The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - io-wq: Fix memory leak in worker creation If the CPU mask allocation for a node fails, then the memory     allocated for the 'io_wqe' struct of the current node doesn't get freed on the error handling path, since     it has not yet been added to the 'wqes' array. This was spotted when fuzzing v6.1-rc1 with Syzkaller: BUG:
    memory leak unreferenced object 0xffff8880093d5000 (size 1024): comm syz-executor.2, pid 7701, jiffies     4295048595 (age 13.900s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace:
    [<00000000cb463369>] __kmem_cache_alloc_node+0x18e/0x720 [<00000000147a3f9c>]     kmalloc_node_trace+0x2a/0x130 [<000000004e107011>] io_wq_create+0x7b9/0xdc0 [<00000000c38b2018>]     io_uring_alloc_task_context+0x31e/0x59d [<00000000867399da>] __io_uring_add_tctx_node.cold+0x19/0x1ba     [<000000007e0e7a79>] io_uring_setup.cold+0x1b80/0x1dce [<00000000b545e9f6>]
    __x64_sys_io_uring_setup+0x5d/0x80 [<000000008a8a7508>] do_syscall_64+0x5d/0x90 [<000000004ac08bec>]     entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2022-50639)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.15.75-48.135. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2025-090 advisory.

    A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects     the function nilfs_attach_log_writer of the file fs/nilfs2/segment.c of the component BPF. The     manipulation leads to memory leak. The attack may be initiated remotely. It is recommended to apply a     patch to fix this issue. The identifier VDB-211961 was assigned to this vulnerability. (CVE-2022-3646)

    drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information     from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case.
    (CVE-2022-40768)

    The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer     overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send     buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer     to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC     message with garbage data is still correctly formed according to the specification and is passed forward     to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the     allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (CVE-2022-43945)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Protect against send buffer overflow in NFSv2 READDIR (CVE-2022-50235)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: fix use-after-free on source server when doing inter-server copy (CVE-2022-50241)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: handle the error returned from sctp_auth_asoc_init_active_key (CVE-2022-50243)

    In the Linux kernel, the following vulnerability has been resolved:

    xen/gntdev: Prevent leaking grants (CVE-2022-50257)

    In the Linux kernel, the following vulnerability has been resolved:

    vhost/vsock: Use kvmalloc/kvfree for larger packets. (CVE-2022-50271)

    In the Linux kernel, the following vulnerability has been resolved:

    md: Replace snprintf with scnprintf (CVE-2022-50299)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: Fix hung when signal interrupts nbd_start_device_ioctl() (CVE-2022-50314)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: fix potential use-after-free in jbd2_fc_wait_bufs (CVE-2022-50328)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix null-ptr-deref in ext4_write_info (CVE-2022-50344)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Protect against send buffer overflow in NFSv3 READ (CVE-2022-50345)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: Fix a memory leak in an error handling path (CVE-2022-50348)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix race between quota enable and quota rescan ioctl (CVE-2022-50379)

    In the Linux kernel, the following vulnerability has been resolved:

    net/ieee802154: reject zero-sized raw_sendmsg() (CVE-2022-50397)

    In the Linux kernel, the following vulnerability has been resolved:

    net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory (CVE-2022-50409)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Protect against send buffer overflow in NFSv2 READ (CVE-2022-50410)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() (CVE-2022-50422)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid crash when inline data creation follows DIO write (CVE-2022-50435)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: Reinject transport-mode packets through workqueue (CVE-2022-50445)

    In the Linux kernel, the following vulnerability has been resolved:

    xen/gntdev: Accommodate VMA splitting (CVE-2022-50471)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/mipi-dsi: Detach devices when removing the host (CVE-2022-50489)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Propagate error from htab_lock_bucket() to userspace (CVE-2022-50490)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix potential memory leak in ext4_fc_record_regions() (CVE-2022-50512)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() (CVE-2022-50544)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: Update ipcomp_scratches with NULL when freed (CVE-2022-50569)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: ftrace: fix module PLTs with mcount (CVE-2022-50579)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-throttle: prevent overflow while calculating wait time (CVE-2022-50580)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix potential memory leak in ext4_fc_record_modified_inode() (CVE-2022-50622)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: hugetlb: fix UAF in hugetlb_handle_userfault (CVE-2022-50630)

    In the Linux kernel, the following vulnerability has been resolved:

    io-wq: Fix memory leak in worker creation (CVE-2022-50639)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix reference state management for synchronous callbacks (CVE-2022-50650)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/siw: Fix QP destroy to wait for all references dropped. (CVE-2022-50666)

    In the Linux kernel, the following vulnerability has been resolved:

    net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() (CVE-2022-50676)

    In the Linux kernel, the following vulnerability has been resolved:

    net/ieee802154: don't warn zero-sized raw_sendmsg() (CVE-2022-50706)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: akcipher - default implementation for setting a private key (CVE-2022-50731)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk() (CVE-2022-50752)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer (CVE-2022-50766)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: add miss release buffer head in fc_do_one_pass() (CVE-2022-50835)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: fix potential buffer head reference count leak (CVE-2022-50839)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message (CVE-2022-50859)

    In the Linux kernel, the following vulnerability has been resolved:

    drm: Prevent drm_copy_field() to attempt copying a NULL pointer (CVE-2022-50884)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
278037	Linux Distros Unpatched Vulnerability : CVE-2022-50639	Nessus	Misc.	12/10/2025	2/4/2026	medium
266163	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2025-090 (ALASKERNEL-5.15-2025-090)	Nessus	Amazon Linux Local Security Checks	9/30/2025	2/9/2026	high

Detections

Analytics

Plugins Search

medium

high