The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - sched: Fix sched_numa_find_nth_cpu() if mask offline sched_numa_find_nth_cpu() uses a bsearch to look for     the 'closest' CPU in sched_domains_numa_masks and given cpus mask. However they might not intersect if all     CPUs in the cpus mask are offline. bsearch will return NULL in that case, bail out instead of     dereferencing a bogus pointer. The previous behaviour lead to this bug when using maxcpus=4 on an rk3399     (LLLLbb) (i.e. booting with all big CPUs offline): [ 1.422922] Unable to handle kernel paging request at     virtual address ffffff8000000000 [ 1.423635] Mem abort info: [ 1.423889] ESR = 0x0000000096000006 [     1.424227] EC = 0x25: DABT (current EL), IL = 32 bits [ 1.424715] SET = 0, FnV = 0 [ 1.424995] EA = 0,     S1PTW = 0 [ 1.425279] FSC = 0x06: level 2 translation fault [ 1.425735] Data abort info: [ 1.425998] ISV =     0, ISS = 0x00000006, ISS2 = 0x00000000 [ 1.426499] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 1.426952] GCS     = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 1.427428] swapper pgtable: 4k pages, 39-bit VAs,     pgdp=0000000004a9f000 [ 1.428038] [ffffff8000000000] pgd=18000000f7fff403, p4d=18000000f7fff403,     pud=18000000f7fff403, pmd=0000000000000000 [ 1.429014] Internal error: Oops: 0000000096000006 [#1] SMP [     1.429525] Modules linked in: [ 1.429813] CPU: 3 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.0-rc4-dirty     #343 PREEMPT [ 1.430559] Hardware name: Pine64 RockPro64 v2.1 (DT) [ 1.431012] pstate: 60000005 (nZCv daif
    -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1.431634] pc : sched_numa_find_nth_cpu+0x2a0/0x488 [ 1.432094] lr :
    sched_numa_find_nth_cpu+0x284/0x488 [ 1.432543] sp : ffffffc084e1b960 [ 1.432843] x29: ffffffc084e1b960     x28: ffffff80078a8800 x27: ffffffc0846eb1d0 [ 1.433495] x26: 0000000000000000 x25: 0000000000000000 x24:
    0000000000000000 [ 1.434144] x23: 0000000000000000 x22: fffffffffff7f093 x21: ffffffc081de6378 [ 1.434792]     x20: 0000000000000000 x19: 0000000ffff7f093 x18: 00000000ffffffff [ 1.435441] x17: 3030303866666666 x16:
    66663d736b73616d x15: ffffffc104e1b5b7 [ 1.436091] x14: 0000000000000000 x13: ffffffc084712860 x12:
    0000000000000372 [ 1.436739] x11: 0000000000000126 x10: ffffffc08476a860 x9 : ffffffc084712860 [ 1.437389]     x8 : 00000000ffffefff x7 : ffffffc08476a860 x6 : 0000000000000000 [ 1.438036] x5 : 000000000000bff4 x4 :
    0000000000000000 x3 : 0000000000000000 [ 1.438683] x2 : 0000000000000000 x1 : ffffffc0846eb000 x0 :
    ffffff8000407b68 [ 1.439332] Call trace: [ 1.439559] sched_numa_find_nth_cpu+0x2a0/0x488 (P) [ 1.440016]     smp_call_function_any+0xc8/0xd0 [ 1.440416] armv8_pmu_init+0x58/0x27c [ 1.440770]     armv8_cortex_a72_pmu_init+0x20/0x2c [ 1.441199] arm_pmu_device_probe+0x1e4/0x5e8 [ 1.441603]     armv8_pmu_device_probe+0x1c/0x28 [ 1.442007] platform_probe+0x5c/0xac [ 1.442347] really_probe+0xbc/0x298     [ 1.442683] __driver_probe_device+0x78/0x12c [ 1.443087] driver_probe_device+0xdc/0x160 [ 1.443475]
    __driver_attach+0x94/0x19c [ 1.443833] bus_for_each_dev+0x74/0xd4 [ 1.444190] driver_attach+0x24/0x30 [     1.444525] bus_add_driver+0xe4/0x208 [ 1.444874] driver_register+0x60/0x128 [ 1.445233]
    __platform_driver_register+0x24/0x30 [ 1.445662] armv8_pmu_driver_init+0x28/0x4c [ 1.446059]     do_one_initcall+0x44/0x25c [ 1.446416] kernel_init_freeable+0x1dc/0x3bc [ 1.446820] kernel_init+0x20/0x1d8     [ 1.447151] ret_from_fork+0x10/0x20 [ 1.447493] Code: 90022e21 f000e5f5 910de2b5 2a1703e2 (f8767803) [     1.448040] ---[ end trace 0000000000000000 ]--- [ 1.448483] note: swapper/0[1] exited with preempt_count 1     [ 1.449047] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b [ 1.449741] SMP:
    stopping secondary CPUs [ 1.450105] Kernel Offset: disabled [ 1.450419] CPU features:
    0x000000,00080000,20002001,0400421b [ ---truncated--- (CVE-2025-39895)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - schedマスクをオフラインに設定する場合の sched_numa_find_nth_cpu() を修正します sched_numa_find_nth_cpu() は、bsearch を使用して sched_domains_numa_masks および与えられた cpus マスクの「closest」CPU を検索します。ただし、cpus マスク内のすべての CPU がオフラインの場合には、交差しない可能性があります。 bsearch は NULL を返し、偽造のポインターを逆参照する代わりに救済します。rk3399LLLLbbでmaxcpus=4を使用するとき、以前の動作により、このバグが発生しました。[ 1.422922]仮想アドレスでカーネルページングリクエストを処理できません。ffffff8000000000 1.423635Mem abort info [ 1.423889] ESR = 0x0000000096000006 [1.424227] EC = 0x25DABT現在の EL、IL = 32 ビット [ 1.424715] SET = 0、FnV = 0 [ 1.424995] EA = 0、S1PTW = 0 [ 1.425279] FSC = 0x06レベル 2 変換障害 [ 1.425735] データ中止情報 [ 1.425998] ISV = 0、ISS = 0x00000006、ISS2 = 0x00000000 [ 1.426499] CM = 0、WnR = 0、TnD = 0、TagAccess = 0 [ 1.426952] GCS = 0、Overlay = 0、DirtyBit = 0、Xs = 0 [ 1.427428] スワッパー pgtable4k ページ、39 ビット VA、 pgdp=0000000004a9f000 [ 1.428038] [ffffff8000000000] pgd=18000000f7fff403、p4d=18000000f7fff403、 pud=18000000f7fff403、 pmd=0000000000000000 [ 1.429014] 内部エラーOops: 00000000096000006 [#1] SMP1.429525] リンクされているモジュール[ 1.429813] CPU: 3 UID: 0 PID: 1 Comm: swapper/0 汚染されていない 6.17 .0-rc4-dirty #343 PREEMPT [ 1.430559] ハードウェア名Pine64 RockPro64 v2.1DT[ 1.431012] pstate60000005nZCv daif
    -PAN -UAO -TCO -DIT -SSBS BTYPE=--[ 1.431634] pc sched_numa_find_nth_cpu+0x2a0/0x488 [ 1.432094] lr
    sched_numa_find_nth_cpu+0x284/0x488 [ 1.432543] sp : ffffffc084e1b960 [ 1.432843] x29: ffffffc084e1b960 x28: ffffff80078a8800 x27: ffffffc0846eb1d0 [ 1.433495] x26: 0000000000000000 x25: 0000000000000000 x24:
    0000000000000000 [ 1.434144] x23: 0000000000000000 x22: fffffffffff7f093 x21: ffffffc081de6378 [ 1.434792] x20: 0000000000000000 x19: 0000000ffff7f093 x18: 00000000ffffffff [ 1.435441] x17: 3030303866666666 x16:
    66663d736b73616d x15ffffffc104e1b5b7 [ 1.436091] x14000000000000000 x13fffffc084712860 x12
    0000000000000372 [ 1.436739] x11: 0000000000000126 x10: ffffffc08476a860 x9 : ffffffc084712860 [ 1.437389] x8 : 00000000ffffefff x7 : ffffffc08476a860 x6 : 0000000000000000 [ 1.438036] x5 : 000000000000bff4 x4 :
     1.43868300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    ffffff8000407b68 [ 1.439332Call trace: [ 1.439559] sched_numa_find_nth_cpu+0x2a0/0x488 (P) [ 1.440016] smp_call_function_any+0xc8/0xd0 1.440416[ ] armv8_pmu_init+0x58/0x27c [ 1.440770] armv8_cortex_a72_pmu [_init 1.441199] arm_pmu_device_probe+0x1e4/0x5e8 1.441603armv8_pmu_device_probe+0x1c/0x28 1.442007platform_probe+0x5c/0xac [ 1.442347] true_probe+0xbc/0x298 1.442683] __driver_probe_device+0x78/0x12c/dc [] driver_probe_device+ 1.4430870x [ ] driver_probe_device+0x [] 0x160 [ 1.443475]
    __driver_attach+0x94/0x19c [ 1.443833] bus_for_each_dev+0x74/0xd4 [ 1.444190] driver_attach+0x24/0x30 [1.444525] bus_add_driver+0xe4/0x208 [ 1.444874] driver_register+0x60/0x128 [ 1.445233]
    __platform_driver_register+0x24/0x30 [ 1.445662] armv8_pmu_driver_init+0x28/0x4c [ 1.446059] do_one_initcall+0x44/0x25c [ 1.446416] kernel_init_freeable+0x1dc/0x3bc 1.446820] kernel_init+0x20/0x1d8 1.447151ret_from/0x1d8 [] ret_from [ 1.447493] コード90022e21 f000e5f5 910de2b5 2a1703e2 (f8767803) [1.448040] ---[ 終了トレース 0000000000000000 ]--- [ 1.448483] 注swapper/0[1] preempt_count 1 で終了しました 1.449047カーネルパニック- not syncinit を kill しようとしました exitcode=0x0000000b1.449741] SMP
    セカンダリ CPU の停止 [ 1.450105 ] カーネルオフセット無効化 1.450419] CPU 機能
    0x000000,00080000,20002001,0400421b [ ---truncated---CVE-2025-39895

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - sched如果遮罩離線 sched_numa_find_nth_cpu() 使用 bsearch 尋找 sched_domains_numa_masks 中「最近的」CPU 及指定的 cpu 遮罩則修正 sched_numa_find_nth_cpu()。不過如果 cpus 遮罩中的所有 CPU 皆離線則它們可能不會相交。在此情況下bsearch 會傳回 NULL結束而非解除參照假的指標。先前的行為在 rk3399 (LLLLbb) 上使用 maxcpus=4 時會導致此錯誤 (亦即以所有大型 CPU 離線開機)[ 1.422922] 無法處理虛擬位址 ffffff8000000000 的核心分頁要求 [ 1.423635] 記憶體中止資訊[ 1.423889] ESR = 0x0000000096000006 [1.424227] EC = 0x25DABT (目前 EL)、IL = 32 位元 [ 1.424715] SET = 0、FnV = 0 [ 1.424995] EA = 0、S1PTW = 0 [ 1.425279] FSC = 0x06第 2 層轉譯錯誤 [ 1.425735] 資料中止資訊[ 1.425998] ISV = 0、ISS = 0x00000006、ISS2 = 0x00000000 [ 1.426499] CM = 0、WnR = 0、TnD = 0、TagAccess = 0 [ 1.426952] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 1.427428] swapper pgtable: 4k pages, 39 位元 VA pgdp=0000000004a9f000 [ 1.428038] [ffffff8000000000] pgd=18000000f7fff403、p4d=18000000f7fff403、 pud=18000000f7fff403、 pmd=0000000000000000 [ 1.429014] 內部錯誤Oops0000000096000006 [#1] SMP [1.429525] 連結中的模組[ 1.429813] CPU3 UID0 PID1 Commswapper/0 未受污染的 6.17 .0-rc4-dirty #343 PREEMPT [ 1.430559] 硬體名稱Pine64 RockPro64 v2.1 (DT) [ 1.431012] pstate 60000005 (nZCv daif
    -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1.431634] pc sched_numa_find_nth_cpu+0x2a0/0x488 [ 1.432094] lr
    sched_numa_find_nth_cpu+0x284/0x488 [ 1.432543] sp : ffffffc084e1b960 [ 1.432843] x29: ffffffc084e1b960 x28: ffffff80078a8800 x27: ffffffc0846eb1d0 [ 1.433495] x26: 0000000000000000 x25: 0000000000000000 x24:
    0000000000000000 [ 1.434144] x23: 0000000000000000 x22: fffffffffff7f093 x21: ffffffc081de6378 [ 1.434792] x20: 0000000000000000 x19: 0000000ffff7f093 x18: 00000000ffffffff [ 1.435441] x17: 3030303866666666 x16:
    66663d736b73616d x15ffffffc104e1b5b7 [ 1.436091] x14 0000000000000000 x13ffffffc084712860 x12
    0000000000000372 [ 1.436739] x11: 0000000000000126 x10: ffffffc08476a860 x9 : ffffffc084712860 [ 1.437389] x8 : 00000000ffffefff x7 : ffffffc08476a860 x6 : 0000000000000000 [ 1.438036] x5 : 000000000000bff4 x4 :
    0000000000000000 x3 0000000000000000 [ 1.438683] x2 0000000000000000 x1 ffffffc0846eb000 x0
    ffffff8000407b68 [ 1.439332] 呼叫追踪 [ 1.439559] sched_numa_find_nth_cpu+0x2a0/0x488 (P) [ 1.440016] smp_call_function_any+0xc8/0xd0 1.440416[  ] armv8_pmu_init+0x58/0x27c 1.440770[  ] armv8_cortex_a72_pmu_init+ 1.44119902x ] arm_pmu_device_probe+0x1e4/0x5e8 [ 1.441603] armv8_pmu_device_probe+0x1c/0x28 [ 1.442007] platform_probe+0x5c/0xac [ 1.442347] emerge_probe+0xbc/0x298 [ 1.442683] __driver_probe_device+0x78/0x12c [ 1.443087] driver_probe_device+0xdc/ 0x160 [ 1.443475]
    __driver_attach+0x94/0x19c [ 1.443833] bus_for_each_dev+0x74/0xd4 [ 1.444190] driver_attach+0x24/0x30 [1.444525] bus_add_driver+0xe4/0x208 [ 1.444874] driver_register+0x60/0x128 [ 1.445233]
    __platform_driver_register+0x24/0x30 [ 1.445662] armv8_pmu_driver_init+0x28/0x4c [ 1.446059] do_one_initcall+0x44/0x25c [ 1.446416] kernel_init_freeable+0x1dc/0x3bc [ 1.446820] kernel_init+0x20/0x1d8 [ 1.447151] ret_from_fork+0x10/0x20 [ 1.447493] 代碼90022e21 f000e5f5 910de2b5 2a1703e2 (f8767803) [1.448040] ---[ end trace 0000000000000000 ]--- [ 1.448483] 注意swapper/0[1] 以 preempt_count 1 結束 [ 1.449047] 核心錯誤- 未同步嘗試終止 init exitcode=0x0000000b [ 1.449741] SMP
    停止次要 CPU [ 1.450105] 核心位移停用 [ 1.450419] CPU 功能
    0x000000,00080000,20002001,0400421b [ ---truncated--- (CVE-2025-39895)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - sched如果掩码离线 sched_numa_find_nth_cpu() 使用 bsearch 在 sched_domains_numa_masks 和给定的 cpus 掩码中查找“最近”的 CPU则修复 sched_numa_find_nth_cpu()。但是，如果 cpus 掩码中的所有 CPU 都处于离线状态，它们可能不会交叉。 bsearch 在这种情况下将返回 NULL退出而不是取消引用虚假的指针。之前的行为导致在 rk3399 上使用 maxcpus=4 时 (LLLLbb)即在所有大型 CPU 离线的情况下启动[ 1.422922] 无法处理虚拟地址 ffffff8000000000 上的内核分页请求 [ 1.423635] Mem 中止信息[ 1.423889] ESR = 0x0000000096000006 [1.424227] EC = 0x25 DABT当前 EL, IL = 32 位 [ 1.424715] SET = 0, FnV = 0 [ 1.424995] EA = 0, S1PTW = 0 [ 1.425279] FSC = 0x06级别 2 转换错误 [ 1.425735] Data 中止信息[ 1.425998] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 [ 1.426499] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 1.426952] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 1.427428] swapper pgtable4k 页面39 位 VA pgdp=0000000004a9f000 [ 1.428038] [ffffff8000000000] pgd=18000000f7fff403、 p4d=18000000f7fff403、 pud=18000000f7fff403、 pmd=0000000000000000 [ 1.429014] 内部错误Oops: 0000000096000006 [#1] SMP [1.429525] 中链接的模块[ 1.429813] CPU:3 UID:0 PID:1 Comm:swapper/0 Not tainted 6.17 .0-rc4-dirty #343 PREEMPT [ 1.430559] 硬件名称Pine64 RockPro64 v2.1 (DT) [ 1.431012] pstate60000005 (nZCv daif
    -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1.431634] pc sched_numa_find_nth_cpu+0x2a0/0x488 [ 1.432094] lr :
    sched_numa_find_nth_cpu+0x284/0x488 [ 1.432543] sp : ffffffc084e1b960 [ 1.432843] x29: ffffffc084e1b960 x28: ffffff80078a8800 x27: ffffffc0846eb1d0 [ 1.433495] x26: 0000000000000000 x25: 0000000000000000 x24:
    0000000000000000 [ 1.434144] x23: 0000000000000000 x22: fffffffffff7f093 x21: ffffffc081de6378 [ 1.434792] x20: 0000000000000000 x19: 0000000ffff7f093 x18: 00000000ffffffff [ 1.435441] x17: 3030303866666666 x16:
    66663d736b73616d x15ffffffc104e1b5b7 [ 1.436091] x140000000000000000 x13ffffffc084712860 x12
    0000000000000372 [ 1.436739] x11: 0000000000000126 x10: ffffffc08476a860 x9 : ffffffc084712860 [ 1.437389] x8 : 00000000ffffefff x7 : ffffffc08476a860 x6 : 0000000000000000 [ 1.438036] x5 : 000000000000bff4 x4 :
    0000000000000000 x3 : 0000000000000000 [ 1.438683] x2 : 0000000000000000 x1 : ffffffc0846eb000 x0
    ffffff8000407b68 [ 1.439332] 调用跟踪[ 1.439559] sched_numa_find_nth_cpu+0x2a0/0x488 (P) [ 1.440016] smp_call_function_any+0xc8/0xd0 [ 1.440416] armv8_pmu_init+0x58/0x27c [ 1.440770] armv8_cortex_a72_pmu_init+0x20/c [2x20/20 1.441199] arm_pmu_device_probe+0x1e4/0x5e8 [ 1.441603] armv8_pmu_device_probe+0x1c/0x28 [ 1.442007] platform_probe+0x5c/0xac [ 1.442347] real_probe+0xbc/0x298 [ 1.442683] __driver_probe_device+0x78/0x12c [ 1.443087] driver_probe_device+0xdc/ 0x160 [ 1.443475]
    __driver_attach+0x94/0x19c [ 1.443833] bus_for_each_dev+0x74/0xd4 [ 1.444190] driver_attach+0x24/0x30 [1.444525] bus_add_driver+0xe4/0x208 [ 1.444874] driver_register+0x60/0x128 [ 1.445233]
    __platform_driver_register+0x24/0x30 [ 1.445662] armv8_pmu_driver_init+0x28/0x4c [ 1.446059] do_one_initcall+0x44/0x25c [ 1.446416] kernel_init_freeable+0x1dc/0x3bc [ 1.446820] kernel_init+0x20/0x1d8 [ 1.447151] ret_from_fork+0x10/0x20 [ 1.447493] Code: 90022e21 f000e5f5 910de2b5 2a1703e2 (f8767803) [1.448040] ---[ end trace 0000000000000000 ]--- [ 1.448483] 注意swapper/0[1] 因 preempt_count 1 退出 [ 1.449047] 内核错误- 不同步尝试终止 init! exitcode=0x0000000b [ 1.449741] SMP
    停止辅助 CPU [ 1.450105] 内核偏移已禁用 [ 1.450419] CPU 功能
    0x000000,00080000,20002001,0400421b [ ---truncated--- (CVE-2025-39895)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

ID	Name	Product	Family	Published	Updated	Severity
269674	Linux Distros Unpatched Vulnerability : CVE-2025-39895	Nessus	Misc.	10/8/2025	10/8/2025	medium
269674	Linux Distros のパッチ未適用の脆弱性: CVE-2025-39895	Nessus	Misc.	10/8/2025	10/8/2025	medium
269674	Linux Distros 未修補的弱點：CVE-2025-39895	Nessus	Misc.	10/8/2025	10/8/2025	medium
269674	Linux Distros 未修补的漏洞：CVE-2025-39895	Nessus	Misc.	10/8/2025	10/8/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium