54062)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix OOB read in indx_insert_into_buffer (CVE-2023-54063)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: Add !tpm_amd_is_rng_defective() to the hwrng_unregister() call site (CVE-2023-54073)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix memory leak if ntfs_read_mft failed (CVE-2023-54077)

    In the Linux kernel, the following vulnerability has been resolved:

    inotify: Avoid reporting event with invalid wd (CVE-2023-54119)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix memleak for 'conf->bio_split' (CVE-2023-54123)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: don't free qgroup space unless specified (CVE-2023-54158)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_api: remove block_cb from driver_list before freeing (CVE-2023-54193)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Add check for kmemdup (CVE-2023-54248)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix memleak of md thread (CVE-2023-54294)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix deadlock when converting an inline directory in nojournal mode (CVE-2023-54311)

    A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This     flaw allows a local user to cause an information leak problem while freeing the old quota file names     before a potential failure, leading to a use-after-free. (CVE-2024-0775)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1767864313 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Ensure scpi_info     is not assigned if the probe fails When scpi probe fails, at any point, we need to ensure that the     scpi_info is not set and will remain NULL until the probe succeeds. If it is not taken care, then it could     result use-after-free as the value is exported via get_scpi_ops() and could refer to a memory allocated     via devm_kzalloc() but freed when the probe fails. (CVE-2022-50087)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: Fix global-out-of-     bounds bug in _rtl8812ae_phy_set_txpower_limit() There is a global-out-of-bounds reported by KASAN: BUG:
    KASAN: global-out-of-bounds in _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] Read of size 1 at addr     ffffffffa0773c43 by task NetworkManager/411 CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D 6.1.0-rc8+     #144 e15588508517267d37 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), Call Trace: <TASK> ...
    kasan_report+0xbb/0x1c0 _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]     rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae] rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae] ...
    </TASK> The root cause of the problem is that the comparison order of prate_section in
    _rtl8812ae_phy_set_txpower_limit() is wrong. The _rtl8812ae_eq_n_byte() is used to compare the first n     bytes of the two strings from tail to head, which causes the problem. In the
    _rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet this requirement by carefully     designing the comparison order. For example, pregulation and pbandwidth are compared in order of     length from small to large, first is 3 and last is 4. However, the comparison order of prate_section     dose not obey such order requirement, therefore when prate_section is HT, when comparing from tail to     head, it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As mentioned above, the
    _rtl8812ae_eq_n_byte() has the same function as strcmp(), so just strcmp() is enough. Fix it by removing
    _rtl8812ae_eq_n_byte() and use strcmp() barely. Although it can be fixed by adjusting the comparison order     of prate_section, this may cause the value of rate_section to not be from 0 to 5. In addition, commit     21e4b0726dc6 not only moved driver from staging to regular tree, but also added setting txpower limit     function during the driver config phase, so the problem was introduced by this commit. (CVE-2022-50279)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix monitor mode bringup     crash When the interface is brought up in monitor mode, it leads to NULL pointer dereference crash. This     crash happens when the packet type is extracted for a SKB. This extraction which is present in the     received msdu delivery path,is not needed for the monitor ring packets since they are all RAW packets.
    Hence appending the flags with RX_FLAG_ONLY_MONITOR to skip that extraction. Observed calltrace: Unable     to handle kernel NULL pointer dereference at virtual address 0000000000000064 Mem abort info: ESR =     0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC =     0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable:
    4k pages, 48-bit VAs, pgdp=0000000048517000 [0000000000000064] pgd=0000000000000000, p4d=0000000000000000     Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP Modules linked in: ath11k_pci ath11k qmi_helpers     CPU: 2 PID: 1781 Comm: napi/-271 Not tainted 6.1.0-rc5-wt-ath-656295-gef907406320c-dirty #6 Hardware name:
    Qualcomm Technologies, Inc. IPQ8074/AP-HK10-C2 (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS     BTYPE=--) pc : ath11k_hw_qcn9074_rx_desc_get_decap_type+0x34/0x60 [ath11k] lr :
    ath11k_hw_qcn9074_rx_desc_get_decap_type+0x5c/0x60 [ath11k] sp : ffff80000ef5bb10 x29: ffff80000ef5bb10     x28: 0000000000000000 x27: ffff000007baafa0 x26: ffff000014a91ed0 x25: 0000000000000000 x24:
    0000000000000000 x23: ffff800002b77378 x22: ffff000014a91ec0 x21: ffff000006c8d600 x20: 0000000000000000     x19: ffff800002b77740 x18: 0000000000000006 x17: 736564203634343a x16: 656e694c20657079 x15:
    0000000000000143 x14: 00000000ffffffea x13: ffff80000ef5b8b8 x12: ffff80000ef5b8c8 x11: ffff80000a591d30     x10: ffff80000a579d40 x9 : c0000000ffffefff x8 : 0000000000000003 x7 : 0000000000017fe8 x6 :
    ffff80000a579ce8 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 3a35ec12ed7f8900     x1 : 0000000000000000 x0 : 0000000000000052 Call trace: ath11k_hw_qcn9074_rx_desc_get_decap_type+0x34/0x60     [ath11k] ath11k_dp_rx_deliver_msdu.isra.42+0xa4/0x3d0 [ath11k]     ath11k_dp_rx_mon_deliver.isra.43+0x2f8/0x458 [ath11k] ath11k_dp_rx_process_mon_rings+0x310/0x4c0 [ath11k]     ath11k_dp_service_srng+0x234/0x338 [ath11k] ath11k_pcic_ext_grp_napi_poll+0x30/0xb8 [ath11k]
    __napi_poll+0x5c/0x190 napi_threaded_poll+0xf0/0x118 kthread+0xf4/0x110 ret_from_fork+0x10/0x20 Tested-on:
    QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 (CVE-2022-50627)

  - In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: fix UAF in     hugetlb_handle_userfault The vma_lock and hugetlb_fault_mutex are dropped before handling userfault and     reacquire them again after handle_userfault(), but reacquire the vma_lock could lead to UAF[1,2] due to     the following race, hugetlb_fault hugetlb_no_page /*unlock vma_lock */ hugetlb_handle_userfault     handle_userfault /* unlock mm->mmap_lock*/ vm_mmap_pgoff do_mmap mmap_region munmap_vma_range /* clean old     vma */ /* lock vma_lock again <--- UAF */ /* unlock vma_lock */ Since the vma_lock will unlock immediately     after hugetlb_handle_userfault(), let's drop the unneeded lock and unlock in hugetlb_handle_userfault() to     fix the issue. [1] https://lore.kernel.org/linux-mm/000000000000d5e00a05e834962e@google.com/ [2]     https://lore.kernel.org/linux-mm/20220921014457.1668-1-liuzixian4@huawei.com/ (CVE-2022-50630)

  - In the Linux kernel, the following vulnerability has been resolved: PCI: Fix pci_device_is_present() for     VFs by checking PF pci_device_is_present() previously didn't work for VFs because it reads the Vendor and     Device ID, which are 0xffff for VFs, which looks like they aren't present. Check the PF instead. Wei Gong     reported that if virtio I/O is in progress when the driver is unbound or 0 is written to     /sys/.../sriov_numvfs, the virtio I/O operation hangs, which may result in output like this: task:bash     state:D stack: 0 pid: 1773 ppid: 1241 flags:0x00004002 Call Trace: schedule+0x4f/0xc0     blk_mq_freeze_queue_wait+0x69/0xa0 blk_mq_freeze_queue+0x1b/0x20 blk_cleanup_queue+0x3d/0xd0     virtblk_remove+0x3c/0xb0 [virtio_blk] virtio_dev_remove+0x4b/0x80 ... device_unregister+0x1b/0x60     unregister_virtio_device+0x18/0x30 virtio_pci_remove+0x41/0x80 pci_device_remove+0x3e/0xb0 This happened     because pci_device_is_present(VF) returned false in virtio_pci_remove(), so it called     virtio_break_device(). The broken vq meant that vring_interrupt() skipped the vq.callback() that would     have completed the virtio I/O operation via virtblk_done(). [bhelgaas: commit log, simplify to always use     pci_physfn(), add stable tag] (CVE-2022-50636)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
278473	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-2522)	Nessus	Huawei Local Security Checks	12/11/2025	3/6/2026	high
281579	EulerOS Virtualization 2.13.0 : kernel (EulerOS-SA-2025-2609)	Nessus	Huawei Local Security Checks	12/31/2025	3/6/2026	high
297309	EulerOS Virtualization 2.10.1 : kernel (EulerOS-SA-2026-1123)	Nessus	Huawei Local Security Checks	1/31/2026	9/19/2026	high
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	7/22/2021	10/9/2026	high
176925	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-184)	Nessus	Amazon Linux Local Security Checks	6/8/2023	2/12/2026	high
360579	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1767864313)	Nessus	Alma Linux Local Security Checks	10/1/2026	10/1/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high