The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1782148320 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: media: ngene: Fix out-of-bounds bug in     ngene_command_config_free_buf() Fix an 11-year old bug in ngene_command_config_free_buf() while addressing     the following warnings caught with -Warray-bounds: arch/alpha/include/asm/string.h:22:16: warning:
    '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject     'config' with type 'unsigned char' at offset 10 [-Warray-bounds] arch/x86/include/asm/string_32.h:182:25:
    warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced     subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds] The problem is that the     original code is trying to copy 6 bytes of data into a one-byte size member _config_ of the wrong structue     FW_CONFIGURE_BUFFERS, in a single call to memcpy(). This causes a legitimate compiler warning because     memcpy() overruns the length of &com.cmd.ConfigureBuffers.config. It seems that the right structure is     FW_CONFIGURE_FREE_BUFFERS, instead, because it contains 6 more members apart from the header _hdr_. Also,     the name of the function ngene_command_config_free_buf() suggests that the actual intention is to     ConfigureFreeBuffers, instead of ConfigureBuffers (which takes place in the function     ngene_command_config_buf(), above). Fix this by enclosing those 6 members of struct     FW_CONFIGURE_FREE_BUFFERS into new struct config, and use &com.cmd.ConfigureFreeBuffers.config as the     destination address, instead of &com.cmd.ConfigureBuffers.config, when calling memcpy(). This also helps     with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the     FORTIFY_SOURCE routines on memcpy(). (CVE-2021-47288)

  - In the Linux kernel, the following vulnerability has been resolved: nvme: fix a possible use-after-free in     controller reset during load Unlike .queue_rq, in .submit_async_event drivers may not check the ctrl     readiness for AER submission. This may lead to a use-after-free condition that was observed with nvme-tcp.
    The race condition may happen in the following scenario: 1. driver executes its reset_ctrl_work 2. ->     nvme_stop_ctrl - flushes ctrl async_event_work 3. ctrl sends AEN which is received by the host, which in     turn schedules AEN handling 4. teardown admin queue (which releases the queue socket) 5. AEN processed,     submits another AER, calling the driver to submit 6. driver attempts to send the cmd ==> use-after-free In     order to fix that, add ctrl state check to validate the ctrl is actually able to accept the AER     submission. This addresses the above race in controller resets because the driver during teardown should:
    1. change ctrl state to RESETTING 2. flush async_event_work (as well as other async work elements) So     after 1,2, any other AER command will find the ctrl state to be RESETTING and bail out without submitting     the AER. (CVE-2022-48790)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free for     aborted TMF sas_task Currently a use-after-free may occur if a TMF sas_task is aborted before we handle     the IO completion in mpi_ssp_completion(). The abort occurs due to timeout. When the timeout occurs, the     SAS_TASK_STATE_ABORTED flag is set and the sas_task is freed in pm8001_exec_internal_tmf_task(). However,     if the I/O completion occurs later, the I/O completion still thinks that the sas_task is available. Fix     this by clearing the ccb->task if the TMF times out - the I/O completion handler does nothing if this     pointer is cleared. (CVE-2022-48791)

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Free buffers when a used     dynamic event is removed After 65536 dynamic events have been added and removed, the type field of the     event then uses the first type number that is available (not currently used by other events). A type     number is the identifier of the binary blobs in the tracing ring buffer (known as events) to map them to     logic that can parse the binary blob. The issue is that if a dynamic event (like a kprobe event) is traced     and is in the ring buffer, and then that event is removed (because it is dynamic, which means it can be     created and destroyed), if another dynamic event is created that has the same number that new event's     logic on parsing the binary blob will be used. To show how this can be an issue, the following can crash     the kernel: # cd /sys/kernel/tracing # for i in `seq 65536`; do echo 'p:kprobes/foo do_sys_openat2     $arg1:u32' > kprobe_events # done For every iteration of the above, the writing to the kprobe_events will     remove the old event and create a new one (with the same format) and increase the type number to the next     available on until the type number reaches over 65535 which is the max number for the 16 bit type. After     it reaches that number, the logic to allocate a new number simply looks for the next available number.
    When an dynamic event is removed, that number is then available to be reused by the next dynamic event     created. That is, once the above reaches the max number, the number assigned to the event in that loop     will remain the same. Now that means deleting one dynamic event and created another will reuse the     previous events type number. This is where bad things can happen. After the above loop finishes, the     kprobes/foo event which reads the do_sys_openat2 function call's first parameter as an integer. # echo 1 >     kprobes/foo/enable # cat /etc/passwd > /dev/null # cat trace cat-2211 [005] .... 2007.849603: foo:
    (do_sys_openat2+0x0/0x130) arg1=4294967196 cat-2211 [005] .... 2007.849620: foo:
    (do_sys_openat2+0x0/0x130) arg1=4294967196 cat-2211 [005] .... 2007.849838: foo:
    (do_sys_openat2+0x0/0x130) arg1=4294967196 cat-2211 [005] .... 2007.849880: foo:
    (do_sys_openat2+0x0/0x130) arg1=4294967196 # echo 0 > kprobes/foo/enable Now if we delete the kprobe and     create a new one that reads a string: # echo 'p:kprobes/foo do_sys_openat2 +0($arg2):string' >     kprobe_events And now we can the trace: # cat trace sendmail-1942 [002] ..... 530.136320: foo:
    (do_sys_openat2+0x0/0x240) arg1= cat-2046 [004] ..... 530.930817: foo: (do_sys_openat2+0x0/0x240)     arg1=     cat-2046 [004] ..... 530.930961: foo: (do_sys_openat2+0x0/0x240)     arg1=     cat-2046 [004] ..... 530.934278: foo: (do_sys_openat2+0x0/0x240)     arg1=     cat-2046 [004] ..... 530.934563: foo: (do_sys_openat2+0x0/0x240)     arg1= ---truncated--- (CVE-2022-49006)

  - In the Linux kernel, the following vulnerability has been resolved: dm raid: fix accesses beyond end of     raid member array On dm-raid table load (using raid_ctr), dm-raid allocates an array     rs->devs[rs->raid_disks] for the raid device members. rs->raid_disks is defined by the number of raid     metadata and image tupples passed into the target's constructor. In the case of RAID layout changes being     requested, that number can be different from the current number of members for existing raid sets as     defined in their superblocks. Example RAID layout changes include: - raid1 legs being added/removed -     raid4/5/6/10 number of stripes changed (stripe reshaping) - takeover to higher raid level (e.g. raid5 ->     raid6) When accessing array members, rs->raid_disks must be used in control loops instead of the     potentially larger value in rs->md.raid_disks. Otherwise it will cause memory access beyond the end of the     rs->devs array. Fix this by changing code that is prone to out-of-bounds access. Also fix     validate_raid_redundancy() to validate all devices that are added. Also, use braces to help clean up     raid_iterate_devices(). The out-of-bounds memory accesses was discovered using KASAN. This commit was     verified to pass all LVM2 RAID tests (with KASAN enabled). (CVE-2022-49674)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    media: uvcvideo: Handle cameras with invalid descriptors(CVE-2023-53437)

    scsi: target: iscsi: Fix a race condition between login_work and the login thread(CVE-2022-50350)

    crypto: cavium - prevent integer overflow loading firmware(CVE-2022-50330)

    HID: core: do not bypass hid_hw_raw_request(CVE-2025-38494)

    tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak(CVE-2022-50389)

    scsi: qla4xxx: Add length check when parsing nlattrs(CVE-2023-53456)

    virtio-mmio: don't break lifecycle of vm_dev(CVE-2023-53515)

    scsi: qla2xxx: Pointer may be dereferenced(CVE-2023-53150)

    tracing/histograms: Add histograms to hist_vars if they have referenced variables(CVE-2023-53560)

    fs: writeback: fix use-after-free in __mark_inode_dirty()(CVE-2025-39866)

    ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS(CVE-2022-50315)

    pnode: terminate at peers of source(CVE-2022-50280)

    drm/sched: Increment job count before swapping tail spsc queue(CVE-2025-38515)

    tracing: Fix race issue between cpu buffer write and swap(CVE-2023-53368)

    usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()(CVE-2022-50544)

    mtd: Fix device name leak when register device failed in add_mtd_device()(CVE-2022-50566)

    ext4: add bounds checking in get_max_inline_xattr_value_size()(CVE-2023-53285)

    tee: fix NULL pointer dereference in tee_shm_put(CVE-2025-39865)

    crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg(CVE-2025-39964)

    do_change_type(): refuse to operate on unmounted/not ours mounts(CVE-2025-38498)

    drm/gem: Acquire references on GEM handles for framebuffers(CVE-2025-38449)

    dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path(CVE-2023-53604)

    qede: confirm skb is allocated before using(CVE-2022-49084)

    recordmcount: Fix memory leaks in the uwrite function(CVE-2023-53318)

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer(CVE-2023-53395)

    usb: net: sierra: check for no status endpoint(CVE-2025-38474)

    posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()(CVE-2025-38352)

    ext4: avoid deadlock in fs reclaim with page writeback(CVE-2023-53149)

    kobject: Add sanity check for kset-kobj.ktype in kset_register()(CVE-2023-53480)

    PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free(CVE-2023-53446)

    tracing: Limit access to parser-buffer when trace_get_user failed(CVE-2025-39683)

    binfmt_misc: fix shift-out-of-bounds in check_special_flags(CVE-2022-50497)

    arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()(CVE-2025-38320)

    udf: Fix uninitialized array access for some pathnames(CVE-2023-53165)

    ext4: avoid crash when inline data creation follows DIO write(CVE-2022-50435)

    serial: 8250: Reinit port-pm on port specific driver unbind(CVE-2023-53176)

    rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails(CVE-2023-53307)

    udf: Do not bother merging very long extents(CVE-2023-53506)

    spi: qup: Don't skip cleanup in remove's error path(CVE-2023-53567)

    calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().(CVE-2025-38181)

    ftrace: Also allocate and copy hash for reading of filter files(CVE-2025-39689)

    xhci: Remove device endpoints from bandwidth list when freeing the device(CVE-2022-50470)

    usbnet: Fix linkwatch use-after-free on disconnect(CVE-2022-50220)

    fs: udf: fix OOB read in lengthAllocDescs handling(CVE-2025-40044)

    blk-mq: use quiesced elevator switch when reinitializing queues(CVE-2022-50552)

    ext4: fix WARNING in mb_find_extent(CVE-2023-53317)

    posix-timers: Ensure timer ID search-loop limit is valid(CVE-2023-53728)

    net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb(CVE-2023-53548)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ext4: add bounds checking in get_max_inline_xattr_value_size() Normally the extended attributes in the     inode body would have been checked when the inode is first opened, but if someone is writing to the block     device while the file system is mounted, it's possible for the inode table to get corrupted. Add bounds     checking to avoid reading beyond the end of allocated memory if this happens. (CVE-2023-53285)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.15.117-72.142. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-021 advisory.

    In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT     flags before replaying logs. (CVE-2022-48425)

    In the Linux kernel, the following vulnerability has been resolved:

    binder: fix UAF of alloc->vma in race with munmap() (CVE-2022-50240)

    In the Linux kernel, the following vulnerability has been resolved:

    binder: fix UAF of alloc->vma in race with munmap() (CVE-2022-50338)

    There is a potential deadlock in the eBPF subsystem in the Linux kernel.

    The default sysctl configuration kernel.unprivileged_bpf_disabled on Amazon Linux does not allow     unprivileged users to use eBPF. (CVE-2023-0160)

    A flaw was found in the Linux kernel's networking subsystem within the RPL protocol's handling. This issue     results from the improper handling of user-supplied data, which can lead to an assertion failure. This     flaw allows an unauthenticated, remote attacker to create a denial of service condition on the system.
    (CVE-2023-2156)

    A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to     achieve local privilege escalation.

    The out-of-bounds write is caused by missing skb->cb  initialization in the ipvlan network driver. The     vulnerability is reachable if CONFIG_IPVLAN is enabled.

    We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. (CVE-2023-3090)

    A flaw in the Linux Kernel found in the GFS2 file system. On corrupted gfs2 file systems the evict code     can try to reference the journal descriptor structure, jdesc, after it has been freed and set to NULL. It     can lead to null pointer dereference when gfs2_trans_begin being called and then fail     ingfs2_evict_inode(). (CVE-2023-3212)

    An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

    An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in     lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an     offset. (CVE-2023-34256)

    A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux     Kernel. In this flaw an attacker with local user access may lead to a system crash or a leak of internal     kernel information. (CVE-2023-3567)

    An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
    It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
    This may result in denial of service or privilege escalation. (CVE-2023-35788)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: Reinit port->pm on port specific driver unbind (CVE-2023-53176)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Avoid undefined behavior: applying zero offset to null pointer (CVE-2023-53182)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Add length check in indx_get_root (CVE-2023-53194)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix i_disksize exceeding i_size problem in paritally written case (CVE-2023-53270)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add bounds checking in get_max_inline_xattr_value_size() (CVE-2023-53285)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup() (CVE-2023-53294)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix leak of 'r10bio->remaining' for recovery (CVE-2023-53299)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix WARNING in mb_find_extent (CVE-2023-53317)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access (CVE-2023-53419)

    In the Linux kernel, the following vulnerability has been resolved:

    net: add vlan_get_protocol_and_depth() helper (CVE-2023-53433)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: remove a BUG_ON in ext4_mb_release_group_pa() (CVE-2023-53450)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: improve error handling from ext4_dirhash() (CVE-2023-53473)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/MCE/AMD: Use an u64 for bank_map (CVE-2023-53474)

    In the Linux kernel, the following vulnerability has been resolved:

    lib: cpu_rmap: Avoid use after free on rmap->obj array entries (CVE-2023-53484)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Enhance the attribute size check (CVE-2023-53486)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. (CVE-2023-53489)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio_net: Fix error unwinding of XDP initialization (CVE-2023-53499)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: allow ext4_get_group_info() to fail (CVE-2023-53503)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: fix incomplete validation of ioctl arg (CVE-2023-53513)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-crypto: make blk_crypto_evict_key() more robust (CVE-2023-53536)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: fix null deref on element insertion (CVE-2023-53566)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: Make intel_get_crtc_new_encoder() less oopsy (CVE-2023-53571)

    In the Linux kernel, the following vulnerability has been resolved:

    null_blk: Always check queue mode setting from configfs (CVE-2023-53576)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: Fix multiple LUN_RESET handling (CVE-2023-53586)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Sync IRQ works before buffer destruction (CVE-2023-53587)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix deadlock in tc route query code (CVE-2023-53591)

    In the Linux kernel, the following vulnerability has been resolved:

    dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (CVE-2023-53604)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_fq: fix integer overflow of credit (CVE-2023-53624)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed (CVE-2023-53655)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline (CVE-2023-53692)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix out-of-bounds access in ipv6_find_tlv() (CVE-2023-53705)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix NULL dereference in ni_write_inode (CVE-2023-53732)

    In the Linux kernel, the following vulnerability has been resolved:

    vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (CVE-2023-53747)

    In the Linux kernel, the following vulnerability has been resolved:

    dm flakey: fix a crash with invalid table line (CVE-2023-53786)

    In the Linux kernel, the following vulnerability has been resolved:

    ethtool: Fix uninitialized number of lanes (CVE-2023-53798)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-mq: release crypto keyslot before reporting I/O complete (CVE-2023-53810)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix null-ptr-deref in raid10_sync_request (CVE-2023-53832)

    In the Linux kernel, the following vulnerability has been resolved:

    netlink: annotate accesses to nlk->cb_running (CVE-2023-53853)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix slab-out-of-bounds read in hdr_delete_de() (CVE-2023-53988)

    In the Linux kernel, the following vulnerability has been resolved:

    SMB3: Add missing locks to protect deferred close file list (CVE-2023-53990)

    In the Linux kernel, the following vulnerability has been resolved:

    udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). (CVE-2023-54004)

    In the Linux kernel, the following vulnerability has been resolved:

    vmci_host: fix a race condition in vmci_host_poll() causing GPF (CVE-2023-54007)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix stack overflow when LRO is disabled for virtual interfaces (CVE-2023-54012)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device (CVE-2023-54015)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: set goal start correctly in ext4_mb_normalize_request (CVE-2023-54021)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps (CVE-2023-54033)

    In the Linux kernel, the following vulnerability has been resolved:

    spmi: Add a check for remove callback when removing a SPMI driver (CVE-2023-54044)

    In the Linux kernel, the following vulnerability has been resolved:

    kheaders: Use array declaration instead of char (CVE-2023-54056)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix invalid free tracking in ext4_xattr_move_to_block() (CVE-2023-54062)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix OOB read in indx_insert_into_buffer (CVE-2023-54063)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix memory leak if ntfs_read_mft failed (CVE-2023-54077)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Add preempt_count_{sub,add} into btf id deny list (CVE-2023-54086)

    In the Linux kernel, the following vulnerability has been resolved:

    net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (CVE-2023-54114)

    In the Linux kernel, the following vulnerability has been resolved:

    inotify: Avoid reporting event with invalid wd (CVE-2023-54119)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix memleak for 'conf->bio_split' (CVE-2023-54123)

    In the Linux kernel, the following vulnerability has been resolved:

    binder: fix UAF of alloc->vma in race with munmap() (CVE-2023-54157)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: don't free qgroup space unless specified (CVE-2023-54158)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: arm_sdei: Fix sleep from invalid context BUG (CVE-2023-54160)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_api: remove block_cb from driver_list before freeing (CVE-2023-54193)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix NULL pointer dereference in 'ni_write_inode' (CVE-2023-54196)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: always release netdev hooks from notifier (CVE-2023-54200)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). (CVE-2023-54218)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data races around sk->sk_shutdown. (CVE-2023-54226)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: EC: Fix oops when removing custom query handlers (CVE-2023-54244)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Add check for kmemdup (CVE-2023-54248)

    In the Linux kernel, the following vulnerability has been resolved:

    debugobjects: Don't wake up kswapd from fill_pool() (CVE-2023-54268)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: double free xprt_ctxt while still in use (CVE-2023-54269)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix a possible null-pointer dereference in ni_clear() (CVE-2023-54272)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix memleak of md thread (CVE-2023-54294)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix deadlock when converting an inline directory in nojournal mode (CVE-2023-54311)

    A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This     flaw allows a local user to cause an information leak problem while freeing the old quota file names     before a potential failure, leading to a use-after-free. (CVE-2024-0775)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.318-240.529. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2100 advisory.

    It was discovered that a nft object or expression could reference a nft set on a different nft table,     leading to a use-after-free once that table was deleted. (CVE-2022-2586)

    A heap buffer overflow flaw was found in the Linux kernel's Netfilter subsystem in the way a user provides     incorrect input of the NFT_DATA_VERDICT type. This flaw allows a local user to crash or potentially     escalate their privileges on the system. (CVE-2022-34918)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() (CVE-2022-50067)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: do not allow SET_ID to refer to another table (CVE-2022-50213)

    A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component. (CVE-2023-2269)

    do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading     to a race condition (with a resultant use-after-free or NULL pointer dereference). (CVE-2023-28466)

    A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to     achieve local privilege escalation.

    The out-of-bounds write is caused by missing skb->cb  initialization in the ipvlan network driver. The     vulnerability is reachable if CONFIG_IPVLAN is enabled.

    We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. (CVE-2023-3090)

    A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the     Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling     btrfs_ioctl_defrag(). (CVE-2023-3111)

    A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the     Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading     to a kernel information leak. (CVE-2023-3141)

    An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in     lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an     offset. (CVE-2023-34256)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: Reinit port->pm on port specific driver unbind (CVE-2023-53176)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Avoid undefined behavior: applying zero offset to null pointer (CVE-2023-53182)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add bounds checking in get_max_inline_xattr_value_size() (CVE-2023-53285)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix leak of 'r10bio->remaining' for recovery (CVE-2023-53299)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: do not write dirty data after degenerating to read-only (CVE-2023-53337)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: remove a BUG_ON in ext4_mb_release_group_pa() (CVE-2023-53450)

    In the Linux kernel, the following vulnerability has been resolved:

    lib: cpu_rmap: Avoid use after free on rmap->obj array entries (CVE-2023-53484)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. (CVE-2023-53489)

    In the Linux kernel, the following vulnerability has been resolved:

    ext2: Check block size validity during mount (CVE-2023-53569)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Sync IRQ works before buffer destruction (CVE-2023-53587)

    In the Linux kernel, the following vulnerability has been resolved:

    dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (CVE-2023-53604)

    In the Linux kernel, the following vulnerability has been resolved:

    net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize (CVE-2023-53667)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() (CVE-2023-53683)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix out-of-bounds access in ipv6_find_tlv() (CVE-2023-53705)

    In the Linux kernel, the following vulnerability has been resolved:

    dm flakey: fix a crash with invalid table line (CVE-2023-53786)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() (CVE-2023-53804)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix infinite loop in nilfs_mdt_get_block() (CVE-2023-53845)

    In the Linux kernel, the following vulnerability has been resolved:

    netlink: annotate accesses to nlk->cb_running (CVE-2023-53853)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: set goal start correctly in ext4_mb_normalize_request (CVE-2023-54021)

    In the Linux kernel, the following vulnerability has been resolved:

    spmi: Add a check for remove callback when removing a SPMI driver (CVE-2023-54044)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix invalid free tracking in ext4_xattr_move_to_block() (CVE-2023-54062)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: sisusbvga: Add endpoint checks (CVE-2023-54213)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). (CVE-2023-54218)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: EC: Fix oops when removing custom query handlers (CVE-2023-54244)

    A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This     flaw allows a local user to cause an information leak problem while freeing the old quota file names     before a potential failure, leading to a use-after-free. (CVE-2024-0775)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()(CVE-2023-53521)

    binfmt_misc: fix shift-out-of-bounds in check_special_flags(CVE-2022-50497)

    scsi: lpfc: Fix buffer free/clear order in deferred receive path(CVE-2025-39841)

    mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory(CVE-2025-39883)

    md: Replace snprintf with scnprintf(CVE-2022-50299)

    drivers: serial: jsm: fix some leaks in probe(CVE-2022-50312)

    udf: Do not bother merging very long extents(CVE-2023-53506)

    fbdev: fix potential buffer overflow in do_register_framebuffer()(CVE-2025-38702)

    mm/slub: avoid accessing metadata when pointer is invalid in object_err()(CVE-2025-39902)

    xhci: Remove device endpoints from bandwidth list when freeing the device(CVE-2022-50470)

    HID: multitouch: Correct devm device reference for hidinput input_dev name(CVE-2023-53454)

    ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed(CVE-2023-53481)

    thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash(CVE-2022-50494)

    md: fix a crash in mempool_free(CVE-2022-50381)

    scsi: ses: Fix possible desc_ptr out-of-bounds accesses(CVE-2023-53675)

    scsi: target: target_core_configfs: Add length check to avoid buffer overflow(CVE-2025-39998)

    fs: dlm: fix invalid derefence of sb_lvbptr(CVE-2022-50516)

    NFS: Fix a race when updating an existing write(CVE-2025-39697)

    mmc: vub300: fix return value check of mmc_add_host()(CVE-2022-50251)

    tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak(CVE-2022-50389)

    scsi: qla4xxx: Add length check when parsing nlattrs(CVE-2023-53456)

    ext4: avoid deadlock in fs reclaim with page writeback(CVE-2023-53149)

    kobject: Add sanity check for kset-kobj.ktype in kset_register()(CVE-2023-53480)

    scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()(CVE-2023-53676)

    udf: Fix uninitialized array access for some pathnames(CVE-2023-53165)

    ext4: avoid crash when inline data creation follows DIO write(CVE-2022-50435)

    cifs: Fix warning and UAF when destroy the MR list(CVE-2023-53427)

    scsi: qla2xxx: Pointer may be dereferenced(CVE-2023-53150)

    fs: writeback: fix use-after-free in __mark_inode_dirty()(CVE-2025-39866)

    blk-mq: use quiesced elevator switch when reinitializing queues(CVE-2022-50552)

    mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()(CVE-2023-53623)

    ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS(CVE-2022-50315)

    pnode: terminate at peers of source(CVE-2022-50280)

    tracing: Fix race issue between cpu buffer write and swap(CVE-2023-53368)

    igb: Fix igb_down hung on surprise removal(CVE-2023-53148)

    udf: Do not update file length for failed writes to inline files(CVE-2023-53295)

    usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()(CVE-2022-50544)

    cacheinfo: Fix shared_cpu_map to handle shared caches at different levels(CVE-2023-53254)

    net/tunnel: wait until all sk_user_data reader finish before releasing the sock(CVE-2022-50405)

    mtd: Fix device name leak when register device failed in add_mtd_device()(CVE-2022-50566)

    ext4: add bounds checking in get_max_inline_xattr_value_size()(CVE-2023-53285)

    drm/mipi-dsi: Detach devices when removing the host(CVE-2022-50489)

    ipv6: Fix out-of-bounds access in ipv6_find_tlv()(CVE-2023-53705)

    md/raid10: check slab-out-of-bounds in md_bitmap_get_counter(CVE-2023-53357)

    scsi: qla2xxx: Wait for io return on terminate rport(CVE-2023-53322)

    PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free(CVE-2023-53446)

    sctp: check send stream number after wait_for_sndbuf(CVE-2023-53296)

    rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails(CVE-2023-53307)

    md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request(CVE-2023-53380)

    ubi: ensure that VID header offset + VID header size = alloc, size(CVE-2023-53265)

    icmp6: Fix null-ptr-deref of ip6_null_entry-rt6i_idev in icmp6_dev().(CVE-2023-53343)

    calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().(CVE-2025-38181)

    ftrace: Also allocate and copy hash for reading of filter files(CVE-2025-39689)

    firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region(CVE-2023-52989)

    sched/fair: Don't balance task to its current running CPU(CVE-2023-53215)

    dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path(CVE-2023-53604)

    qede: confirm skb is allocated before using(CVE-2022-49084)

    sctp: linearize cloned gso packets in sctp_rcv(CVE-2025-38718)

    af_unix: Fix data-races around user-unix_inflight.(CVE-2023-53204)

    scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue(CVE-2023-53280)

    md/raid10: fix leak of 'r10bio-remaining' for recovery(CVE-2023-53299)

    recordmcount: Fix memory leaks in the uwrite function(CVE-2023-53318)

    cifs: fix oops during encryption(CVE-2022-50341)

    nfsd: call op_release, even when op_func returns an error(CVE-2023-53241)

    uio_hv_generic: Let userspace take care of interrupt mask(CVE-2025-40048)

    posix-timers: Ensure timer ID search-loop limit is valid(CVE-2023-53728)

    tipc: fix a null-ptr-deref in tipc_topsrv_accept(CVE-2022-50555)

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer(CVE-2023-53395)

    x86/MCE: Always save CS register on AMD Zen IF Poison errors(CVE-2023-53438)

    xfrm: fix slab-use-after-free in decode_session6(CVE-2023-53500)

    posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()(CVE-2025-38352)

    i40e: add validation for ring_len param(CVE-2025-39973)

    firewire: net: fix use after free in fwnet_finish_incoming_packet()(CVE-2023-53432)

    NFSD: Protect against send buffer overflow in NFSv2 READ(CVE-2022-50410)

    drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()(CVE-2022-50402)

    net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode(CVE-2023-53733)

    crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg(CVE-2025-39964)

    udf: Detect system inodes linked into directory hierarchy(CVE-2023-53695)

    skbuff: Account for tail adjustment during pull operations(CVE-2022-50365)

    mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING(CVE-2022-50430)

    skbuff: skb_segment, Call zero copy functions before using skbuff frags(CVE-2023-53354)

    tracing/histograms: Add histograms to hist_vars if they have referenced variables(CVE-2023-53560)

    net: fix skb leak in __skb_tstamp_tx()(CVE-2023-53716)

    media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()(CVE-2023-53220)

    serial: arc_uart: fix of_iomap leak in `arc_serial_probe`(CVE-2023-53719)

    fs: udf: fix OOB read in lengthAllocDescs handling(CVE-2025-40044)

    ipvs: Defer ip_vs_ftp unregister during netns cleanup(CVE-2025-40018)

    scsi: target: iscsi: Fix a race condition between login_work and the login thread(CVE-2022-50350)

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare(CVE-2025-39817)

    igb: Do not free q_vector unless new one was allocated(CVE-2022-50252)

    iommu/vt-d: Clean up si_domain in the init_dmars() error path(CVE-2022-50482)

    VMCI: check context-notify_page after call to get_user_pages_fast() to avoid GPF(CVE-2023-53259)

    ext4: fix WARNING in mb_find_extent(CVE-2023-53317)

    ip_vti: fix potential slab-use-after-free in decode_session6(CVE-2023-53559)

    netfilter: conntrack: Avoid nf_ct_helper_hash uses after free(CVE-2023-53619)

    Input: MT - limit max slots(CVE-2024-45008)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
353232	CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1782148320)	Nessus	CentOS Local Security Checks	2026/9/30	2026/9/30	high
284771	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2026-1050)	Nessus	Huawei Local Security Checks	2026/1/15	2026/9/19	high
265228	Linux Distros Unpatched Vulnerability : CVE-2023-53285	Nessus	Misc.	2025/9/17	2026/9/30	high
177781	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-021 (ALASKERNEL-5.15-2023-021)	Nessus	Amazon Linux Local Security Checks	2023/6/29	2026/2/11	high
177862	Amazon Linux 2 : kernel, --advisory ALAS2-2023-2100 (ALAS-2023-2100)	Nessus	Amazon Linux Local Security Checks	2023/7/1	2026/2/9	high
284758	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2026-1029)	Nessus	Huawei Local Security Checks	2026/1/15	2026/9/19	high

検出

プラグインの検索

high

high

high

high

high

high