The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1241-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
    - CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync     (bsc#1239095).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989408 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    tunnels: do not assume mac header is set in skb_tunnel_check_pmtu()

    Recently added debug in commit f9aefd6b2aa3 (net: warn if mac header     was not set) caught a bug in skb_tunnel_check_pmtu(), as shown     in this syzbot report [1].

    In ndo_start_xmit() paths, there is really no need to use skb->mac_header,     because skb->data is supposed to point at it.

    [1] WARNING: CPU: 1 PID: 8604 at include/linux/skbuff.h:2784 skb_mac_header_len     include/linux/skbuff.h:2784 [inline]     WARNING: CPU: 1 PID: 8604 at include/linux/skbuff.h:2784 skb_tunnel_check_pmtu+0x5de/0x2f90     net/ipv4/ip_tunnel_core.c:413     Modules linked in:
    CPU: 1 PID: 8604 Comm: syz-executor.3 Not tainted 5.19.0-rc2-syzkaller-00443-g8720bd951b8e #0     Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011     RIP: 0010:skb_mac_header_len include/linux/skbuff.h:2784 [inline]     RIP: 0010:skb_tunnel_check_pmtu+0x5de/0x2f90 net/ipv4/ip_tunnel_core.c:413     Code: 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 80 3c 02 00 0f 84 b9 fe ff ff 4c 89 ff e8 7c 0f d7 f9 e9     ac fe ff ff e8 c2 13 8a f9 <0f> 0b e9 28 fc ff ff e8 b6 13 8a f9 48 8b 54 24 70 48 b8 00 00 00     RSP: 0018:ffffc90002e4f520 EFLAGS: 00010212     RAX: 0000000000000324 RBX: ffff88804d5fd500 RCX: ffffc90005b52000     RDX: 0000000000040000 RSI: ffffffff87f05e3e RDI: 0000000000000003     RBP: ffffc90002e4f650 R08: 0000000000000003 R09: 000000000000ffff     R10: 000000000000ffff R11: 0000000000000000 R12: 000000000000ffff     R13: 0000000000000000 R14: 000000000000ffcd R15: 000000000000001f     FS: 00007f3babba9700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000     CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: 0000000020000080 CR3: 0000000075319000 CR4: 00000000003506e0     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000     DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400     Call Trace:
    <TASK>     geneve_xmit_skb drivers/net/geneve.c:927 [inline]     geneve_xmit+0xcf8/0x35d0 drivers/net/geneve.c:1107
    __netdev_start_xmit include/linux/netdevice.h:4805 [inline]     netdev_start_xmit include/linux/netdevice.h:4819 [inline]
    __dev_direct_xmit+0x500/0x730 net/core/dev.c:4309     dev_direct_xmit include/linux/netdevice.h:3007 [inline]     packet_direct_xmit+0x1b8/0x2c0 net/packet/af_packet.c:282     packet_snd net/packet/af_packet.c:3073 [inline]     packet_sendmsg+0x21f4/0x55d0 net/packet/af_packet.c:3104     sock_sendmsg_nosec net/socket.c:714 [inline]     sock_sendmsg+0xcf/0x120 net/socket.c:734
    ____sys_sendmsg+0x6eb/0x810 net/socket.c:2489
    ___sys_sendmsg+0xf3/0x170 net/socket.c:2543
    __sys_sendmsg net/socket.c:2572 [inline]
    __do_sys_sendmsg net/socket.c:2581 [inline]
    __se_sys_sendmsg net/socket.c:2579 [inline]
    __x64_sys_sendmsg+0x132/0x220 net/socket.c:2579     do_syscall_x64 arch/x86/entry/common.c:50 [inline]     do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80     entry_SYSCALL_64_after_hwframe+0x46/0xb0     RIP: 0033:0x7f3baaa89109     Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d     89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48     RSP: 002b:00007f3babba9168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e     RAX: ffffffffffffffda RBX: 00007f3baab9bf60 RCX: 00007f3baaa89109     RDX: 0000000000000000 RSI: 0000000020000a00 RDI: 0000000000000003     RBP: 00007f3baaae305d R08: 0000000000000000 R09: 0000000000000000     R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000     R13: 00007ffe74f2543f R14: 00007f3babba9300 R15: 0000000000022000     </TASK>

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    usbnet: gl620a: fix endpoint checking in genelink_bind().(CVE-2025-21877)

    ASoC: soc-compress: prevent the potentially use of null pointer(CVE-2021-47650)

    net: gso: fix ownership in __udp_gso_segment(CVE-2025-21926)

    exec: Force single empty string when argv is empty(CVE-2022-49264)

    IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition(CVE-2022-49089)

    netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits(CVE-2023-53033)

    erspan: do not assume transport header is always set(CVE-2022-49691)

    tipc: check attribute length for bearer name(CVE-2022-49374)

    qede: confirm skb is allocated before using(CVE-2022-49084)

    nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu().(CVE-2025-21927)

    ice: fix memory leak in aRFS after reset(CVE-2025-21981)

    arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall(CVE-2022-49520)

    NFSD: prevent underflow in nfssvc_decode_writeargs().(CVE-2022-49280)

    tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd(CVE-2022-49330)

    net: sched: Disallow replacing of child qdisc from one parent to another(CVE-2025-21702)

    net: ipv4: fix route with nexthop object delete warning(CVE-2022-49092)

    x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL(CVE-2023-52993)

    firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region(CVE-2023-52989)

    netfilter: nf_tables: don't skip expired elements during walk(CVE-2023-52924)

    net: openvswitch: fix leak of nested actions(CVE-2022-49086)

    drm/nouveau: prime: fix refcount underflow(CVE-2024-43867)

    net_sched: Prevent creation of classes with TC_H_ROOT(CVE-2025-21971)

    netfilter: nf_tables: memleak flow rule from commit path(CVE-2022-49358)

    rcu-tasks: Fix race in schedule and flush work(CVE-2022-49540)

    netfilter: use get_random_u32 instead of prandom(CVE-2022-49698)

    fbdev: hyperv_fb: Allow graceful removal of framebuffer(CVE-2025-21976)

    nvme-pci: add missing condition check for existence of mapped data(CVE-2024-42276)

    cifs: Fix oops due to uncleared server-smbd_conn in reconnect(CVE-2023-53006)

    ipv6: mcast: add RCU protection to mld_newpack().(CVE-2025-21758)

    ftrace: Clean up hash direct_functions on register failures(CVE-2022-49402)

    clocksource: hyper-v: unexport __init-annotated hv_init_clocksource().(CVE-2022-49726)

    usb: cdc-acm: Check control transfer buffer size before access(CVE-2025-21704)

    PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1(CVE-2025-21831)

    ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero(CVE-2022-49584)

    gpio: Restrict usage of GPIO chip irq members before initialization(CVE-2022-49072)

    i40e: Fix call trace in setup_tx_descriptors(CVE-2022-49725)

    RDMA/hfi1: Fix potential integer multiplication overflow errors(CVE-2022-49404)

    ice: Fix memory corruption in VF driver(CVE-2022-49722)

    ipv4: prevent potential spectre v1 gadget in fib_metrics_match().(CVE-2023-52996)

    ACPI: CPPC: Avoid out of bounds access when parsing _CPC data(CVE-2022-49145)

    KVM: SVM: fix panic on out-of-bounds guest IRQ(CVE-2022-49154)

    ipv4: prevent potential spectre v1 gadget in ip_metrics_convert().(CVE-2023-52997)

    net: fix NULL pointer in skb_segment_list(CVE-2023-52991)

    dlm: fix plock invalid read(CVE-2022-49407)

    netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree().(CVE-2025-21959)

    tee: optee: Fix supplicant wait loop(CVE-2025-21871)

    dm raid: fix accesses beyond end of raid member array(CVE-2022-49674)

    ipv4: use RCU protection in __ip_rt_update_pmtu().(CVE-2025-21766)

    dm array: fix releasing a faulty array block twice in dm_array_cursor_end(CVE-2024-57929)

    netlink: prevent potential spectre v1 gadgets(CVE-2023-53000)

    net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices(CVE-2023-52984)

    net: xfrm: unexport __init-annotated xfrm4_protocol_init().(CVE-2022-49345)

    tunnels: do not assume mac header is set in skb_tunnel_check_pmtu().(CVE-2022-49663)

    cpufreq: governor: Use kobject release() method to free dbs_data(CVE-2022-49513)

    brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path(CVE-2022-49263)

    HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections(CVE-2024-57986)

    ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up(CVE-2025-21887)

    xsk: Fix race at socket teardown(CVE-2022-49215)

    acct: perform last write from workqueue(CVE-2025-21846)

    nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags(CVE-2022-49492)

    drop_monitor: fix incorrect initialization order(CVE-2025-21862)

    udp: Fix a data-race around sysctl_udp_l3mdev_accept.(CVE-2022-49577)

    ip: Fix data-races around sysctl_ip_prot_sock.(CVE-2022-49578)

    ipv4: Fix data-races around sysctl_fib_multipath_hash_policy.(CVE-2022-49579)

    ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh.(CVE-2022-49580)

    tcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout.(CVE-2022-49585)

    drm/drm_vma_manager: Add drm_vma_node_allow_once().(CVE-2023-53001)

    x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes(CVE-2025-21991)

    ipv6: Fix signed integer overflow in __ip6_append_data(CVE-2022-49728)

    ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().(CVE-2025-22005)

    exec: don't WARN for racy path_noexec check(CVE-2024-50010)

    iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic().(CVE-2025-21993)

    RDMA/hns: Fix soft lockup during bt pages loop(CVE-2025-22010)

    tracing: Fix use-after-free in print_graph_function_flags during tracer switching(CVE-2025-22035)

    regulator: check that dummy regulator has been probed before using it(CVE-2025-22008)

    smb: client: Add check for next_buffer in receive_encrypted_standard().(CVE-2025-21844)

    vlan: enforce underlying device type(CVE-2025-21920)

    tcp: Fix data-races around sysctl_tcp_mtu_probing.(CVE-2022-49598)

    mm/swapfile: add cond_resched() in get_swap_pages().(CVE-2023-52932)

    proc: fix UAF in proc_get_inode().(CVE-2025-21999)

    driver core: Fix wait_for_device_probe()  deferred_probe_timeout interaction(CVE-2022-49379)

    NFSD: prevent integer overflow on 32 bit systems(CVE-2022-49279)

    x86/kexec: fix memory leak of elf header buffer(CVE-2022-49546)

    PM: core: keep irq flags in device_pm_check_callbacks().(CVE-2022-49175)

    KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak(CVE-2022-49556)

    tracing: Fix bad hist from corrupting named_triggers list(CVE-2025-21899)

    drivers/base/node.c: fix compaction sysfs file leak(CVE-2022-49442)

    hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio(CVE-2025-21931)

    s390/cpum_sf: Handle CPU hotplug remove during sampling(CVE-2024-57849)

    bpf, sockmap: Fix double uncharge the mem of sk_msg(CVE-2022-49205)

    perf/x86/amd: fix potential integer overflow on shift of a int(CVE-2022-49748)

    firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle(CVE-2022-49370)

    driver core: fix deadlock in __device_attach(CVE-2022-49371)

    RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers(CVE-2025-21885)

    RDMA/core: Fix ib block iterator counter overflow(CVE-2023-53026)

    net: let net.core.dev_weight always be non-zero(CVE-2025-21806)

    irqchip/gic-v3: Fix GICR_CTLR.RWP polling(CVE-2022-49074)

    x86/speculation: Fill RSB on vmexit for IBRS(CVE-2022-49611)

    netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.(CVE-2023-53032)

    arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY(CVE-2024-39488)

    udp: Deal with race between UDP socket address change and rehash(CVE-2024-57974)

    net: mdio: validate parameter addr in mdiobus_get_phy().(CVE-2023-53019)

    ppp: Fix KMSAN uninit-value warning with bpf(CVE-2025-21922)

    KVM: x86: Use __try_cmpxchg_user() to update guest PTE A/D bits(CVE-2022-49562)

    NFS: Avoid writeback threads getting stuck in mempool_alloc().(CVE-2022-49097)

    virtio_net: fix xdp_rxq_info bug after suspend/resume(CVE-2022-49687)

    LSM: general protection fault in legacy_parse_param(CVE-2022-49180)

    net/mlx5: handle errors in mlx5_chains_create_table().(CVE-2025-21975)

    net: mdio: unexport __init-annotated mdio_bus_init().(CVE-2022-49350)

    be2net: Fix buffer overflow in be_get_module_eeprom(CVE-2022-49581)

    l2tp: close all race conditions in l2tp_tunnel_register().(CVE-2023-53020)

    ipvlan: ensure network headers are in skb linear part(CVE-2025-21891)

    serial: 8250: Fix PM usage_count for console handover(CVE-2022-49613)

    scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress(CVE-2023-52975)

    NFSD: Fix the behavior of READ near OFFSET_MAX(CVE-2022-48827)

    af_netlink: Fix shift out of bounds in group mask calculation(CVE-2022-49197)

    dm thin: make get_first_thin use rcu-safe list first function(CVE-2025-21664)

    netfilter: conntrack: re-fetch conntrack after insertion(CVE-2022-49561)

    mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath().(CVE-2023-52939)

    tick/nohz: unexport __init-annotated tick_nohz_full_setup().(CVE-2022-49675)

    ipv6: use RCU protection in ip6_default_advmss().(CVE-2025-21765)

    virtio_console: eliminate anonymous module_init  module_exit(CVE-2022-49100)

    net: tun: unlink NAPI from device on destruction(CVE-2022-49672)

    Drivers: hv: vmbus: Fix potential crash on module unload(CVE-2022-49098)

    net/tls: fix slab-out-of-bounds bug in decrypt_internal(CVE-2022-49094)

    keys: Fix UAF in key_put().(CVE-2025-21893)

    bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener(CVE-2023-52986)

    RDMA/hfi1: Prevent panic when SDMA is disabled(CVE-2022-49429)

    xhci: Handle TD clearing for multiple streams case(CVE-2024-40927)

    ipmr: do not call mr_mfc_uses_dev() for unres entries(CVE-2025-21719)

    scsi: hisi_sas: Add cond_resched() for no forced preemption model(CVE-2024-56589)

    veth: Ensure eth header is in skb's linear part(CVE-2022-49066)

    tracing: Fix potential double free in create_var_ref().(CVE-2022-49410)

    dmaengine: Fix double increment of client_count in dma_chan_get().(CVE-2022-49753)

    scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress(CVE-2023-52974)

    net_sched: sch_sfq: don't allow 1 packet limit(CVE-2024-57996)

    vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF(CVE-2023-52973)

    dm mirror log: round up region bitmap size to BITS_PER_LONG(CVE-2022-49710)

    x86/xen: don't do PV iret hypercall through hypercall page(CVE-2024-53241)

    bpf, sockmap: Fix more uncharged while msg has more_data(CVE-2022-49204)

    mm/khugepaged: fix -anon_vma race(CVE-2023-52935)

    dm integrity: fix memory corruption when tag_size is less than digest size(CVE-2022-49044)

    scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp().(CVE-2022-49521)

    bpf: Fix request_sock leak in sk lookup helpers(CVE-2022-49697)

    mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize().(CVE-2025-21861)

    efi: Don't map the entire mokvar table to determine its size(CVE-2025-21872)

    net: asix: add proper error handling of usb read errors(CVE-2022-49226)

    HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove().(CVE-2025-21928)

    bpf: Skip task with pid=1 in send_signal_common().(CVE-2023-52992)

    bpf: Skip invalid kfunc call in backtrack_insn(CVE-2023-52928)

    bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation(CVE-2023-53024)

    igb: Fix potential invalid memory access in igb_init_module().(CVE-2024-52332)

    ftrace: Avoid potential division by zero in function_stat_show().(CVE-2025-21898)

    efi: fix potential NULL deref in efi_mem_reserve_persistent(CVE-2023-52976)

    uprobes: Reject the shared zeropage in uprobe_write_opcode().(CVE-2025-21881)

    bnxt: Do not read past the end of test names(CVE-2023-53010)

    trace_events_hist: add check for return value of 'create_hist_field'(CVE-2023-53005)

    tracing: Make sure trace_printk() can output as soon as it can be used(CVE-2023-53007)

    Squashfs: fix handling and sanity checking of xattr_ids count(CVE-2023-52933)

    tcp: Fix a data-race around sysctl_tcp_probe_threshold.(CVE-2022-49595)

    tcp: Fix data-races around sysctl_tcp_min_snd_mss.(CVE-2022-49596)

    tcp: Fix data-races around sysctl_tcp_base_mss.(CVE-2022-49597)

    tcp: Fix data-races around sysctl_tcp_l3mdev_accept.(CVE-2022-49599)

    hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING(CVE-2025-21816)

    RDMA/hfi1: Prevent use of lock before it is initialized(CVE-2022-49433)

    cifs: fix potential memory leaks in session setup(CVE-2023-53008)

    ovl: Use 'buf' flexible array for memcpy() destination(CVE-2022-49743)

    openvswitch: fix lockup on tx to unregistering netdev with carrier(CVE-2025-21681)

    net: hns3: add vlan list lock to protect vlan list(CVE-2022-49182)

    driver: base: fix UAF when driver_attach failed(CVE-2022-49385)

    ubi: ubi_create_volume: Fix use-after-free when volume creation failed(CVE-2022-49388)

    rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read(CVE-2024-58069)

    lz4: fix LZ4_decompress_safe_partial read out of bound(CVE-2022-49078)

    um: Fix out-of-bounds read in LDT setup(CVE-2022-49395)

    KVM: Explicitly verify target vCPU is online in kvm_get_vcpu().(CVE-2024-58083)

    ipv6: mcast: extend RCU protection in igmp6_send().(CVE-2025-21759)

    vsock: Keep the binding until socket destruction(CVE-2025-21756)

    pps: Fix a use-after-free(CVE-2024-57979)

    padata: fix UAF in padata_reorder(CVE-2025-21727)

    netfilter: nf_tables: avoid skb access on nf_stolen(CVE-2022-49622)

    srcu: Tighten cleanup_srcu_struct() GP checks(CVE-2022-49651)

    openvswitch: use RCU protection in ovs_vport_cmd_fill_info().(CVE-2025-21761)

    cgroup: Use separate src/dst nodes when preloading css_sets for migration(CVE-2022-49647)

    ice: arfs: fix use-after-free when freeing @rx_cpu_rmap(CVE-2022-49063)

    macsec: fix UAF bug for real_dev(CVE-2022-49390)

    ndisc: extend RCU protection in ndisc_send_skb().(CVE-2025-21760)

    nfsd: release svc_expkey(CVE-2024-53216)

    nfsd: make sure exp active before svc_export_show(CVE-2024-56558)

    net: sched: Disallow replacing of child qdisc from one parent to another(CVE-2025-21700)

    neighbour: use RCU protection in __neigh_notify().(CVE-2025-21763)

    nfsd: clear acl_access/acl_default after releasing them(CVE-2025-21796)

    ndisc: use RCU protection in ndisc_alloc_skb().(CVE-2025-21764)

    arp: use RCU protection in arp_xmit().(CVE-2025-21762)

    iommu/arm-smmu-v3: check return value after calling platform_get_resource().(CVE-2022-49319)

    memcg: fix soft lockup in the OOM process(CVE-2024-57977)

    rdma/cxgb4: Prevent potential integer overflow on 32bit(CVE-2024-57973)

    scsi: hisi_sas: Free irq vectors in order for v3 HW(CVE-2022-49118)

    drm/plane: Move range check for format_count earlier(CVE-2021-47659)

    USB: hub: Ignore non-compliant devices with too many configs or interfaces(CVE-2025-21776)

    bpf: avoid holding freeze_mutex during mmap operation(CVE-2025-21853)

    linux/dim: Fix divide by 0 in RDMA DIM(CVE-2022-49670)

    HID: multitouch: Add NULL check in mt_input_configured(CVE-2024-58020)

    nfp: bpf: Add check for nfp_app_ctrl_msg_alloc().(CVE-2025-21848)

    KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel(CVE-2025-21779)

    usb: xhci: Fix NULL pointer dereference on certain command aborts(CVE-2024-57981)

    ceph: fix memory leak in ceph_readdir when note_last_dentry returns error(CVE-2022-49107)

    NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify().(CVE-2022-49103)

    io_uring: fix memory leak of uid in files registration(CVE-2022-49144)

    hwrng: cavium - fix NULL but dereferenced coccicheck error(CVE-2022-49177)

    mlxsw: spectrum: Guard against invalid local ports(CVE-2022-49134)

    iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe().(CVE-2022-49323)

    drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes(CVE-2022-49532)

    scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair().(CVE-2022-49155)

    NFSv4: Don't hold the layoutget locks across multiple RPC calls(CVE-2022-49316)

    kernel/resource: fix kfree() of bootmem memory again(CVE-2022-49190)

    vrf: use RCU protection in l3mdev_l3_out().(CVE-2025-21791)

    tcp: Fix a data-race around sysctl_tcp_ecn_fallback.(CVE-2022-49630)

    i2c: dev: check return value when calling dev_set_name().(CVE-2022-49046)

    list: fix a data-race around ep-rdllist(CVE-2022-49443)

    perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()(CVE-2022-49607)

    drm/amd/display: Fix memory leak(CVE-2022-49135)

    media: uvcvideo: Fix double free in error path(CVE-2024-57980)

    io_uring: prevent opcode speculation(CVE-2025-21863)

    geneve: Fix use-after-free in geneve_find_dev().(CVE-2025-21858)

    arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array(CVE-2025-21785)

    scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock(CVE-2022-49536)

    KVM: VMX: Prevent RSB underflow before vmenter(CVE-2022-49610)

    tpm: Change to kvalloc() in eventlog/acpi.c(CVE-2024-58005)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume mac header is     set in skb_tunnel_check_pmtu() Recently added debug in commit f9aefd6b2aa3 (net: warn if mac header was     not set) caught a bug in skb_tunnel_check_pmtu(), as shown in this syzbot report [1]. In ndo_start_xmit()     paths, there is really no need to use skb->mac_header, because skb->data is supposed to point at it. [1]     WARNING: CPU: 1 PID: 8604 at include/linux/skbuff.h:2784 skb_mac_header_len include/linux/skbuff.h:2784     [inline] WARNING: CPU: 1 PID: 8604 at include/linux/skbuff.h:2784 skb_tunnel_check_pmtu+0x5de/0x2f90     net/ipv4/ip_tunnel_core.c:413 Modules linked in: CPU: 1 PID: 8604 Comm: syz-executor.3 Not tainted     5.19.0-rc2-syzkaller-00443-g8720bd951b8e #0 Hardware name: Google Google Compute Engine/Google Compute     Engine, BIOS Google 01/01/2011 RIP: 0010:skb_mac_header_len include/linux/skbuff.h:2784 [inline] RIP:
    0010:skb_tunnel_check_pmtu+0x5de/0x2f90 net/ipv4/ip_tunnel_core.c:413 Code: 00 00 00 00 fc ff df 4c 89 fa     48 c1 ea 03 80 3c 02 00 0f 84 b9 fe ff ff 4c 89 ff e8 7c 0f d7 f9 e9 ac fe ff ff e8 c2 13 8a f9 <0f> 0b e9     28 fc ff ff e8 b6 13 8a f9 48 8b 54 24 70 48 b8 00 00 00 RSP: 0018:ffffc90002e4f520 EFLAGS: 00010212 RAX:
    0000000000000324 RBX: ffff88804d5fd500 RCX: ffffc90005b52000 RDX: 0000000000040000 RSI: ffffffff87f05e3e     RDI: 0000000000000003 RBP: ffffc90002e4f650 R08: 0000000000000003 R09: 000000000000ffff R10:
    000000000000ffff R11: 0000000000000000 R12: 000000000000ffff R13: 0000000000000000 R14: 000000000000ffcd     R15: 000000000000001f FS: 00007f3babba9700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010     DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000080 CR3: 0000000075319000 CR4: 00000000003506e0     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
    00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> geneve_xmit_skb drivers/net/geneve.c:927     [inline] geneve_xmit+0xcf8/0x35d0 drivers/net/geneve.c:1107 __netdev_start_xmit     include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline]
    __dev_direct_xmit+0x500/0x730 net/core/dev.c:4309 dev_direct_xmit include/linux/netdevice.h:3007 [inline]     packet_direct_xmit+0x1b8/0x2c0 net/packet/af_packet.c:282 packet_snd net/packet/af_packet.c:3073 [inline]     packet_sendmsg+0x21f4/0x55d0 net/packet/af_packet.c:3104 sock_sendmsg_nosec net/socket.c:714 [inline]     sock_sendmsg+0xcf/0x120 net/socket.c:734 ____sys_sendmsg+0x6eb/0x810 net/socket.c:2489
    ___sys_sendmsg+0xf3/0x170 net/socket.c:2543 __sys_sendmsg net/socket.c:2572 [inline] __do_sys_sendmsg     net/socket.c:2581 [inline] __se_sys_sendmsg net/socket.c:2579 [inline] __x64_sys_sendmsg+0x132/0x220     net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0     arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f3baaa89109 Code: ff ff     c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b     4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP:
    002b:00007f3babba9168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX:
    00007f3baab9bf60 RCX: 00007f3baaa89109 RDX: 0000000000000000 RSI: 0000000020000a00 RDI: 0000000000000003     RBP: 00007f3baaae305d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11:
    0000000000000246 R12: 0000000000000000 R13: 00007ffe74f2543f R14: 00007f3babba9300 R15: 0000000000022000     </TASK> (CVE-2022-49663)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.15.54-25.126. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2022-005 advisory.

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365)

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-33740)

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-33741)

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-33742)

    network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data     Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further     processing to nevertheless be freed. (CVE-2022-33743)

    A heap buffer overflow flaw was found in the Linux kernel's Netfilter subsystem in the way a user provides     incorrect input of the NFT_DATA_VERDICT type. This flaw allows a local user to crash or potentially     escalate their privileges on the system. (CVE-2022-34918)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Fix crash during module load unload test (CVE-2022-49160)

    In the Linux kernel, the following vulnerability has been resolved:

    block: fix rq-qos breakage from skipping rq_qos_done_bio() (CVE-2022-49266)

    In the Linux kernel, the following vulnerability has been resolved:

    module: fix [e_shstrndx].sh_size=0 OOB access (CVE-2022-49444)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals (CVE-2022-49658)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix lockdep splat in in6_dump_addrs() (CVE-2022-49662)

    In the Linux kernel, the following vulnerability has been resolved:

    tunnels: do not assume mac header is set in skb_tunnel_check_pmtu() (CVE-2022-49663)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: move bc link creation back to tipc_node_create (CVE-2022-49664)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bonding: fix use-after-free after 802.3ad slave unbind (CVE-2022-49667)

    In the Linux kernel, the following vulnerability has been resolved:

    linux/dim: Fix divide by 0 in RDMA DIM (CVE-2022-49670)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/cm: Fix memory leak in ib_cm_insert_listen (CVE-2022-49671)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tun: unlink NAPI from device on destruction (CVE-2022-49672)

    In the Linux kernel, the following vulnerability has been resolved:

    dm raid: fix KASAN warning in raid5_add_disks (CVE-2022-49673)

    In the Linux kernel, the following vulnerability has been resolved:

    dm raid: fix accesses beyond end of raid member array (CVE-2022-49674)

    In the Linux kernel, the following vulnerability has been resolved:

    tick/nohz: unexport __init-annotated tick_nohz_full_setup() (CVE-2022-49675)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio_net: fix xdp_rxq_info bug after suspend/resume (CVE-2022-49687)

    In the Linux kernel, the following vulnerability has been resolved:

    afs: Fix dynamic root getattr (CVE-2022-49688)

    In the Linux kernel, the following vulnerability has been resolved:

    erspan: do not assume transport header is always set (CVE-2022-49691)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: fix a use-after-free issue in igb_clean_tx_ring (CVE-2022-49695)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix use-after-free Read in tipc_named_reinit (CVE-2022-49696)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix request_sock leak in sk lookup helpers (CVE-2022-49697)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: use get_random_u32 instead of prandom (CVE-2022-49698)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/slub: add missing TID updates on slab deactivation (CVE-2022-49700)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix hang during unmount when block group reclaim task is running (CVE-2022-49702)

    In the Linux kernel, the following vulnerability has been resolved:

    sock: redo the psock vs ULP protection check (CVE-2022-49732)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2951 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    The following packages have been upgraded to a later upstream version: kernel (4.18.0). (BZ#2122230,     BZ#2122267)

    Security Fix(es):

    * use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)

    * net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)

    * hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)

    * malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)

    * when setting font with malicious data by ioctl PIO_FONT, kernel will write memory out of bounds     (CVE-2021-33656)

    * possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)

    * use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)

    * KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)

    * KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)

    * netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)

    * race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)

    * media: em28xx: initialize refcount before kref_get (CVE-2022-3239)

    * race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)

    * memory leak in ipv6_renew_options() (CVE-2022-3524)

    * data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)

    * data races around sk->sk_prot (CVE-2022-3567)

    * memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)

    * denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)

    * use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)

    * USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)

    * Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)

    * l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)

    * igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)

    * Executable Space Protection Bypass (CVE-2022-25265)

    * Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

    * unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)

    * TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning     (CVE-2022-39189)

    * Report vmalloc UAF in dvb-core/dmxdev (CVE-2022-41218)

    * u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)

    * use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)

    * use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)

    * BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)

    * Denial of service in beacon protection for P2P-device (CVE-2022-42722)

    * memory corruption in usbmon driver (CVE-2022-43750)

    * NULL pointer dereference in traffic control subsystem (CVE-2022-47929)

    * NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)

    * use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)

    * Soft lockup occurred during __page_mapcount (CVE-2023-1582)

    * slab-out-of-bounds read vulnerabilities in cbq_classify (CVE-2023-23454)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989291 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    tunnels: do not assume mac header is set in skb_tunnel_check_pmtu()

    Recently added debug in commit f9aefd6b2aa3 (net: warn if mac header     was not set) caught a bug in skb_tunnel_check_pmtu(), as shown     in this syzbot report [1].

    In ndo_start_xmit() paths, there is really no need to use skb->mac_header,     because skb->data is supposed to point at it.

    [1] WARNING: CPU: 1 PID: 8604 at include/linux/skbuff.h:2784 skb_mac_header_len     include/linux/skbuff.h:2784 [inline]     WARNING: CPU: 1 PID: 8604 at include/linux/skbuff.h:2784 skb_tunnel_check_pmtu+0x5de/0x2f90     net/ipv4/ip_tunnel_core.c:413     Modules linked in:
    CPU: 1 PID: 8604 Comm: syz-executor.3 Not tainted 5.19.0-rc2-syzkaller-00443-g8720bd951b8e #0     Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011     RIP: 0010:skb_mac_header_len include/linux/skbuff.h:2784 [inline]     RIP: 0010:skb_tunnel_check_pmtu+0x5de/0x2f90 net/ipv4/ip_tunnel_core.c:413     Code: 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 80 3c 02 00 0f 84 b9 fe ff ff 4c 89 ff e8 7c 0f d7 f9 e9     ac fe ff ff e8 c2 13 8a f9 <0f> 0b e9 28 fc ff ff e8 b6 13 8a f9 48 8b 54 24 70 48 b8 00 00 00     RSP: 0018:ffffc90002e4f520 EFLAGS: 00010212     RAX: 0000000000000324 RBX: ffff88804d5fd500 RCX: ffffc90005b52000     RDX: 0000000000040000 RSI: ffffffff87f05e3e RDI: 0000000000000003     RBP: ffffc90002e4f650 R08: 0000000000000003 R09: 000000000000ffff     R10: 000000000000ffff R11: 0000000000000000 R12: 000000000000ffff     R13: 0000000000000000 R14: 000000000000ffcd R15: 000000000000001f     FS: 00007f3babba9700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000     CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: 0000000020000080 CR3: 0000000075319000 CR4: 00000000003506e0     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000     DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400     Call Trace:
    <TASK>     geneve_xmit_skb drivers/net/geneve.c:927 [inline]     geneve_xmit+0xcf8/0x35d0 drivers/net/geneve.c:1107
    __netdev_start_xmit include/linux/netdevice.h:4805 [inline]     netdev_start_xmit include/linux/netdevice.h:4819 [inline]
    __dev_direct_xmit+0x500/0x730 net/core/dev.c:4309     dev_direct_xmit include/linux/netdevice.h:3007 [inline]     packet_direct_xmit+0x1b8/0x2c0 net/packet/af_packet.c:282     packet_snd net/packet/af_packet.c:3073 [inline]     packet_sendmsg+0x21f4/0x55d0 net/packet/af_packet.c:3104     sock_sendmsg_nosec net/socket.c:714 [inline]     sock_sendmsg+0xcf/0x120 net/socket.c:734
    ____sys_sendmsg+0x6eb/0x810 net/socket.c:2489
    ___sys_sendmsg+0xf3/0x170 net/socket.c:2543
    __sys_sendmsg net/socket.c:2572 [inline]
    __do_sys_sendmsg net/socket.c:2581 [inline]
    __se_sys_sendmsg net/socket.c:2579 [inline]
    __x64_sys_sendmsg+0x132/0x220 net/socket.c:2579     do_syscall_x64 arch/x86/entry/common.c:50 [inline]     do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80     entry_SYSCALL_64_after_hwframe+0x46/0xb0     RIP: 0033:0x7f3baaa89109     Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d     89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48     RSP: 002b:00007f3babba9168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e     RAX: ffffffffffffffda RBX: 00007f3baab9bf60 RCX: 00007f3baaa89109     RDX: 0000000000000000 RSI: 0000000020000a00 RDI: 0000000000000003     RBP: 00007f3baaae305d R08: 0000000000000000 R09: 0000000000000000     R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000     R13: 00007ffe74f2543f R14: 00007f3babba9300 R15: 0000000000022000     </TASK>

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.130-118.517. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-018 advisory.

    An out-of-bounds write flaw was found in the Linux kernel's framebuffer-based console driver     functionality in the way a user triggers ioctl FBIOPUT_VSCREENINFO with malicious data. This flaw allows a     local user to crash or potentially escalate their privileges on the system. (CVE-2021-33655)

    There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that     allow attackers to crash linux kernel without any privileges. (CVE-2022-2318)

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365)

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-33740)

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-33741)

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-33742)

    network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data     Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further     processing to nevertheless be freed. (CVE-2022-33743)

    Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree     to keep track of the foreign mappings. Updating of that rbtree is not always done completely with the     related lock held, resulting in a small race window, which can be used by unprivileged guests via PV     devices to cause inconsistencies of the rbtree. These inconsistencies can lead to Denial of Service (DoS)     of dom0, e.g. by causing crashes or the inability to perform further mappings of other guests' memory     pages. (CVE-2022-33744)

    A heap buffer overflow flaw was found in the Linux kernel's Netfilter subsystem in the way a user provides     incorrect input of the NFT_DATA_VERDICT type. This flaw allows a local user to crash or potentially     escalate their privileges on the system. (CVE-2022-34918)

    In the Linux kernel, the following vulnerability has been resolved:

    usbnet: fix memory leak in error case (CVE-2022-49657)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals (CVE-2022-49658)

    In the Linux kernel, the following vulnerability has been resolved:

    tunnels: do not assume mac header is set in skb_tunnel_check_pmtu() (CVE-2022-49663)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: move bc link creation back to tipc_node_create (CVE-2022-49664)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bonding: fix use-after-free after 802.3ad slave unbind (CVE-2022-49667)

    In the Linux kernel, the following vulnerability has been resolved:

    linux/dim: Fix divide by 0 in RDMA DIM (CVE-2022-49670)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/cm: Fix memory leak in ib_cm_insert_listen (CVE-2022-49671)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tun: unlink NAPI from device on destruction (CVE-2022-49672)

    In the Linux kernel, the following vulnerability has been resolved:

    dm raid: fix KASAN warning in raid5_add_disks (CVE-2022-49673)

    In the Linux kernel, the following vulnerability has been resolved:

    dm raid: fix accesses beyond end of raid member array (CVE-2022-49674)

    In the Linux kernel, the following vulnerability has been resolved:

    tick/nohz: unexport __init-annotated tick_nohz_full_setup() (CVE-2022-49675)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio_net: fix xdp_rxq_info bug after suspend/resume (CVE-2022-49687)

    In the Linux kernel, the following vulnerability has been resolved:

    afs: Fix dynamic root getattr (CVE-2022-49688)

    In the Linux kernel, the following vulnerability has been resolved:

    erspan: do not assume transport header is always set (CVE-2022-49691)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: fix a use-after-free issue in igb_clean_tx_ring (CVE-2022-49695)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix use-after-free Read in tipc_named_reinit (CVE-2022-49696)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix request_sock leak in sk lookup helpers (CVE-2022-49697)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: use get_random_u32 instead of prandom (CVE-2022-49698)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/slub: add missing TID updates on slab deactivation (CVE-2022-49700)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8267 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

    * use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

    * smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)

    * NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

    * swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

    * uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)

    * race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

    * use-after-free and memory errors in ext4 when mounting and operating on a corrupted image     (CVE-2022-1184)

    * concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280)

    * kernel info leak issue in pfkey_register (CVE-2022-1353)

    * use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)

    * NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

    * fanotify misuses fd_install() which could lead to use-after-free (CVE-2022-1998)

    * nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)

    * integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

    * slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

    * incomplete clean-up of multi-core shared buffers (aka SBDR) (CVE-2022-21123)

    * incomplete clean-up of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125)

    * incomplete clean-up in specific special register write operations (aka DRPW) (CVE-2022-21166)

    * possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

    * AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816,     CVE-2022-29900)

    * AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)

    * Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

    * double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

    * use after free in SUNRPC subsystem (CVE-2022-28893)

    * use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

    * Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

    * DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

    * nf_tables disallow binding to already bound chain (CVE-2022-39190)

    * nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1027-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
    - CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
    - CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
234407	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1241-1)	Nessus	SuSE Local Security Checks	4/15/2025	10/28/2025	high
273181	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989408)	Nessus	Unity Linux Local Security Checks	11/5/2025	11/5/2025	medium
265107	EulerOS Virtualization 2.13.0 : kernel (EulerOS-SA-2025-2169)	Nessus	Huawei Local Security Checks	9/16/2025	9/16/2025	high
241018	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-1704)	Nessus	Huawei Local Security Checks	6/30/2025	9/25/2025	high
226412	Linux Distros Unpatched Vulnerability : CVE-2022-49663	Nessus	Misc.	3/5/2025	10/28/2025	medium
163352	Amazon Linux 2 : kernel (ALASKERNEL-5.15-2022-005)	Nessus	Amazon Linux Local Security Checks	7/21/2022	10/27/2025	high
175900	RHEL 8 : kernel (RHSA-2023:2951)	Nessus	Red Hat Local Security Checks	5/17/2023	9/10/2025	high
241015	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-1689)	Nessus	Huawei Local Security Checks	6/30/2025	9/25/2025	high
273891	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989291)	Nessus	Unity Linux Local Security Checks	11/5/2025	11/5/2025	medium
163382	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-018)	Nessus	Amazon Linux Local Security Checks	7/22/2022	10/27/2025	high
167620	RHEL 9 : kernel (RHSA-2022:8267)	Nessus	Red Hat Local Security Checks	11/16/2022	9/12/2025	high
233410	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1027-1)	Nessus	SuSE Local Security Checks	3/27/2025	9/24/2025	high
265114	EulerOS Virtualization 2.13.1 : kernel (EulerOS-SA-2025-2168)	Nessus	Huawei Local Security Checks	9/16/2025	9/16/2025	high

Detections

Analytics

Plugins Search

high

medium

high

high

medium

high

high

high

medium

high

high

high

high