The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02969-1 advisory.

    The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
    - CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing     before MONITOR (bsc#1238896).
    - CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
    - CVE-2024-49861: net: clear the dst when changing skb protocol (bsc#1245954).
    - CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
    - CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
    - CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
    - CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
    - CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
    - CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
    - CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
    - CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
    - CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
    - CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
    - CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
    - CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
    - CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
    - CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write()     (bsc#1245440).
    - CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
    - CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
    - CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
    - CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
    - CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
    - CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
    - CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
    - CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers     (bsc#1245671).
    - CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
    - CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
    - CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
    - CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
    - CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping     (bsc#1245708).
    - CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
    - CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
    - CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).
    - CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma address error (bsc#1245750).
    - CVE-2025-38162: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (bsc#1245752).
    - CVE-2025-38166: bpf: fix ktls panic with sockmap (bsc#1245758).
    - CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
    - CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
    - CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()     (bsc#1246006).
    - CVE-2025-38187: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() (bsc#1245951).
    - CVE-2025-38188: drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (bsc#1246098).
    - CVE-2025-38200: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (bsc#1246045).
    - CVE-2025-38202: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (bsc#1245980).
    - CVE-2025-38203: jfs: Fix null-ptr-deref in jfs_ioc_trim (bsc#1246044).
    - CVE-2025-38204: jfs: fix array-index-out-of-bounds read in add_missing_indices (bsc#1245983).
    - CVE-2025-38206: exfat: fix double free in delayed_free (bsc#1246073).
    - CVE-2025-38210: configfs-tsm-report: Fix NULL dereference of tsm_ops (bsc#1246020).
    - CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246029).
    - CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).
    - CVE-2025-38222: ext4: inline: fix len overflow in ext4_prepare_inline_data (bsc#1245976).
    - CVE-2025-38236: af_unix: Disable MSG_OOB for unprivileged users (bsc#1246093).
    - CVE-2025-38239: scsi: megaraid_sas: Fix invalid node index (bsc#1246178).
    - CVE-2025-38244: smb: client: fix potential deadlock when reconnecting channels (bsc#1246183).
    - CVE-2025-38248: bridge: mcast: Fix use-after-free during router port configuration (bsc#1246173).
    - CVE-2025-38250: kABI workaround for bluetooth hci_dev changes (bsc#1246182).
    - CVE-2025-38264: llist: add interface to check if a node is on a list (bsc#1246387).
    - CVE-2025-38272: net: dsa: b53: do not enable EEE on bcm63xx (bsc#1246268).
    - CVE-2025-38279: selftests/bpf: Add tests with stack ptr register in conditional jmp (bsc#1246264).
    - CVE-2025-38283: hisi_acc_vfio_pci: bugfix live migration function without VF device driver     (bsc#1246273).
    - CVE-2025-38303: Bluetooth: eir: Fix possible crashes on eir_create_adv_data (bsc#1246354).
    - CVE-2025-38310: seg6: Fix validation of nexthop addresses (bsc#1246361).
    - CVE-2025-38323: net: atm: add lec_mutex (bsc#1246473).
    - CVE-2025-38334: x86/sgx: Prevent attempts to reclaim poisoned pages (bsc#1246384).
    - CVE-2025-38335: Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (bsc#1246250).
    - CVE-2025-38337: jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (bsc#1246253).
    - CVE-2025-38349: eventpoll: do not decrement ep refcount while still holding the ep mutex (bsc#1246777).
    - CVE-2025-38350: net/sched: Always pass notifications when child class becomes empty (bsc#1246781).
    - CVE-2025-38352: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()     (bsc#1246911).
    - CVE-2025-38364: maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (bsc#1247091).
    - CVE-2025-38365: btrfs: fix a race between renames and directory logging (bsc#1247023).
    - CVE-2025-38371: drm/v3d: Disable interrupts before resetting the GPU (bsc#1247178).
    - CVE-2025-38375: virtio-net: ensure the received length does not exceed allocated size (bsc#1247177).
    - CVE-2025-38382: btrfs: fix iteration of extrefs during log replay (bsc#1247031).
    - CVE-2025-38392: idpf: convert control queue mutex to a spinlock (bsc#1247169).
    - CVE-2025-38396: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (bsc#1247156).
    - CVE-2025-38399: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()     (bsc#1247097).
    - CVE-2025-38403: vsock/vmci: Clear the vmci transport packet properly when initializing it (bsc#1247141).
    - CVE-2025-38414: wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (bsc#1247145).
    - CVE-2025-38426: drm/amdgpu: Add basic validation for RAS header (bsc#1247252).
    - CVE-2025-38429: bus: mhi: ep: Update read pointer only after buffer is written (bsc#1247253).
    - CVE-2025-38455: KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight     (bsc#1247101).
    - CVE-2025-38457: net/sched: Abort __tc_modify_qdisc if parent class does not exist (bsc#1247098).
    - CVE-2025-38460: atm: clip: Fix potential null-ptr-deref in to_atmarpd() (bsc#1247143).
    - CVE-2025-38461: vsock: Fix transport_* TOCTOU (bsc#1247103).
    - CVE-2025-38462: vsock: Fix transport_{g2h,h2g} TOCTOU (bsc#1247104).
    - CVE-2025-38463: tcp: Correct signedness in skb remaining space calculation (bsc#1247113).
    - CVE-2025-38465: netlink: make sure we allow at least one dump skb (bsc#1247118).
    - CVE-2025-38470: kABI fix for net: vlan: fix VLAN 0 refcount imbalance of toggling (bsc#1247288).
    - CVE-2025-38471: tls: always refresh the queue when reading sock (bsc#1247450).
    - CVE-2025-38497: usb: gadget: configfs: Fix OOB read on empty string write (bsc#1247347).
    - CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247374).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:15661 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: drm/vkms: Fix use after free and double free on init error (CVE-2025-22097)

    * kernel: scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332)

    * kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()     (CVE-2025-38352)

    * kernel: drm/gem: Acquire references on GEM handles for framebuffers (CVE-2025-38449)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:17123 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: usb: dwc3: gadget: check that event count does not exceed event buffer length (CVE-2025-37810)

    * kernel: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CVE-2025-38200)

    * kernel: vsock: Fix transport_* TOCTOU (CVE-2025-38461)

    * kernel: drm/gem: Acquire references on GEM handles for framebuffers (CVE-2025-38449)

    * kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CVE-2025-38472)

    * kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    net: xfrm: unexport __init-annotated xfrm4_protocol_init()(CVE-2022-49345)

    tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts.(CVE-2022-49575)

    x86/speculation: Fill RSB on vmexit for IBRS(CVE-2022-49611)

    ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg(CVE-2022-49727)

    bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()(CVE-2022-49840)

    ipvs: fix WARNING in ip_vs_app_net_cleanup()(CVE-2022-49917)

    ipvs: fix WARNING in __ip_vs_cleanup_batch()(CVE-2022-49918)

    HID: hidraw: fix memory leak in hidraw_release()(CVE-2022-49981)

    dm raid: fix address sanitizer warning in raid_resume(CVE-2022-50085)

    RDMA/hfi1: fix potential memory leak in setup_base_ctxt()(CVE-2022-50134)

    KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT(CVE-2022-50224)

    erspan: do not use skb_mac_header() in ndo_start_xmit()(CVE-2023-53053)

    qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info(CVE-2023-53066)

    net: tunnels: annotate lockless accesses to dev-needed_headroom(CVE-2023-53109)

    tls: stop recv() if initial process_rx_list gave us non-DATA(CVE-2024-58239)

    ext4: inline: fix len overflow in ext4_prepare_inline_data(CVE-2025-38222)

    bpf: Fix WARN() in get_bpf_raw_tp_regs(CVE-2025-38285)

    Use rcu_dereference_rtnl() in mpls_route_input_rcu().(CVE-2025-38324)

    scsi: lpfc: Use memcpy() for BIOS version(CVE-2025-38332)

    ACPICA: Refuse to evaluate a method if arguments are missing(CVE-2025-38386)

    usb: typec: altmodes/displayport: do not index invalid pin_assignments(CVE-2025-38391)

    Squashfs: check return result of sb_min_blocksize(CVE-2025-38415)

    perf: Fix sample vs do_exit()(CVE-2025-38424)

    md/raid1: Fix stack memory use after return in raid1_reshape(CVE-2025-38445)

    drm/gem: Acquire references on GEM handles for framebuffers(CVE-2025-38449)

    usb: net: sierra: check for no status endpoint(CVE-2025-38474)

    net/sched: sch_qfq: Fix race condition on qfq_aggregate(CVE-2025-38477)

    HID: core: do not bypass hid_hw_raw_request(CVE-2025-38494)

    do_change_type(): refuse to operate on unmounted/not ours mounts(CVE-2025-38498)

    clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns(CVE-2025-38499)

    smb: client: fix use-after-free in cifs_oplock_break(CVE-2025-38527)

    net/packet: fix a race in packet_set_ring() and packet_notifier()(CVE-2025-38617)

    vsock: Do not allow binding to VMADDR_PORT_ANY(CVE-2025-38618)

    scsi: libiscsi: Initialize iscsi_conn-dd_data only if memory is allocated(CVE-2025-38700)

    gfs2: Validate i_depth for exhash directories(CVE-2025-38710)

    nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()(CVE-2025-38724)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    tracing: Add down_write(trace_event_sem) when adding trace event(CVE-2025-38539)

    tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer(CVE-2025-38184)

    pinmux: fix race causing mux_owner NULL with active mux_usecount(CVE-2025-38632)

    openvswitch: Fix unsafe attribute parsing in output_userspace()(CVE-2025-37998)

    perf: Revert to requiring CAP_SYS_ADMIN for uprobes(CVE-2025-38466)

    fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var(CVE-2025-38214)

    posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()(CVE-2025-38352)

    padata: do not leak refcount in reorder_work(CVE-2025-38031)

    rseq: Fix segfault on registration when rseq_cs is non-zero(CVE-2025-38067)

    dm: fix unconditional IO throttle caused by REQ_PREFLUSH(CVE-2025-38063)

    RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow(CVE-2025-22086)

    HID: core: ensure the allocated report buffer can contain the reserved report ID(CVE-2025-38495)

    net_sched: sch_sfq: fix a potential crash on gso_skb handling(CVE-2025-38115)

    pinctrl: qcom: msm: mark certain pins as invalid for interrupts(CVE-2025-38516)

    fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass(CVE-2025-38396)

    ata: libata-sff: Ensure that we cannot write outside the allocated buffer(CVE-2025-21738)

    HID: intel-ish-hid: ipc: Fix potential use-after-free in work function(CVE-2023-53039)

    sched/core: Do not requeue task on CPU excluded from cpus_mask(CVE-2022-50100)

    netfilter: nft_set_pipapo: prevent overflow in lookup table allocation(CVE-2025-38162)

    fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()(CVE-2025-38312)

    clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns(CVE-2025-38499)

    crypto: algif_hash - fix double free in hash_accept(CVE-2025-38079)

    pptp: ensure minimal skb length in pptp_xmit()(CVE-2025-38574)

    net: ch9200: fix uninitialised access during mii_nway_restart(CVE-2025-38086)

    arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()(CVE-2025-38320)

    net: openvswitch: Fix the dead loop of MPLS parse(CVE-2025-38146)

    scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts(CVE-2022-50098)

    scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()(CVE-2025-38399)

    i2c: qup: jump out of the loop in case of timeout(CVE-2025-38671)

    x86/sgx: Prevent attempts to reclaim poisoned pages(CVE-2025-38334)

    nvmet-tcp: don't restore null(CVE-2025-38035)

    net: fix udp gso skb_segment after pull from frag_list(CVE-2025-38124)

    net/mlx5e: Fix cleanup null-ptr deref on encap lock(CVE-2023-53105)

    net: fix NULL pointer dereference in l3mdev_l3_rcv(CVE-2025-22103)

    do_change_type(): refuse to operate on unmounted/not ours mounts(CVE-2025-38498)

    ext4: inline: fix len overflow in ext4_prepare_inline_data(CVE-2025-38222)

    bpf: check changes_pkt_data property for extension programs(CVE-2024-58100)

    bpf: fix ktls panic with sockmap(CVE-2025-38166)

    drm/gem: Acquire references on GEM handles for framebuffers(CVE-2025-38449)

    ACPICA: Refuse to evaluate a method if arguments are missing(CVE-2025-38386)

    rtnetlink: Allocate vfinfo size for VF GUIDs when supported(CVE-2025-22075)

    ftrace: Fix UAF when lookup kallsym after ftrace disabled(CVE-2025-38346)

    KVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace(CVE-2022-49932)

    net/mdiobus: Fix potential out-of-bounds read/write access(CVE-2025-38111)

    dmaengine: idxd: fix memory leak in error handling path of idxd_alloc(CVE-2025-38015)

    tcp: add accessors to read/set tp-snd_cwnd(CVE-2022-49325)

    perf: Fix sample vs do_exit()(CVE-2025-38424)

    regulator: core: fix NULL dereference on unbind due to stale coupling data(CVE-2025-38668)

    calipso: Don't call calipso functions for AF_INET sk.(CVE-2025-38147)

    Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var If     fb_add_videomode()(CVE-2025-38215)

    usb: typec: altmodes/displayport: do not index invalid pin_assignments(CVE-2025-38391)

    tipc: Fix use-after-free in tipc_conn_close().(CVE-2025-38464)

    netdevsim: Fix memory leak of nsim_dev-fa_cookie(CVE-2022-49803)

    HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()(CVE-2025-38103)

    net/sched: Abort __tc_modify_qdisc if parent class does not exist(CVE-2025-38457)

    netlink: Fix wraparounds of sk-sk_rmem_alloc(CVE-2025-38465)

    EDAC/skx_common: Fix general protection fault(CVE-2025-38298)

    drm/nouveau: prime: fix ttm_bo_delayed_delete oops(CVE-2025-37765)

    libnvdimm/labels: Fix divide error in nd_label_data_init()(CVE-2025-38072)

    net: tipc: fix refcount warning in tipc_aead_encrypt(CVE-2025-38273)

    netfilter: nf_set_pipapo_avx2: fix initial map fill(CVE-2025-38120)

    bpf, sockmap: Fix panic when calling skb_linearize(CVE-2025-38165)

    nvme-tcp: sanitize request list handling(CVE-2025-38264)

    bpf, sockmap: Avoid using sk_socket after free when sending(CVE-2025-38154)

    bpf: consider that tail calls invalidate packet pointers(CVE-2024-58237)

    RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction(CVE-2025-38211)

    NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN(CVE-2025-38393)

    ipc: fix to protect IPCS lookups using(CVE-2025-38212)

    net_sched: Flush gso_skb list too during -change()(CVE-2025-37992)

    netfilter: socket: Lookup orig tuple for IPv6 SNAT(CVE-2025-22021)

    net: fix geneve_opt length integer overflow(CVE-2025-22055)

    net: tls: explicitly disallow disconnect(CVE-2025-37756)

    bpf: Scrub packet on bpf_redirect_peer(CVE-2025-37959)

    netfilter: allow exp not to be removed in nf_ct_find_expectation(CVE-2023-52927)

    net: ppp: Add bound checking for skb data on ppp_sync_txmung(CVE-2025-37749)

    net: decrease cached dst counters in dst_release(CVE-2025-22057)

    net: openvswitch: fix nested key length validation in the set() action(CVE-2025-37789)

    netfilter: conntrack: revisit gc autotuning(CVE-2022-49110)

    bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()(CVE-2023-53133)

    blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()(CVE-2023-53421)

    writeback: fix use-after-free in __mark_inode_dirty()(CVE-2025-39866)

    scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure(CVE-2025-38695)

    serial: mctrl_gpio: split disable_ms into sync and no_sync APIs(CVE-2025-38040)

    A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including     the recent Fine(IBT), and to leak arbitrary Linux kernel memory on Intel systems.(CVE-2024-2201)

    perf/core: Prevent VMA split of buffer mappings(CVE-2025-38563)

    ipvs: fix uninit-value for saddr in do_output_route4(CVE-2025-37961)

    net: phy: leds: fix memory leak(CVE-2025-37989)

    seg6: Fix validation of nexthop addresses(CVE-2025-38310)

    page_pool: avoid infinite loop to schedule delayed worker(CVE-2025-37859)

    net: clear the dst when changing skb protocol(CVE-2025-38192)

    perf/core: Exit early on perf_mmap() fail(CVE-2025-38565)

    virtio-net: ensure the received length does not exceed allocated size(CVE-2025-38375)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:15661 advisory.

    * kernel: drm/vkms: Fix use after free and double free on init error (CVE-2025-22097)

    * kernel: scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332)

    * kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()     (CVE-2025-38352)

    * kernel: drm/gem: Acquire references on GEM handles for framebuffers (CVE-2025-38449)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    do_change_type(): refuse to operate on unmounted/not ours mounts(CVE-2025-38498)

    HID: core: ensure the allocated report buffer can contain the reserved report ID(CVE-2025-38495)

    perf: Revert to requiring CAP_SYS_ADMIN for uprobes(CVE-2025-38466)

    tipc: Fix use-after-free in tipc_conn_close().(CVE-2025-38464)

    net/sched: Abort __tc_modify_qdisc if parent class does not exist(CVE-2025-38457)

    drm/gem: Acquire references on GEM handles for framebuffers(CVE-2025-38449)

    scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()(CVE-2025-38399)

    usb: typec: altmodes/displayport: do not index invalid pin_assignments(CVE-2025-38391)

    ACPICA: Refuse to evaluate a method if arguments are missing(CVE-2025-38386)

    virtio-net: ensure the received length does not exceed allocated size(CVE-2025-38375)

    posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()(CVE-2025-38352)

    ftrace: Fix UAF when lookup kallsym after ftrace disabled(CVE-2025-38346)

    jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()(CVE-2025-38337)

    mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().(CVE-2025-38324)

    arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()(CVE-2025-38320)

    bpf: Fix WARN() in get_bpf_raw_tp_regs(CVE-2025-38285)

    net: tipc: fix refcount warning in tipc_aead_encrypt(CVE-2025-38273)

    media: cxusb: no longer judge rbuf when the write fails(CVE-2025-38229)

    ext4: inline: fix len overflow in ext4_prepare_inline_data(CVE-2025-38222)

    fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var(CVE-2025-38215)

    fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var(CVE-2025-38214)

    RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction(CVE-2025-38211)

    net: clear the dst when changing skb protocol(CVE-2025-38192)

    tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer(CVE-2025-38184)

    bpf: fix ktls panic with sockmap(CVE-2025-38166)

    netfilter: nft_set_pipapo: prevent overflow in lookup table allocation(CVE-2025-38162)

    ice: fix Tx scheduler error handling in XDP callback(CVE-2025-38127)

    net: fix udp gso skb_segment after pull from frag_list(CVE-2025-38124)

    netfilter: nf_set_pipapo_avx2: fix initial map fill(CVE-2025-38120)

    net_sched: sch_sfq: fix a potential crash on gso_skb handling(CVE-2025-38115)

    net/mdiobus: Fix potential out-of-bounds read/write access(CVE-2025-38111)

    net_sched: red: fix a race in __red_change()(CVE-2025-38108)

    VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify(CVE-2025-38102)

    x86/iopl: Cure TIF_IO_BITMAP inconsistencies(CVE-2025-38100)

    net: ch9200: fix uninitialised access during mii_nway_restart(CVE-2025-38086)

    mm/hugetlb: unshare page tables during VMA split, not before(CVE-2025-38084)

    net_sched: prio: fix a race in prio_tune()(CVE-2025-38083)

    scsi: target: iscsi: Fix timeout on deleted connection(CVE-2025-38075)

    vhost-scsi: protect vq-log_used with vq-mutex(CVE-2025-38074)

    libnvdimm/labels: Fix divide error in nd_label_data_init()(CVE-2025-38072)

    crypto: lzo - Fix compression buffer overrun(CVE-2025-38068)

    rseq: Fix segfault on registration when rseq_cs is non-zero(CVE-2025-38067)

    dm cache: prevent BUG_ON by blocking retries on failed device resumes(CVE-2025-38066)

    dm: fix unconditional IO throttle caused by REQ_PREFLUSH(CVE-2025-38063)

    net: pktgen: fix access outside of user given buffer in pktgen_thread_write()(CVE-2025-38061)

    net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done(CVE-2025-38052)

    media: cx231xx: set device_caps for 417(CVE-2025-38044)

    dmaengine: idxd: Refactor remove call with idxd_cleanup() helper(CVE-2025-38014)

    net_sched: hfsc: Address reentrant enqueue adding class to eltree twice(CVE-2025-38001)

    sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()(CVE-2025-38000)

    openvswitch: Fix unsafe attribute parsing in output_userspace()(CVE-2025-37998)

    netfilter: ipset: fix region locking in hash types(CVE-2025-37997)

    net_sched: Flush gso_skb list too during -change()(CVE-2025-37992)

    net: phy: leds: fix memory leak(CVE-2025-37989)

    ipvs: fix uninit-value for saddr in do_output_route4(CVE-2025-37961)

    bpf: Scrub packet on bpf_redirect_peer(CVE-2025-37959)

    arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs(CVE-2025-37948)

    sch_htb: make htb_qlen_notify() idempotent(CVE-2025-37932)

    xsk: Fix race condition in AF_XDP generic RX path(CVE-2025-37920)

    net_sched: drr: Fix double list add in class with netem as child qdisc(CVE-2025-37915)

    net_sched: qfq: Fix double list add in class with netem as child qdisc(CVE-2025-37913)

    net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc(CVE-2025-37890)

    HID: pidff: Fix null pointer dereference in pidff_find_fields(CVE-2025-37862)

    page_pool: avoid infinite loop to schedule delayed worker(CVE-2025-37859)

    tipc: fix NULL pointer dereference in tipc_mon_reinit_self()(CVE-2025-37824)

    net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too(CVE-2025-37823)

    codel: remove sch-q.qlen check before qdisc_tree_reduce_backlog()(CVE-2025-37798)

    net_sched: hfsc: Fix a UAF vulnerability in class handling(CVE-2025-37797)

    net: openvswitch: fix nested key length validation in the set() action(CVE-2025-37789)

    cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path(CVE-2025-37788)

    tipc: fix memory leak in tipc_link_xmit(CVE-2025-37757)

    net: tls: explicitly disallow disconnect(CVE-2025-37756)

    net: ppp: Add bound checking for skb data on ppp_sync_txmung(CVE-2025-37749)

    sctp: detect and prevent references to a freed transport in sendmsg(CVE-2025-23142)

    net: fix NULL pointer dereference in l3mdev_l3_rcv(CVE-2025-22103)

    RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow(CVE-2025-22086)

    rtnetlink: Allocate vfinfo size for VF GUIDs when supported(CVE-2025-22075)

    net: decrease cached dst counters in dst_release(CVE-2025-22057)

    net: fix geneve_opt length integer overflow(CVE-2025-22055)

    netfilter: socket: Lookup orig tuple for IPv6 SNAT(CVE-2025-22021)

    regulator: check that dummy regulator has been probed before using it(CVE-2025-22008)

    block: mark GFP_NOIO around sysfs -store()(CVE-2025-21817)

    ata: libata-sff: Ensure that we cannot write outside the allocated buffer(CVE-2025-21738)

    net: avoid race between device unregistration and ethnl ops(CVE-2025-21701)

    bpf: check changes_pkt_data property for extension programs(CVE-2024-58100)

    bpf: track changes_pkt_data property for global functions(CVE-2024-58098)

    net: fix memory leak in tcp_conn_request()(CVE-2024-57841)

    A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including     the recent Fine(IBT), and to leak arbitrary Linux kernel memory on Intel systems.(CVE-2024-2201)

    net/mlx5e: Fix cleanup null-ptr deref on encap lock(CVE-2023-53105)

    net: usb: lan78xx: Limit packet length to skb-len(CVE-2023-53068)

    HID: intel-ish-hid: ipc: Fix potential use-after-free in work function(CVE-2023-53039)

    netfilter: allow exp not to be removed in nf_ct_find_expectation(CVE-2023-52927)

    arm64: set UXN on swapper page tables(CVE-2022-50232)

    arm64: set UXN on swapper page tables(CVE-2022-50230)

    bpf: fix potential 32-bit overflow when accessing ARRAY map element(CVE-2022-50167)

    sched/core: Do not requeue task on CPU excluded from cpus_mask(CVE-2022-50100)

    scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts(CVE-2022-50098)

    bpf: Fix a data-race around bpf_jit_limit.(CVE-2022-49967)

    netdevsim: Fix memory leak of nsim_dev-fa_cookie(CVE-2022-49803)

    x86/fpu: KVM: Set the base guest FPU uABI size to sizeof(struct kvm_xsave)(CVE-2022-49557)

    block: fix rq-qos breakage from skipping rq_qos_done_bio()(CVE-2022-49266)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:18043 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: drm/vkms: Fix use after free and double free on init error (CVE-2025-22097)

    * kernel: net_sched: ets: Fix double list add in class with netem as child qdisc (CVE-2025-37914)

    * kernel: ALSA: bcd2000: Fix a UAF bug on the error path of probing (CVE-2022-50229)

    * kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (CVE-2022-50087)

    * kernel: bpf: Don't use tnum_range on array range checking for poke descriptors (CVE-2022-49985)

    * kernel: drm/amd/display: clear optc underflow before turn off odm clock (CVE-2022-49969)

    * kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211)

    * kernel: vsock: Fix transport_* TOCTOU (CVE-2025-38461)

    * kernel: drm/gem: Acquire references on GEM handles for framebuffers (CVE-2025-38449)

    * kernel: do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
255199	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:02969-1)	Nessus	SuSE Local Security Checks	8/26/2025	9/24/2025	high
264525	RHEL 9 : kernel (RHSA-2025:15661)	Nessus	Red Hat Local Security Checks	9/11/2025	9/11/2025	high
266325	RHEL 9 : kernel-rt (RHSA-2025:17123)	Nessus	Red Hat Local Security Checks	10/1/2025	10/1/2025	high
274898	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2025-2390)	Nessus	Huawei Local Security Checks	11/12/2025	11/12/2025	high
274905	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2025-2330)	Nessus	Huawei Local Security Checks	11/12/2025	11/12/2025	high
269943	RockyLinux 9 : kernel (RLSA-2025:15661)	Nessus	Rocky Linux Local Security Checks	10/10/2025	10/10/2025	high
270016	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2025-2230)	Nessus	Huawei Local Security Checks	10/11/2025	10/11/2025	medium
270562	RHEL 8 : kernel (RHSA-2025:18043)	Nessus	Red Hat Local Security Checks	10/15/2025	10/15/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

medium

high