The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LoongArch: BPF: Sign-extend struct ops return values properly The ns_bpf_qdisc selftest triggers a kernel     panic: Oops[#1]: CPU 0 Unable to handle kernel paging request at virtual address 0000000000741d58, era ==     90000000851b5ac0, ra == 90000000851b5aa4 CPU: 0 UID: 0 PID: 449 Comm: test_progs Tainted: G OE 6.16.0+ #3     PREEMPT(full) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU QEMU Virtual Machine, BIOS     unknown 2/2/2022 pc 90000000851b5ac0 ra 90000000851b5aa4 tp 90000001076b8000 sp 90000001076bb600 a0     0000000000741ce8 a1 0000000000000001 a2 90000001076bb5c0 a3 0000000000000008 a4 90000001004c4620 a5     9000000100741ce8 a6 0000000000000000 a7 0100000000000000 t0 0000000000000010 t1 0000000000000000 t2     9000000104d24d30 t3 0000000000000001 t4 4f2317da8a7e08c4 t5 fffffefffc002f00 t6 90000001004c4620 t7     ffffffffc61c5b3d t8 0000000000000000 u0 0000000000000001 s9 0000000000000050 s0 90000001075bc800 s1     0000000000000040 s2 900000010597c400 s3 0000000000000008 s4 90000001075bc880 s5 90000001075bc8f0 s6     0000000000000000 s7 0000000000741ce8 s8 0000000000000000 ra: 90000000851b5aa4 __qdisc_run+0xac/0x8d8 ERA:
    90000000851b5ac0 __qdisc_run+0xc8/0x8d8 CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) PRMD:
    00000004 (PPLV0 +PIE -PWE) EUEN: 00000007 (+FPE +SXE +ASXE -BTE) ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)     ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) BADV: 0000000000741d58 PRID: 0014c010 (Loongson-64bit,     Loongson-3A5000) Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE)] Process test_progs     (pid: 449, threadinfo=000000009af02b3a, task=00000000e9ba4956) Stack : 0000000000000000 90000001075bc8ac     90000000869524a8 9000000100741ce8 90000001075bc800 9000000100415300 90000001075bc8ac 0000000000000000     900000010597c400 900000008694a000 0000000000000000 9000000105b59000 90000001075bc800 9000000100741ce8     0000000000000050 900000008513000c 9000000086936000 0000000100094d4c fffffff400676208 0000000000000000     9000000105b59000 900000008694a000 9000000086bf0dc0 9000000105b59000 9000000086bf0d68 9000000085147010     90000001075be788 0000000000000000 9000000086bf0f98 0000000000000001 0000000000000010 9000000006015840     0000000000000000 9000000086be6c40 0000000000000000 0000000000000000 0000000000000000 4f2317da8a7e08c4     0000000000000101 4f2317da8a7e08c4 ... Call Trace: [<90000000851b5ac0>] __qdisc_run+0xc8/0x8d8     [<9000000085130008>] __dev_queue_xmit+0x578/0x10f0 [<90000000853701c0>] ip6_finish_output2+0x2f0/0x950     [<9000000085374bc8>] ip6_finish_output+0x2b8/0x448 [<9000000085370b24>] ip6_xmit+0x304/0x858     [<90000000853c4438>] inet6_csk_xmit+0x100/0x170 [<90000000852b32f0>] __tcp_transmit_skb+0x490/0xdd0     [<90000000852b47fc>] tcp_connect+0xbcc/0x1168 [<90000000853b9088>] tcp_v6_connect+0x580/0x8a0     [<90000000852e7738>] __inet_stream_connect+0x170/0x480 [<90000000852e7a98>] inet_stream_connect+0x50/0x88     [<90000000850f2814>] __sys_connect+0xe4/0x110 [<90000000850f2858>] sys_connect+0x18/0x28     [<9000000085520c94>] do_syscall+0x94/0x1a0 [<9000000083df1fb8>] handle_syscall+0xb8/0x158 Code: 4001ad80     2400873f 2400832d <240073cc> 001137ff 001133ff 6407b41f 001503cc 0280041d ---[ end trace 0000000000000000     ]--- The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer is treated as a 32bit value     and sign extend to 64bit in epilogue. This behavior is right for most bpf prog types but wrong for struct     ops which requires LoongArch ABI. So let's sign extend struct ops return values according to the LoongArch     ABI ([1]) and return value spec in function model. [1]: https://loongson.github.io/LoongArch-     Documentation/LoongArch-ELF-ABI-EN.html (CVE-2025-40041)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - LoongArchBPF符号拡張構造体 ops の値を適切に返します ns_bpf_qdisc セルフテストは、カーネルパニックを発生させます Oops#1]CPU 0 仮想アドレスでカーネルページングリクエストを処理できません 0000000000741d58、era == 90000000851b5ac0、ra == 90000000851b5aa4 CPU 0 UID0 PID449 通信test_progs汚染G OE 6.16.0+ #3 PREEMPT(full) 汚染[O]=OOT_MODULE、[E]=UNSIGNED_MODULE ハードウェア名QEMU QEMU 仮想マシン、BIOS 不明 2/2 /2022 pc 90000000851b5ac0 ra 90000000851b5aa4 tp 90000001076b8000 sp 90000001076bb600 a0 0000000000741ce8 a1 0000000000000001 a2 90000001076bb5c0 a3 0000000000000008 a4 90000001004c4620 a5 9000000100741ce8 a6 0000000000000000 a7 0100000000000000 t0 0000000000000010 t1 0000000000000000 t2 9000000104d24d30 t3 0000000000000001 t4 4f2317da8a7e08c4 t5 fffffefffc002f00 t6 90000001004c4620 t7 ffffffffc61c5b3d t8 0000000000000000 u0 0000000000000001 s9 0000000000000050 s0 90000001075bc800 s1 000000000000040 s2 900000010597c400 s3 000000000000008 s4 90000001075bc88 0 s5 90000001075bc8f0 s6 00000000000000000000000000000000000000000000000000 s7 00000000000741ce8 s8 00000000000000000000851b5aa4 __qdisc_run+0xac/0x8d8 ERA:
    90000000851b5ac0 __qdisc_run+0xc8/0x8d8 CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) PRMD:
    00000004 (PPLV0 +PIE -PWE) EUEN: 00000007 (+FPE +SXE +ASXE -BTE) ECFG: 00071d (LIE=0,2-4,10-12 VS=7) ESTAT: 00010000 [PIL] (IS= ECode) =1 EsubCode=0BADV0000000000741d58 PRID0014c010Loongson-64bit、Loongson-3A5000リンクされているモジュールbpf_testmod(OE) [last unloadedbpf_testmod(OE)] プロセス test_progspid449、 threadinfo=000000009af02b3a、 task=00000000e9ba4956) Stack : 0000000000000000 90000001075bc8ac 90000000869524a8 9000000100741ce8 90000001075bc800 9000000100415300 90000001075bc8ac 0000000000000000 900000010597c400 900000008694a000 0000000000000000 9000000105b59000 90000001075bc800 9000000100741ce8 0000000000000050 900000008513000c 9000000086936000 0000000100094d4c fffffff400676208 0000000000000000 9000000105b59000 900000008694a000 9000000086bf0dc0 9000000105b59000 9000000086bf0d68 9000000085147010 90000001075be788 0000000000000000 9000000086bf0f98 0000000000000001 0000000000000010 9000000006015840 0000000000000000 9000000086be6c40 0000000000000000 0000000000000000 0000000000000000 4f2317da8a7e08c4 0000000000000101 4f2317da8a7e08c4 ... Call Trace: [<90000000851b5ac0>] __qdisc_run+0xc8/0x8d8 [<9000000085130008>] __dev_queue_xmit+0x578/0x10f0 [<90000000853701c0>] ip6_finish_output2+0x2f0/0x950 [<9000000085374bc8>ip6_finish_output+0x2b8/0x448 [<9000000085370b24>] ip6_xmit+0x304/ [<90000000853c4438>] ] inet6_csk_xmit+0x100/0x170 [<90000000852b32f0>] __tcp_transmit_skb+0x490/0xdd0 [<90000000852b47fc>] tcp_connect+0xbcc/0x1168 [<90000000853b9088>] tcp_v6_connect+0x580/0x8a0 [<90000000852e7738>] __inet_stream_connect+0x170/<90000000852e7a98>0x140000000000000000000000000000000000000000000000000000000000000 /0x88 [<90000000850f2814>] __sys_connect+0xe4/0x110 [<90000000850f2858>] sys_connect+0x18/0x28 [<9000000085520c94>] do_syscall+0x94/0x1a0 [<9000000083df1fb8>] handle_syscall+0xb8/0x158 Code: 4001ad80 2400873f 2400832d <240073cc> 001137ff 001133ff 6407b41f 001503cc 0280041d ---[ end trace 000000000000000]----- bpf_fifo_dequeue prog はポインターである skb を返します。ポインターは 32 ビット値として扱われ、エピローグでは 64 ビットに符号拡張します。この動作は、ほとんどの bpf prog タイプで適切ですが、LoongArch ABI を必要とする struct ops では不適切です。LoongArch ABI[1]および関数モデルの戻り値仕様に従って、struct ops 戻り値を符号拡張します。 [1] https://loongson.github.io/LoongArch-Documentation/LoongArch-ELF-ABI-EN.htmlCVE-2025-40041]

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - LoongArch: BPF對結構 ops 正確傳回值 ns_bpf_qdisc 自我測試觸發核心錯誤Oops[#1]: CPU 0 無法處理虛擬位址 0000000000741d58 的核心分頁要求era == 90000000851b5ac0, ra == 90000000851b5aa4 CPU 0 UID0 PID449 Commtest_progs 污染G OE 6.16.0+ #3 PREEMPT(full) 污染[O]=OOT_MODULE[E]=UNSIGNED_MODULE 硬體名稱 QEMU QEMU 虛擬機器BIOS 不明 2/2 /2022 pc 90000000851b5ac0 ra 90000000851b5aa4 tp 90000001076b8000 sp 90000001076bb600 a0 0000000000741ce8 a1 0000000000000001 a2 90000001076bb5c0 a3 0000000000000008 a4 90000001004c4620 a5 9000000100741ce8 a6 0000000000000000 a7 0100000000000000 t0 0000000000000010 t1 0000000000000000 t2 9000000104d24d30 t3 0000000000000001 t4 4f2317da8a7e08c4 t5 fffffefffc002f00 t6 90000001004c4620 t7 ffffffffc61c5b3d t8 0000000000000000 u0 0000000000000001 s9 0000000000000050 s0 90000001075bc800 s1 0000000000000040 s2 900000010597c400 s3 0000000000000008 s4 90000001075bc88 0 s5 90000001075bc8f0 s6 0000000000000000 s7 0000000000741ce8 s8 0000000000000000 ra9000000851b5aa4 __qdisc_run+0xac/0x8d8 ERA
    90000000851b5ac0 __qdisc_run+0xc8/0x8d8 CRMD 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) PRMD
    00000004 (PPLV0 +PIE -PWE) EUEN: 00000007 (+FPE +SXE +ASXE -BTE) ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7) ESTAT: 00010000 [PIL] (IS= ECode =1 EsubCode=0) BADV0000000000741d58 PRID0014c010 (Loongson-64bit、Loongson-3A5000) 模組連結於bpf_testmod(OE) [上次卸載bpf_testmod(OE)] 處理程序 test_progs (pid449、 threadinfo=000000009af02b3a、 task=00000000e9ba4956) Stack : 0000000000000000 90000001075bc8ac 90000000869524a8 9000000100741ce8 90000001075bc800 9000000100415300 90000001075bc8ac 0000000000000000 900000010597c400 900000008694a000 0000000000000000 9000000105b59000 90000001075bc800 9000000100741ce8 0000000000000050 900000008513000c 9000000086936000 0000000100094d4c fffffff400676208 0000000000000000 9000000105b59000 900000008694a000 9000000086bf0dc0 9000000105b59000 9000000086bf0d68 9000000085147010 90000001075be788 0000000000000000 9000000086bf0f98 0000000000000001 0000000000000010 9000000006015840 0000000000000000 9000000086be6c40 0000000000000000 0000000000000000 0000000000000000 4f2317da8a7e08c4 0000000000000101 4f2317da8a7e08c4 ... 呼叫追踪 [<90000000851b5ac0>] __qdisc_run+0xc8/0x8d8 [<9000000085130008>] __dev_queue_xmit+0x578/0x10f0 [<90000000853701c0>] ip6_finish_output2+0x2f0/0x950 [<9000000085374bc8>] ip6_finish_output+0x2b8/0x448 [<9000000085370b24>] ip6_xmit [[+0x304/0x858<90000000853c4438>] ] ] inet6_csk_xmit+0x100/0x170 [<90000000852b32f0>] __tcp_transmit_skb+0x490/0xdd0 [<90000000852b47fc>] tcp_connect+0xbcc/0x1168 [<90000000853b9088>] tcp_v6_connect+0x580/0x8a0 [<90000000852e7a98><90000000852e7738>] __inet_stream_connect+0x170/0x480 [ [50] inet_stream_connect+0x8a0 /0x88 [<90000000850f2814>] __sys_connect+0xe4/0x110 [<90000000850f2858>] sys_connect+0x18/0x28 [<9000000085520c94>] do_syscall+0x94/0x1a0 [<9000000083df1fb8>] handle_syscall+0xb8/0x158 Code: 4001ad80 2400873f 2400832d <240073cc> 001137ff 001133ff 6407b41f 001503cc 0280041d ---[ end trace 0000000000000000]--- bpf_fifo_dequeue prog 傳回為指標的 skb。指標被視為 32 位元值且在 epilogue 中符號延伸至 64 位元。此行為對於大多數 bpf prog 類型而言是正確的但對於需要 LoongArch ABI 的 struct ops 而言是錯誤的。因此讓我們根據 LoongArch ABI ([1]) 簽署延伸結構 ops 傳回值並函式模型中的傳回值規格。 [1]: https://loongson.github.io/LoongArch-Documentation/LoongArch-ELF-ABI-EN.html (CVE-2025-40041)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - LoongArchBPF: Sign-extend struct ops 正确返回值ns_bpf_qdisc selftest 触发内核恐慌Oops[#1]: CPU 0 无法处理虚拟地址 0000000000741d58 上的内核分页请求era == 90000000851b5ac0, ra == 90000000851b5aa4 CPU 0 UID:0 PID449 Commtest_progs 受感染G OE 6.16.0+ #3 PREEMPT(full) 受感染[O]=OOT_MODULE、[E]=UNSIGNED_MODULE 硬件名称QEMU QEMU 虚拟机BIOS 未知2/2 /2022 pc 90000000851b5ac0 ra 90000000851b5aa4 tp 90000001076b8000 sp 90000001076bb600 a0 0000000000741ce8 a1 0000000000000001 a2 90000001076bb5c0 a3 0000000000000008 a4 90000001004c4620 a5 9000000100741ce8 a6 0000000000000000 a7 0100000000000000 t0 0000000000000010 t1 0000000000000000 t2 9000000104d24d30 t3 0000000000000001 t4 4f2317da8a7e08c4 t5 fffffefffc002f00 t6 90000001004c4620 t7 ffffffffc61c5b3d t8 0000000000000000 u0 0000000000000001 s9 0000000000000050 s0 90000001075bc800 s1 0000000000000040 s2 900000010597c400 s3 0000000000000008 s4 90000001075bc88 0 s5 90000001075bc8f0 s6 000000000000000 s7 0000000000741ce8 s8 0000000000000000 ra90000000851b5aa4 __qdisc_run+0xac/0x8d8 ERA
    90000000851b5ac0 __qdisc_run+0xc8/0x8d8 CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) PRMD:
    00000004 (PPLV0 +PIE -PWE) EUEN00000007 (+FPE +SXE +ASXE -BTE) ECFG00071c1d (LIE=0,2-4,10-12 VS=7) ESTAT: 00010000 [PIL] (IS= ECode =1 EsubCode=0) BADV: 0000000000741d58 PRID: 0014c010 (Loongson-64bit, Loongson-3A5000) 链接的模块bpf_testmod(OE) [最后一个卸载的: bpf_testmod(OE)] Process test_progspid: 449、 threadinfo=000000009af02b3a、 task=00000000e9ba4956) Stack : 0000000000000000 90000001075bc8ac 90000000869524a8 9000000100741ce8 90000001075bc800 9000000100415300 90000001075bc8ac 0000000000000000 900000010597c400 900000008694a000 0000000000000000 9000000105b59000 90000001075bc800 9000000100741ce8 0000000000000050 900000008513000c 9000000086936000 0000000100094d4c fffffff400676208 0000000000000000 9000000105b59000 900000008694a000 9000000086bf0dc0 9000000105b59000 9000000086bf0d68 9000000085147010 90000001075be788 0000000000000000 9000000086bf0f98 0000000000000001 0000000000000010 9000000006015840 0000000000000000 9000000086be6c40 0000000000000000 0000000000000000 0000000000000000 4f2317da8a7e08c4 0000000000000101 4f2317da8a7e08c4 ... Call Trace[<90000000851b5ac0>] __qdisc_run+0xc8/0x8d8 [<9000000085130008>] __dev_queue_xmit+0x578/0x10f0 [<90000000853701c0>] ip6_finish_output2+0x2f0/0x950 [<9000000085374bc8>] ip6_finish_output+0x2b8/0x448 [<9000000085370b24>] ip6_xmit+0x304/0x858 [<90000000853c4438>] inet6_csk_xmit+0x100/0x170 [<90000000852b32f0>] __tcp_transmit_skb+0x490/0xdd0 [<90000000852b47fc>] tcp_connect+0xbcc/0x1168 [<90000000853b9088>] tcp_v6_connect+0x580/0x8a0 [<90000000852e7738>] __inet_stream_connect+0x170/0x480 [<90000000852e7a98>inetx50_stream [] /0x88 [<90000000850f2814>] __sys_connect+0xe4/0x110 [<90000000850f2858>] sys_connect+0x18/0x28 [<9000000085520c94>] do_syscall+0x94/0x1a0 [<9000000083df1fb8>] handle_syscall+0xb8/0x158 Code: 4001ad80 2400873f 2400832d <240073cc> 001137ff 001133ff 6407b41f 001503cc 0280041d ---[结束跟踪 0000000000000000]--- bpf_fifo_dequeue prog 返回一个指针 skb。指针被视为 32 位值并且在尾声中符号扩展为 64 位。此行为适用于大多数 bpf prog 类型但不适用于需要 LoongArch ABI 的 struct ops。让我们根据 LoongArch ABI ([1]) 签署 extend struct ops 返回值以及函数模型中的返回值规范。 [1] https://loongson.github.io/LoongArch-Documentation/LoongArch-ELF-ABI-EN.html (CVE-2025-40041)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

ID	Name	Product	Family	Published	Updated	Severity
272024	Linux Distros Unpatched Vulnerability : CVE-2025-40041	Nessus	Misc.	10/30/2025	11/3/2025	medium
272024	Linux Distros のパッチ未適用の脆弱性: CVE-2025-40041	Nessus	Misc.	10/30/2025	11/3/2025	medium
272024	Linux Distros 未修補的弱點：CVE-2025-40041	Nessus	Misc.	10/30/2025	11/3/2025	medium
272024	Linux Distros 未修补的漏洞：CVE-2025-40041	Nessus	Misc.	10/30/2025	11/3/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium