The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force     Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in     response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-     after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0     will have already exited and thus the call to kthread_stop will be performed against a stale pointer.
    (CVE-2021-28691)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5050-1 advisory.

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly perform access     control. An authenticated attacker could possibly use this to expose sensitive information.
    (CVE-2020-26558, CVE-2021-0129)

    Michael Brown discovered that the Xen netback driver in the Linux kernel did not properly handle malformed     packets from a network PV frontend, leading to a use-after-free vulnerability. An attacker in a guest VM     could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-28691)

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device     initialization failure, leading to a double-free vulnerability. An attacker could use this to cause a     denial of service or possibly execute arbitrary code. (CVE-2021-3564)

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device     detach events, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of     service or possibly execute arbitrary code. (CVE-2021-3573)

    It was discovered that the NFC implementation in the Linux kernel did not properly handle failed connect     events leading to a NULL pointer dereference. A local attacker could use this to cause a denial of     service. (CVE-2021-38208)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5015-1 advisory.

    It was discovered that the virtual file system implementation in the Linux kernel contained an unsigned to     signed integer conversion error. A local attacker could use this to cause a denial of service (system     crash) or execute arbitrary code. (CVE-2021-33909)

    Michael Brown discovered that the Xen netback driver in the Linux kernel did not properly handle malformed     packets from a network PV frontend, leading to a use-after-free vulnerability. An attacker in a guest VM     could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-28691)

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device     initialization failure, leading to a double-free vulnerability. An attacker could use this to cause a     denial of service or possibly execute arbitrary code. (CVE-2021-3564)

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device     detach events, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of     service or possibly execute arbitrary code. (CVE-2021-3573)

    It was discovered that the NFC implementation in the Linux kernel did not properly handle failed connect     events leading to a NULL pointer dereference. A local attacker could use this to cause a denial of     service. (CVE-2021-3587)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5046-1 advisory.

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly perform access     control. An authenticated attacker could possibly use this to expose sensitive information.
    (CVE-2020-26558, CVE-2021-0129)

    Michael Brown discovered that the Xen netback driver in the Linux kernel did not properly handle malformed     packets from a network PV frontend, leading to a use-after-free vulnerability. An attacker in a guest VM     could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-28691)

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device     initialization failure, leading to a double-free vulnerability. An attacker could use this to cause a     denial of service or possibly execute arbitrary code. (CVE-2021-3564)

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device     detach events, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of     service or possibly execute arbitrary code. (CVE-2021-3573)

    It was discovered that the NFC implementation in the Linux kernel did not properly handle failed connect     events leading to a NULL pointer dereference. A local attacker could use this to cause a denial of     service. (CVE-2021-3587)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202107-30 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414634 advisory.

    Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force     Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in     response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-     after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0     will have already exited and thus the call to kthread_stop will be performed against a stale pointer.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
248163	Linux Distros Unpatched Vulnerability : CVE-2021-28691	Nessus	Misc.	8/11/2025	8/11/2025	high
152774	Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-5050-1)	Nessus	Ubuntu Local Security Checks	8/24/2021	8/27/2024	high
202866	Photon OS 4.0: Linux PHSA-2021-4.0-0058	Nessus	PhotonOS Local Security Checks	7/22/2024	9/20/2025	high
160459	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2022-002 (ALASKERNEL-5.10-2022-002)	Nessus	Amazon Linux Local Security Checks	5/2/2022	11/7/2025	high
151921	Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5015-1)	Nessus	Ubuntu Local Security Checks	7/22/2021	8/28/2024	high
152665	Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-5046-1)	Nessus	Ubuntu Local Security Checks	8/19/2021	8/27/2024	high
157004	GLSA-202107-30 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	1/24/2022	1/26/2022	high
267105	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414634)	Nessus	Unity Linux Local Security Checks	10/7/2025	10/15/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high