Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Linux カーネルでは、以下の脆弱性が解決されています: tcp: drop secpath at the same time as we currently drop dst Xiumei reported hitting the WARN in xfrm6_tunnel_net_exit while running tests that boil down to: - create a pair of netns - run a basic TCP test over ipcomp6 - delete the pair of netns The xfrm_state found on spi_byaddr was not deleted at the time we delete the netns, because we still have a reference on it. This lingering reference comes from a secpath (which holds a ref on the xfrm_state), which is still attached to an skb. This skb is not leaked, it ends up on sk_receive_queue and then gets defer-free'd by skb_attempt_defer_free. The problem happens when we defer freeing an skb (push it on one CPU's defer_list), and don't flush that list before the netns is deleted. In that case, we still have a reference on the xfrm_state that we don't expect at this point. We already drop the skb's dst in the TCP receive path when it's no longer needed, so let's also drop the secpath. At this point, tcp_filter has already called into the LSM hooks that may require the secpath, so it should not be needed anymore.
    However, in some of those places, the MPTCP extension has just been attached to the skb, so we cannot simply drop all extensions. (CVE-2025-21864)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

検出

Linux Distros のパッチ未適用の脆弱性: CVE-2025-21864

medium Nessus プラグイン ID 243718

バージョン 1.14

バージョン 1.13

バージョン 1.12

バージョン 1.11

バージョン 1.10

バージョン 1.9

バージョン 1.8

バージョン 1.7

バージョン 1.2

バージョン 1.14 Feb 4, 2026, 6:31 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602040631
バージョン 1.13 Feb 3, 2026, 10:27 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602032227
バージョン 1.12 Jan 15, 2026, 2:04 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601151404
バージョン 1.11 Jan 10, 2026, 7:58 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601101958
バージョン 1.10 Dec 3, 2025, 8:52 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512032052
バージョン 1.9 Nov 12, 2025, 12:37 AM Plugin metadata Detection (updated detection logic) Plugin Feed: 202511120037
バージョン 1.8 Oct 28, 2025, 5:56 PM Detection (updated detection logic) Plugin Feed: 202510281756
バージョン 1.7 Oct 27, 2025, 11:56 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:U/RC:C") Detection (updated detection logic) Plugin Feed: 202510272356
バージョン 1.2 Sep 1, 2025, 4:30 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509010430