The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - igb: Fix igb_down hung on surprise removal In a setup where a Thunderbolt hub connects to Ethernet and a     display through USB Type-C, users may experience a hung task timeout when they remove the cable between     the PC and the Thunderbolt hub. This is because the igb_down function is called multiple times when the     Thunderbolt hub is unplugged. For example, the igb_io_error_detected triggers the first call, and the     igb_remove triggers the second call. The second call to igb_down will block at napi_synchronize. Here's     the call trace: __schedule+0x3b0/0xddb ? __mod_timer+0x164/0x5d3 schedule+0x44/0xa8     schedule_timeout+0xb2/0x2a4 ? run_local_timers+0x4e/0x4e msleep+0x31/0x38 igb_down+0x12c/0x22a [igb     6615058754948bfde0bf01429257eb59f13030d4] __igb_close+0x6f/0x9c [igb     6615058754948bfde0bf01429257eb59f13030d4] igb_close+0x23/0x2b [igb     6615058754948bfde0bf01429257eb59f13030d4] __dev_close_many+0x95/0xec dev_close_many+0x6e/0x103     unregister_netdevice_many+0x105/0x5b1 unregister_netdevice_queue+0xc2/0x10d unregister_netdev+0x1c/0x23     igb_remove+0xa7/0x11c [igb 6615058754948bfde0bf01429257eb59f13030d4] pci_device_remove+0x3f/0x9c     device_release_driver_internal+0xfe/0x1b4 pci_stop_bus_device+0x5b/0x7f pci_stop_bus_device+0x30/0x7f     pci_stop_bus_device+0x30/0x7f pci_stop_and_remove_bus_device+0x12/0x19 pciehp_unconfigure_device+0x76/0xe9     pciehp_disable_slot+0x6e/0x131 pciehp_handle_presence_or_link_change+0x7a/0x3f7 pciehp_ist+0xbe/0x194     irq_thread_fn+0x22/0x4d ? irq_thread+0x1fd/0x1fd irq_thread+0x17b/0x1fd ? irq_forced_thread_fn+0x5f/0x5f     kthread+0x142/0x153 ? __irq_get_irqchip_state+0x46/0x46 ? kthread_associate_blkcg+0x71/0x71     ret_from_fork+0x1f/0x30 In this case, igb_io_error_detected detaches the network interface and requests a     PCIE slot reset, however, the PCIE reset callback is not being invoked and thus the Ethernet connection     breaks down. As the PCIE error in this case is a non-fatal one, requesting a slot reset can be avoided.
    This patch fixes the task hung issue and preserves Ethernet connection by ignoring non-fatal PCIE errors.
    (CVE-2023-53148)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.4.253-167.359. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-054 advisory.

    A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This     flaw allows an attacker to crash the system and possibly cause a kernel information lea (CVE-2023-1611)

    A flaw in the Linux Kernel found in the GFS2 file system. On corrupted gfs2 file systems the evict code     can try to reference the journal descriptor structure, jdesc, after it has been freed and set to NULL. It     can lead to null pointer dereference when gfs2_trans_begin being called and then fail     ingfs2_evict_inode(). (CVE-2023-3212)

    The fix for XSA-423 added logic to Linux'es netback driver to deal witha frontend splitting a packet in a     way such that not all of the headerswould come in one piece.  Unfortunately the logic introduced     theredidn't account for the extreme case of the entire packet being splitinto as many pieces as permitted     by the protocol, yet still beingsmaller than the area that's specially dealt with to keep all     (possible)headers together.  Such an unusual packet would therefore trigger abuffer overrun in the driver.
    (CVE-2023-34319)

    An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux     kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.
    (CVE-2023-39197)

    A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in     the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to     incorrect handling of the existing filter, leading to a kernel information leak issue. (CVE-2023-4128)

    A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to     bypass network filters and gain unauthorized access to some resources. The original patches fixing     CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits -     a096ccca6e50 (tun: tun_chr_open(): correctly initialize socket uid), - 66b2c338adce (tap: tap_open():
    correctly initialize socket uid), pass inode->i_uid to sock_init_data_uid() as the last parameter and     that turns out to not be accurate. (CVE-2023-4194)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to     achieve local privilege escalation.

    When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into     the new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8. (CVE-2023-4206)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation.

    When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the     new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec. (CVE-2023-4207)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation.

    When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the     new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81. (CVE-2023-4208)

    In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race     condition between a nonblocking atomic commit and a driver unload. (CVE-2023-51043)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (CVE-2023-52885)

    In the Linux kernel, the following vulnerability has been resolved:

    can: bcm: Fix UAF in bcm_proc_show() (CVE-2023-52922)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: Fix igb_down hung on surprise removal (CVE-2023-53148)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Pointer may be dereferenced (CVE-2023-53150)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: prevent soft lockup while flush writes (CVE-2023-53151)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix null pointer dereference in tracing_err_log_open() (CVE-2023-53167)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6/addrconf: fix a potential refcount underflow for idev (CVE-2023-53189)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/fair: Don't balance task to its current running CPU (CVE-2023-53215)

    In the Linux kernel, the following vulnerability has been resolved:

    jfs: jfs_dmap: Validate db_l2nbperpage while mounting (CVE-2023-53222)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue (CVE-2023-53280)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/client: Fix memory leak in drm_client_modeset_probe (CVE-2023-53288)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix wrong setting of max_corr_read_errors (CVE-2023-53313)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Wait for io return on terminate rport (CVE-2023-53322)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one (CVE-2023-53333)

    In the Linux kernel, the following vulnerability has been resolved:

    icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). (CVE-2023-53343)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: check slab-out-of-bounds in md_bitmap_get_counter (CVE-2023-53357)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6mr: Fix skb_under_panic in ip6mr_cache_report() (CVE-2023-53365)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dcb: choose correct policy to parse DCB_ATTR_BCN (CVE-2023-53369)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request (CVE-2023-53380)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free (CVE-2023-53446)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Fix potential NULL pointer dereference (CVE-2023-53451)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx (CVE-2023-53546)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb (CVE-2023-53548)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing/histograms: Add histograms to hist_vars if they have referenced variables (CVE-2023-53560)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (CVE-2023-53619)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Fix deadloop issue on reading trace_pipe (CVE-2023-53668)

    In the Linux kernel, the following vulnerability has been resolved:

    bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent (CVE-2023-53681)

    A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in     net/sctp/socket.c in the Linux kernel's SCTP subsystem. This flaw allows guests with local user privileges     to trigger a deadlock and potentially crash the system. (CVE-2024-0639)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03634-1 advisory.

    The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
    - CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
    - CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
    - CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
    - CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
    - CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
    - CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
    - CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
    - CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
    - CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
    - CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
    - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
    - CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
    - CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
    - CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
    - CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
    - CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
    - CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
    - CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
    - CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
    - CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
    - CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
    - CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
    - CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
    - CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
    - CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
    - CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in     rproc_attach() (bsc#1247136).
    - CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
    - CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()     (bsc#1247167).
    - CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
    - CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
    - CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
    - CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
    - CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
    - CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
    - CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
    - CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
    - CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
    - CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns     (bsc#1247976).
    - CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface     (bsc#1248088).
    - CVE-2025-38506: KVM: Allow CPU to reschedule while setting per-page memory attributes (bsc#1248186).
    - CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
    - CVE-2025-38520: drm/amdkfd: Do not call mmput from MMU notifier callback (bsc#1248217).
    - CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
    - CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
    - CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
    - CVE-2025-38528: bpf: Reject %p% format string in bprintf-like helpers (bsc#1248198).
    - CVE-2025-38531: iio: common: st_sensors: Fix use of uninitialize device structs (bsc#1248205).
    - CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
    - CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
    - CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
    - CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
    - CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
    - CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
    - CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
    - CVE-2025-38585: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (bsc#1248355).
    - CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
    - CVE-2025-38591: bpf: Reject narrower access to pointer ctx fields (bsc#1248363).
    - CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
    - CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
    - CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port     (bsc#1248378).
    - CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
    - CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
    - CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
    - CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
    - CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).
    - CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
    - CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
    - CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
    - CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
    - CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
    - CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data     (bsc#1248647).
    - CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
    - CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
    - CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
    - CVE-2025-38705: drm/amd/pm: fix null pointer access (bsc#1249334).
    - CVE-2025-38709: loop: Avoid updating block size under exclusive owner (bsc#1249199).
    - CVE-2025-38721: netfilter: ctnetlink: fix refcount leak on table dump (bsc#1249176).
    - CVE-2025-38722: habanalabs: fix UAF in export_dmabuf() (bsc#1249163).
    - CVE-2025-38730: io_uring/net: commit partial buffers on retry (bsc#1249172).
    - CVE-2025-38732: netfilter: nf_reject: do not leak dst refcount for loopback packets (bsc#1249262).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
    - CVE-2025-39677: net/sched: Fix backlog accounting in qdisc_dequeue_internal (bsc#1249300).
    - CVE-2025-39678: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL (bsc#1249290).
    - CVE-2025-39681: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (bsc#1249303).
    - CVE-2025-39682: tls: fix handling of zero-length records on the rx_list (bsc#1249284).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39705: drm/amd/display: fix a Null pointer dereference vulnerability (bsc#1249295).
    - CVE-2025-39718: vsock/virtio: Validate length in packet header before skb_put() (bsc#1249305).
    - CVE-2025-39738: btrfs: do not allow relocation of partially dropped subvolumes (bsc#1249540).
    - CVE-2025-39744: rcu: Fix rcu_read_unlock() deadloop due to IRQ work (bsc#1249494).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39749: rcu: Protect ->defer_qs_iw_pending from data race (bsc#1249533).
    - CVE-2025-39754: mm/smaps: fix race between smaps_hugetlb_range and migration (bsc#1249524).
    - CVE-2025-39764: netfilter: ctnetlink: remove refcounting in expectation dumpers (bsc#1249513).
    - CVE-2025-39766: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (bsc#1249510).
    - CVE-2025-39770: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (bsc#1249508).
    - CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
    - CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
    - CVE-2025-39787: soc: qcom: mdt_loader: Deal with zero e_shentsize (bsc#1249545).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39825: smb: client: fix race with concurrent opens in rename(2) (bsc#1250179).
    - CVE-2025-39828: kABI workaround for struct atmdev_ops extension (bsc#1250205).
    - CVE-2025-39832: net/mlx5: Fix lockdep assertion on sync reset unload event (bsc#1249901).
    - CVE-2025-39835: xfs: do not propagate ENODATA disk errors into xattr code (bsc#1250025).
    - CVE-2025-39838: cifs: prevent NULL pointer dereference in UTF16 conversion (bsc#1250365).
    - CVE-2025-39842: ocfs2: prevent release journal inode after journal shutdown (bsc#1250267).
    - CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
    - CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
    - CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
    - CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
    - CVE-2025-39857: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (bsc#1250251).
    - CVE-2025-39865: tee: fix NULL pointer dereference in tee_shm_put (bsc#1250294).
    - CVE-2025-39885: ocfs2: fix recursive semaphore deadlock in fiemap call (bsc#1250407).
    - CVE-2025-40300: x86/vmscape: Warn when STIBP is disabled with SMT (bsc#1247483).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.152-100.162. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-058 advisory.

    A flaw was found in the smb client in the Linux kernel. A potential out-of-bounds error was seen in the     smb2_parse_contexts() function. Validate offsets and lengths before dereferencing create contexts in     smb2_parse_contexts(). (CVE-2023-52434)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix oob in ntfs_listxattr (CVE-2023-52640)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame() (CVE-2023-52641)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: Fix igb_down hung on surprise removal (CVE-2023-53148)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: prevent soft lockup while flush writes (CVE-2023-53151)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/fair: Don't balance task to its current running CPU (CVE-2023-53215)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix mid leak during reconnection after timeout threshold (CVE-2023-53597)

    A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel     hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or     potentially escalate their privileges on the system. (CVE-2024-0841)

    A vulnerability was discovered in the Linux kernel's IPv4 networking stack. Under certain conditions,     MPTCP and NetLabel can be configured in a way that triggers a double free memory error in     net/ipv4/af_inet.c:inet_sock_destruct(). This may lead to a system crash, denial of service, or potential     arbitrary code execution. (CVE-2024-1627)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: regenerate buddy after block freeing failed if under fc replay

    This mostly reverts commit 6bd97bf273bd (ext4: remove redundantmb_regenerate_buddy()) and reintroduces     mb_regenerate_buddy(). Based oncode in mb_free_blocks(), fast commit replay can end up marking as     freeblocks that are already marked as such. This causes corruption of thebuddy bitmap so we need to     regenerate it in that case. (CVE-2024-26601)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/fpu: Stop relying on userspace for info to fault in xsave buffer

    Before this change, the expected size of the user space buffer wastaken from fx_sw->xstate_size.
    fx_sw->xstate_size can be changedfrom user-space, so it is possible construct a sigreturn frame where:

    * fx_sw->xstate_size is smaller than the size required by valid bits infx_sw->xfeatures.* user-space     unmaps parts of the sigrame fpu buffer so that not all ofthe buffer required by xrstor is accessible.

    In this case, xrstor tries to restore and accesses the unmapped areawhich results in a fault. But     fault_in_readable succeeds because buf +fx_sw->xstate_size is within the still mapped area, so it goes     back andtries xrstor again. It will spin in this loop forever.

    Instead, fault in the maximum size which can be touched by XRSTOR (takenfrom fpstate->user_size).

    [ dhansen: tweak subject / changelog ] (CVE-2024-26603)

    In the Linux kernel, the following vulnerability has been resolved:

    xhci: handle isoc Babble and Buffer Overrun events properly (CVE-2024-26659)

    In the Linux kernel, the following vulnerability has been resolved:

    fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (CVE-2024-26688)

    In the Linux kernel, the following vulnerability has been resolved:

    arp: Prevent overflow in arp_req_get(). (CVE-2024-26733)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel (CVE-2024-26737)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Drop oob_skb ref before purging queue in GC. (CVE-2024-26750)

    In the Linux kernel, the following vulnerability has been resolved:

    gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() (CVE-2024-26754)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-crypt: don't modify the data when using authenticated encryption (CVE-2024-26763)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio (CVE-2024-26764)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (CVE-2024-26772)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (CVE-2024-26773)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt (CVE-2024-26774)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix double-free on socket dismantle (CVE-2024-26782)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: dev-replace: properly validate device names (CVE-2024-26791)

    In the Linux kernel, the following vulnerability has been resolved:

    gtp: fix use-after-free and null-ptr-deref in gtp_newlink() (CVE-2024-26793)

    In the Linux kernel, the following vulnerability has been resolved:

    fbcon: always restore the old font data in fbcon_do_set_font() (CVE-2024-26798)

    In the Linux kernel, the following vulnerability has been resolved:

    net: veth: clear GRO when clearing XDP even when down (CVE-2024-26803)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804)

    In the Linux kernel, the following vulnerability has been resolved:

    netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter (CVE-2024-26805)

    In the Linux kernel, the following vulnerability has been resolved:

    hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (CVE-2024-26820)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: set dormant flag on hook register failure (CVE-2024-26835)

    In the Linux kernel, the following vulnerability has been resolved:

    cachefiles: fix memory leak in cachefiles_add_cache() (CVE-2024-26840)

    In the Linux kernel, the following vulnerability has been resolved:

    efi: runtime: Fix potential overflow of soft-reserved region size (CVE-2024-26843)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: core: Add TMF to tmr_list handling (CVE-2024-26845)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_h323: Add protection for bmp length out of range (CVE-2024-26851)

    In the Linux kernel, the following vulnerability has been resolved:

    net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (CVE-2024-26852)

    In the Linux kernel, the following vulnerability has been resolved:

    geneve: make sure to pull inner header in geneve_rx() (CVE-2024-26857)

    In the Linux kernel, the following vulnerability has been resolved:

    net/rds: fix WARNING in rds_conn_connect_if_down (CVE-2024-27024)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_flow_offload: reset dst in route object after setting up flow (CVE-2024-27403)

    In the Linux kernel, the following vulnerability has been resolved:

    efi/capsule-loader: fix incorrect allocation size (CVE-2024-27413)

    In the Linux kernel, the following vulnerability has been resolved:

    rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back (CVE-2024-27414)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: bridge: confirm multicast packets before passing them up the stack (CVE-2024-27415)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix potential struct net leak in inet6_rtm_getaddr() (CVE-2024-27417)

    In the Linux kernel, the following vulnerability has been resolved:

    cpumap: Zero-initialise xdp_rxq_info struct before running XDP program (CVE-2024-27431)

    In the Linux kernel, the following vulnerability has been resolved:

    tls: stop recv() if initial process_rx_list gave us non-DATA (CVE-2024-58239)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.192-182.736. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-039 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests (CVE-2021-47391)

    A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss     of confidentiality. (CVE-2023-20588)

    A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in     net/netfilter/nf_tables_api.c.

    Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same     transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to     cause a privilege escalation issue.

    We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97. (CVE-2023-3390)

    The fix for XSA-423 added logic to Linux'es netback driver to deal witha frontend splitting a packet in a     way such that not all of the headerswould come in one piece.  Unfortunately the logic introduced     theredidn't account for the extreme case of the entire packet being splitinto as many pieces as permitted     by the protocol, yet still beingsmaller than the area that's specially dealt with to keep all     (possible)headers together.  Such an unusual packet would therefore trigger abuffer overrun in the driver.
    (CVE-2023-34319)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the     chain's owner rule can also release the objects in certain circumstances.

    We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8. (CVE-2023-3777)

    A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing     of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local     privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an     information disclosure. (CVE-2023-39194)

    An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux     kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.
    (CVE-2023-39197)

    A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    On an error when building a nftables rule, deactivating immediate expressions in     nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used.

    We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2. (CVE-2023-4015)

    A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in     the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to     incorrect handling of the existing filter, leading to a kernel information leak issue. (CVE-2023-4128)

    netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID (CVE-2023-4147)

    A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to     bypass network filters and gain unauthorized access to some resources. The original patches fixing     CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits -     a096ccca6e50 (tun: tun_chr_open(): correctly initialize socket uid), - 66b2c338adce (tap: tap_open():
    correctly initialize socket uid), pass inode->i_uid to sock_init_data_uid() as the last parameter and     that turns out to not be accurate. (CVE-2023-4194)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to     achieve local privilege escalation.

    When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into     the new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8. (CVE-2023-4206)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation.

    When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the     new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec. (CVE-2023-4207)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation.

    When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the     new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81. (CVE-2023-4208)

    A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation     of the file name reconstruction function, which is responsible for reading file name entries from a     directory index and merging file name parts belonging to one file into a single long file name. Since the     file name characters are copied into a stack variable, a local privileged attacker could use this flaw to     overflow the kernel stack. (CVE-2023-4273)

    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.

    The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without     locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that     is being released by garbage collection, resulting in use-after-free.

    We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

    In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has     a fence use-after-free. (CVE-2023-51042)

    In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race     condition between a nonblocking atomic commit and a driver unload. (CVE-2023-51043)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (CVE-2023-52885)

    In the Linux kernel, the following vulnerability has been resolved:

    can: bcm: Fix UAF in bcm_proc_show() (CVE-2023-52922)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: add NULL check in xfrm_update_ae_params (CVE-2023-53147)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: Fix igb_down hung on surprise removal (CVE-2023-53148)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Pointer may be dereferenced (CVE-2023-53150)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: prevent soft lockup while flush writes (CVE-2023-53151)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix uninitialized array access for some pathnames (CVE-2023-53165)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix null pointer dereference in tracing_err_log_open() (CVE-2023-53167)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fix possible memory leak if device_add() fails (CVE-2023-53174)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6/addrconf: fix a potential refcount underflow for idev (CVE-2023-53189)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: Fix nexthop hash size (CVE-2023-53192)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/fair: Don't balance task to its current running CPU (CVE-2023-53215)

    In the Linux kernel, the following vulnerability has been resolved:

    nubus: Partially revert proc_create_single_data() conversion (CVE-2023-53217)

    In the Linux kernel, the following vulnerability has been resolved:

    jfs: jfs_dmap: Validate db_l2nbperpage while mounting (CVE-2023-53222)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile (CVE-2023-53243)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (CVE-2023-53245)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue (CVE-2023-53280)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Return the firmware result upon destroying QP/RQ (CVE-2023-53286)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/client: Fix memory leak in drm_client_modeset_probe (CVE-2023-53288)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: fix overlap expiration walk (CVE-2023-53304)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: Fix integer overflow in radeon_cs_parser_init (CVE-2023-53309)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (CVE-2023-53311)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix wrong setting of max_corr_read_errors (CVE-2023-53313)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Wait for io return on terminate rport (CVE-2023-53322)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one (CVE-2023-53333)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix BUG_ON condition in btrfs_cancel_balance (CVE-2023-53339)

    In the Linux kernel, the following vulnerability has been resolved:

    icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). (CVE-2023-53343)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: check slab-out-of-bounds in md_bitmap_get_counter (CVE-2023-53357)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6mr: Fix skb_under_panic in ip6mr_cache_report() (CVE-2023-53365)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dcb: choose correct policy to parse DCB_ATTR_BCN (CVE-2023-53369)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request (CVE-2023-53380)

    In the Linux kernel, the following vulnerability has been resolved:

    shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs (CVE-2023-53391)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free (CVE-2023-53446)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Fix potential NULL pointer dereference (CVE-2023-53451)

    In the Linux kernel, the following vulnerability has been resolved:

    FS: JFS: Fix null-ptr-deref Read in txBegin (CVE-2023-53457)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring: wait interruptibly for request completions on exit (CVE-2023-53461)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (CVE-2023-53469)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev (CVE-2023-53485)

    In the Linux kernel, the following vulnerability has been resolved:

    powerpc/rtas_flash: allow user copy to flash block cache objects (CVE-2023-53487)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix slab-use-after-free in decode_session6 (CVE-2023-53500)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-mmio: don't break lifecycle of vm_dev (CVE-2023-53515)

    In the Linux kernel, the following vulnerability has been resolved:

    media: v4l2-mem2mem: add lock to protect parameter num_rdy (CVE-2023-53519)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx (CVE-2023-53546)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb (CVE-2023-53548)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/core: initialize damo_filter->list from damos_new_filter() (CVE-2023-53555)

    In the Linux kernel, the following vulnerability has been resolved:

    ip_vti: fix potential slab-use-after-free in decode_session6 (CVE-2023-53559)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing/histograms: Add histograms to hist_vars if they have referenced variables (CVE-2023-53560)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Check for NOT_READY flag state after locking (CVE-2023-53581)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Release folio lock on fscache read hit. (CVE-2023-53593)

    In the Linux kernel, the following vulnerability has been resolved:

    tunnels: fix kasan splat when generating ipv4 pmtu error (CVE-2023-53600)

    In the Linux kernel, the following vulnerability has been resolved:

    dax: Fix dax_mapping_release() use after free (CVE-2023-53613)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (CVE-2023-53619)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: Fix possible data races in gfs2_show_options() (CVE-2023-53622)

    In the Linux kernel, the following vulnerability has been resolved:

    iavf: Fix out-of-bounds when setting channels on remove (CVE-2023-53659)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Fix deadloop issue on reading trace_pipe (CVE-2023-53668)

    In the Linux kernel, the following vulnerability has been resolved:

    bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent (CVE-2023-53681)

    A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two     threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline     enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This     could allow a local unprivileged user to escalate their privileges on the system. (CVE-2023-6546)

    A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in     net/sctp/socket.c in the Linux kernel's SCTP subsystem. This flaw allows guests with local user privileges     to trigger a deadlock and potentially crash the system. (CVE-2024-0639)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-330 advisory.

    A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss     of confidentiality. (CVE-2023-20588)

    The fix for XSA-423 added logic to Linux'es netback driver to deal witha frontend splitting a packet in a     way such that not all of the headerswould come in one piece.  Unfortunately the logic introduced     theredidn't account for the extreme case of the entire packet being splitinto as many pieces as permitted     by the protocol, yet still beingsmaller than the area that's specially dealt with to keep all     (possible)headers together.  Such an unusual packet would therefore trigger abuffer overrun in the driver.
    (CVE-2023-34319)

    A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)

    A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of     XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data     to userspace. (CVE-2023-3773)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the     chain's owner rule can also release the objects in certain circumstances.

    We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8. (CVE-2023-3777)

    A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing     of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local     privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an     information disclosure. (CVE-2023-39194)

    A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    On an error when building a nftables rule, deactivating immediate expressions in     nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used.

    We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2. (CVE-2023-4015)

    A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in     the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to     incorrect handling of the existing filter, leading to a kernel information leak issue. (CVE-2023-4128)

    netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID (CVE-2023-4147)

    A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to     bypass network filters and gain unauthorized access to some resources. The original patches fixing     CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits -     a096ccca6e50 (tun: tun_chr_open(): correctly initialize socket uid), - 66b2c338adce (tap: tap_open():
    correctly initialize socket uid), pass inode->i_uid to sock_init_data_uid() as the last parameter and     that turns out to not be accurate. (CVE-2023-4194)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to     achieve local privilege escalation.

    When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into     the new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8. (CVE-2023-4206)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation.

    When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the     new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec. (CVE-2023-4207)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation.

    When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the     new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81. (CVE-2023-4208)

    A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation     of the file name reconstruction function, which is responsible for reading file name entries from a     directory index and merging file name parts belonging to one file into a single long file name. Since the     file name characters are copied into a stack variable, a local privileged attacker could use this flaw to     overflow the kernel stack. (CVE-2023-4273)

    A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux     Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which     can result in a memory leak. (CVE-2023-4569)

    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.

    The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without     locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that     is being released by garbage collection, resulting in use-after-free.

    We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: add NULL check in xfrm_update_ae_params (CVE-2023-53147)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: Fix igb_down hung on surprise removal (CVE-2023-53148)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix uninitialized array access for some pathnames (CVE-2023-53165)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fix possible memory leak if device_add() fails (CVE-2023-53174)

    In the Linux kernel, the following vulnerability has been resolved:

    dma-buf/dma-resv: Stop leaking on krealloc() failure (CVE-2023-53181)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: exit gracefully if reloc roots don't match (CVE-2023-53183)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: Fix nexthop hash size (CVE-2023-53192)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/fair: Don't balance task to its current running CPU (CVE-2023-53215)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix warning in cifs_smb3_do_mount() (CVE-2023-53230)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (CVE-2023-53245)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand (CVE-2023-53247)

    In the Linux kernel, the following vulnerability has been resolved:

    ovl: fix null pointer dereference in ovl_permission() (CVE-2023-53260)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/client: Fix memory leak in drm_client_modeset_probe (CVE-2023-53288)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: fix overlap expiration walk (CVE-2023-53304)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (CVE-2023-53311)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Enhance sanity check while generating attr_list (CVE-2023-53328)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix BUG_ON condition in btrfs_cancel_balance (CVE-2023-53339)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6mr: Fix skb_under_panic in ip6mr_cache_report() (CVE-2023-53365)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dcb: choose correct policy to parse DCB_ATTR_BCN (CVE-2023-53369)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (CVE-2023-53401)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/ttm: fix bulk_move corruption when adding a entry (CVE-2023-53444)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (CVE-2023-53469)

    In the Linux kernel, the following vulnerability has been resolved:

    powerpc/rtas_flash: allow user copy to flash block cache objects (CVE-2023-53487)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix disconnect vs accept race (CVE-2023-53490)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix slab-use-after-free in decode_session6 (CVE-2023-53500)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-mmio: don't break lifecycle of vm_dev (CVE-2023-53515)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic() (CVE-2023-53558)

    In the Linux kernel, the following vulnerability has been resolved:

    ip_vti: fix potential slab-use-after-free in decode_session6 (CVE-2023-53559)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, cpumap: Make sure kthread is running before map update returns (CVE-2023-53577)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Release folio lock on fscache read hit. (CVE-2023-53593)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix mid leak during reconnection after timeout threshold (CVE-2023-53597)

    In the Linux kernel, the following vulnerability has been resolved:

    tunnels: fix kasan splat when generating ipv4 pmtu error (CVE-2023-53600)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: reject invalid reloc tree root keys with stack dump (CVE-2023-53618)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, cpumap: Handle skb as well when clean up ptr_ring (CVE-2023-53660)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.322-244.536. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2268 advisory.

    A flaw in the Linux Kernel found in the GFS2 file system. On corrupted gfs2 file systems the evict code     can try to reference the journal descriptor structure, jdesc, after it has been freed and set to NULL. It     can lead to null pointer dereference when gfs2_trans_begin being called and then fail     ingfs2_evict_inode(). (CVE-2023-3212)

    A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in     net/netfilter/nf_tables_api.c.

    Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same     transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to     cause a privilege escalation issue.

    We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97. (CVE-2023-3390)

    The fix for XSA-423 added logic to Linux'es netback driver to deal witha frontend splitting a packet in a     way such that not all of the headerswould come in one piece.  Unfortunately the logic introduced     theredidn't account for the extreme case of the entire packet being splitinto as many pieces as permitted     by the protocol, yet still beingsmaller than the area that's specially dealt with to keep all     (possible)headers together.  Such an unusual packet would therefore trigger abuffer overrun in the driver.
    (CVE-2023-34319)

    A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in     the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to     incorrect handling of the existing filter, leading to a kernel information leak issue. (CVE-2023-4128)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to     achieve local privilege escalation.

    When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into     the new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8. (CVE-2023-4206)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation.

    When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the     new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81. (CVE-2023-4208)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (CVE-2023-52885)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: Fix igb_down hung on surprise removal (CVE-2023-53148)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Pointer may be dereferenced (CVE-2023-53150)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: prevent soft lockup while flush writes (CVE-2023-53151)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6/addrconf: fix a potential refcount underflow for idev (CVE-2023-53189)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/fair: Don't balance task to its current running CPU (CVE-2023-53215)

    In the Linux kernel, the following vulnerability has been resolved:

    jfs: jfs_dmap: Validate db_l2nbperpage while mounting (CVE-2023-53222)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix wrong setting of max_corr_read_errors (CVE-2023-53313)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Wait for io return on terminate rport (CVE-2023-53322)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6mr: Fix skb_under_panic in ip6mr_cache_report() (CVE-2023-53365)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Fix potential NULL pointer dereference (CVE-2023-53451)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb (CVE-2023-53548)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (CVE-2023-53619)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Fix deadloop issue on reading trace_pipe (CVE-2023-53668)

    A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in     net/sctp/socket.c in the Linux kernel's SCTP subsystem. This flaw allows guests with local user privileges     to trigger a deadlock and potentially crash the system. (CVE-2024-0639)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3751-1 advisory.

    The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
    - CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
    - CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
    - CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
    - CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
    - CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
    - CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
    - CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
    - CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
    - CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
    - CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in     rproc_attach() (bsc#1247136).
    - CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
    - CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
    - CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
    - CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
    - CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
    - CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
    - CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
    - CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
    - CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
    - CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
    - CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
    - CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
    - CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port     (bsc#1248378).
    - CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
    - CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
    - CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
    - CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
    - CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
    - CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
    - CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
    - CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
    - CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data     (bsc#1248647).
    - CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
    - CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
    - CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
    - CVE-2025-38705: drm/amd/pm: fix null pointer access (bsc#1249334).
    - CVE-2025-38709: loop: Avoid updating block size under exclusive owner (bsc#1249199).
    - CVE-2025-38721: netfilter: ctnetlink: fix refcount leak on table dump (bsc#1249176).
    - CVE-2025-38722: habanalabs: fix UAF in export_dmabuf() (bsc#1249163).
    - CVE-2025-38730: io_uring/net: commit partial buffers on retry (bsc#1249172).
    - CVE-2025-38732: netfilter: nf_reject: do not leak dst refcount for loopback packets (bsc#1249262).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
    - CVE-2025-39677: net/sched: Fix backlog accounting in qdisc_dequeue_internal (bsc#1249300).
    - CVE-2025-39678: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL (bsc#1249290).
    - CVE-2025-39681: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (bsc#1249303).
    - CVE-2025-39682: tls: fix handling of zero-length records on the rx_list (bsc#1249284).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39705: drm/amd/display: fix a Null pointer dereference vulnerability (bsc#1249295).
    - CVE-2025-39718: vsock/virtio: Validate length in packet header before skb_put() (bsc#1249305).
    - CVE-2025-39738: btrfs: do not allow relocation of partially dropped subvolumes (bsc#1249540).
    - CVE-2025-39744: rcu: Fix rcu_read_unlock() deadloop due to IRQ work (bsc#1249494).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39749: rcu: Protect ->defer_qs_iw_pending from data race (bsc#1249533).
    - CVE-2025-39754: mm/smaps: fix race between smaps_hugetlb_range and migration (bsc#1249524).
    - CVE-2025-39764: netfilter: ctnetlink: remove refcounting in expectation dumpers (bsc#1249513).
    - CVE-2025-39766: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (bsc#1249510).
    - CVE-2025-39770: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (bsc#1249508).
    - CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
    - CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
    - CVE-2025-39787: soc: qcom: mdt_loader: Deal with zero e_shentsize (bsc#1249545).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39825: smb: client: fix race with concurrent opens in rename(2) (bsc#1250179).
    - CVE-2025-39832: net/mlx5: Fix lockdep assertion on sync reset unload event (bsc#1249901).
    - CVE-2025-39835: xfs: do not propagate ENODATA disk errors into xattr code (bsc#1250025).
    - CVE-2025-39838: cifs: prevent NULL pointer dereference in UTF16 conversion (bsc#1250365).
    - CVE-2025-39842: ocfs2: prevent release journal inode after journal shutdown (bsc#1250267).
    - CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
    - CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
    - CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
    - CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
    - CVE-2025-39857: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (bsc#1250251).
    - CVE-2025-39865: tee: fix NULL pointer dereference in tee_shm_put (bsc#1250294).
    - CVE-2025-39885: ocfs2: fix recursive semaphore deadlock in fiemap call (bsc#1250407).
    - CVE-2025-40300: x86/vmscape: Warn when STIBP is disabled with SMT (bsc#1247483).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03614-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
    - CVE-2022-50242: drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() (bsc#1249696).
    - CVE-2022-50244: cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() (bsc#1249647).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
    - CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()     (bsc#1249947).
    - CVE-2022-50265: kcm: annotate data-races around kcm->rx_wait (bsc#1249744).
    - CVE-2022-50278: PNP: fix name memory leak in pnp_alloc_dev() (bsc#1249715).
    - CVE-2022-50285: mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages (bsc#1249803).
    - CVE-2022-50288: qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure (bsc#1249802).
    - CVE-2022-50291: kcm: annotate data-races around kcm->rx_psock (bsc#1249798).
    - CVE-2022-50294: wifi: libertas: fix memory leak in lbs_init_adapter() (bsc#1249799).
    - CVE-2022-50297: wifi: ath9k: verify the expected usb_endpoints are present (bsc#1250250).
    - CVE-2022-50304: mm: export bdi_unregister (bsc#1249725).
    - CVE-2022-50311: cxl: Fix refcount leak in cxl_calc_capp_routing (bsc#1249720).
    - CVE-2022-50312: drivers: serial: jsm: fix some leaks in probe (bsc#1249716).
    - CVE-2022-50321: wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() (bsc#1249706).
    - CVE-2022-50330: crypto: cavium - prevent integer overflow loading firmware (bsc#1249700).
    - CVE-2022-50349: misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() (bsc#1249920).
    - CVE-2022-50352: net: hns: fix possible memory leak in hnae_ae_register() (bsc#1249922).
    - CVE-2022-50359: media: cx88: Fix a null-ptr-deref bug in buffer_prepare() (bsc#1250269).
    - CVE-2022-50365: skbuff: Account for tail adjustment during pull operations (bsc#1250084).
    - CVE-2022-50375: tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown     (bsc#1250132).
    - CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
    - CVE-2022-50396: net: sched: fix memory leak in tcindex_set_parms (bsc#1250104).
    - CVE-2022-50402: drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() (bsc#1250363).
    - CVE-2022-50405: net/tunnel: wait until all sk_user_data reader finish before releasing the sock     (bsc#1250155).
    - CVE-2022-50406: iomap: iomap: fix memory corruption when recording errors during writeback     (bsc#1250165).
    - CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
    - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
    - CVE-2022-50419: Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times (bsc#1250394).
    - CVE-2023-53148: igb: Do not bring the device up after non-fatal error (bsc#1249842).
    - CVE-2023-53153: wifi: cfg80211: Partial revert 'wifi: cfg80211: Fix use after free for wext'     (bsc#1249877).
    - CVE-2023-53176: serial: 8250: Fix oops for port->pm on uart_change_pm() (bsc#1249991).
    - CVE-2023-53178: mm: zswap: fix missing folio cleanup in writeback race path (bsc#1249827 git-fix).
    - CVE-2023-53199: wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails (bsc#1249683).
    - CVE-2023-53201: RDMA/bnxt_re: wraparound mbox producer index (bsc#1249687).
    - CVE-2023-53226: wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (bsc#1249658).
    - CVE-2023-53248: drm/amdgpu: install stub fence into potential unused fence pointers (bsc#1249779).
    - CVE-2023-53254: drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug     (bsc#1249871).
    - CVE-2023-53272: net: ena: fix shift-out-of-bounds in exponential backoff (bsc#1249917).
    - CVE-2023-53277: wifi: iwl3945: Add missing check for create_singlethread_workqueue (bsc#1249936).
    - CVE-2023-53288: drm/client: Fix memory leak in drm_client_modeset_probe (bsc#1250058).
    - CVE-2023-53298: nfc: fix memory leak of se_io context in nfc_genl_se_io (bsc#1249944).
    - CVE-2023-53302: wifi: iwl4965: Add missing check for create_singlethread_workqueue() (bsc#1249958).
    - CVE-2023-53305: Bluetooth: L2CAP: Fix use-after-free (bsc#1250049).
    - CVE-2023-53309: drm/radeon: Fix integer overflow in radeon_cs_parser_init (bsc#1250055).
    - CVE-2023-53317: ext4: fix WARNING in mb_find_extent (bsc#1250081).
    - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
    - CVE-2023-53335: RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() (bsc#1250072).
    - CVE-2023-53344: can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (bsc#1250023).
    - CVE-2023-53348: btrfs: fix deadlock when aborting transaction during relocation with scrub     (bsc#1250018).
    - CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
    - CVE-2023-53384: wifi: mwifiex: avoid possible NULL skb pointer dereference (bsc#1250127).
    - CVE-2023-53393: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device (bsc#1250114).
    - CVE-2023-53395: ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (bsc#1250358).
    - CVE-2023-53397: modpost: fix off by one in is_executable_section() (bsc#1250125).
    - CVE-2023-53400: ALSA: hda: Fix Oops by 9.1 surround channel names (bsc#1250328).
    - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
    - CVE-2023-53441: bpf: cpumap: Fix memory leak in cpu_map_update_elem (bsc#1250150).
    - CVE-2024-53194: PCI: Fix use-after-free of slot->bus on hot remove (bsc#1235459).
    - CVE-2024-58240: tls: separate no-async decryption request handling from async (bsc#1248847).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
    - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree     (bsc#1248255).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
    - CVE-2025-38602: wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() (bsc#1248341).
    - CVE-2025-38604: wifi: rtl818x: Kill URBs before clearing tx status queue (bsc#1248333).
    - CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
    - CVE-2025-38624: PCI: pnv_php: Clean up allocated IRQs on unplug (bsc#1248617).
    - CVE-2025-38632: pinmux: fix race causing mux_owner NULL with active mux_usecount (bsc#1248669).
    - CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
    - CVE-2025-38665: can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode     (bsc#1248648).
    - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
    - CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
    - CVE-2025-38702: fbdev: fix potential buffer overflow in do_register_framebuffer() (bsc#1249254).
    - CVE-2025-38705: drm/amd/pm: fix null pointer access (bsc#1249334).
    - CVE-2025-38712: hfsplus: do not use BUG_ON() in hfsplus_create_attributes_file() (bsc#1249194).
    - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
    - CVE-2025-38729: ALSA: usb-audio: Validate UAC3 power domain descriptors, too (bsc#1249164).
    - CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
    - CVE-2025-39677: net/sched: Fix backlog accounting in qdisc_dequeue_internal (bsc#1249300).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39705: drm/amd/display: fix a Null pointer dereference vulnerability (bsc#1249295).
    - CVE-2025-39706: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (bsc#1249413).
    - CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
    - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
    - CVE-2025-39754: mm/smaps: fix race between smaps_hugetlb_range and migration (bsc#1249524).
    - CVE-2025-39757: ALSA: usb-audio: Fix size validation in convert_chmap_v3() (bsc#1249515).
    - CVE-2025-39760: usb: core: config: Prevent OOB read in SS endpoint companion parsing (bsc#1249598).
    - CVE-2025-39763: ACPICA: Fix error code path in acpi_ds_call_control_method() (bsc#1249615).
    - CVE-2025-39764: netfilter: ctnetlink: remove refcounting in expectation dumpers (bsc#1249513).
    - CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
    - CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
    - CVE-2025-39787: soc: qcom: mdt_loader: Deal with zero e_shentsize (bsc#1249545).
    - CVE-2025-39800: btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (bsc#1250177).
    - CVE-2025-39808: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (bsc#1250088).
    - CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
    - CVE-2025-39833: mISDN: hfcpci: Fix warning when deleting uninitialized timer (bsc#1250028).
    - CVE-2025-39838: cifs: prevent NULL pointer dereference in UTF16 conversion (bsc#1250365).
    - CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
    - CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
    - CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
    - CVE-2025-39863: wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work     (bsc#1250281).
    - CVE-2025-39865: tee: fix NULL pointer dereference in tee_shm_put (bsc#1250294).
    - CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).
    - CVE-2025-39885: ocfs2: fix recursive semaphore deadlock in fiemap call (bsc#1250407).
    - CVE-2025-40300: x86/vmscape: Warn when STIBP is disabled with SMT (bsc#1247483).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

ID	Name	Product	Family	Published	Updated	Severity
265011	Linux Distros Unpatched Vulnerability : CVE-2023-53148	Nessus	Misc.	9/16/2025	10/8/2025	medium
182659	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2023-054 (ALASKERNEL-5.4-2023-054)	Nessus	Amazon Linux Local Security Checks	10/6/2023	10/24/2025	high
270738	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:03634-1)	Nessus	SuSE Local Security Checks	10/18/2025	10/21/2025	high
213366	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2024-058 (ALASKERNEL-5.15-2024-058)	Nessus	Amazon Linux Local Security Checks	12/23/2024	10/24/2025	high
180566	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-039 (ALASKERNEL-5.10-2023-039)	Nessus	Amazon Linux Local Security Checks	9/6/2023	10/24/2025	high
181159	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-330)	Nessus	Amazon Linux Local Security Checks	9/8/2023	10/24/2025	high
182627	Amazon Linux 2 : kernel, --advisory ALAS2-2023-2268 (ALAS-2023-2268)	Nessus	Amazon Linux Local Security Checks	10/5/2023	10/24/2025	high
271407	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:3751-1)	Nessus	SuSE Local Security Checks	10/24/2025	10/24/2025	high
270831	SUSE SLES12 Security Update : kernel (SUSE-SU-2025:03614-1)	Nessus	SuSE Local Security Checks	10/21/2025	10/21/2025	high
211393	Photon OS 4.0: Linux PHSA-2024-4.0-0711	Nessus	PhotonOS Local Security Checks	11/15/2024	10/15/2025	high

Detections

Analytics

Plugins Search

medium

high

high

high

high

high

high

high

high

high