An update of the linux package has been released.

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 跟踪修复 kprobe 初始化中造成空指针取消引用的争用条件 kprobe 初始化中有一个危急的争用条件可能导致空指针取消引用 和内核崩溃。
    [1135630.084782] 无法处理虚拟地址 0000710a04630000 处的内核分页请求
    [1135630.260314] pstate: 404003c9 (nZcv DAIF +PAN -UAO) [1135630.269239] pc : kprobe_perf_func+0x30/0x260 [1135630.277643] lr: kprobe_dispatcher+0x44/0x60 [1135630.286041] sp: ffffaeff4977fa40 [1135630.293441] x29 ffffaeff4977fa40 x28ffffaf015340e400 [1135630.302837] x27: 0000000000000000 x26: 0000000000000000 [1135630.312257] x25ffffaf029ed108a8 x24: ffffaf015340e528 [1135630.321705] x297ffffc2: ffffafc2: ffffafc2: ffffaf029ed108a8 x297
    ffffaeff4977fc50 [1135630.331154] x210000000000000000 x20 ffffaeff4977fc50 [1135630.340586] x19
    ffffaf015340e400 x18: 0000000000000000 [1135630.349985] x17: 0000000000000000 x16: 0000000000000000 [1135630.359285] x15: 0000000000000000 x14: 0000000000000000 [1135630.368445] x13: 0000000000000000 x12:
    0000000000000000 [1135630.377473] x11: 0000000000000000 x10: 0000000000000000 [1135630.386411] x9 :
    0000000000000000 x8 : 0000000000000000 [1135630.395252] x7 : 0000000000000000 x6 : 0000000000000000 [1135630.403963] x5 : 0000000000000000 x4 : 0000000000000000 [1135630.412545] x3 : 0000710a04630000 x2 :
    0000000000000006 [1135630.421021] x1 : ffffaeff4977fc50 x0 : 0000710a04630000 [1135630.429410] 调用跟踪
    [1135630.434828] kprobe_perf_func+0x30/0x260 [1135630.441661] kprobe_dispatcher+0x44/0x60 [1135630.448396] aggr_pre_handler+0x70/0xc8 [1135630.454959] kprobe_breakpoint_handler+0x140/0x1e0 [1135630.462435] brk_handler+0xbc/0xd8 [1135630.468437] do_debug_exception +0x84/0x138 [1135630.475074] el1_dbg+0x18/0x8c [1135630.480582] security_file_permission+0x0/0xd0 [1135630.487426] vfs_write+0x70/0x1c0 [1135630.493059] ksys_write+0x5c/0xc8 [1135630.498638] __arm64_sys_write+0x24/0x30 [1135630.504821el0_svc_common+0x78/0x130 [1135630.510838] el0_svc_handler+0x38/0x78 [1135630.516834] el0_svc+0x8/0x1b0 kernel/trace/trace_kprobe.c1308 0xffff3df8995039ec <kprobe_perf_func+0x2c>ldr x21[x24,#120] include/ linux/compiler.h294 0xffff3df8995039f0 <kprobe_perf_func+0x30>ldr x1[x21,x0] kernel/trace/trace_kprobe.c 1308head = this_cpu_ptr(call->perf_events); 1309if (hlist_empty(head)) 1310返回 0 crash> struct trace_event_call -o struct trace_event_call { ... [120] struct hlist_head
    *perf_events; //(call->perf_event) ... } crash> struct trace_event_call ffffaf015340e528 struct trace_event_call { ... perf_events = 0xffff0ad5fa89f088, //this value is true, but x21 = 0 ... } 争用条件分析：争用发生在 之间kprobe 激活和 perf_events 初始化CPU0 CPU1 ==== ==== perf_kprobe_init perf_trace_event_init tp_event->perf_events = list;(1) tp_event->class->reg (2) KPROBE ACTIVE Debug 异常触发 ... kprobe_dispatcher kprobe_perf_func ->tp.flags & TP_FLAG_PROFILEhead = this_cpu_ptr(call->perf_events)(3)perf_events 仍为 NULL 问题1. CPU0 执行 (1) 分配 tp_event->perf_events = list 2. CPU0 执行 (2) 启用通过 class->reg() 实现的 kprobe 功能 3. CPU1 触发并达到 kprobe_dispatcher 4. CPU1 检查 TP_FLAG_PROFILE - 条件通过步骤 2 已完成 5. CPU1 调用 kprobe_perf_func() 并在 (3) 崩溃因为 call->perf_events 仍为空CPU1 发现 kprobe 功能已启用但没有发现 perf_ev已分配 ents。添加配对读取 ---truncated--- (CVE-2025-40042)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - tracingNULL ポインターデリファレンスを引き起こす kprobe 初期化の競合状態を修正します。kprobe 初期化には、NULL ポインターデリファレンスおよびカーネルクラッシュにつながる可能性のある重大な競合状態があります。
    [1135630.084782] 仮想アドレス 0000710a04630000 ... でカーネルページングリクエストを処理できません
    [1135630.260314] pstate404003c9 (nZcv DAIF +PAN -UAO) [1135630.269239] pc : kprobe_perf_func+0x30/0x260 [1135630.277643] lr : kprobe_dispatcher+0x44/0x60 [1135630.286041] sp : ffffaeff4977fa40 [1135630.293441] x29 ffffaeff4977fa40 x28: ffffaf015340e400 [1135630.302837] x27: 0000000000000000 x26: 0000000000000000 [1135630.312257] x25: ffffaf029ed108a8 x24: ffffaf015340e528 [1135630.321705] x23: ffffaeff4977fc50 x22:
    ffffaeff4977fc50 [1135630.331154x21: 0000000000000000 x20: ffffaeff4977fc50 [1135630.340586x19:
    ffffaf015340e400 x18: 0000000000000000 [1135630.349985] x17: 0000000000000000 x16: 0000000000000000 [1135630.359285] x15: 0000000000000000 x14: 0000000000000000 [1135630.368445] x13: 0000000000000000 x12:
    1135630.37747300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001135630.386411​
    0000000000000000 x8 : 0000000000000000 [1135630.395252] x7 : 0000000000000000 x6 : 0000000000000000 [1135630.403963] x5 : 0000000000000000 x4 : 0000000000000000 [1135630.412545] x3 : 0000710a04630000 x2 :
    00000000000000061135630.421021] x1 : ffffaeff4977fc50 x0 : 0000710a04630000 [1135630.429410] Call trace:
    [1135630.434828] kprobe_perf_func+0x30/0x260 [1135630.441661] kprobe_dispatcher+0x44/0x60 [1135630.448396] aggr_pre_handler+0x70/0xc8 [1135630.454959] kprobe_breakpoint_handler+0x140/0x1e0 [1135630.462435] brk_handler+0xbc/0xd8 [[] ] dox_handler+0xbc/0xd8 [1135630.468437] do +0x84/0x138 [1135630.475074] el1_dbg+0x18/0x8c [1135630.480582] security_file_permission+0x0/0xd0 [1135630.487426] vfs_write+0x70/0x1c0 [1135630.493059] ksys_write+0x5c/0xc8 [1135630.498638] __arm64_sys_write+0x24/0x30 []1135630.504821el0_svc_common+0x78/0x130 [1135630.510838] el0_svc_handler+0x38/0x78 [1135630.516834] el0_svc+0x8/0x1b0 kernel/trace/trace_kprobe.c:1308 0xffff3df8995039ec <kprobe_perf_func+0x2c>ldr x21、[x24、#120] include/ linux/compiler.h294 0xffff3df8995039f0 <kprobe_perf_func+0x30>ldr x1、[x21、x0] kernel/trace/trace_kprobe.c 1308head = this_cpu_ptr(call->perf_events); 1309if (hlist_empty(head)) 1310return 0; crash> struct trace_event_call -o struct trace_event_call { ... [120] struct hlist_head
    *perf_events; //(call->perf_event) ... } crash> struct trace_event_call ffffaf015340e528 struct trace_event_call { ... perf_events = 0xffff0ad5fa89f088, //この値は正しい, x21 = 0 ... } 競合状態分析 : 競合が発生します。 kprobe アクティベーションおよび perf_events の初期化CPU0 CPU1 ==== ==== perf_kprobe_init perf_trace_event_init tp_event->perf_events = list;(1) tp_event->class->reg (2) KPROBE ACTIVE デバッグ例外トリガー ... kprobe_dispatcher kprobe_perf_func (tk) ->tp.flags & TP_FLAG_PROFILEヘッド = this_cpu_ptr(call->perf_events)(3)perf_events がまだ NULL の問題1. CPU0 が実行1割り当て tp_event->perf_events = リスト 2. CPU0 が実行2有効化class->reg() を介した kprobe 機能 3. CPU1 が発生し、kprobe_dispatcher 4 に到達します。 CPU1 が TP_FLAG_PROFILE をチェックします - 条件が合格ステップ 2 完了5. CPU1 が kprobe_perf_func() を呼び出し、3でクラッシュします。call->perf_events が NULL のままであるためですCPU1 では、kprobe 機能が有効化されていると認識していますが、perf_ev は確認していませんents が割り当てられました。ペアリング読み取りアンスを追加 ---truncated---CVE-2025-40042]

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference There is a critical     race condition in kprobe initialization that can lead to NULL pointer dereference and kernel crash.
    [1135630.084782] Unable to handle kernel paging request at virtual address 0000710a04630000 ...
    [1135630.260314] pstate: 404003c9 (nZcv DAIF +PAN -UAO) [1135630.269239] pc : kprobe_perf_func+0x30/0x260     [1135630.277643] lr : kprobe_dispatcher+0x44/0x60 [1135630.286041] sp : ffffaeff4977fa40 [1135630.293441]     x29: ffffaeff4977fa40 x28: ffffaf015340e400 [1135630.302837] x27: 0000000000000000 x26: 0000000000000000     [1135630.312257] x25: ffffaf029ed108a8 x24: ffffaf015340e528 [1135630.321705] x23: ffffaeff4977fc50 x22:
    ffffaeff4977fc50 [1135630.331154] x21: 0000000000000000 x20: ffffaeff4977fc50 [1135630.340586] x19:
    ffffaf015340e400 x18: 0000000000000000 [1135630.349985] x17: 0000000000000000 x16: 0000000000000000     [1135630.359285] x15: 0000000000000000 x14: 0000000000000000 [1135630.368445] x13: 0000000000000000 x12:
    0000000000000000 [1135630.377473] x11: 0000000000000000 x10: 0000000000000000 [1135630.386411] x9 :
    0000000000000000 x8 : 0000000000000000 [1135630.395252] x7 : 0000000000000000 x6 : 0000000000000000     [1135630.403963] x5 : 0000000000000000 x4 : 0000000000000000 [1135630.412545] x3 : 0000710a04630000 x2 :
    0000000000000006 [1135630.421021] x1 : ffffaeff4977fc50 x0 : 0000710a04630000 [1135630.429410] Call trace:
    [1135630.434828] kprobe_perf_func+0x30/0x260 [1135630.441661] kprobe_dispatcher+0x44/0x60 [1135630.448396]     aggr_pre_handler+0x70/0xc8 [1135630.454959] kprobe_breakpoint_handler+0x140/0x1e0 [1135630.462435]     brk_handler+0xbc/0xd8 [1135630.468437] do_debug_exception+0x84/0x138 [1135630.475074] el1_dbg+0x18/0x8c     [1135630.480582] security_file_permission+0x0/0xd0 [1135630.487426] vfs_write+0x70/0x1c0 [1135630.493059]     ksys_write+0x5c/0xc8 [1135630.498638] __arm64_sys_write+0x24/0x30 [1135630.504821]     el0_svc_common+0x78/0x130 [1135630.510838] el0_svc_handler+0x38/0x78 [1135630.516834] el0_svc+0x8/0x1b0     kernel/trace/trace_kprobe.c: 1308 0xffff3df8995039ec <kprobe_perf_func+0x2c>: ldr x21, [x24,#120]     include/linux/compiler.h: 294 0xffff3df8995039f0 <kprobe_perf_func+0x30>: ldr x1, [x21,x0]     kernel/trace/trace_kprobe.c 1308: head = this_cpu_ptr(call->perf_events); 1309: if (hlist_empty(head))     1310: return 0; crash> struct trace_event_call -o struct trace_event_call { ... [120] struct hlist_head
    *perf_events; //(call->perf_event) ... } crash> struct trace_event_call ffffaf015340e528 struct     trace_event_call { ... perf_events = 0xffff0ad5fa89f088, //this value is correct, but x21 = 0 ... } Race     Condition Analysis: The race occurs between kprobe activation and perf_events initialization: CPU0 CPU1     ==== ==== perf_kprobe_init perf_trace_event_init tp_event->perf_events = list;(1) tp_event->class->reg     (2) KPROBE ACTIVE Debug exception triggers ... kprobe_dispatcher kprobe_perf_func (tk->tp.flags &     TP_FLAG_PROFILE) head = this_cpu_ptr(call->perf_events)(3) (perf_events is still NULL) Problem: 1. CPU0     executes (1) assigning tp_event->perf_events = list 2. CPU0 executes (2) enabling kprobe functionality via     class->reg() 3. CPU1 triggers and reaches kprobe_dispatcher 4. CPU1 checks TP_FLAG_PROFILE - condition     passes (step 2 completed) 5. CPU1 calls kprobe_perf_func() and crashes at (3) because call->perf_events is     still NULL CPU1 sees that kprobe functionality is enabled but does not see that perf_events has been     assigned. Add pairing read an ---truncated--- (CVE-2025-40042)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 追踪修正 kprobe 初始化中造成 NULL 指標解除參照的爭用情形。kprobe 初始化中有重大爭用情形可能會導致 NULL 指標解除參照和核心損毀。
    [1135630.084782] 無法處理虛擬位址 0000710a04630000 的核心分頁要求 ...
    [1135630.260314] pstate404003c9 (nZcv DAIF +PAN -UAO) [1135630.269239] pc kprobe_perf_func+0x30/0x260 [1135630.277643] lr kprobe_dispatcher+0x44/0x60 [1135630.286041] spffffaeff4977fa40 [1135630.293441] x29 ffffaeff4977fa40 x28ffffaf015340e400 [1135630.302837] x2700000000000000001135630.321705x260000000000000000 [1135630.312257] x25 ffffaf029ed108a8 x24ffffaf015340e5feff497497
    ffffaeff4977fc50 [1135630.331154] x210000000000000000 x20ffffaeff4977fc50 [1135630.340586] x19
    ffffaf015340e400 x18: 0000000000000000 [1135630.349985] x17: 0000000000000000 x16: 0000000000000000 [1135630.359285] x15: 0000000000000000 x14: 0000000000000000 [1135630.368445] x13: 0000000000000000 x12:
    0000000000000000 [1135630.377473] x11: 0000000000000000 x10: 0000000000000000 [1135630.386411] x9 :
    0000000000000000 x8 : 0000000000000000 [1135630.395252] x7 : 0000000000000000 x6 : 0000000000000000 [1135630.403963] x5 : 0000000000000000 x4 : 0000000000000000 [1135630.412545] x3 : 0000710a04630000 x2 :
    0000000000000006 [1135630.421021] x1ffffaeff4977fc50 x00000710a04630000 [1135630.429410] 呼叫追踪
    [1135630.434828] kprobe_perf_func+0x30/0x260 [1135630.441661] kprobe_dispatcher+0x44/0x60 [1135630.448396] aggr_pre_handler+0x70/0xc8 [1135630.454959] kprobe_breakpoint_handler+0x140/0x1e0 [1135630.462435] brk_handler+0xbc/0xd8 [1135630.468437] do_debug_except +0x84/0x138 [1135630.475074] el1_dbg+0x18/0x8c [1135630.480582] security_file_permission+0x0/0xd0 [1135630.487426] vfs_write+0x70/0x1c0 [1135630.493059] ksys_write+0x5c/0xc8 [1135630.498638] __arm64_sys_write+0x24/0x30 [1135630.504821] el0_svc_common+0x78/0x130 [1135630.510838] el0_svc_handler+0x38/0x78 [1135630.516834] el0_svc+0x8/0x1b0 kernel/trace/trace_kprobe.c: 1308 0xffff3df8995039ec <kprobe_perf_func+0x2c>: ldr x21、 [x24,#120] include/ linux/compiler.h: 294 0xffff3df8995039f0 <kprobe_perf_func+0x30>ldr x1、[x21,x0] kernel/trace/trace_kprobe.c 1308head = this_cpu_ptr(call->perf_events) 1309if (hlist_empty(head)) 1310傳回 0 crash> struct trace_event_call -o struct trace_event_call { ... [120] struct hlist_head
    *perf_events //(call->perf_event) ... } crash> struct trace_event_call ffffaf015340e528 struct trace_event_call { ... perf_events = 0xffff0ad5fa89f088, //此值正確但 x21 = 0 ... } 爭用情形分析kprobe 啟用和 perf_events 初始化CPU0 CPU1 ==== ==== perf_kprobe_init perf_trace_event_init tp_event->perf_events = list;(1) tp_event->class->reg (2) KPROBE ACTIVE 偵錯例外狀況觸發了 ... kprobe_dispatcher kprobe_perf_func (tk ->tp.flags & TP_FLAG_PROFILE) head = this_cpu_ptr(call->perf_events)(3) (perf_events 仍為 NULL) 問題1. CPU0 執行 (1) 指派 tp_event->perf_events = list 2. CPU0 執行 (2) 啟用kprobe 功能透過 class->reg() 3. CPU1 觸發並到達 kprobe_dispatcher 4. CPU1 檢查 TP_FLAG_PROFILE - 條件通過 (步驟 2 已完成) 5. CPU1 呼叫 kprobe_perf_func() 並在 (3) 損毀因為 call->perf_events 仍為 NULL CPU1 發現 kprobe 功能已啟用但未發現 perf_ev ents 已指派。新增配對讀取和 ---truncated--- (CVE-2025-40042)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

ID	Name	Product	Family	Published	Updated	Severity
274526	Photon OS 4.0: Linux PHSA-2025-4.0-0899	Nessus	PhotonOS Local Security Checks	11/8/2025	11/11/2025	medium
271898	Linux Distros 未修补的漏洞：CVE-2025-40042	Nessus	Misc.	10/28/2025	10/31/2025	medium
271898	Linux Distros のパッチ未適用の脆弱性: CVE-2025-40042	Nessus	Misc.	10/28/2025	10/31/2025	medium
271898	Linux Distros Unpatched Vulnerability : CVE-2025-40042	Nessus	Misc.	10/28/2025	10/31/2025	medium
271898	Linux Distros 未修補的弱點：CVE-2025-40042	Nessus	Misc.	10/28/2025	10/31/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium