The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992516 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Do not update file length for failed writes to inline files

    When write to inline file fails (or happens only partly), we still     updated length of inline data as if the whole write succeeded. Fix the     update of length of inline data to happen only if the write succeeds.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    media: v4l2-mem2mem: add lock to protect parameter num_rdy(CVE-2023-53519)

    md: Replace snprintf with scnprintf(CVE-2022-50299)

    mm/vmscan: don't try to reclaim hwpoison folio(CVE-2025-37834)

    ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()(CVE-2023-53271)

    md/raid10: fix wrong setting of max_corr_read_errors(CVE-2023-53313)

    scsi: target: target_core_configfs: Add length check to avoid buffer overflow(CVE-2025-39998)

    loop: Avoid updating block size under exclusive owner(CVE-2025-38709)

    mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory(CVE-2025-39883)

    scsi: qla4xxx: Prevent a potential error pointer dereference(CVE-2025-39676)

    NFS: Fix a race when updating an existing write(CVE-2025-39697)

    scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses(CVE-2023-7324)

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare(CVE-2025-39817)

    dm raid: fix address sanitizer warning in raid_resume(CVE-2022-50085)

    usb-storage: alauda: Fix uninit-value in alauda_check_media()(CVE-2023-53847)

    mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list(CVE-2025-39725)

    md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request(CVE-2023-53380)

    md/raid10: check slab-out-of-bounds in md_bitmap_get_counter(CVE-2023-53357)

    net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode(CVE-2023-53733)

    fs: quota: create dedicated workqueue for quota_release_work(CVE-2025-40196)

    partitions: mac: fix handling of bogus partition table(CVE-2025-21772)

    HID: hidraw: fix memory leak in hidraw_release()(CVE-2022-49981)

    pid: Add a judgment for ns null in pid_nr_ns(CVE-2025-40178)

    libceph: fix potential use-after-free in have_mon_and_osd_map()(CVE-2025-68285)

    watchdog: Fix kmemleak in watchdog_cdev_register(CVE-2023-53234)

    drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()(CVE-2022-50402)

    PNP: fix name memory leak in pnp_alloc_dev()(CVE-2022-50278)

    ipvs: Defer ip_vs_ftp unregister during netns cleanup(CVE-2025-40018)

    nbd: Fix hung when signal interrupts nbd_start_device_ioctl()(CVE-2022-50314)

    igb: Do not free q_vector unless new one was allocated(CVE-2022-50252)

    ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed(CVE-2023-53481)

    cacheinfo: Fix shared_cpu_map to handle shared caches at different levels(CVE-2023-53254)

    scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()(CVE-2025-40115)

    scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()(CVE-2023-53676)

    NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid(CVE-2025-68349)

    net: hns: fix possible memory leak in hnae_ae_register()(CVE-2022-50352)

    md: call __md_stop_writes in md_stop(CVE-2022-49987)

    net/packet: fix a race in packet_set_ring() and packet_notifier()(CVE-2025-38617)

    regulator: of: Fix refcount leak bug in of_get_regulation_constraints()(CVE-2022-50191)

    ubi: Fix use-after-free when volume resizing failed(CVE-2023-53800)

    HID: multitouch: Correct devm device reference for hidinput input_dev name(CVE-2023-53454)

    ipv6: reject malicious packets in ipv6_gso_segment()(CVE-2025-38572)

    md/raid10: fix leak of 'r10bio-remaining' for recovery(CVE-2023-53299)

    scsi: qla2xxx: Wait for io return on terminate rport(CVE-2023-53322)

    udf: Detect system inodes linked into directory hierarchy(CVE-2023-53695)

    igb: Fix igb_down hung on surprise removal(CVE-2023-53148)

    cifs: Fix warning and UAF when destroy the MR list(CVE-2023-53427)

    scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()(CVE-2023-53803)

    ubi: ensure that VID header offset + VID header size = alloc, size(CVE-2023-53265)

    fs/proc: fix uaf in proc_readdir_de()(CVE-2025-40271)

    firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails(CVE-2022-50087)

    md-raid10: fix KASAN warning(CVE-2022-50211)

    scsi: ses: Fix possible desc_ptr out-of-bounds accesses(CVE-2023-53675)

    mmc: core: Fix kernel panic when remove non-standard SDIO card(CVE-2022-50640)

    nfs: handle failure of nfs_get_lock_context in unlock path(CVE-2025-38023)

    udf: Do not update file length for failed writes to inline files(CVE-2023-53295)

    RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug(CVE-2025-38024)

    sctp: check send stream number after wait_for_sndbuf(CVE-2023-53296)

    net/sched: sch_qfq: Fix race condition on qfq_aggregate(CVE-2025-38477)

    RDMA/rxe: Fix 'kernel NULL pointer dereference' error(CVE-2022-50671)

    i40e: add validation for ring_len param(CVE-2025-39973)

    md/raid1: Fix stack memory use after return in raid1_reshape(CVE-2025-38445)

    Squashfs: check return result of sb_min_blocksize(CVE-2025-38415)

    net/tunnel: wait until all sk_user_data reader finish before releasing the sock(CVE-2022-50405)

    ip6_vti: fix slab-use-after-free in decode_session6(CVE-2023-53821)

    af_unix: Fix data-races around user-unix_inflight.(CVE-2023-53204)

    RDMA/rxe: Fix error unwind in rxe_create_qp()(CVE-2022-50127)

    __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock(CVE-2025-38058)

    NFSD: Protect against send buffer overflow in NFSv2 READ(CVE-2022-50410)

    scsi: hpsa: Fix possible memory leak in hpsa_init_one()(CVE-2022-50646)

    sctp: handle the error returned from sctp_auth_asoc_init_active_key(CVE-2022-50243)

    vsock: Do not allow binding to VMADDR_PORT_ANY(CVE-2025-38618)

    smb: client: Fix use-after-free in cifs_fill_dirent(CVE-2025-38051)

    scsi: libiscsi: Initialize iscsi_conn-dd_data only if memory is allocated(CVE-2025-38700)

    sctp: fix a potential overflow in sctp_ifwdtsn_skip(CVE-2023-53372)

    pstore/ram: Check start of empty przs during init(CVE-2023-53331)

    clk: samsung: Fix memory leak in _samsung_clk_register_pll()(CVE-2022-50449)

    md/raid10: prevent soft lockup while flush writes(CVE-2023-53151)

    nfsd: call op_release, even when op_func returns an error(CVE-2023-53241)

    cifs: Release folio lock on fscache read hit.(CVE-2023-53593)

    net: bridge: fix soft lockup in br_multicast_query_expired()(CVE-2025-39773)

    cifs: fix small mempool leak in SMB2_negotiate()(CVE-2022-49938)

    dm raid: fix address sanitizer warning in raid_status(CVE-2022-50084)

    nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()(CVE-2025-38724)

    scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()(CVE-2023-54014)

    block: fix resource leak in blk_register_queue() error path(CVE-2025-37980)

    drm/client: Fix memory leak in drm_client_target_cloned(CVE-2023-54091)

    dm flakey: fix a crash with invalid table line(CVE-2023-53786)

    crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()(CVE-2023-53817)

    hwrng: virtio - Fix race on data_avail and actual data(CVE-2023-53998)

    sched/fair: Don't balance task to its current running CPU(CVE-2023-53215)

    ppp: associate skb with a device at tx(CVE-2022-50655)

    fbdev: bitblit: bound-check glyph index in bit_putcs*(CVE-2025-40322)

    acct: fix potential integer overflow in encode_comp_t()(CVE-2022-50749)

    udf: Avoid double brelse() in udf_rename()(CVE-2022-50755)

    tee: add overflow check in register_shm_helper()(CVE-2022-50080)

    drm: Prevent drm_copy_field() to attempt copying a NULL pointer(CVE-2022-50884)

    crypto: api - Use work queue in crypto_destroy_instance(CVE-2023-53799)

    mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()(CVE-2023-53623)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03615-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
    - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
    - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
    - CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
    - CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
    - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
    - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
    - CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
    - CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
    - CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree     (bsc#1248255).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
    - CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
    - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
    - CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
    - CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
    - CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1777616064 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in     create_var_ref() In create_var_ref(), init_var_ref() is called to initialize the fields of variable     ref_field, which is allocated in the previous function call to create_hist_field(). Function     init_var_ref() allocates the corresponding fields such as ref_field->system, but frees these fields when     the function encounters an error. The caller later calls destroy_hist_field() to conduct error handling,     which frees the fields and the variable itself. This results in double free of the fields which are     already freed in the previous function. Fix this by storing NULL to the corresponding fields when they are     freed in init_var_ref(). (CVE-2022-49410)

  - In the Linux kernel, the following vulnerability has been resolved: net: mdio: fix undefined behavior in     bit shift for __mdiobus_register Shifting signed 32-bit value by 31 bits is undefined, so changing     significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in     drivers/net/phy/mdio_bus.c:586:27 left shift of 1 by 31 places cannot be represented in type 'int' Call     Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e
    __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c __mdiobus_register+0x49d/0x4e0     fixed_mdio_bus_init+0xd8/0x12d do_one_initcall+0x76/0x430 kernel_init_freeable+0x3b3/0x422     kernel_init+0x24/0x1e0 ret_from_fork+0x1f/0x30 </TASK> (CVE-2022-49907)

  - In the Linux kernel, the following vulnerability has been resolved: vt: Clear selection before changing     the font When changing the console font with ioctl(KDFONTOP) the new font size can be bigger than the     previous font. A previous selection may thus now be outside of the new screen size and thus trigger out-     of-bounds accesses to graphics memory if the selection is removed in vc_do_resize(). Prevent such out-of-     memory accesses by dropping the selection before the various con_font_set() console handlers are called.
    (CVE-2022-49948)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix double free on     tx path. We see kernel crashes and lockups and KASAN errors related to ax210 firmware crashes. One of the     KASAN dumps pointed at the tx path, and it appears there is indeed a way to double-free an skb. If     iwl_mvm_tx_skb_sta returns non-zero, then the 'skb' sent into the method will be freed. But, in case where     we build TSO skb buffer, the skb may also be freed in error case. So, return 0 in that particular error     case and do cleanup manually. BUG: KASAN: use-after-free in __list_del_entry_valid+0x12/0x90 iwlwifi     0000:06:00.0: 0x00000000 | tsf hi Read of size 8 at addr ffff88813cfa4ba0 by task btserver/9650 CPU: 4     PID: 9650 Comm: btserver Tainted: G W 5.19.8+ #5 iwlwifi 0000:06:00.0: 0x00000000 | time gp1 Hardware     name: Default string Default string/SKYBAY, BIOS 5.12 02/19/2019 Call Trace: <TASK>     dump_stack_lvl+0x55/0x6d print_report.cold.12+0xf2/0x684 iwlwifi 0000:06:00.0: 0x1D0915A8 | time gp2 ?
    __list_del_entry_valid+0x12/0x90 kasan_report+0x8b/0x180 iwlwifi 0000:06:00.0: 0x00000001 | uCode revision     type ? __list_del_entry_valid+0x12/0x90 __list_del_entry_valid+0x12/0x90 iwlwifi 0000:06:00.0: 0x00000048     | uCode version major tcp_update_skb_after_send+0x5d/0x170 __tcp_transmit_skb+0xb61/0x15c0 iwlwifi     0000:06:00.0: 0xDAA05125 | uCode version minor ? __tcp_select_window+0x490/0x490 iwlwifi 0000:06:00.0:
    0x00000420 | hw version ? trace_kmalloc_node+0x29/0xd0 ? __kmalloc_node_track_caller+0x12a/0x260 ?     memset+0x1f/0x40 ? __build_skb_around+0x125/0x150 ? __alloc_skb+0x1d4/0x220 ?     skb_zerocopy_clone+0x55/0x230 iwlwifi 0000:06:00.0: 0x00489002 | board version ? kmalloc_reserve+0x80/0x80     ? rcu_read_lock_bh_held+0x60/0xb0 tcp_write_xmit+0x3f1/0x24d0 iwlwifi 0000:06:00.0: 0x034E001C | hcmd ?
    __check_object_size+0x180/0x350 iwlwifi 0000:06:00.0: 0x24020000 | isr0 tcp_sendmsg_locked+0x8a9/0x1520     iwlwifi 0000:06:00.0: 0x01400000 | isr1 ? tcp_sendpage+0x50/0x50 iwlwifi 0000:06:00.0: 0x48F0000A | isr2 ?     lock_release+0xb9/0x400 ? tcp_sendmsg+0x14/0x40 iwlwifi 0000:06:00.0: 0x00C3080C | isr3 ?     lock_downgrade+0x390/0x390 ? do_raw_spin_lock+0x114/0x1d0 iwlwifi 0000:06:00.0: 0x00200000 | isr4 ?     rwlock_bug.part.2+0x50/0x50 iwlwifi 0000:06:00.0: 0x034A001C | last cmd Id ? rwlock_bug.part.2+0x50/0x50 ?     lockdep_hardirqs_on_prepare+0xe/0x200 iwlwifi 0000:06:00.0: 0x0000C2F0 | wait_event ?
    __local_bh_enable_ip+0x87/0xe0 ? inet_send_prepare+0x220/0x220 iwlwifi 0000:06:00.0: 0x000000C4 |     l2p_control tcp_sendmsg+0x22/0x40 sock_sendmsg+0x5f/0x70 iwlwifi 0000:06:00.0: 0x00010034 | l2p_duration
    __sys_sendto+0x19d/0x250 iwlwifi 0000:06:00.0: 0x00000007 | l2p_mhvalid ? __ia32_sys_getpeername+0x40/0x40     iwlwifi 0000:06:00.0: 0x00000000 | l2p_addr_match ? rcu_read_lock_held_common+0x12/0x50 ?     rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? rcu_read_lock_sched_held+0x5a/0xd0     ? rcu_read_lock_sched_held+0x5a/0xd0 ? lock_release+0xb9/0x400 ? lock_downgrade+0x390/0x390 ?     ktime_get+0x64/0x130 ? ktime_get+0x8d/0x130 ? rcu_read_lock_held_common+0x12/0x50 ?     rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_held_common+0x12/0x50 ?     rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? rcu_read_lock_bh_held+0xb0/0xb0
    __x64_sys_sendto+0x6f/0x80 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP:
    0033:0x7f1d126e4531 Code: 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 35 80 0c 00 41 89 ca 8b 00 85 c0     75 1c 45 31 c9 45 31 c0 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 67 c3 66 0f 1f 44 00 00 55 48 83 ec 20     48 89 RSP: 002b:00007ffe21a679d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX:
    000000000000ffdc RCX: 00007f1d126e4531 RDX: 0000000000010000 RSI: 000000000374acf0 RDI: 0000000000000014     RBP: 00007ffe21a67ac0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11:
    0000000000000246 R ---truncated--- (CVE-2022-50248)

  - In the Linux kernel, the following vulnerability has been resolved: mmc: rtsx_usb_sdmmc: fix return value     check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that     allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added     device in the remove path. So fix this by checking the return value and calling mmc_free_host() in the     error path, besides, led_classdev_unregister() and pm_runtime_disable() also need be called.
    (CVE-2022-50347)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
280624	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-992516)	Nessus	Unity Linux Local Security Checks	2025/12/30	2025/12/30	medium
302607	EulerOS Virtualization 2.10.1 : kernel (EulerOS-SA-2026-1537)	Nessus	Huawei Local Security Checks	2026/3/16	2026/3/16	high
270837	SUSE SLES15 : Security update for the Linux Kernel (SUSE-SU-2025:03615-1)	Nessus	SuSE Local Security Checks	2025/10/21	2026/9/29	high
353159	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1777616064)	Nessus	Alma Linux Local Security Checks	2026/9/30	2026/10/20	high

検出

プラグインの検索

medium

high

high

high