The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1791780738 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: invoke MMU notifiers in     shmem/file collapse paths Any codepath that zaps page table entries must invoke MMU notifiers to ensure     that secondary MMUs (like KVM) don't keep accessing pages which aren't mapped anymore. Secondary MMUs     don't hold their own references to pages that are mirrored over, so failing to notify them can lead to     page use-after-free. I'm marking this as addressing an issue introduced in commit f3f0e1d2150b     (khugepaged: add support of collapse for tmpfs/shmem pages), but most of the security impact of this     only came in commit 27e1f8273113 (khugepaged: enable collapse pmd for pte-mapped THP), which actually     omitted flushes for the removal of present PTEs, not just for the removal of empty page tables.
    (CVE-2022-48991)

  - In the Linux kernel, the following vulnerability has been resolved: virtio_net: fix xdp_rxq_info bug after     suspend/resume The following sequence currently causes a driver bug warning when using virtio_net: # ip     link set eth0 up # echo mem > /sys/power/state (or e.g. # rtcwake -s 10 -m mem) <resume> # ip link set     eth0 down Missing register, driver bug WARNING: CPU: 0 PID: 375 at net/core/xdp.c:138     xdp_rxq_info_unreg+0x58/0x60 Call trace: xdp_rxq_info_unreg+0x58/0x60 virtnet_close+0x58/0xac
    __dev_close_many+0xac/0x140 __dev_change_flags+0xd8/0x210 dev_change_flags+0x24/0x64     do_setlink+0x230/0xdd0 ... This happens because virtnet_freeze() frees the receive_queue completely     (including struct xdp_rxq_info) but does not call xdp_rxq_info_unreg(). Similarly, virtnet_restore() sets     up the receive_queue again but does not call xdp_rxq_info_reg(). Actually, parts of virtnet_freeze_down()     and virtnet_restore_up() are almost identical to virtnet_close() and virtnet_open(): only the calls to     xdp_rxq_info_(un)reg() are missing. This means that we can fix this easily and avoid such problems in the     future by just calling virtnet_close()/open() from the freeze/restore handlers. Aside from adding the     missing xdp_rxq_info calls the only difference is that the refill work is only cancelled if     netif_running(). However, this should not make any functional difference since the refill work should only     be active if the network interface is actually up. (CVE-2022-49687)

  - In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix repeated calls to     sock_put() when msg has more_data In tcp_bpf_send_verdict() redirection, the eval variable is assigned to
    __SK_REDIRECT after the apply_bytes data is sent, if msg has more_data, sock_put() will be called multiple     times. We should reset the eval variable to __SK_NONE every time more_data starts. This causes: IPv4:
    Attempt to release TCP socket in state 1 00000000b4c925d7 ------------[ cut here ]------------ refcount_t:
    addition on 0; use-after-free. WARNING: CPU: 5 PID: 4482 at lib/refcount.c:25     refcount_warn_saturate+0x7d/0x110 Modules linked in: CPU: 5 PID: 4482 Comm: sockhash_bypass Kdump: loaded     Not tainted 6.0.0 #1 Hardware name: Red Hat KVM, BIOS 1.11.0-2.el7 04/01/2014 Call Trace: <TASK>
    __tcp_transmit_skb+0xa1b/0xb90 ? __alloc_skb+0x8c/0x1a0 ? __kmalloc_node_track_caller+0x184/0x320     tcp_write_xmit+0x22a/0x1110 __tcp_push_pending_frames+0x32/0xf0 do_tcp_sendpages+0x62d/0x640     tcp_bpf_push+0xae/0x2c0 tcp_bpf_sendmsg_redir+0x260/0x410 ? preempt_count_add+0x70/0xa0     tcp_bpf_send_verdict+0x386/0x4b0 tcp_bpf_sendmsg+0x21b/0x3b0 sock_sendmsg+0x58/0x70
    __sys_sendto+0xfa/0x170 ? xfd_validate_state+0x1d/0x80 ? switch_fpu_return+0x59/0xe0
    __x64_sys_sendto+0x24/0x30 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd     (CVE-2022-50536)

  - In the Linux kernel, the following vulnerability has been resolved: crypto: scomp - fix req->dst buffer     overflow The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid     req->dst buffer overflow problem. (CVE-2023-52612)

  - In the Linux kernel, the following vulnerability has been resolved: net: atlantic: eliminate double free     in error handling logic Driver has a logic leak in ring data allocation/free, where aq_ring_free could be     called multiple times on same ring, if system is under stress and got memory allocation error. Ring     pointer was used as an indicator of failure, but this is not correct since only ring data is     allocated/deallocated. Ring itself is an array member. Changing ring allocation functions to return error     code directly. This simplifies error handling and eliminates aq_ring_free on higher layer.
    (CVE-2023-52664)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01983-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-47670: can: peak_usb: fix use after free bugs (bsc#1241407).
    - CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
    - CVE-2022-49145: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data (bsc#1238162).
    - CVE-2022-49168: btrfs: do not clean up repair bio if submit fails (bsc#1238109).
    - CVE-2022-49190: kernel/resource: fix kfree() of bootmem memory again (bsc#1238130).
    - CVE-2022-49212: mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init (bsc#1238331).
    - CVE-2022-49216: drm/tegra: Fix reference leak in tegra_dsi_ganged_probe (bsc#1238338).
    - CVE-2022-49235: ath9k_htc: fix uninit value bugs (bsc#1238333).
    - CVE-2022-49248: ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction (bsc#1238284).
    - CVE-2022-49253: media: usb: go7007: s2250-board: fix leak in probe() (bsc#1238420).
    - CVE-2022-49320: dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type (bsc#1238394).
    - CVE-2022-49326: rtl818x: Prevent using not initialized queues (bsc#1238646).
    - CVE-2022-49371: driver core: fix deadlock in __device_attach (bsc#1238546).
    - CVE-2022-49382: soc: rockchip: Fix refcount leak in rockchip_grf_init (bsc#1238306).
    - CVE-2022-49396: phy: qcom-qmp: fix reset-controller leak on probe errors (bsc#1238289).
    - CVE-2022-49420: net: annotate races around sk->sk_bound_dev_if (bsc#1238887).
    - CVE-2022-49441: tty: fix deadlock caused by calling printk() under tty_port->lock (bsc#1238263).
    - CVE-2022-49445: pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources()     (bsc#1238019).
    - CVE-2022-49460: PM / devfreq: rk3399_dmc: Disable edev on remove() (bsc#1238892).
    - CVE-2022-49467: drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() (bsc#1238815).
    - CVE-2022-49474: Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout (bsc#1238071).
    - CVE-2022-49491: drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() (bsc#1238539).
    - CVE-2022-49503: ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix     (bsc#1238868).
    - CVE-2022-49592: net: stmmac: fix dma queue left shift overflow issue (bsc#1238311).
    - CVE-2022-49625: sfc: fix kernel panic when creating VF (bsc#1238411).
    - CVE-2022-49635: drm/i915/selftests: fix subtraction overflow bug (bsc#1238806).
    - CVE-2022-49652: dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate (bsc#1238871).
    - CVE-2022-49715: irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions (bsc#1238818).
    - CVE-2022-49728: kABI workaround for changeing the variable length type to size_t (bsc#1239111).
    - CVE-2022-49729: nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred (bsc#1239060).
    - CVE-2022-49751: w1: fix WARNING after calling w1_process() (bsc#1240254).
    - CVE-2022-49761: btrfs: always report error in run_one_delayed_ref() (bsc#1240261).
    - CVE-2022-49772: ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (bsc#1242147).
    - CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
    - CVE-2022-49776: macvlan: enforce a consistent minimal mtu (bsc#1242248).
    - CVE-2022-49787: mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (bsc#1242352).
    - CVE-2022-49788: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (bsc#1242353).
    - CVE-2022-49813: net: ena: Fix error handling in ena_init() (bsc#1242497).
    - CVE-2022-49821: mISDN: fix possible memory leak in mISDN_dsp_element_register() (bsc#1242542).
    - CVE-2022-49826: ata: libata-transport: fix double ata_host_put() in ata_tport_add() (bsc#1242549).
    - CVE-2022-49829: drm/scheduler: fix fence ref counting (bsc#1242691).
    - CVE-2022-49832: pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (bsc#1242154).
    - CVE-2022-49835: ALSA: hda: fix potential memleak in 'add_widget_node' (bsc#1242385).
    - CVE-2022-49840: bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() (bsc#1242447).
    - CVE-2022-49842: ASoC: soc-utils: Remove __exit for snd_soc_util_exit() (bsc#1242484).
    - CVE-2022-49853: net: macvlan: fix memory leaks of macvlan_common_newlink (bsc#1242688).
    - CVE-2022-49861: dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove() (bsc#1242580).
    - CVE-2022-49862: tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header     (bsc#1242755).
    - CVE-2022-49865: ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network (bsc#1242570).
    - CVE-2022-49871: net: tun: call napi_schedule_prep() to ensure we own a napi (bsc#1242558).
    - CVE-2022-49872: net: gso: fix panic on frag_list with mixed head alloc types (bsc#1242594).
    - CVE-2022-49874: HID: hyperv: fix possible memory leak in mousevsc_probe() (bsc#1242478).
    - CVE-2022-49898: btrfs: fix tree mod log mishandling of reallocated nodes (bsc#1242472).
    - CVE-2022-49907: net: mdio: fix undefined behavior in bit shift for __mdiobus_register (bsc#1242450).
    - CVE-2022-49913: btrfs: fix inode list leak during backref walking at find_parent_nodes() (bsc#1242470).
    - CVE-2022-49914: btrfs: fix inode list leak during backref walking at resolve_indirect_refs()     (bsc#1242427).
    - CVE-2022-49922: nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send() (bsc#1242378).
    - CVE-2022-49923: nfc: nxp-nci: Fix potential memory leak in nxp_nci_send() (bsc#1242394).
    - CVE-2022-49924: nfc: fdp: Fix potential memory leak in fdp_nci_send() (bsc#1242426).
    - CVE-2022-49925: RDMA/core: Fix null-ptr-deref in ib_core_cleanup() (bsc#1242371).
    - CVE-2022-49931: IB/hfi1: Correctly move list in sc_disable() (bsc#1242382).
    - CVE-2023-52868: thermal: core: prevent potential string overflow (bsc#1225044).
    - CVE-2023-52975: scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress (bsc#1240322).
    - CVE-2023-52988: ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()     (bsc#1240293).
    - CVE-2023-52989: firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region     (bsc#1240266).
    - CVE-2023-52993: x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL (bsc#1240297).
    - CVE-2023-53039: HID: intel-ish-hid: ipc: Fix potential use-after-free in work function (bsc#1242745).
    - CVE-2023-53045: usb: gadget: u_audio: do not let userspace block driver unbind (bsc#1242756).
    - CVE-2023-53066: qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info (bsc#1242227).
    - CVE-2023-53079: net/mlx5: Fix steering rules cleanup (bsc#1242765).
    - CVE-2023-53080: xsk: Add missing overflow check in xdp_umem_reg (bsc#1242287).
    - CVE-2023-53094: tty: serial: fsl_lpuart: fix race on RX DMA shutdown (bsc#1242288).
    - CVE-2023-53103: bonding: Fix memory leak when changing bond type to Ethernet (bsc#1242408).
    - CVE-2023-53114: i40e: Fix kernel crash during reboot when adapter is in recovery mode (bsc#1242398).
    - CVE-2023-53139: nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties     (bsc#1242361).
    - CVE-2024-26740: Fixed use the backlog for mirred ingress  (bsc#1222563).
    - CVE-2024-27010: net/sched: Fix mirred deadlock on device recursion (bsc#1223720).
    - CVE-2024-45021: memcg_write_event_control(): fix a user-triggerable oops (bsc#1230434).
    - CVE-2024-46751: btrfs: do not BUG_ON() when 0 reference count at btrfs_lookup_extent_info()     (bsc#1230786).
    - CVE-2024-46752: btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info() (bsc#1230794).
    - CVE-2024-50106: nfsd: fix race between laundromat and free_stateid() (bsc#1232882).
    - CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1234887).
    - CVE-2024-56779: nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur (bsc#1235632).
    - CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
    - CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
    - CVE-2025-21704: usb: cdc-acm: Check control transfer buffer size before access (bsc#1237571).
    - CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
    - CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
    - CVE-2025-22021: netfilter: socket: Lookup orig tuple for IPv6 SNAT (bsc#1241282).
    - CVE-2025-22027: media: streamzap: fix race between device disconnection and urb callback (bsc#1241369).
    - CVE-2025-22050: usbnet:fix NPE during rx_complete (bsc#1241441).
    - CVE-2025-22058: udp: Fix memory accounting leak (bsc#1241332).
    - CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
    - CVE-2025-22063: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (bsc#1241351).
    - CVE-2025-22104: ibmvnic: Use kernel helpers for hex dumps (bsc#1241550).
    - CVE-2025-23136: thermal: int340x: Add NULL check for adev (bsc#1241357).
    - CVE-2025-23150: ext4: fix off-by-one error in do_split (bsc#1242513).
    - CVE-2025-23161: PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (bsc#1242792).
    - CVE-2025-37749: net: ppp: Add bound checking for skb data on ppp_sync_txmung (bsc#1242859).
    - CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
    - CVE-2025-37780: isofs: Prevent the use of too small fid (bsc#1242786).
    - CVE-2025-37782: hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (bsc#1242770).
    - CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
    - CVE-2025-37794: wifi: mac80211: Purge vif txq in ieee80211_do_stop() (bsc#1242566).
    - CVE-2025-37796: wifi: at76c50x: fix use after free access in at76_disconnect (bsc#1242727).
    - CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
    - CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
    - CVE-2025-37833: net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (bsc#1242868).
    - CVE-2025-37852: drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create()     (bsc#1243074).
    - CVE-2025-37879: 9p/net: fix improper handling of bogus negative read/write replies (bsc#1243077).
    - CVE-2025-37949: xenbus: Use kref to track req lifetime (bsc#1243541).
    - CVE-2025-37989: net: phy: leds: fix memory leak (bsc#1243511).
    - CVE-2025-38637: net_sched: skbprio: Remove overly strict queue assertions (bsc#1241657).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.176-157.645. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-059 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: block range must be validated before use in ext4_mb_clear_bb() (CVE-2022-50021)

    In the Linux kernel, the following vulnerability has been resolved:

    block, bfq: fix possible uaf for 'bfqq->bic' (CVE-2022-50488)

    In the Linux kernel, the following vulnerability has been resolved:

    seccomp: Move copy_seccomp() to no failure path. (CVE-2022-50661)

    An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64     lacks consistency checks for CR0 and CR4. (CVE-2023-30456)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix invalid address access in lookup_rec() when index is 0 (CVE-2023-53075)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/shmem-helper: Remove another errant put in error path (CVE-2023-53084)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/active: Fix misuse of non-idle barriers as fence trackers (CVE-2023-53087)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix task hung in ext4_xattr_delete_inode (CVE-2023-53089)

    In the Linux kernel, the following vulnerability has been resolved:

    interconnect: fix mem leak when freeing nodes (CVE-2023-53096)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix WARNING in ext4_update_inline_data (CVE-2023-53100)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: zero i_disksize when initializing the bootloader inode (CVE-2023-53101)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tunnels: annotate lockless accesses to dev->needed_headroom (CVE-2023-53109)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: Fix kernel crash during reboot when adapter is in recovery mode (CVE-2023-53114)

    In the Linux kernel, the following vulnerability has been resolved:

    nvmet: avoid potential UAF in nvmet_req_complete() (CVE-2023-53116)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: prevent out-of-bounds array speculation when closing a file descriptor (CVE-2023-53117)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: tcp_make_synack() can be called from process context (CVE-2023-53121)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() (CVE-2023-53124)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usb: smsc75xx: Limit packet length to skb->len (CVE-2023-53125)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Fix a server shutdown leak (CVE-2023-53131)

    In the Linux kernel, the following vulnerability has been resolved:

    bnxt_en: Avoid order-5 memory allocation for TPA data (CVE-2023-53134)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: Fix possible corruption when moving a directory (CVE-2023-53137)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Remove the /proc/scsi/${proc_name} directory earlier (CVE-2023-53140)

    In the Linux kernel, the following vulnerability has been resolved:

    ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() (CVE-2023-53141)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix another off-by-one fsmap error on 1k block filesystems (CVE-2023-53143)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: efi: Make efi_rt_lock a raw_spinlock (CVE-2023-53216)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: VMX: Fix crash due to uninitialized current_vmcs (CVE-2023-53756)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter (CVE-2023-54057)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    KVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace(CVE-2022-49932)

    drivers:md:fix a potential use-after-free bug(CVE-2022-50022)

    ceph: don't leak snap_rwsem in handle_cap_grant(CVE-2022-50059)

    posix-cpu-timers: Cleanup CPU timers before freeing them during exec(CVE-2022-50095)

    scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts(CVE-2022-50098)

    sched/core: Do not requeue task on CPU excluded from cpus_mask(CVE-2022-50100)

    sched, cpuset: Fix dl_cpu_busy() panic due to empty cs-cpus_allowed(CVE-2022-50103)

    An issue was discovered in drivers/tty/n_gsm.c in the Linux kernel 6.2. There is a sleeping function     called from an invalid context in gsmld_write, which will block the kernel. Note: This has been disputed     by 3rd parties as not a valid vulnerability.(CVE-2023-31082)

    scsi: qla2xxx: Perform lockless command completion in abort path(CVE-2023-53041)

    drm/nouveau: prime: fix ttm_bo_delayed_delete oops(CVE-2025-37765)

    dmaengine: idxd: fix memory leak in error handling path of idxd_alloc(CVE-2025-38015)

    padata: do not leak refcount in reorder_work(CVE-2025-38031)

    nvmet-tcp: don't restore null sk_state_change(CVE-2025-38035)

    rseq: Fix segfault on registration when rseq_cs is non-zero(CVE-2025-38067)

    libnvdimm/labels: Fix divide error in nd_label_data_init()(CVE-2025-38072)

    HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()(CVE-2025-38103)

    net: openvswitch: Fix the dead loop of MPLS parse(CVE-2025-38146)

    calipso: Don't call calipso functions for AF_INET sk.(CVE-2025-38147)

    tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer(CVE-2025-38184)

    net: clear the dst when changing skb protocol(CVE-2025-38192)

    ipc: fix to protect IPCS lookups using RCU(CVE-2025-38212)

    fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var(CVE-2025-38215)

    sched/rt: Fix race in push_rt_task(CVE-2025-38234)

    nvme-tcp: sanitize request list handling(CVE-2025-38264)

    net: tipc: fix refcount warning in tipc_aead_encrypt(CVE-2025-38273)

    fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()(CVE-2025-38312)

    arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()(CVE-2025-38320)

    virtio-net: ensure the received length does not exceed allocated size(CVE-2025-38375)

    NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN(CVE-2025-38393)

    perf: Fix sample vs do_exit()(CVE-2025-38424)

    net/sched: Abort __tc_modify_qdisc if parent class does not exist(CVE-2025-38457)

    tipc: Fix use-after-free in tipc_conn_close().(CVE-2025-38464)

    netlink: Fix wraparounds of sk-sk_rmem_alloc.(CVE-2025-38465)

    perf: Revert to requiring CAP_SYS_ADMIN for uprobes(CVE-2025-38466)

    do_change_type(): refuse to operate on unmounted/not ours mounts(CVE-2025-38498)

    tracing: Add down_write(trace_event_sem) when adding trace event(CVE-2025-38539)

    perf/core: Prevent VMA split of buffer mappings(CVE-2025-38563)

    perf/core: Exit early on perf_mmap() fail(CVE-2025-38565)

    pptp: ensure minimal skb length in pptp_xmit()(CVE-2025-38574)

    pinmux: fix race causing mux_owner NULL with active mux_usecount(CVE-2025-38632)

    i2c: qup: jump out of the loop in case of timeout(CVE-2025-38671)

    ipv6: fix panic when forwarding a pkt with no in6 dev(CVE-2022-49048)

    netfilter: conntrack: revisit gc autotuning(CVE-2022-49110)

    bpf, sockmap: Fix memleak in sk_psock_queue_msg(CVE-2022-49207)

    block: fix rq-qos breakage from skipping rq_qos_done_bio()(CVE-2022-49266)

    tcp: add accessors to read/set tp-snd_cwnd(CVE-2022-49325)

    ip_gre: test csum_start instead of transport header(CVE-2022-49340)

    netfilter: nf_tables: double hook unregistration in netns path(CVE-2022-49558)

    tcp: Fix data-races around sysctl_tcp_recovery.(CVE-2022-49574)

    igmp: Fix data-races around sysctl_igmp_llm_reports.(CVE-2022-49590)

    tcp: Fix a data-race around sysctl_tcp_probe_interval.(CVE-2022-49593)

    ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open()(CVE-2022-49772)

    macvlan: enforce a consistent minimal mtu(CVE-2022-49776)

    x86/sgx: Add overflow check in sgx_validate_offset_length()(CVE-2022-49785)

    mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()(CVE-2022-49787)

    tracing: Fix memory leak in tracing_read_pipe()(CVE-2022-49801)

    netdevsim: Fix memory leak of nsim_dev-fa_cookie(CVE-2022-49803)

    bridge: switchdev: Fix memory leaks when changing VLAN protocol(CVE-2022-49812)

    net: ena: Fix error handling in ena_init()(CVE-2022-49813)

    sctp: clear out_curr if all frag chunks of current msg are pruned(CVE-2022-49838)

    ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network(CVE-2022-49865)

    net: gso: fix panic on frag_list with mixed head alloc types(CVE-2022-49872)

    bpf, sockmap: Fix the sk-sk_forward_alloc warning of sk_stream_kill_queues(CVE-2022-49877)

    ipv6: fix WARNING in ip6_route_net_exit_late()(CVE-2022-49903)

    net, neigh: Fix null-ptr-deref in neigh_table_clear()(CVE-2022-49904)

    net: mdio: fix undefined behavior in bit shift for __mdiobus_register(CVE-2022-49907)

    ipvs: fix WARNING in ip_vs_app_net_cleanup()(CVE-2022-49917)

    ipvs: fix WARNING in __ip_vs_cleanup_batch()(CVE-2022-49918)

    netfilter: nf_tables: release flow rule object from commit path(CVE-2022-49919)

    tty: n_gsm: add sanity check for gsm-receive in gsm_receive_buf()(CVE-2022-49940)

    vt: Clear selection before changing the font(CVE-2022-49948)

    bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO(CVE-2022-49961)

    arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level(CVE-2022-49964)

    bpf: Fix a data-race around bpf_jit_limit.(CVE-2022-49967)

    ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead(CVE-2022-49977)

    net: fix refcount bug in sk_psock_get (2)(CVE-2022-49979)

    media: pvrusb2: fix memory leak in pvr_probe(CVE-2022-49982)

    bpf: Don't use tnum_range on array range checking for poke descriptors(CVE-2022-49985)

    ice: xsk: prohibit usage of non-balanced queue id(CVE-2022-50003)

    kprobes: don't call disarm_kprobe() for disabled kprobes(CVE-2022-50008)

    ext4: avoid resizing to a partial cluster size(CVE-2022-50020)

    x86/fpu: KVM: Set the base guest FPU uABI size to sizeof(struct kvm_xsave).(CVE-2022-49557)

    A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including     the recent Fine(IBT), and to leak arbitrary Linux kernel memory on Intel systems.(CVE-2024-2201)

    perf/x86/amd/uncore: Fix memory leak for events array(CVE-2022-49784)

    perf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and throttling(CVE-2022-49781)

    perf/x86/amd/core: Always clear status for idx(CVE-2023-53073)

    drm/drv: Fix potential memory leak in drm_dev_init().(CVE-2022-49830)

    drm/shmem-helper: Remove another errant put in error path(CVE-2023-53084)

    perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output(CVE-2023-53065)

    arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users(CVE-2025-37963)

    arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs(CVE-2025-37948)

    crypto: null - Use spin lock instead of mutex(CVE-2025-37808)

    tracing: Fix oob write in trace_seq_to_buffer().(CVE-2025-37923)

    media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer().(CVE-2023-53146)

    usb: ucsi: Fix NULL pointer deref in ucsi_connector_change().(CVE-2023-53049)

    iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid(CVE-2025-37927)

    drm     ouveau: Fix WARN_ON in nouveau_fence_context_kill().(CVE-2025-37930)

    module: ensure that kobject_put() is safe for module type kobjects(CVE-2025-37995)

    bnxt_en: Fix out-of-bound memcpy() during ethtool -w(CVE-2025-37911)

    capabilities: fix undefined behavior in bit shift for CAP_TO_MASK(CVE-2022-49870)

    HID: intel-ish-hid: ipc: Fix potential use-after-free in work function(CVE-2023-53039)

    IB/hfi1: Correctly move list in sc_disable().(CVE-2022-49931)

    tpm: do not start chip while suspended(CVE-2025-23149)

    bpf: check changes_pkt_data property for extension programs(CVE-2024-58100)

    ext4: block range must be validated before use in ext4_mb_clear_bb()(CVE-2022-50021)

    iavf: Fix adminq error handling(CVE-2022-50055)

    virtio_net: fix memory leak inside XPD_TX with mergeable(CVE-2022-50065)

    net: atlantic: fix aq_vec index out of range error(CVE-2022-50066)

    BPF: Fix potential bad pointer dereference in bpf_sys_bpf()(CVE-2022-50069)

    net: tap: NULL pointer derefence in dev_parse_header_protocol when skb-dev is null(CVE-2022-50073)

    apparmor: Fix memleak in aa_simple_write_to_buffer()(CVE-2022-50074)

    resolved: apparmor: fix reference count leak in aa_pivotroot() (CVE-2022-50077)

    ext4: fix warning in ext4_iomap_begin as race between bmap and write(CVE-2022-50082)

    Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering     Authority.(CVE-2022-50083)

    block: don't allow the same type rq_qos add more than once(CVE-2022-50086)

    jbd2: fix assertion 'jh-b_frozen_data == NULL' failure when journal aborted(CVE-2022-50126)

    RDMA/srpt: Fix a use-after-free(CVE-2022-50129)

    RDMA/hfi1: fix potential memory leak in setup_base_ctxt()(CVE-2022-50134)

    RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr()(CVE-2022-50138)

    bpf: fix potential 32-bit overflow when accessing ARRAY map element(CVE-2022-50167)

    virtio-gpu: fix a missing check to avoid NULL dereference(CVE-2022-50181)

    selinux: Add boundary check in put_entry()(CVE-2022-50200)

    PM: hibernate: defer device probing when resuming from hibernation(CVE-2022-50202)

    arm64: fix oops in concurrently setting insn_emulation sysctls(CVE-2022-50206)

    netfilter: nf_tables: do not allow SET_ID to refer to another table(CVE-2022-50213)

    scsi: sg: Allow waiting for commands to complete on removed device(CVE-2022-50215)

    bpf: Fix KASAN use-after-free Read in compute_effective_progs(CVE-2022-50219)

    usbnet: Fix linkwatch use-after-free on disconnect(CVE-2022-50220)

    tty: vt: initialize unicode screen buffer(CVE-2022-50222)

    KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0(CVE-2022-50228)

    arm64: set UXN on swapper page tables(CVE-2022-50230)

    crypto: arm64/poly1305 - fix a read out-of-bound(CVE-2022-50231)

    arm64: set UXN on swapper page tables(CVE-2022-50232)

    netfilter: nf_tables: don't fail inserts if duplicate has expired(CVE-2023-52925)

    netfilter: allow exp not to be removed in nf_ct_find_expectation(CVE-2023-52927)

    dm crypt: add cond_resched() to dmcrypt_write()(CVE-2023-53051)

    erspan: do not use skb_mac_header() in ndo_start_xmit()(CVE-2023-53053)

    net/mlx5: E-Switch, Fix an Oops in error handling code(CVE-2023-53058)

    net: usb: smsc95xx: Limit packet length to skb-len(CVE-2023-53062)

    qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info(CVE-2023-53066)

    net: usb: lan78xx: Limit packet length to skb-len(CVE-2023-53068)

    net/mlx5: Fix steering rules cleanup(CVE-2023-53079)

    xsk: Add missing overflow check in xdp_umem_reg(CVE-2023-53080)

    ice: xsk: disable txq irq before flushing hw(CVE-2023-53102)

    bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails(CVE-2023-53103)

    net: tunnels: annotate lockless accesses to dev-needed_headroom(CVE-2023-53109)

    i40e: Fix kernel crash during reboot when adapter is in recovery mode(CVE-2023-53114)

    tcp: tcp_make_synack() can be called from process context(CVE-2023-53121)

    net: usb: smsc75xx: Limit packet length to skb-len(CVE-2023-53125)

    SUNRPC: Fix a server shutdown leak(CVE-2023-53131)

    bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()(CVE-2023-53133)

    bpf: consider that tail calls invalidate packet pointers(CVE-2024-58237)

    net: avoid race between device unregistration and ethnl ops(CVE-2025-21701)

    ata: libata-sff: Ensure that we cannot write outside the allocated buffer(CVE-2025-21738)

    block: mark GFP_NOIO around sysfs -store()(CVE-2025-21817)

    netfilter: nf_tables: reject mismatching sum of field_len with set key length(CVE-2025-21826)

    netfilter: socket: Lookup orig tuple for IPv6 SNAT(CVE-2025-22021)

    net: fix geneve_opt length integer overflow(CVE-2025-22055)

    net: decrease cached dst counters in dst_release(CVE-2025-22057)

    rtnetlink: Allocate vfinfo size for VF GUIDs when supported(CVE-2025-22075)

    RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow(CVE-2025-22086)

    net: fix NULL pointer dereference in l3mdev_l3_rcv(CVE-2025-22103)

    sctp: detect and prevent references to a freed transport in sendmsg(CVE-2025-23142)

    net: ppp: Add bound checking for skb data on ppp_sync_txmung Ensure we have enough data in linear buffer     from skb before accessing initial bytes.(CVE-2025-37749)

    net: tls: explicitly disallow disconnect(CVE-2025-37756)

    tipc: fix memory leak in tipc_link_xmit(CVE-2025-37757)

    cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path(CVE-2025-37788)

    net: openvswitch: fix nested key length validation in the set() action(CVE-2025-37789)

    net_sched: hfsc: Fix a UAF vulnerability in class handling(CVE-2025-37797)

    codel: remove sch-q.qlen check before qdisc_tree_reduce_backlog()(CVE-2025-37798)

    net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too(CVE-2025-37823)

    tipc: fix NULL pointer dereference in tipc_mon_reinit_self()(CVE-2025-37824)

    page_pool: avoid infinite loop to schedule delayed worker(CVE-2025-37859)

    HID: pidff: Fix null pointer dereference in pidff_find_fields(CVE-2025-37862)

    net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc(CVE-2025-37890)

    net_sched: qfq: Fix double list add in class with netem as child qdisc(CVE-2025-37913)

    net_sched: drr: Fix double list add in class with netem as child qdisc(CVE-2025-37915)

    xsk: Fix race condition in AF_XDP generic RX path(CVE-2025-37920)

    sch_htb: make htb_qlen_notify() idempotent(CVE-2025-37932)

    bpf: Scrub packet on bpf_redirect_peer(CVE-2025-37959)

    ipvs: fix uninit-value for saddr in do_output_route4(CVE-2025-37961)

    net: phy: leds: fix memory leak(CVE-2025-37989)

    net_sched: Flush gso_skb list too during -change()(CVE-2025-37992)

    netfilter: ipset: fix region locking in hash types(CVE-2025-37997)

    openvswitch: Fix unsafe attribute parsing in output_userspace()(CVE-2025-37998)

    sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()(CVE-2025-38000)

    net_sched: hfsc: Address reentrant enqueue adding class to eltree twice(CVE-2025-38001)

    dmaengine: idxd: Refactor remove call with idxd_cleanup() helper(CVE-2025-38014)

    serial: mctrl_gpio: split disable_ms into sync and no_sync APIs(CVE-2025-38040)

    media: cx231xx: set device_caps for 417(CVE-2025-38044)

    net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done(CVE-2025-38052)

    net: pktgen: fix access outside of user given buffer in pktgen_thread_write()(CVE-2025-38061)

    dm: fix unconditional IO throttle caused by REQ_PREFLUSH(CVE-2025-38063)

    dm cache: prevent BUG_ON by blocking retries on failed device resumes(CVE-2025-38066)

    crypto: lzo - Fix compression buffer overrun(CVE-2025-38068)

    vhost-scsi: protect vq-log_used with vq-mutex(CVE-2025-38074)

    scsi: target: iscsi: Fix timeout on deleted connection(CVE-2025-38075)

    net_sched: prio: fix a race in prio_tune()(CVE-2025-38083)

    mm/hugetlb: unshare page tables during VMA split, not before(CVE-2025-38084)

    net: ch9200: fix uninitialised access during mii_nway_restart(CVE-2025-38086)

    x86/iopl: Cure TIF_IO_BITMAP inconsistencies(CVE-2025-38100)

    VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify(CVE-2025-38102)

    net_sched: red: fix a race in __red_change()(CVE-2025-38108)

    net/mdiobus: Fix potential out-of-bounds read/write access(CVE-2025-38111)

    net: Fix TOCTOU issue in sk_is_readable()(CVE-2025-38112)

    net_sched: sch_sfq: fix a potential crash on gso_skb handling(CVE-2025-38115)

    netfilter: nf_set_pipapo_avx2: fix initial map fill(CVE-2025-38120)

    net: fix udp gso skb_segment after pull from frag_list(CVE-2025-38124)

    ice: fix Tx scheduler error handling in XDP callback(CVE-2025-38127)

    page_pool: Fix use-after-free in page_pool_recycle_in_ring(CVE-2025-38129)

    bpf, sockmap: Avoid using sk_socket after free when sending(CVE-2025-38154)

    netfilter: nft_set_pipapo: prevent overflow in lookup table allocation(CVE-2025-38162)

    bpf, sockmap: Fix panic when calling skb_linearize(CVE-2025-38165)

    bpf: fix ktls panic with sockmap(CVE-2025-38166)

    RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction(CVE-2025-38211)

    fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var(CVE-2025-38214)

    ext4: inline: fix len overflow in ext4_prepare_inline_data(CVE-2025-38222)

    media: cxusb: no longer judge rbuf when the write fails(CVE-2025-38229)

    bpf: Avoid __bpf_prog_ret0_warn when jit fails(CVE-2025-38280)

    bpf: Fix WARN() in get_bpf_raw_tp_regs(CVE-2025-38285)

    EDAC/skx_common: Fix general protection fault(CVE-2025-38298)

    mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().(CVE-2025-38324)

    jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()(CVE-2025-38337)

    ACPICA: fix acpi operand cache leak in dswstate.c(CVE-2025-38345)

    ftrace: Fix UAF when lookup kallsym after ftrace disabled(CVE-2025-38346)

    posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()(CVE-2025-38352)

    ACPICA: Refuse to evaluate a method if arguments are missing(CVE-2025-38386)

    usb: typec: altmodes/displayport: do not index invalid pin_assignments(CVE-2025-38391)

    fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass(CVE-2025-38396)

    scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()(CVE-2025-38399)

    drm/gem: Acquire references on GEM handles for framebuffers(CVE-2025-38449)

    HID: core: ensure the allocated report buffer can contain the reserved report ID(CVE-2025-38495)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
364675	CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1791780738)	Nessus	CentOS Local Security Checks	2026/10/12	2026/10/12	high
240793	SUSE SLES12 Security Update : kernel (SUSE-SU-2025:01983-1)	Nessus	SuSE Local Security Checks	2025/6/27	2025/12/9	high
200362	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2024-059 (ALASKERNEL-5.10-2024-059)	Nessus	Amazon Linux Local Security Checks	2024/6/11	2026/2/9	high
279319	EulerOS Virtualization 2.13.0 : kernel (EulerOS-SA-2025-2581)	Nessus	Huawei Local Security Checks	2025/12/18	2026/2/23	high

検出

プラグインの検索

high

high

high

high