The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02173-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
    - CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
    - CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
    - CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
    - CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
    - CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
    - CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
    - CVE-2024-28956: x86/its: Add support for ITS-safe indirect thunk (bsc#1242006).
    - CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The version of kernel installed on the remote host is prior to 5.4.226-129.415. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-071 advisory.

    A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request     of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting     in a PCIe link disconnect. (CVE-2022-3169)

    A vulnerability classified as problematic has been found in Linux Kernel. This affects the function     fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to     out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to     fix this issue. The identifier VDB-210357 was assigned to this vulnerability. (CVE-2022-3435)

    In the Linux kernel, the following vulnerability has been resolved:

    char: tpm: Protect tpm_pm_suspend with locks (CVE-2022-48997)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference (CVE-2022-48999)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (CVE-2022-49002)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Free buffers when a used dynamic event is removed (CVE-2022-49006)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() (CVE-2022-49007)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix memory leak in sctp_stream_outq_migrate() (CVE-2022-49013)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tun: Fix use-after-free in tun_detach() (CVE-2022-49014)

    In the Linux kernel, the following vulnerability has been resolved:

    net: hsr: Fix potential use-after-free (CVE-2022-49015)

    In the Linux kernel, the following vulnerability has been resolved:

    net: phy: fix null-ptr-deref while probe() failed (CVE-2022-49021)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix use-after-free when reverting termination table (CVE-2022-49025)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() (CVE-2022-49033)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs: check overflow when iterating ATTR_RECORDs (CVE-2022-49762)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs: fix use-after-free in ntfs_attr_find() (CVE-2022-49763)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: Check sb_bsize_shift after reading superblock (CVE-2022-49769)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: avoid putting the realm twice when decoding snaps fails (CVE-2022-49770)

    In the Linux kernel, the following vulnerability has been resolved:

    dm ioctl: fix misbehavior if list_versions races with module loading (CVE-2022-49771)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: enforce a consistent minimal mtu (CVE-2022-49776)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: i8042 - fix leaking of platform device on module removal (CVE-2022-49777)

    In the Linux kernel, the following vulnerability has been resolved:

    kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case (CVE-2022-49779)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() (CVE-2022-49780)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (CVE-2022-49787)

    In the Linux kernel, the following vulnerability has been resolved:

    misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CVE-2022-49788)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix null pointer dereference in ftrace_add_mod() (CVE-2022-49802)

    In the Linux kernel, the following vulnerability has been resolved:

    drbd: use after free in drbd_create_device() (CVE-2022-49811)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: close race conditions on sk_receive_queue (CVE-2022-49814)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-transport: fix double ata_host_put() in ata_tport_add() (CVE-2022-49826)

    In the Linux kernel, the following vulnerability has been resolved:

    pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (CVE-2022-49832)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix use-after-free bug of ns_writer on remount (CVE-2022-49834)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() (CVE-2022-49840)

    In the Linux kernel, the following vulnerability has been resolved:

    ASoC: core: Fix use-after-free in snd_soc_exit() (CVE-2022-49842)

    In the Linux kernel, the following vulnerability has been resolved:

    can: j1939: j1939_send_one(): fix missing CAN header initialization (CVE-2022-49845)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CVE-2022-49846)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix deadlock in nilfs_count_free_blocks() (CVE-2022-49850)

    In the Linux kernel, the following vulnerability has been resolved:

    net: macvlan: fix memory leaks of macvlan_common_newlink (CVE-2022-49853)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header (CVE-2022-49862)

    In the Linux kernel, the following vulnerability has been resolved:

    can: af_can: fix NULL pointer dereference in can_rx_register() (CVE-2022-49863)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network (CVE-2022-49865)

    In the Linux kernel, the following vulnerability has been resolved:

    bnxt_en: Fix possible crash in bnxt_hwrm_set_coal() (CVE-2022-49869)

    In the Linux kernel, the following vulnerability has been resolved:

    capabilities: fix undefined behavior in bit shift for CAP_TO_MASK (CVE-2022-49870)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tun: Fix memory leaks of napi_get_frags (CVE-2022-49871)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gso: fix panic on frag_list with mixed head alloc types (CVE-2022-49872)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: hyperv: fix possible memory leak in mousevsc_probe() (CVE-2022-49874)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues (CVE-2022-49877)

    A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This     issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc     protocol in the Linux kernel. (CVE-2023-1382)

    In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.
    (CVE-2023-26607)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991119 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs: fix use-after-free in ntfs_attr_find()

    Patch series ntfs: fix bugs about Attribute, v2.

    This patchset fixes three bugs relative to Attribute in record:

    Patch 1 adds a sanity check to ensure that, attrs_offset field in first     mft record loading from disk is within bounds.

    Patch 2 moves the ATTR_RECORD's bounds checking earlier, to avoid     dereferencing ATTR_RECORD before checking this ATTR_RECORD is within     bounds.

    Patch 3 adds an overflow checking to avoid possible forever loop in     ntfs_attr_find().

    Without patch 1 and patch 2, the kernel triggersa KASAN use-after-free     detection as reported by Syzkaller.

    Although one of patch 1 or patch 2 can fix this, we still need both of     them.  Because patch 1 fixes the root cause, and patch 2 not only fixes     the direct cause, but also fixes the potential out-of-bounds bug.


    This patch (of 3):

    Syzkaller reported use-after-free read as follows:
    ==================================================================     BUG: KASAN: use-after-free in ntfs_attr_find+0xc02/0xce0 fs/ntfs/attrib.c:597     Read of size 2 at addr ffff88807e352009 by task syz-executor153/3607

    [...]     Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]      dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106      print_address_description mm/kasan/report.c:317 [inline]      print_report.cold+0x2ba/0x719 mm/kasan/report.c:433      kasan_report+0xb1/0x1e0 mm/kasan/report.c:495      ntfs_attr_find+0xc02/0xce0 fs/ntfs/attrib.c:597      ntfs_attr_lookup+0x1056/0x2070 fs/ntfs/attrib.c:1193      ntfs_read_inode_mount+0x89a/0x2580 fs/ntfs/inode.c:1845      ntfs_fill_super+0x1799/0x9320 fs/ntfs/super.c:2854      mount_bdev+0x34d/0x410 fs/super.c:1400      legacy_get_tree+0x105/0x220 fs/fs_context.c:610      vfs_get_tree+0x89/0x2f0 fs/super.c:1530      do_new_mount fs/namespace.c:3040 [inline]      path_mount+0x1326/0x1e20 fs/namespace.c:3370      do_mount fs/namespace.c:3383 [inline]
     __do_sys_mount fs/namespace.c:3591 [inline]
     __se_sys_mount fs/namespace.c:3568 [inline]
     __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568      do_syscall_x64 arch/x86/entry/common.c:50 [inline]      do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80      entry_SYSCALL_64_after_hwframe+0x63/0xcd      [...]      </TASK>

    The buggy address belongs to the physical page:
    page:ffffea0001f8d400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7e350     head:ffffea0001f8d400 order:3 compound_mapcount:0 compound_pincount:0     flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)     raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888011842140     raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000     page dumped because: kasan: bad access detected     Memory state around the buggy address:
     ffff88807e351f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc      ffff88807e351f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc     >ffff88807e352000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb                           ^      ffff88807e352080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb      ffff88807e352100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb     ==================================================================

    Kernel will loads $MFT/$DATA's first mft record in     ntfs_read_inode_mount().

    Yet the problem is that after loading, kernel doesn't check whether     attrs_offset field is a valid value.

    To be more specific, if attrs_offset field is larger than bytes_allocated     field, then it may trigger the out-of-bounds read bug(reported as     use-after-free bug) in ntfs_attr_find(), when kernel tries to access the     corresponding mft record's attribute.

    This patch solves it by adding the sanity check between attrs_offset field     and bytes_allocated field, after loading the first mft record.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.301-224.520. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1903 advisory.

    A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to     memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
    The identifier VDB-211021 was assigned to this vulnerability. (CVE-2022-3524)

    A use-after-free flaw was found in the Linux kernel's implementation of logical link control and     adaptation protocol (L2CAP), part of the Bluetooth stack in the l2cap_connect and l2cap_le_connect_req     functions. An attacker with physical access within the range of standard Bluetooth transmission could     execute code leaking kernel memory via Bluetooth if within proximity of the victim. (CVE-2022-42896)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (CVE-2022-49002)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() (CVE-2022-49007)

    In the Linux kernel, the following vulnerability has been resolved:

    net: hsr: Fix potential use-after-free (CVE-2022-49015)

    In the Linux kernel, the following vulnerability has been resolved:

    net: phy: fix null-ptr-deref while probe() failed (CVE-2022-49021)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() (CVE-2022-49033)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs: check overflow when iterating ATTR_RECORDs (CVE-2022-49762)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs: fix use-after-free in ntfs_attr_find() (CVE-2022-49763)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: Check sb_bsize_shift after reading superblock (CVE-2022-49769)

    In the Linux kernel, the following vulnerability has been resolved:

    dm ioctl: fix misbehavior if list_versions races with module loading (CVE-2022-49771)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: enforce a consistent minimal mtu (CVE-2022-49776)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (CVE-2022-49787)

    In the Linux kernel, the following vulnerability has been resolved:

    misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CVE-2022-49788)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix null pointer dereference in ftrace_add_mod() (CVE-2022-49802)

    In the Linux kernel, the following vulnerability has been resolved:

    drbd: use after free in drbd_create_device() (CVE-2022-49811)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: close race conditions on sk_receive_queue (CVE-2022-49814)

    In the Linux kernel, the following vulnerability has been resolved:

    pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (CVE-2022-49832)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix use-after-free bug of ns_writer on remount (CVE-2022-49834)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() (CVE-2022-49840)

    In the Linux kernel, the following vulnerability has been resolved:

    ASoC: core: Fix use-after-free in snd_soc_exit() (CVE-2022-49842)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CVE-2022-49846)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix deadlock in nilfs_count_free_blocks() (CVE-2022-49850)

    In the Linux kernel, the following vulnerability has been resolved:

    net: macvlan: fix memory leaks of macvlan_common_newlink (CVE-2022-49853)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header (CVE-2022-49862)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network (CVE-2022-49865)

    In the Linux kernel, the following vulnerability has been resolved:

    capabilities: fix undefined behavior in bit shift for CAP_TO_MASK (CVE-2022-49870)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gso: fix panic on frag_list with mixed head alloc types (CVE-2022-49872)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: hyperv: fix possible memory leak in mousevsc_probe() (CVE-2022-49874)

    In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.
    (CVE-2023-26607)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ntfs: fix use-after-free in ntfs_attr_find() Patch series ntfs: fix bugs about Attribute, v2. This     patchset fixes three bugs relative to Attribute in record: Patch 1 adds a sanity check to ensure that,     attrs_offset field in first mft record loading from disk is within bounds. Patch 2 moves the ATTR_RECORD's     bounds checking earlier, to avoid dereferencing ATTR_RECORD before checking this ATTR_RECORD is within     bounds. Patch 3 adds an overflow checking to avoid possible forever loop in ntfs_attr_find(). Without     patch 1 and patch 2, the kernel triggersa KASAN use-after-free detection as reported by Syzkaller.
    Although one of patch 1 or patch 2 can fix this, we still need both of them. Because patch 1 fixes the     root cause, and patch 2 not only fixes the direct cause, but also fixes the potential out-of-bounds bug.
    This patch (of 3): Syzkaller reported use-after-free read as follows:
    ================================================================== BUG: KASAN: use-after-free in     ntfs_attr_find+0xc02/0xce0 fs/ntfs/attrib.c:597 Read of size 2 at addr ffff88807e352009 by task syz-     executor153/3607 [...] Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline]     dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline]     print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495     ntfs_attr_find+0xc02/0xce0 fs/ntfs/attrib.c:597 ntfs_attr_lookup+0x1056/0x2070 fs/ntfs/attrib.c:1193     ntfs_read_inode_mount+0x89a/0x2580 fs/ntfs/inode.c:1845 ntfs_fill_super+0x1799/0x9320 fs/ntfs/super.c:2854     mount_bdev+0x34d/0x410 fs/super.c:1400 legacy_get_tree+0x105/0x220 fs/fs_context.c:610     vfs_get_tree+0x89/0x2f0 fs/super.c:1530 do_new_mount fs/namespace.c:3040 [inline] path_mount+0x1326/0x1e20     fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline]
    __se_sys_mount fs/namespace.c:3568 [inline] __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568 do_syscall_x64     arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80     entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] </TASK> The buggy address belongs to the physical page:
    page:ffffea0001f8d400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7e350     head:ffffea0001f8d400 order:3 compound_mapcount:0 compound_pincount:0 flags:
    0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 0000000000000000     dead000000000122 ffff888011842140 raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000     page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88807e351f00:
    fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88807e351f80: fc fc fc fc fc fc fc fc fc fc fc fc fc     fc fc fc >ffff88807e352000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88807e352080: fb fb fb     fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807e352100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb     ================================================================== Kernel will loads $MFT/$DATA's first     mft record in ntfs_read_inode_mount(). Yet the problem is that after loading, kernel doesn't check whether     attrs_offset field is a valid value. To be more specific, if attrs_offset field is larger than     bytes_allocated field, then it may trigger the out-of-bounds read bug(reported as use-after-free bug) in     ntfs_attr_find(), when kernel tries to access the corresponding mft record's attribute. This patch solves     it by adding the sanity check between attrs_offset field and bytes_allocated field, after loading the     first mft record. (CVE-2022-49763)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990736 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs: fix use-after-free in ntfs_attr_find()

    Patch series ntfs: fix bugs about Attribute, v2.

    This patchset fixes three bugs relative to Attribute in record:

    Patch 1 adds a sanity check to ensure that, attrs_offset field in first     mft record loading from disk is within bounds.

    Patch 2 moves the ATTR_RECORD's bounds checking earlier, to avoid     dereferencing ATTR_RECORD before checking this ATTR_RECORD is within     bounds.

    Patch 3 adds an overflow checking to avoid possible forever loop in     ntfs_attr_find().

    Without patch 1 and patch 2, the kernel triggersa KASAN use-after-free     detection as reported by Syzkaller.

    Although one of patch 1 or patch 2 can fix this, we still need both of     them.  Because patch 1 fixes the root cause, and patch 2 not only fixes     the direct cause, but also fixes the potential out-of-bounds bug.


    This patch (of 3):

    Syzkaller reported use-after-free read as follows:
    ==================================================================     BUG: KASAN: use-after-free in ntfs_attr_find+0xc02/0xce0 fs/ntfs/attrib.c:597     Read of size 2 at addr ffff88807e352009 by task syz-executor153/3607

    [...]     Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]      dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106      print_address_description mm/kasan/report.c:317 [inline]      print_report.cold+0x2ba/0x719 mm/kasan/report.c:433      kasan_report+0xb1/0x1e0 mm/kasan/report.c:495      ntfs_attr_find+0xc02/0xce0 fs/ntfs/attrib.c:597      ntfs_attr_lookup+0x1056/0x2070 fs/ntfs/attrib.c:1193      ntfs_read_inode_mount+0x89a/0x2580 fs/ntfs/inode.c:1845      ntfs_fill_super+0x1799/0x9320 fs/ntfs/super.c:2854      mount_bdev+0x34d/0x410 fs/super.c:1400      legacy_get_tree+0x105/0x220 fs/fs_context.c:610      vfs_get_tree+0x89/0x2f0 fs/super.c:1530      do_new_mount fs/namespace.c:3040 [inline]      path_mount+0x1326/0x1e20 fs/namespace.c:3370      do_mount fs/namespace.c:3383 [inline]
     __do_sys_mount fs/namespace.c:3591 [inline]
     __se_sys_mount fs/namespace.c:3568 [inline]
     __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568      do_syscall_x64 arch/x86/entry/common.c:50 [inline]      do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80      entry_SYSCALL_64_after_hwframe+0x63/0xcd      [...]      </TASK>

    The buggy address belongs to the physical page:
    page:ffffea0001f8d400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7e350     head:ffffea0001f8d400 order:3 compound_mapcount:0 compound_pincount:0     flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)     raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888011842140     raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000     page dumped because: kasan: bad access detected     Memory state around the buggy address:
     ffff88807e351f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc      ffff88807e351f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc     >ffff88807e352000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb                           ^      ffff88807e352080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb      ffff88807e352100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb     ==================================================================

    Kernel will loads $MFT/$DATA's first mft record in     ntfs_read_inode_mount().

    Yet the problem is that after loading, kernel doesn't check whether     attrs_offset field is a valid value.

    To be more specific, if attrs_offset field is larger than bytes_allocated     field, then it may trigger the out-of-bounds read bug(reported as     use-after-free bug) in ntfs_attr_find(), when kernel tries to access the     corresponding mft record's attribute.

    This patch solves it by adding the sanity check between attrs_offset field     and bytes_allocated field, after loading the first mft record.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992867 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs: fix use-after-free in ntfs_attr_find()

    Patch series ntfs: fix bugs about Attribute, v2.

    This patchset fixes three bugs relative to Attribute in record:

    Patch 1 adds a sanity check to ensure that, attrs_offset field in first     mft record loading from disk is within bounds.

    Patch 2 moves the ATTR_RECORD's bounds checking earlier, to avoid     dereferencing ATTR_RECORD before checking this ATTR_RECORD is within     bounds.

    Patch 3 adds an overflow checking to avoid possible forever loop in     ntfs_attr_find().

    Without patch 1 and patch 2, the kernel triggersa KASAN use-after-free     detection as reported by Syzkaller.

    Although one of patch 1 or patch 2 can fix this, we still need both of     them.  Because patch 1 fixes the root cause, and patch 2 not only fixes     the direct cause, but also fixes the potential out-of-bounds bug.


    This patch (of 3):

    Syzkaller reported use-after-free read as follows:
    ==================================================================     BUG: KASAN: use-after-free in ntfs_attr_find+0xc02/0xce0 fs/ntfs/attrib.c:597     Read of size 2 at addr ffff88807e352009 by task syz-executor153/3607

    [...]     Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]      dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106      print_address_description mm/kasan/report.c:317 [inline]      print_report.cold+0x2ba/0x719 mm/kasan/report.c:433      kasan_report+0xb1/0x1e0 mm/kasan/report.c:495      ntfs_attr_find+0xc02/0xce0 fs/ntfs/attrib.c:597      ntfs_attr_lookup+0x1056/0x2070 fs/ntfs/attrib.c:1193      ntfs_read_inode_mount+0x89a/0x2580 fs/ntfs/inode.c:1845      ntfs_fill_super+0x1799/0x9320 fs/ntfs/super.c:2854      mount_bdev+0x34d/0x410 fs/super.c:1400      legacy_get_tree+0x105/0x220 fs/fs_context.c:610      vfs_get_tree+0x89/0x2f0 fs/super.c:1530      do_new_mount fs/namespace.c:3040 [inline]      path_mount+0x1326/0x1e20 fs/namespace.c:3370      do_mount fs/namespace.c:3383 [inline]
     __do_sys_mount fs/namespace.c:3591 [inline]
     __se_sys_mount fs/namespace.c:3568 [inline]
     __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568      do_syscall_x64 arch/x86/entry/common.c:50 [inline]      do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80      entry_SYSCALL_64_after_hwframe+0x63/0xcd      [...]      </TASK>

    The buggy address belongs to the physical page:
    page:ffffea0001f8d400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7e350     head:ffffea0001f8d400 order:3 compound_mapcount:0 compound_pincount:0     flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)     raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888011842140     raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000     page dumped because: kasan: bad access detected     Memory state around the buggy address:
     ffff88807e351f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc      ffff88807e351f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc     >ffff88807e352000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb                           ^      ffff88807e352080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb      ffff88807e352100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb     ==================================================================

    Kernel will loads $MFT/$DATA's first mft record in     ntfs_read_inode_mount().

    Yet the problem is that after loading, kernel doesn't check whether     attrs_offset field is a valid value.

    To be more specific, if attrs_offset field is larger than bytes_allocated     field, then it may trigger the out-of-bounds read bug(reported as     use-after-free bug) in ntfs_attr_find(), when kernel tries to access the     corresponding mft record's attribute.

    This patch solves it by adding the sanity check between attrs_offset field     and bytes_allocated field, after loading the first mft record.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
241036	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2025:02173-1)	Nessus	SuSE Local Security Checks	7/1/2025	6/25/2026	medium
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	7/22/2021	9/15/2026	high
200364	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2024-071 (ALASKERNEL-5.4-2024-071)	Nessus	Amazon Linux Local Security Checks	6/11/2024	6/4/2026	high
278233	Unity Linux 20.1050e Security Update: kernel (UTSA-2025-991119)	Nessus	Unity Linux Local Security Checks	12/11/2025	12/11/2025	high
168676	Amazon Linux 2 : kernel (ALAS-2022-1903)	Nessus	Amazon Linux Local Security Checks	12/13/2022	2/24/2026	high
244039	Linux Distros Unpatched Vulnerability : CVE-2022-49763	Nessus	Misc.	8/6/2025	7/17/2026	high
275146	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990736)	Nessus	Unity Linux Local Security Checks	11/12/2025	11/12/2025	high
281431	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992867)	Nessus	Unity Linux Local Security Checks	12/31/2025	12/31/2025	high

Detections

Analytics

Plugins Search

medium

high

high

high

high

high

high

high