The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0317-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
    - CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
    - CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
    - CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
    - CVE-2024-56590: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (bsc#1235038).
    - CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
    - CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
    - CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
    - CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
    - CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
    - CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
    - CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
    - CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
    - CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
    - CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
    - CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).

    The following non security issues were fixed:

    - ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (git-fixes).
    - ACPI: PRM: Remove unnecessary strict handler address checks (git-fixes).
    - ACPI: property: Do not pass NULL handles to acpi_attach_data() (git-fixes).
    - ACPI: property: Fix buffer properties extraction for subnodes (git-fixes).
    - KVM: SVM: Fix TSC_AUX virtualization setup (git-fixes).
    - RDMA/cm: Rate limit destroy CM ID timeout error message (git-fixes).
    - RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes).
    - RDMA/hns: Fix the modification of max_send_sge (git-fixes).
    - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes).
    - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes).
    - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
    - RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes).
    - RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes).
    - RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes).
    - RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes).
    - RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes).
    - RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
    - arch/idle: Change arch_cpu_idle() behavior: always exit with IRQs disabled (git-fixes).
    - cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls (git-fixes).
    - cpuidle: Move IRQ state validation (git-fixes).
    - cpuidle: haltpoll: Do not enable interrupts when entering idle (git-fixes).
    - dm: free table mempools if not used in __bind (git-fixes).
    - padata: Honor the caller's alignment in case of chunk_size 0 (bsc#1237563).
    - platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (git-fixes).
    - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (git-fixes).
    - x86/bugs: Use SBPB in write_ibpb() if applicable (git-fixes).
    - x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (git-fixes).
    - x86/tdx: Drop flags from __tdx_hypercall() (git-fixes).
    - x86/tdx: Dynamically disable SEPT violations from causing #VEs (git-fixes).
    - x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (git-fixes).
    - x86/tdx: Extend TDX_MODULE_CALL to support more TDCALL/SEAMCALL leafs (git-fixes).
    - x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed() (git-fixes).
    - x86/tdx: Fix arch_safe_halt() execution for TDX VMs (git-fixes).
    - x86/tdx: Introduce wrappers to read and write TD metadata (git-fixes).
    - x86/tdx: Make TDX_HYPERCALL asm similar to TDX_MODULE_CALL (git-fixes).
    - x86/tdx: Make macros of TDCALLs consistent with the spec (git-fixes).
    - x86/tdx: Pass TDCALL/SEAMCALL input/output registers via a structure (git-fixes).
    - x86/tdx: Reimplement __tdx_hypercall() using TDX_MODULE_CALL asm (git-fixes).
    - x86/tdx: Remove 'struct tdx_hypercall_args' (git-fixes).
    - x86/tdx: Remove TDX_HCALL_ISSUE_STI (git-fixes).
    - x86/tdx: Rename __tdx_module_call() to __tdcall() (git-fixes).
    - x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup() (git-fixes).
    - x86/tdx: Retry partially-completed page conversion hypercalls (git-fixes).
    - x86/tdx: Skip saving output regs when SEAMCALL fails with VMFailInvalid (git-fixes).
    - x86/tdx: Zero out the missing RSI in TDX_HYPERCALL macro (git-fixes).
    - x86/virt/tdx: Make TDX_MODULE_CALL handle SEAMCALL #UD and #GP (git-fixes).
    - x86/virt/tdx: Wire up basic SEAMCALL functions (git-fixes).
    - xfs: fix sparse inode limits on runt AG (bsc#1254392).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.304-226.531. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1932 advisory.

    Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC     interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It     appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol     headers are all contained within the linear section of the SKB and some NICs behave badly if this is not     the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x)     though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with     split headers, netback will forward those violating above mentioned assumption to the networking core,     resulting in said misbehavior. (CVE-2022-3643)

    Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329). (CVE-2022-42328)

    Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329). (CVE-2022-42329)

    An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c     has an integer wraparound via L2CAP_CONF_REQ packets. (CVE-2022-45934)

    In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows     an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control     configuration that is set up with tc qdisc and tc class commands. This affects qdisc_graft in     net/sched/sch_api.c. (CVE-2022-47929)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix preallocation discarding at indirect extent boundary (CVE-2022-48946)

    In the Linux kernel, the following vulnerability has been resolved:

    Bluetooth: L2CAP: Fix u8 overflow (CVE-2022-48947)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: Initialize mailbox message for VF reset (CVE-2022-48949)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: avoid use-after-free in ip6_fragment() (CVE-2022-48956)

    In the Linux kernel, the following vulnerability has been resolved:

    mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() (CVE-2022-48972)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: fix shift-out-of-bounds in hid_report_raw_event (CVE-2022-48978)

    In the Linux kernel, the following vulnerability has been resolved:

    media: v4l2-dv-timings.c: fix too strict blanking sanity checks (CVE-2022-48987)

    In the Linux kernel, the following vulnerability has been resolved:

    memcg: fix possible use-after-free in memcg_write_event_control() (CVE-2022-48988)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths (CVE-2022-48991)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: vub300: fix return value check of mmc_add_host() (CVE-2022-50251)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: Do not free q_vector unless new one was allocated (CVE-2022-50252)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: make sure skb->len != 0 when redirecting to a tunneling device (CVE-2022-50253)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: Add the missed acpi_put_table() to fix memory leak (CVE-2022-50275)

    In the Linux kernel, the following vulnerability has been resolved:

    PNP: fix name memory leak in pnp_alloc_dev() (CVE-2022-50278)

    In the Linux kernel, the following vulnerability has been resolved:

    pnode: terminate at peers of source (CVE-2022-50280)

    In the Linux kernel, the following vulnerability has been resolved:

    chardev: fix error handling in cdev_device_add() (CVE-2022-50282)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: jfs: fix shift-out-of-bounds in dbDiscardAG (CVE-2022-50333)

    In the Linux kernel, the following vulnerability has been resolved:

    rapidio: fix possible name leaks when rio_add_device() fails (CVE-2022-50343)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: init quota for 'old.inode' in 'ext4_rename' (CVE-2022-50346)

    In the Linux kernel, the following vulnerability has been resolved:

    misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() (CVE-2022-50349)

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: Account for tail adjustment during pull operations (CVE-2022-50365)

    In the Linux kernel, the following vulnerability has been resolved:

    md: fix a crash in mempool_free (CVE-2022-50381)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak (CVE-2022-50389)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (CVE-2022-50401)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tunnel: wait until all sk_user_data reader finish before releasing the sock (CVE-2022-50405)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Fix error code path in acpi_ds_call_control_method() (CVE-2022-50411)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails (CVE-2022-50414)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (CVE-2022-50423)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING (CVE-2022-50430)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-mq: fix possible memleak when register 'hctx' failed (CVE-2022-50434)

    In the Linux kernel, the following vulnerability has been resolved:

    MIPS: vpe-mt: fix possible memory leak while module exiting (CVE-2022-50462)

    In the Linux kernel, the following vulnerability has been resolved:

    macintosh: fix possible memory leak in macio_add_one_device() (CVE-2022-50474)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() (CVE-2022-50478)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache: Fix UAF in destroy() (CVE-2022-50496)

    In the Linux kernel, the following vulnerability has been resolved:

    binfmt_misc: fix shift-out-of-bounds in check_special_flags (CVE-2022-50497)

    In the Linux kernel, the following vulnerability has been resolved:

    mtd: lpddr2_nvm: Fix possible null-ptr-deref (CVE-2022-50503)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: Fix pci device refcount leak in ppr_notifier() (CVE-2022-50505)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() (CVE-2022-50520)

    In the Linux kernel, the following vulnerability has been resolved:

    mcb: mcb-parse: fix error handing in chameleon_parse_gdd() (CVE-2022-50522)

    In the Linux kernel, the following vulnerability has been resolved:

    dm thin: Use last transaction's pmd->root when commit failed (CVE-2022-50534)

    In the Linux kernel, the following vulnerability has been resolved:

    dm thin: Fix UAF in run_timer_softirq() (CVE-2022-50563)

    In the Linux kernel, the following vulnerability has been resolved:

    mtd: Fix device name leak when register device failed in add_mtd_device() (CVE-2022-50566)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: jfs: fix shift-out-of-bounds in dbAllocAG (CVE-2022-50567)

    In the Linux kernel, the following vulnerability has been resolved:

    class: fix possible memory leak in __class_register() (CVE-2022-50578)

    In the Linux kernel, the following vulnerability has been resolved:

    hfs: fix OOB Read in __hfs_brec_find (CVE-2022-50581)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: amba-pl011: avoid SBSA UART accessing DMACR register (CVE-2022-50625)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: Fix pci_device_is_present() for VFs by checking PF (CVE-2022-50636)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug_on in __es_tree_search caused by bad boot loader inode (CVE-2022-50638)

    In the Linux kernel, the following vulnerability has been resolved:

    uio: uio_dmem_genirq: Fix missing unlock in irq configuration (CVE-2022-50652)

    In the Linux kernel, the following vulnerability has been resolved:

    ppp: associate skb with a device at tx (CVE-2022-50655)

    In the Linux kernel, the following vulnerability has been resolved:

    mrp: introduce active flags to prevent UAF when applicant uninit (CVE-2022-50697)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid1: stop mdx_raid1 thread when raid1 array run failed (CVE-2022-50715)

    In the Linux kernel, the following vulnerability has been resolved:

    hfs: Fix OOB Write in hfs_asc2mac (CVE-2022-50747)

    In the Linux kernel, the following vulnerability has been resolved:

    acct: fix potential integer overflow in encode_comp_t() (CVE-2022-50749)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Avoid double brelse() in udf_rename() (CVE-2022-50755)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/xen: Fix memory leak in xen_init_lock_cpu() (CVE-2022-50761)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak (CVE-2022-50824)

    In the Linux kernel, the following vulnerability has been resolved:

    net: stream: purge sk_error_queue in sk_stream_kill_queues() (CVE-2022-50838)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix inode leak in ext4_xattr_inode_create() on an error path (CVE-2022-50845)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: via-sdmmc: fix return value check of mmc_add_host() (CVE-2022-50846)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP (CVE-2022-50849)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: ipr: Fix WARNING in ipr_init() (CVE-2022-50850)

    In the Linux kernel, the following vulnerability has been resolved:

    hwrng: amd - Fix PCI device refcount leak (CVE-2022-50868)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed (CVE-2022-50885)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: toshsd: fix return value check of mmc_add_host() (CVE-2022-50886)

    In the Linux kernel, the following vulnerability has been resolved:

    regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() (CVE-2022-50887)

    The Linux kernel does not correctly mitigate SMT attacks, as discovered through a strange pattern in the     kernel API using STIBP as a mitigation, leaving the process exposed for a short period of time after a     syscall. The kernel also does not issue an IBPB immediately during the syscall. (CVE-2023-0045)

    A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

    Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as     well as insufficient hardening of the usercopy functions against spectre-v1. (CVE-2023-0459)

    There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege.

    There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock.

    When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket.
    The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is     created from the listener, the context is inherited and vulnerable.

    The setsockopt TCP_ULP operation does not require any privilege.

    We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

    atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition     rather than valid classification results). (CVE-2023-23455)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix general protection fault in nilfs_btree_insert() (CVE-2023-52900)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: xhci: Check endpoint is valid before dereferencing it (CVE-2023-52901)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. (CVE-2023-53032)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: rndis_host: Secure rndis_query check against int overflow (CVE-2023-54110)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013793 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    uio: uio_dmem_genirq: Fix missing unlock in irq configuration

    Commit b74351287d4b (uio: fix a sleep-in-atomic-context bug in     uio_dmem_genirq_irqcontrol()) started calling disable_irq() without     holding the spinlock because it can sleep. However, that fix introduced     another bug: if interrupt is already disabled and a new disable request     comes in, then the spinlock is not unlocked:

    root@localhost:~# printf '\x00\x00\x00\x00' > /dev/uio0     root@localhost:~# printf '\x00\x00\x00\x00' > /dev/uio0     root@localhost:~# [   14.851538] BUG: scheduling while atomic: bash/223/0x00000002     [   14.851991] Modules linked in: uio_dmem_genirq uio myfpga(OE) bochs drm_vram_helper drm_ttm_helper ttm     drm_kms_helper drm snd_pcm ppdev joydev psmouse snd_timer snd e1000fb_sys_fops syscopyarea parport     sysfillrect soundcore sysimgblt input_leds pcspkr i2c_piix4 serio_raw floppy evbug qemu_fw_cfg mac_hid     pata_acpi ip_tables x_tables autofs4 [last unloaded: parport_pc]     [   14.854206] CPU: 0 PID: 223 Comm: bash Tainted: G           OE      6.0.0-rc7 #21     [   14.854786] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS     rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014     [   14.855664] Call Trace:
    [   14.855861]  <TASK>     [   14.856025]  dump_stack_lvl+0x4d/0x67     [   14.856325]  dump_stack+0x14/0x1a     [   14.856583]  __schedule_bug.cold+0x4b/0x5c     [   14.856915]  __schedule+0xe81/0x13d0     [   14.857199]  ? idr_find+0x13/0x20     [   14.857456]  ? get_work_pool+0x2d/0x50     [   14.857756]  ? __flush_work+0x233/0x280     [   14.858068]  ? __schedule+0xa95/0x13d0     [   14.858307]  ? idr_find+0x13/0x20     [   14.858519]  ? get_work_pool+0x2d/0x50     [   14.858798]  schedule+0x6c/0x100     [   14.859009]  schedule_hrtimeout_range_clock+0xff/0x110     [   14.859335]  ? tty_write_room+0x1f/0x30     [   14.859598]  ? n_tty_poll+0x1ec/0x220     [   14.859830]  ? tty_ldisc_deref+0x1a/0x20     [   14.860090]  schedule_hrtimeout_range+0x17/0x20     [   14.860373]  do_select+0x596/0x840     [   14.860627]  ? __kernel_text_address+0x16/0x50     [   14.860954]  ? poll_freewait+0xb0/0xb0     [   14.861235]  ? poll_freewait+0xb0/0xb0     [   14.861517]  ? rpm_resume+0x49d/0x780     [   14.861798]  ? common_interrupt+0x59/0xa0     [   14.862127]  ? asm_common_interrupt+0x2b/0x40     [   14.862511]  ? __uart_start.isra.0+0x61/0x70     [   14.862902]  ? __check_object_size+0x61/0x280     [   14.863255]  core_sys_select+0x1c6/0x400     [   14.863575]  ? vfs_write+0x1c9/0x3d0     [   14.863853]  ? vfs_write+0x1c9/0x3d0     [   14.864121]  ? _copy_from_user+0x45/0x70     [   14.864526]  do_pselect.constprop.0+0xb3/0xf0     [   14.864893]  ? do_syscall_64+0x6d/0x90     [   14.865228]  ? do_syscall_64+0x6d/0x90     [   14.865556]  __x64_sys_pselect6+0x76/0xa0     [   14.865906]  do_syscall_64+0x60/0x90     [   14.866214]  ? syscall_exit_to_user_mode+0x2a/0x50     [   14.866640]  ? do_syscall_64+0x6d/0x90     [   14.866972]  ? do_syscall_64+0x6d/0x90     [   14.867286]  ? do_syscall_64+0x6d/0x90     [   14.867626]  entry_SYSCALL_64_after_hwframe+0x63/0xcd     [...] stripped     [   14.872959]  </TASK>

    ('myfpga' is a simple 'uio_dmem_genirq' driver I wrote to test this)

    The implementation of uio_dmem_genirq was based on uio_pdrv_genirq and     it is used in a similar manner to the uio_pdrv_genirq driver with respect     to interrupt configuration and handling. At the time uio_dmem_genirq was     introduced, both had the same implementation of the 'uio_info' handlers     irqcontrol() and handler(). Then commit 34cb27528398 (UIO: Fix concurrency     issue), which was only applied to uio_pdrv_genirq, ended up making them     a little different. That commit, among other things, changed disable_irq()     to disable_irq_nosync() in the implementation of irqcontrol(). The     motivation there was to avoid a deadlock between irqcontrol() and     handler(), since it added a spinlock in the irq handler, and disable_irq()     waits for the completion of the irq handler.

    By changing disable_irq() to disable_irq_nosync() in irqcontrol(), we also     avoid the sleeping-whil
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010813 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    uio: uio_dmem_genirq: Fix missing unlock in irq configuration

    Commit b74351287d4b (uio: fix a sleep-in-atomic-context bug in     uio_dmem_genirq_irqcontrol()) started calling disable_irq() without     holding the spinlock because it can sleep. However, that fix introduced     another bug: if interrupt is already disabled and a new disable request     comes in, then the spinlock is not unlocked:

    root@localhost:~# printf '\x00\x00\x00\x00' > /dev/uio0     root@localhost:~# printf '\x00\x00\x00\x00' > /dev/uio0     root@localhost:~# [   14.851538] BUG: scheduling while atomic: bash/223/0x00000002     [   14.851991] Modules linked in: uio_dmem_genirq uio myfpga(OE) bochs drm_vram_helper drm_ttm_helper ttm     drm_kms_helper drm snd_pcm ppdev joydev psmouse snd_timer snd e1000fb_sys_fops syscopyarea parport     sysfillrect soundcore sysimgblt input_leds pcspkr i2c_piix4 serio_raw floppy evbug qemu_fw_cfg mac_hid     pata_acpi ip_tables x_tables autofs4 [last unloaded: parport_pc]     [   14.854206] CPU: 0 PID: 223 Comm: bash Tainted: G           OE      6.0.0-rc7 #21     [   14.854786] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS     rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014     [   14.855664] Call Trace:
    [   14.855861]  <TASK>     [   14.856025]  dump_stack_lvl+0x4d/0x67     [   14.856325]  dump_stack+0x14/0x1a     [   14.856583]  __schedule_bug.cold+0x4b/0x5c     [   14.856915]  __schedule+0xe81/0x13d0     [   14.857199]  ? idr_find+0x13/0x20     [   14.857456]  ? get_work_pool+0x2d/0x50     [   14.857756]  ? __flush_work+0x233/0x280     [   14.858068]  ? __schedule+0xa95/0x13d0     [   14.858307]  ? idr_find+0x13/0x20     [   14.858519]  ? get_work_pool+0x2d/0x50     [   14.858798]  schedule+0x6c/0x100     [   14.859009]  schedule_hrtimeout_range_clock+0xff/0x110     [   14.859335]  ? tty_write_room+0x1f/0x30     [   14.859598]  ? n_tty_poll+0x1ec/0x220     [   14.859830]  ? tty_ldisc_deref+0x1a/0x20     [   14.860090]  schedule_hrtimeout_range+0x17/0x20     [   14.860373]  do_select+0x596/0x840     [   14.860627]  ? __kernel_text_address+0x16/0x50     [   14.860954]  ? poll_freewait+0xb0/0xb0     [   14.861235]  ? poll_freewait+0xb0/0xb0     [   14.861517]  ? rpm_resume+0x49d/0x780     [   14.861798]  ? common_interrupt+0x59/0xa0     [   14.862127]  ? asm_common_interrupt+0x2b/0x40     [   14.862511]  ? __uart_start.isra.0+0x61/0x70     [   14.862902]  ? __check_object_size+0x61/0x280     [   14.863255]  core_sys_select+0x1c6/0x400     [   14.863575]  ? vfs_write+0x1c9/0x3d0     [   14.863853]  ? vfs_write+0x1c9/0x3d0     [   14.864121]  ? _copy_from_user+0x45/0x70     [   14.864526]  do_pselect.constprop.0+0xb3/0xf0     [   14.864893]  ? do_syscall_64+0x6d/0x90     [   14.865228]  ? do_syscall_64+0x6d/0x90     [   14.865556]  __x64_sys_pselect6+0x76/0xa0     [   14.865906]  do_syscall_64+0x60/0x90     [   14.866214]  ? syscall_exit_to_user_mode+0x2a/0x50     [   14.866640]  ? do_syscall_64+0x6d/0x90     [   14.866972]  ? do_syscall_64+0x6d/0x90     [   14.867286]  ? do_syscall_64+0x6d/0x90     [   14.867626]  entry_SYSCALL_64_after_hwframe+0x63/0xcd     [...] stripped     [   14.872959]  </TASK>

    ('myfpga' is a simple 'uio_dmem_genirq' driver I wrote to test this)

    The implementation of uio_dmem_genirq was based on uio_pdrv_genirq and     it is used in a similar manner to the uio_pdrv_genirq driver with respect     to interrupt configuration and handling. At the time uio_dmem_genirq was     introduced, both had the same implementation of the 'uio_info' handlers     irqcontrol() and handler(). Then commit 34cb27528398 (UIO: Fix concurrency     issue), which was only applied to uio_pdrv_genirq, ended up making them     a little different. That commit, among other things, changed disable_irq()     to disable_irq_nosync() in the implementation of irqcontrol(). The     motivation there was to avoid a deadlock between irqcontrol() and     handler(), since it added a spinlock in the irq handler, and disable_irq()     waits for the completion of the irq handler.

    By changing disable_irq() to disable_irq_nosync() in irqcontrol(), we also     avoid the sleeping-whil
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0617-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
    - CVE-2022-50697: mrp: introduce active flags to prevent UAF when applicant uninit (bsc#1255594).
    - CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
    - CVE-2023-53215: sched/fair: Don't balance task to its current running CPU (bsc#1250397).
    - CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
    - CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
    - CVE-2023-54142: gtp: Fix use-after-free in __gtp_encap_destroy() (bsc#1256095).
    - CVE-2023-54243: netfilter: ebtables: fix table blob use-after-free (bsc#1255908).
    - CVE-2024-28956: x86/its: Enumerate Indirect Target Selection (ITS) bug (bsc#1242006).
    - CVE-2024-36348: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
    - CVE-2024-36349: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
    - CVE-2024-36350: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
    - CVE-2024-36357: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
    - CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).
    - CVE-2024-46854: net: dpaa: Pad packets to ETH_ZLEN (bsc#1231084).
    - CVE-2025-21738: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (bsc#1238917).
    - CVE-2025-38068: crypto: lzo - Fix compression buffer overrun (bsc#1245210).
    - CVE-2025-38129: page_pool: fix inconsistency for page_pool_ring_lock() (bsc#1245723).
    - CVE-2025-38159: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (bsc#1245751).
    - CVE-2025-38375: virtio-net: ensure the received length does not exceed allocated size (bsc#1247177).
    - CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
    - CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
    - CVE-2025-40139: net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward (bsc#1253409).
    - CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
    - CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
    - CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
    - CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
    - CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
    - CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
    - CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
    - CVE-2025-40300: Documentation/hw-vuln: Add VMSCAPE documentation (bsc#1247483).
    - CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
    - CVE-2025-68183: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (bsc#1255251).
    - CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key()     (bsc#1255377).
    - CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
    - CVE-2025-68312: usbnet: Prevents free active kevent (bsc#1255171).
    - CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).
    - CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).
    - CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256623).
    - CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256612).
    - CVE-2025-71112: net: hns3: add VLAN id validation before using (bsc#1256726).
    - CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744).
    - CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf     (bsc#1256779).
    - CVE-2026-22999: net/sched: sch_qfq: do not free existing class in qfq_change_class() (bsc#1257236).
    - CVE-2026-23001: macvlan: fix possible UAF in macvlan_forward_source() (bsc#1257232).
    - CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
    - CVE-2026-23089: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (bsc#1257790).

    The following non security issues were fixed:

    - net: hv_netvsc: reject RSS hash key programming without RX indirection table (bsc#1257473).
    - net: tcp: allow zero-window ACK update the window (bsc#1254767).
    - net: tcp: send zero-window ACK when no memory (bsc#1254767).
    - scsi: storvsc: Process unsupported MODE_SENSE_10 (bsc#1257296).
    - tcp: correct handling of extreme memory squeeze (bsc#1254767).
    - x86/CPU/AMD: Add ZenX generations flags (bsc#1238896).
    - x86/its: Fix crash during dynamic its initialization (bsc#1257771).
    - x86/modules: Set VM_FLUSH_RESET_PERMS in module_alloc() (bsc#1257771).
    - x86: make page fault handling disable interrupts properly (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - uio: uio_dmem_genirq: Fix missing unlock in irq configuration Commit b74351287d4b (uio: fix a sleep-in-     atomic-context bug in uio_dmem_genirq_irqcontrol()) started calling disable_irq() without holding the     spinlock because it can sleep. However, that fix introduced another bug: if interrupt is already disabled     and a new disable request comes in, then the spinlock is not unlocked: root@localhost:~# printf     '\x00\x00\x00\x00' > /dev/uio0 root@localhost:~# printf '\x00\x00\x00\x00' > /dev/uio0 root@localhost:~# [     14.851538] BUG: scheduling while atomic: bash/223/0x00000002 [ 14.851991] Modules linked in:
    uio_dmem_genirq uio myfpga(OE) bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper drm snd_pcm ppdev     joydev psmouse snd_timer snd e1000fb_sys_fops syscopyarea parport sysfillrect soundcore sysimgblt     input_leds pcspkr i2c_piix4 serio_raw floppy evbug qemu_fw_cfg mac_hid pata_acpi ip_tables x_tables     autofs4 [last unloaded: parport_pc] [ 14.854206] CPU: 0 PID: 223 Comm: bash Tainted: G OE 6.0.0-rc7 #21 [     14.854786] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS     rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 14.855664] Call Trace: [ 14.855861] <TASK> [     14.856025] dump_stack_lvl+0x4d/0x67 [ 14.856325] dump_stack+0x14/0x1a [ 14.856583]
    __schedule_bug.cold+0x4b/0x5c [ 14.856915] __schedule+0xe81/0x13d0 [ 14.857199] ? idr_find+0x13/0x20 [     14.857456] ? get_work_pool+0x2d/0x50 [ 14.857756] ? __flush_work+0x233/0x280 [ 14.858068] ?
    __schedule+0xa95/0x13d0 [ 14.858307] ? idr_find+0x13/0x20 [ 14.858519] ? get_work_pool+0x2d/0x50 [     14.858798] schedule+0x6c/0x100 [ 14.859009] schedule_hrtimeout_range_clock+0xff/0x110 [ 14.859335] ?     tty_write_room+0x1f/0x30 [ 14.859598] ? n_tty_poll+0x1ec/0x220 [ 14.859830] ? tty_ldisc_deref+0x1a/0x20 [     14.860090] schedule_hrtimeout_range+0x17/0x20 [ 14.860373] do_select+0x596/0x840 [ 14.860627] ?
    __kernel_text_address+0x16/0x50 [ 14.860954] ? poll_freewait+0xb0/0xb0 [ 14.861235] ?     poll_freewait+0xb0/0xb0 [ 14.861517] ? rpm_resume+0x49d/0x780 [ 14.861798] ? common_interrupt+0x59/0xa0 [     14.862127] ? asm_common_interrupt+0x2b/0x40 [ 14.862511] ? __uart_start.isra.0+0x61/0x70 [ 14.862902] ?
    __check_object_size+0x61/0x280 [ 14.863255] core_sys_select+0x1c6/0x400 [ 14.863575] ?     vfs_write+0x1c9/0x3d0 [ 14.863853] ? vfs_write+0x1c9/0x3d0 [ 14.864121] ? _copy_from_user+0x45/0x70 [     14.864526] do_pselect.constprop.0+0xb3/0xf0 [ 14.864893] ? do_syscall_64+0x6d/0x90 [ 14.865228] ?     do_syscall_64+0x6d/0x90 [ 14.865556] __x64_sys_pselect6+0x76/0xa0 [ 14.865906] do_syscall_64+0x60/0x90 [     14.866214] ? syscall_exit_to_user_mode+0x2a/0x50 [ 14.866640] ? do_syscall_64+0x6d/0x90 [ 14.866972] ?     do_syscall_64+0x6d/0x90 [ 14.867286] ? do_syscall_64+0x6d/0x90 [ 14.867626]     entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] stripped [ 14.872959] </TASK> ('myfpga' is a simple     'uio_dmem_genirq' driver I wrote to test this) The implementation of uio_dmem_genirq was based on     uio_pdrv_genirq and it is used in a similar manner to the uio_pdrv_genirq driver with respect to     interrupt configuration and handling. At the time uio_dmem_genirq was introduced, both had the same     implementation of the 'uio_info' handlers irqcontrol() and handler(). Then commit 34cb27528398 (UIO: Fix     concurrency issue), which was only applied to uio_pdrv_genirq, ended up making them a little different.
    That commit, among other things, changed disable_irq() to disable_irq_nosync() in the implementation of     irqcontrol(). The motivation there was to avoid a deadlock between irqcontrol() and handler(), since it     added a spinlock in the irq handler, and disable_irq() waits for the completion of the irq handler. By     changing disable_irq() to disable_irq_nosync() in irqcontrol(), we also avoid the sleeping-whil
    ---truncated--- (CVE-2022-50652)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
297191	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0317-1)	Nessus	SuSE Local Security Checks	1/30/2026	1/30/2026	high
171216	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-026 (ALASKERNEL-5.10-2023-026)	Nessus	Amazon Linux Local Security Checks	2/8/2023	2/11/2026	high
171229	Amazon Linux 2 : kernel, --advisory ALAS2-2023-1932 (ALAS-2023-1932)	Nessus	Amazon Linux Local Security Checks	2/8/2023	2/11/2026	high
309500	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013793)	Nessus	Unity Linux Local Security Checks	4/22/2026	4/26/2026	medium
170458	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-012 (ALASKERNEL-5.15-2023-012)	Nessus	Amazon Linux Local Security Checks	1/24/2023	2/11/2026	high
171848	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2023-042 (ALASKERNEL-5.4-2023-042)	Nessus	Amazon Linux Local Security Checks	2/23/2023	2/11/2026	high
308658	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010813)	Nessus	Unity Linux Local Security Checks	4/21/2026	4/22/2026	medium
300092	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0617-1)	Nessus	SuSE Local Security Checks	2/28/2026	3/19/2026	medium
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	7/22/2021	3/23/2026	high
278327	Linux Distros Unpatched Vulnerability : CVE-2022-50652	Nessus	Misc.	12/11/2025	2/4/2026	medium

Detections

Analytics

Plugins Search

high

high

high

medium

high

high

medium

medium

high

medium