The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989609 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    f2fs: fix to do sanity check on block address in f2fs_do_zero_range()

    As Yanming reported in bugzilla:

    https://bugzilla.kernel.org/show_bug.cgi?id=215894

    I have encountered a bug in F2FS file system in kernel v5.17.

    I have uploaded the system call sequence as case.c, and a fuzzed image can     be found in google net disk

    The kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can     reproduce the bug by running the following commands:

    kernel BUG at fs/f2fs/segment.c:2291!     Call Trace:
     f2fs_invalidate_blocks+0x193/0x2d0      f2fs_fallocate+0x2593/0x4a70      vfs_fallocate+0x2a5/0xac0      ksys_fallocate+0x35/0x70
     __x64_sys_fallocate+0x8e/0xf0      do_syscall_64+0x3b/0x90      entry_SYSCALL_64_after_hwframe+0x44/0xae

    The root cause is, after image was fuzzed, block mapping info in inode     will be inconsistent with SIT table, so in f2fs_fallocate(), it will cause     panic when updating SIT with invalid blkaddr.

    Let's fix the issue by adding sanity check on block address before updating     SIT table with it.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - f2fs: fix to do sanity check on block address in f2fs_do_zero_range() As Yanming reported in bugzilla:
    https://bugzilla.kernel.org/show_bug.cgi?id=215894 I have encountered a bug in F2FS file system in kernel     v5.17. I have uploaded the system call sequence as case.c, and a fuzzed image can be found in google net     disk The kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can reproduce the bug by     running the following commands: kernel BUG at fs/f2fs/segment.c:2291! Call Trace:
    f2fs_invalidate_blocks+0x193/0x2d0 f2fs_fallocate+0x2593/0x4a70 vfs_fallocate+0x2a5/0xac0     ksys_fallocate+0x35/0x70 __x64_sys_fallocate+0x8e/0xf0 do_syscall_64+0x3b/0x90     entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is, after image was fuzzed, block mapping info in     inode will be inconsistent with SIT table, so in f2fs_fallocate(), it will cause panic when updating SIT     with invalid blkaddr. Let's fix the issue by adding sanity check on block address before updating SIT     table with it. (CVE-2022-49363)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989361 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    f2fs: fix to do sanity check on block address in f2fs_do_zero_range()

    As Yanming reported in bugzilla:

    https://bugzilla.kernel.org/show_bug.cgi?id=215894

    I have encountered a bug in F2FS file system in kernel v5.17.

    I have uploaded the system call sequence as case.c, and a fuzzed image can     be found in google net disk

    The kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can     reproduce the bug by running the following commands:

    kernel BUG at fs/f2fs/segment.c:2291!     Call Trace:
     f2fs_invalidate_blocks+0x193/0x2d0      f2fs_fallocate+0x2593/0x4a70      vfs_fallocate+0x2a5/0xac0      ksys_fallocate+0x35/0x70
     __x64_sys_fallocate+0x8e/0xf0      do_syscall_64+0x3b/0x90      entry_SYSCALL_64_after_hwframe+0x44/0xae

    The root cause is, after image was fuzzed, block mapping info in inode     will be inconsistent with SIT table, so in f2fs_fallocate(), it will cause     panic when updating SIT with invalid blkaddr.

    Let's fix the issue by adding sanity check on block address before updating     SIT table with it.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
273130	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989609)	Nessus	Unity Linux Local Security Checks	11/5/2025	11/5/2025	medium
225779	Linux Distros Unpatched Vulnerability : CVE-2022-49363	Nessus	Misc.	3/5/2025	1/14/2026	medium
275906	TencentOS Server 4: kernel (TSSA-2025:0346)	Nessus	Tencent Local Security Checks	11/20/2025	3/11/2026	high
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	7/22/2021	3/23/2026	high
273667	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989361)	Nessus	Unity Linux Local Security Checks	11/5/2025	11/5/2025	medium

Detections

Analytics

Plugins Search

medium

medium

high

high

medium