Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - netcaif修正 cfusbl_device_notify() 中的釋放後使用 syzbot 報告 cfusbl_device_notify() 中存在釋放後使用 [1]。這會導致類似以下的堆疊追踪錯誤: KASAN: 作業 kworker/u4:6/1214 在 cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138 中於 addr ffff88807ac4e6f0 讀取大小為 8 的 8 之 CPU: 0 PID1214 Commkworker/u4:6 未受污染的 5.19。0-rc3-syzkaller-00146-g92f20ff72066#0 硬體名稱Google Google Compute Engine/Google Compute Engine、BIOS Google 01/01/2011 工作佇列
    netns cleanup_net 呼叫追踪 <TASK> __dump_stack lib/dump_stack.c:88 [內嵌] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [內嵌] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138 notifier_call_chain+0xb5/0x200 kernel/ notifier.c:87 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945 call_netdevice_notifiers_extack net/core/dev.c:1983 [內嵌] call_netdevice_notifiers net/core/dev.c:1997 [內嵌] netdev_wait_allrefs_any net/core/ dev.c:10227 [內嵌] netdev_run_todo+0xbc0/0x10f0 net/core/dev.c:10341 default_device_exit_batch+0x44e/0x590 net/core/dev.c:11334 ops_exit_list+0x125/0x170 net/core/net_namespace.c:167 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_f rom_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 </TASK> 取消註冊網路裝置時unregister_netdevice_many_notify() 會將裝置的 reg_state 設定為 NETREG_UNREGISTERING、呼叫具有 NETDEV_UNREGISTER 的通知程式並將裝置新增到待辦事項清單。稍後待辦事項清單中的裝置會由 netdev_run_todo() 處理。 netdev_run_todo() 在 rebdoadcasting NETDEV_UNREGISTER 通知時等候裝置的參照計數變成 1。以 NETDEV_UNREGISTER 多次呼叫 cfusbl_device_notify() 時可能會釋放父項裝置。這可能會造成 UAF。
    多次處理 NETDEV_UNREGISTER 也會造成模組的參照計數不平衡。此修補程式可修正此問題只接受第一個 NETDEV_UNREGISTER 通知。 (CVE-2023-53138)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - netcaif修复 cfusbl_device_notify() 中的释放后使用 syzbot 报告的 cfusbl_device_notify() 中存在释放后使用 [1]。这会造成如下所示的堆栈跟踪 BUGKASANcfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138 通过任务 kworker/u4:6/1214 在 addr ffff88807ac4e6f0 处读取大小 8 CPU 0 PID1214 Commkworker/u4:6 未受感染5.19.0-rc3-syzkaller-00146-g92f20ff72066#0 硬件名称Google Google Compute Engine/Google Compute Engine，BIOS Google 01/01/2011 Workqueue
    netns cleanup_net 调用跟踪 <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [内联] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138 notifier_call_chain+0xb5/0x200 kernel/ notifier.c:87 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945 call_netdevice_notifiers_extack net/core/dev.c:1983 [内联] call_netdevice_notifiers net/core/dev.c:1997 [内联] netdev_wait_allrefs_any net/core/ dev.c:10227 [内联] netdev_run_todo+0xbc0/0x10f0 net/core/dev.c:10341 default_device_exit_batch+0x44e/0x590 net/core/dev.c:11334 ops_exit_list+0x125/0x170 net/core/net_namespace.c:167 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 work_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_f rom_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 </TASK> 取消注册网络设备时unregister_netdevice_many_notify() 将设备的 reg_state 设置为 NETREG_UNREGISTERING使用 NETDEV_UNREGISTER 调用通知程序并将设备添加到待办事项列表。稍后todo 列表中的设备将由 netdev_run_todo() 处理。在 rebdoadcasting NETDEV_UNREGISTER 通知时netdev_run_todo() 等待设备的引用计数变成 1。当多次调用 NETDEV_UNREGISTER 的 cfusbl_device_notify() 时可能会释放父设备。这可能导致 UAF。
    多次处理 NETDEV_UNREGISTER 也会造成该模块的引用计数不平衡。此修补程序通过只接受第一个 NETDEV_UNREGISTER 通知修复 问题。 (CVE-2023-53138)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - netcaifcfusbl_device_notify() の use-after-free を修正します syzbot が cfusbl_device_notify() の use-after-free を報告しました [1]。これにより、以下のようなスタックトレースが発生します バグ KASANタスク kworker/u4:6/1214 CPU による addr ffff88807ac4e6f0 でのサイズ 8 の読み取り0 PID1214 通信kworker/u4:6 5.19 は汚染されていません0-rc3-syzkaller-00146-g92f20ff72066#0 ハードウェア名 Google Google Compute Engine / Google Compute Engine、BIOS Google 2011 年 1 月 1 日 Workqueue
    netns cleanup_net Call Trace <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138 notifier_call_chain+0xb5/0x200 kernel/ notifier.c:87 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945 call_netdevice_notifiers_extack net/core/dev.c:1983 [inline] call_netdevice_notifiers net/core/dev.c:1997 [inline] netdev_wait_allrefs_any net/core/ dev.c:10227 [inline] netdev_run_todo+0xbc0/0x10f0 net/core/dev.c:10341 default_device_exit_batch+0x44e/0x590 net/core/dev.c:11334 ops_exit_list+0x125/0x170 net/core/net_namespace.c:167 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_f rom_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 </TASK> net デバイスを登録解除するとき、unregister_netdevice_many_notify() はデバイスの reg_state を NETREG_UNREGISTERING に設定し、NETDEV_UNREGISTER で通知を呼び出し、デバイスを todo リストに追加します。後で、todo リストのデバイスが netdev_run_todo() によって処理されます。 netdev_run_todo() は、rebdoadcasting NETDEV_UNREGISTER 通知を行う際に、デバイスの参照カウントが 1 になるのを待機します。cfusbl_device_notify() が NETDEV_UNREGISTER で複数回呼び出される場合、親デバイスが解放される可能性があります。これにより、UAF が発生する可能性があります。
    NETDEV_UNREGISTER を複数回処理すると、モジュールの参照カウントのバランスが崩れます。このパッチは、最初の NETDEV_UNREGISTER 通知のみを受け入れることで、 の問題を修正します。CVE-2023-53138

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992672 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: caif: Fix use-after-free in cfusbl_device_notify()

    syzbot reported use-after-free in cfusbl_device_notify() [1].  This     causes a stack trace like below:

    BUG: KASAN: use-after-free in cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138     Read of size 8 at addr ffff88807ac4e6f0 by task kworker/u4:6/1214

    CPU: 0 PID: 1214 Comm: kworker/u4:6 Not tainted 5.19.0-rc3-syzkaller-00146-g92f20ff72066 #0     Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011     Workqueue: netns cleanup_net     Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]      dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106      print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313      print_report mm/kasan/report.c:429 [inline]      kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491      cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138      notifier_call_chain+0xb5/0x200 kernel/notifier.c:87      call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945      call_netdevice_notifiers_extack net/core/dev.c:1983 [inline]      call_netdevice_notifiers net/core/dev.c:1997 [inline]      netdev_wait_allrefs_any net/core/dev.c:10227 [inline]      netdev_run_todo+0xbc0/0x10f0 net/core/dev.c:10341      default_device_exit_batch+0x44e/0x590 net/core/dev.c:11334      ops_exit_list+0x125/0x170 net/core/net_namespace.c:167      cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594      process_one_work+0x996/0x1610 kernel/workqueue.c:2289      worker_thread+0x665/0x1080 kernel/workqueue.c:2436      kthread+0x2e9/0x3a0 kernel/kthread.c:376      ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302      </TASK>

    When unregistering a net device, unregister_netdevice_many_notify()     sets the device's reg_state to NETREG_UNREGISTERING, calls notifiers     with NETDEV_UNREGISTER, and adds the device to the todo list.

    Later on, devices in the todo list are processed by netdev_run_todo().
    netdev_run_todo() waits devices' reference count become 1 while     rebdoadcasting NETDEV_UNREGISTER notification.

    When cfusbl_device_notify() is called with NETDEV_UNREGISTER multiple     times, the parent device might be freed.  This could cause UAF.
    Processing NETDEV_UNREGISTER multiple times also causes inbalance of     reference count for the module.

    This patch fixes the issue by accepting only first NETDEV_UNREGISTER     notification.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990754 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: caif: Fix use-after-free in cfusbl_device_notify()

    syzbot reported use-after-free in cfusbl_device_notify() [1].  This     causes a stack trace like below:

    BUG: KASAN: use-after-free in cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138     Read of size 8 at addr ffff88807ac4e6f0 by task kworker/u4:6/1214

    CPU: 0 PID: 1214 Comm: kworker/u4:6 Not tainted 5.19.0-rc3-syzkaller-00146-g92f20ff72066 #0     Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011     Workqueue: netns cleanup_net     Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]      dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106      print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313      print_report mm/kasan/report.c:429 [inline]      kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491      cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138      notifier_call_chain+0xb5/0x200 kernel/notifier.c:87      call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945      call_netdevice_notifiers_extack net/core/dev.c:1983 [inline]      call_netdevice_notifiers net/core/dev.c:1997 [inline]      netdev_wait_allrefs_any net/core/dev.c:10227 [inline]      netdev_run_todo+0xbc0/0x10f0 net/core/dev.c:10341      default_device_exit_batch+0x44e/0x590 net/core/dev.c:11334      ops_exit_list+0x125/0x170 net/core/net_namespace.c:167      cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594      process_one_work+0x996/0x1610 kernel/workqueue.c:2289      worker_thread+0x665/0x1080 kernel/workqueue.c:2436      kthread+0x2e9/0x3a0 kernel/kthread.c:376      ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302      </TASK>

    When unregistering a net device, unregister_netdevice_many_notify()     sets the device's reg_state to NETREG_UNREGISTERING, calls notifiers     with NETDEV_UNREGISTER, and adds the device to the todo list.

    Later on, devices in the todo list are processed by netdev_run_todo().
    netdev_run_todo() waits devices' reference count become 1 while     rebdoadcasting NETDEV_UNREGISTER notification.

    When cfusbl_device_notify() is called with NETDEV_UNREGISTER multiple     times, the parent device might be freed.  This could cause UAF.
    Processing NETDEV_UNREGISTER multiple times also causes inbalance of     reference count for the module.

    This patch fixes the issue by accepting only first NETDEV_UNREGISTER     notification.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: caif: Fix use-after-free in cfusbl_device_notify() syzbot reported use-after-free in     cfusbl_device_notify() [1]. This causes a stack trace like below: BUG: KASAN: use-after-free in     cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138 Read of size 8 at addr ffff88807ac4e6f0 by task     kworker/u4:6/1214 CPU: 0 PID: 1214 Comm: kworker/u4:6 Not tainted 5.19.0-rc3-syzkaller-00146-g92f20ff72066     #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue:
    netns cleanup_net Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134     lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313     print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491     cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138 notifier_call_chain+0xb5/0x200     kernel/notifier.c:87 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945     call_netdevice_notifiers_extack net/core/dev.c:1983 [inline] call_netdevice_notifiers net/core/dev.c:1997     [inline] netdev_wait_allrefs_any net/core/dev.c:10227 [inline] netdev_run_todo+0xbc0/0x10f0     net/core/dev.c:10341 default_device_exit_batch+0x44e/0x590 net/core/dev.c:11334 ops_exit_list+0x125/0x170     net/core/net_namespace.c:167 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594     process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436     kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 </TASK>     When unregistering a net device, unregister_netdevice_many_notify() sets the device's reg_state to     NETREG_UNREGISTERING, calls notifiers with NETDEV_UNREGISTER, and adds the device to the todo list. Later     on, devices in the todo list are processed by netdev_run_todo(). netdev_run_todo() waits devices'     reference count become 1 while rebdoadcasting NETDEV_UNREGISTER notification. When cfusbl_device_notify()     is called with NETDEV_UNREGISTER multiple times, the parent device might be freed. This could cause UAF.
    Processing NETDEV_UNREGISTER multiple times also causes inbalance of reference count for the module. This     patch fixes the issue by accepting only first NETDEV_UNREGISTER notification. (CVE-2023-53138)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992929 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: caif: Fix use-after-free in cfusbl_device_notify()

    syzbot reported use-after-free in cfusbl_device_notify() [1].  This     causes a stack trace like below:

    BUG: KASAN: use-after-free in cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138     Read of size 8 at addr ffff88807ac4e6f0 by task kworker/u4:6/1214

    CPU: 0 PID: 1214 Comm: kworker/u4:6 Not tainted 5.19.0-rc3-syzkaller-00146-g92f20ff72066 #0     Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011     Workqueue: netns cleanup_net     Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]      dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106      print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313      print_report mm/kasan/report.c:429 [inline]      kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491      cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138      notifier_call_chain+0xb5/0x200 kernel/notifier.c:87      call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945      call_netdevice_notifiers_extack net/core/dev.c:1983 [inline]      call_netdevice_notifiers net/core/dev.c:1997 [inline]      netdev_wait_allrefs_any net/core/dev.c:10227 [inline]      netdev_run_todo+0xbc0/0x10f0 net/core/dev.c:10341      default_device_exit_batch+0x44e/0x590 net/core/dev.c:11334      ops_exit_list+0x125/0x170 net/core/net_namespace.c:167      cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594      process_one_work+0x996/0x1610 kernel/workqueue.c:2289      worker_thread+0x665/0x1080 kernel/workqueue.c:2436      kthread+0x2e9/0x3a0 kernel/kthread.c:376      ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302      </TASK>

    When unregistering a net device, unregister_netdevice_many_notify()     sets the device's reg_state to NETREG_UNREGISTERING, calls notifiers     with NETDEV_UNREGISTER, and adds the device to the todo list.

    Later on, devices in the todo list are processed by netdev_run_todo().
    netdev_run_todo() waits devices' reference count become 1 while     rebdoadcasting NETDEV_UNREGISTER notification.

    When cfusbl_device_notify() is called with NETDEV_UNREGISTER multiple     times, the parent device might be freed.  This could cause UAF.
    Processing NETDEV_UNREGISTER multiple times also causes inbalance of     reference count for the module.

    This patch fixes the issue by accepting only first NETDEV_UNREGISTER     notification.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
245482	Linux Distros 未修補的弱點：CVE-2023-53138	Nessus	Misc.	8/7/2025	11/12/2026	high
245482	Linux Distros 未修补的漏洞：CVE-2023-53138	Nessus	Misc.	8/7/2025	11/12/2026	high
245482	Linux Distros のパッチ未適用の脆弱性: CVE-2023-53138	Nessus	Misc.	8/7/2025	11/12/2026	high
280170	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-992672)	Nessus	Unity Linux Local Security Checks	12/30/2025	12/30/2025	high
275107	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-990754)	Nessus	Unity Linux Local Security Checks	11/12/2025	8/29/2026	high
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	7/22/2021	11/2/2026	high
245482	Linux Distros Unpatched Vulnerability : CVE-2023-53138	Nessus	Misc.	8/7/2025	11/12/2026	high
281394	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992929)	Nessus	Unity Linux Local Security Checks	12/31/2025	8/29/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high