An update of the linux package has been released.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986516 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY

    When CONFIG_DEBUG_BUGVERBOSE=n, we fail to add necessary padding bytes     to bug_table entries, and as a result the last entry in a bug table will     be ignored, potentially leading to an unexpected panic(). All prior     entries in the table will be handled correctly.

    The arm64 ABI requires that struct fields of up to 8 bytes are     naturally-aligned, with padding added within a struct such that struct     are suitably aligned within arrays.

    When CONFIG_DEBUG_BUGVERPOSE=y, the layout of a bug_entry is:

            struct bug_entry {                     signed int      bug_addr_disp;  // 4 bytes                     signed int      file_disp;      // 4 bytes                     unsigned short  line;           // 2 bytes                     unsigned short  flags;          // 2 bytes             }

    ... with 12 bytes total, requiring 4-byte alignment.

    When CONFIG_DEBUG_BUGVERBOSE=n, the layout of a bug_entry is:

            struct bug_entry {                     signed int      bug_addr_disp;  // 4 bytes                     unsigned short  flags;          // 2 bytes                     < implicit padding >            // 2 bytes             }

    ... with 8 bytes total, with 6 bytes of data and 2 bytes of trailing     padding, requiring 4-byte alginment.

    When we create a bug_entry in assembly, we align the start of the entry     to 4 bytes, which implicitly handles padding for any prior entries.
    However, we do not align the end of the entry, and so when     CONFIG_DEBUG_BUGVERBOSE=n, the final entry lacks the trailing padding     bytes.

    For the main kernel image this is not a problem as find_bug() doesn't     depend on the trailing padding bytes when searching for entries:

            for (bug = __start___bug_table; bug < __stop___bug_table; ++bug)                     if (bugaddr == bug_addr(bug))                             return bug;

    However for modules, module_bug_finalize() depends on the trailing     bytes when calculating the number of entries:

            mod->num_bugs = sechdrs[i].sh_size / sizeof(struct bug_entry);

    ... and as the last bug_entry lacks the necessary padding bytes, this entry     will not be counted, e.g. in the case of a single entry:

            sechdrs[i].sh_size == 6             sizeof(struct bug_entry) == 8;

            sechdrs[i].sh_size / sizeof(struct bug_entry) == 0;

    Consequently module_find_bug() will miss the last bug_entry when it does:

            for (i = 0; i < mod->num_bugs; ++i, ++bug)                     if (bugaddr == bug_addr(bug))                             goto out;

    ... which can lead to a kenrel panic due to an unhandled bug.

    This can be demonstrated with the following module:

            static int __init buginit(void)             {                     WARN(1, hello\n);
                    return 0;
            }

            static void __exit bugexit(void)             {             }

            module_init(buginit);
            module_exit(bugexit);
            MODULE_LICENSE(GPL);

    ... which will trigger a kernel panic when loaded:

            ------------[ cut here ]------------             hello             Unexpected kernel BRK exception at EL1             Internal error: BRK handler: 00000000f2000800 [#1] PREEMPT SMP             Modules linked in: hello(O+)             CPU: 0 PID: 50 Comm: insmod Tainted: G           O       6.9.1 #8             Hardware name: linux,dummy-virt (DT)             pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)             pc : buginit+0x18/0x1000 [hello]             lr : buginit+0x18/0x1000 [hello]             sp : ffff800080533ae0             x29: ffff800080533ae0 x28: 0000000000000000 x27: 0000000000000000             x26: ffffaba8c4e70510 x25: ffff800080533c30 x24: ffffaba8c4a28a58             x23: 0000000000000000 x22: 0000000000000000 x21: ffff3947c0eab3c0             x20: ffffaba8c4e3f000 x19: ffffaba846464000 x18: 0000000000000006             x17: 0000000000000000 x16: ffffaba8c2492834 x15: 0720072007200720             x14: 0720072007200720 x13: ffffaba8c49b27c8 x12: 0000000000000312             x11: 0000000000000106 x10: ffffaba8c4a0a7c8 x9 : ffffaba8c49b27c8             x8 : 00000000ffffefff x7 : ffffaba8c4a0a7c8 x6 : 80000000fffff000             x5 : 0000000000000107 x4 : 0000000000000000 x3 : 0000000000000000             x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff3947c0eab3c0             Call trace:
             buginit+0x18/0x1000 [hello]              do_one_initcall+0x80/0x1c8              do_init_module+0x60/0x218              load_module+0x1ba4/0x1d70
             __do_sys_init_module+0x198/0x1d0
             __arm64_sys_init_module+0x1c/0x28              invoke_syscall+0x48/0x114              el0_svc
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-9528:03 advisory.

    kernel: bluetooth: BR/EDR Bluetooth Impersonation Attacks (BIAS)     (CVE-2020-10135)         kernel: Information disclosure in vhost/vhost.c:vhost_new_msg()     (CVE-2024-0340)         kernel: use-after-free in cec_queue_msg_fh (CVE-2024-23848)         kernel: stack overflow problem in Open vSwitch kernel module leading to DoS     (CVE-2024-1151)         kernel: crash due to a missing check for leb_size (CVE-2024-25739)         kernel: bpf: Fix re-attachment branch in bpf_tracing_prog_attach     (CVE-2024-26591)         kernel: powerpc: Fix access beyond end of drmem array (CVE-2023-52451)         kernel: pvrusb2: fix use after free on context disconnection     (CVE-2023-52445)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
204485	Photon OS 5.0: Linux PHSA-2024-5.0-0305	Nessus	PhotonOS Local Security Checks	7/24/2024	1/30/2026	high
269000	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986516)	Nessus	Unity Linux Local Security Checks	10/7/2025	10/15/2025	medium
291775	MiracleLinux 9 : kernel-5.14.0-503.11.1.el9_5 (AXSA:2025-9528:03)	Nessus	Miracle Linux Local Security Checks	1/20/2026	3/24/2026	high

Detections

Analytics

Plugins Search

high

medium

high