Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Linux カーネルにおいて、以下の脆弱性は解決されました： nfsd: fix possible badness in FREE_STATEID When multiple FREE_STATEIDs are sent for the same delegation stateid, it can lead to a possible either use-after-free or counter refcount underflow errors. In nfsd4_free_stateid() under the client lock we find a delegation stateid, however the code drops the lock before calling nfs4_put_stid(), that allows another FREE_STATE to find the stateid again. The first one will proceed to then free the stateid which leads to either use-after-free or decrementing already zeroed counter. (CVE-2024-50043)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

CentOS Linux 8.5 ホストには、TuxCare CENTOS8.5:CLSA-2025:1753298320アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

  - Linux カーネルでは、以下の脆弱性が解決されています: ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855 Commit b4a0f54156ac (ath11k: move peer delete after vdev stop of station for QCA6390 and WCN6855) is to fix firmware crash by changing the WMI command sequence, but actually skip all the peer delete operation, then it lead commit 58595c9874c6 (ath11k: Fixing dangling pointer issue upon peer delete failure) not take effect, and then happened a use-after-free warning from KASAN. because the peer->sta is not set to NULL and then used later. Change to only skip the WMI_PEER_DELETE_CMDID for QCA6390/WCN6855. log of user-after-free: [ 534.888665] BUG: KASAN: use-after-free in ath11k_dp_rx_update_peer_stats+0x912/0xc10 [ath11k] [ 534.888696] Read of size 8 at addr ffff8881396bb1b8 by task rtcwake/2860 [ 534.888705] CPU: 4 PID: 2860 Comm: rtcwake Kdump: loaded Tainted:
    G W 5.15.0-wt-ath+ #523 [ 534.888712] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0067.2021.0528.1339 05/28/2021 [ 534.888716] Call Trace: [ 534.888720] <IRQ> [ 534.888726] dump_stack_lvl+0x57/0x7d [ 534.888736] print_address_description.constprop.0+0x1f/0x170 [ 534.888745] ? ath11k_dp_rx_update_peer_stats+0x912/0xc10 [ath11k] [ 534.888771] kasan_report.cold+0x83/0xdf [534.888783] ? ath11k_dp_rx_update_peer_stats+0x912/0xc10 [ath11k] [ 534.888810] ath11k_dp_rx_update_peer_stats+0x912/0xc10 [ath11k] [ 534.888840] ath11k_dp_rx_process_mon_status+0x529/0xa70 [ath11k] [ 534.888874] ? ath11k_dp_rx_mon_status_bufs_replenish+0x3f0/0x3f0 [ath11k] [ 534.888897] ? check_prev_add+0x20f0/0x20f0 [534.888922] ? __lock_acquire+0xb72/0x1870 [ 534.888937] ? find_held_lock+0x33/0x110 [ 534.888954] ath11k_dp_rx_process_mon_rings+0x297/0x520 [ath11k] [ 534.888981] ? rcu_read_unlock+0x40/0x40 [534.888990] ? ath11k_dp_rx_pdev_alloc+0xd90/0xd90 [ath11k] [ 534.889026] ath11k_dp_service_mon_ring+0x67/0xe0 [ath11k] [ 534.889053] ? ath11k_dp_rx_process_mon_rings+0x520/0x520 [ath11k] [ 534.889075] call_timer_fn+0x167/0x4a0 [ 534.889084] ? add_timer_on+0x3b0/0x3b0 [ 534.889103] ? lockdep_hardirqs_on_prepare.part.0+0x18c/0x370 [ 534.889117] __run_timers.part.0+0x539/0x8b0 [ 534.889123] ? ath11k_dp_rx_process_mon_rings+0x520/0x520 [ath11k] [ 534.889157] ? call_timer_fn+0x4a0/0x4a0 [534.889164] ? mark_lock_irq+0x1c30/0x1c30 [ 534.889173] ? clockevents_program_event+0xdd/0x280 [534.889189] ? mark_held_locks+0xa5/0xe0 [ 534.889203] run_timer_softirq+0x97/0x180 [ 534.889213]
    __do_softirq+0x276/0x86a [ 534.889230] __irq_exit_rcu+0x11c/0x180 [ 534.889238] irq_exit_rcu+0x5/0x20 [534.889244] sysvec_apic_timer_interrupt+0x8e/0xc0 [ 534.889251] </IRQ> [ 534.889254] <TASK> [ 534.889259] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 534.889265] RIP: 0010:_raw_spin_unlock_irqrestore+0x38/0x70 [534.889271] Code: 74 24 10 e8 ea c2 bf fd 48 89 ef e8 12 53 c0 fd 81 e3 00 02 00 00 75 25 9c 58 f6 c4 02 75 2d 48 85 db 74 01 fb bf 01 00 00 00 <e8> 13 a7 b5 fd 65 8b 05 cc d9 9c 5e 85 c0 74 0a 5b 5d c3 e8 a0 ee [ 534.889276] RSP: 0018:ffffc90002e5f880 EFLAGS: 00000206 [ 534.889284] RAX: 0000000000000006 RBX:
    0000000000000200 RCX: ffffffff9f256f10 [ 534.889289] RDX: 0000000000000000 RSI: ffffffffa1c6e420 RDI:
    0000000000000001 [ 534.889293] RBP: ffff8881095e6200 R08: 0000000000000001 R09: ffffffffa40d2b8f [534.889298] R10: fffffbfff481a571 R11: 0000000000000001 R12: ffff8881095e6e68 [ 534.889302] R13:
    ffffc90002e5f908 R14: 0000000000000246 R15: 0000000000000000 [ 534.889316] ? mark_lock+0xd0/0x14a0 [534.889332] klist_next+0x1d4/0x450 [ 534.889340] ? dpm_wait_for_subordinate+0x2d0/0x2d0 [ 534.889350] device_for_each_child+0xa8/0x140 [ 534.889360] ? device_remove_class_symlinks+0x1b0/0x1b0 [ 534.889370] ?
    __lock_release+0x4bd/0x9f0 [ 534.889378] ? dpm_suspend+0x26b/0x3f0 [ 534.889390] dpm_wait_for_subordinate+
    ---truncated--- (CVE-2022-49238)

  - Linux カーネルでは、以下の脆弱性が解決されています: tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() A null pointer dereference can happen when attempting to access the gsm->receive() function in gsmld_receive_buf(). Currently, the code assumes that gsm->recieve is only called after MUX activation. Since the gsmld_receive_buf() function can be accessed without the need to initialize the MUX, the gsm->receive() function will not be set and a NULL pointer dereference will occur.
    Fix this by avoiding the call to gsm->receive() in case the function is not initialized by adding a sanity check. Call Trace: <TASK> gsmld_receive_buf+0x1c2/0x2f0 drivers/tty/n_gsm.c:2861 tiocsti drivers/tty/tty_io.c:2293 [inline] tty_ioctl+0xa75/0x15d0 drivers/tty/tty_io.c:2692 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline]
    __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2022-49940)

  - Linux カーネルでは、以下の脆弱性が解決されています: net: qrtr: start MHI channel after endpoit creation MHI channel may generates event/interrupt right after enabling. It may leads to 2 race conditions issues. 1) Such event may be dropped by qcom_mhi_qrtr_dl_callback() at check: if (!qdev || mhi_res->transaction_status) return; Because dev_set_drvdata(&mhi_dev->dev, qdev) may be not performed at this moment. In this situation qrtr-ns will be unable to enumerate services in device.
    --------------------------------------------------------------- 2) Such event may come at the moment after dev_set_drvdata() and before qrtr_endpoint_register(). In this case kernel will panic with accessing wrong pointer at qcom_mhi_qrtr_dl_callback(): rc = qrtr_endpoint_post(&qdev->ep, mhi_res->buf_addr, mhi_res->bytes_xferd); Because endpoint is not created yet.
    -------------------------------------------------------------- So move mhi_prepare_for_transfer_autoqueue after endpoint creation to fix it. (CVE-2022-50044)

  - Linux カーネルでは、以下の脆弱性が解決されています: net: atlantic: fix aq_vec index out of range error The final update statement of the for loop exceeds the array range, the dereference of self->aq_vec[i] is not checked and then leads to the index out of range error. Also fixed this kind of coding style in other for loop. [ 97.937604] UBSAN: array-index-out-of-bounds in drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1404:48 [ 97.937607] index 8 is out of range for type 'aq_vec_s *[8]' [ 97.937608] CPU: 38 PID: 3767 Comm: kworker/u256:18 Not tainted 5.19.0+ #2 [ 97.937610] Hardware name: Dell Inc. Precision 7865 Tower/, BIOS 1.0.0 06/12/2022 [ 97.937611] Workqueue:
    events_unbound async_run_entry_fn [ 97.937616] Call Trace: [ 97.937617] <TASK> [ 97.937619] dump_stack_lvl+0x49/0x63 [ 97.937624] dump_stack+0x10/0x16 [ 97.937626] ubsan_epilogue+0x9/0x3f [97.937627] __ubsan_handle_out_of_bounds.cold+0x44/0x49 [ 97.937629] ? __scm_send+0x348/0x440 [ 97.937632] ? aq_vec_stop+0x72/0x80 [atlantic] [ 97.937639] aq_nic_stop+0x1b6/0x1c0 [atlantic] [ 97.937644] aq_suspend_common+0x88/0x90 [atlantic] [ 97.937648] aq_pm_suspend_poweroff+0xe/0x20 [atlantic] [97.937653] pci_pm_suspend+0x7e/0x1a0 [ 97.937655] ? pci_pm_suspend_noirq+0x2b0/0x2b0 [ 97.937657] dpm_run_callback+0x54/0x190 [ 97.937660] __device_suspend+0x14c/0x4d0 [ 97.937661] async_suspend+0x23/0x70 [ 97.937663] async_run_entry_fn+0x33/0x120 [ 97.937664] process_one_work+0x21f/0x3f0 [ 97.937666] worker_thread+0x4a/0x3c0 [ 97.937668] ? process_one_work+0x3f0/0x3f0 [ 97.937669] kthread+0xf0/0x120 [97.937671] ? kthread_complete_and_exit+0x20/0x20 [ 97.937672] ret_from_fork+0x22/0x30 [ 97.937676] </TASK> v2. fixed warning: variable 'aq_vec' set but not used v3. simplified a for loop (CVE-2022-50066)

  - Linux カーネルでは、以下の脆弱性が解決されています: NFSv4/pnfs: Fix a use-after-free bug in open If someone cancels the open RPC call, then we must not try to free either the open slot or the layoutget operation arguments, since they are likely still in use by the hung RPC call. (CVE-2022-50072)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートの Oracle Linux 8 / 9 ホストに、ELSA-2026-50261 アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

    - xfrm:esp:ipv4:フラグ設定を修正します(Greg Kroah-Hartman 氏)[Orabug: 39344515] {CVE-2026-43284}
    - xfrm:esp:共有 skb フラグでのインプレース復号化を回避(Kuan-Ting Chen 氏)[Orabug: 39344515] {CVE-2026-43284}
    - x86/CPU/AMD:AMD-SB-7052 の修正を追加(Prathyushi Nangia 氏)[Orabug: 39327141] {CVE-2025-54518}
    - crypto:algif_aead - 場所外の操作に戻す(Herbert Xu 氏)[Orabug: 39250686] {CVE-2026-31431}
    - x86/CPU:Zen1 の FPDSS を修正 (Borislav Petkov) [Orabug: 39241228、39273722] {CVE-2026-31628}
    - net/handshake:重複ハンドシェイクキャンセルによる漏洩ソケット(Scott Mayhew 氏)[Orabug: 38847720] {CVE-2025-68775}
    - ipv6:ip6_xmit() で RCU を使用(Eric Dumazet 氏)[Orabug: 38649062] {CVE-2025-40135}
    - scsi:qla2xxx:ペイロードサイズをサニタイズしてメンバーオーバーフローを防止(Jiasheng Jiang)[Orabug: 38930868] {CVE-2026-23059}
    - bpf:bpf_prog_test_run_xdp() の参照カウント漏洩を修正(Tetsuo Handa)[Orabug: 38887702] {CVE-2026-22994}
    - nfsd:サーバーが unlock_filesystem で実行されていることをチェック(Olga Kornievskaia 氏)[Orabug: 38887682] {CVE-2026-22989}
    - net/mlx5e:TC、既存のピア用のフローのみを削除(Mark Bloch 氏)[Orabug: 38970398] {CVE-2026-23173}
    - net/handshake:サブミット失敗時にデストラクターを復元します(Caoping)[Orabug: 38887601] {CVE-2025-71148}
    - scsi:qla2xxx:purex アイテムの不適切な解放を修正します(Zilin Guan 氏)[Orabug: 38798929] {CVE-2025-68741}
    - bnxt_en:XDP_TXパスを修正します(Michael Chan 氏)[Orabug: 38847684] {CVE-2025-68770}
    - perf/x86/amd:GPF を回避するために有効にする前にイベントをチェックします(George Kennedy 氏)[Orabug: 38847849] {CVE-2025-68798}
    - scsi:smartpqi:デバイス削除後にアクセスされるデバイスリソースを修正します(Mike Mcgowen)[Orabug: 38798848] {CVE-2025-68371}
    - KVM:SVM:INT3/INTO が置換される場合、関連のない命令をスキップしません(Omar Sandoval 氏)[Orabug: 38773579] {CVE-2025-68259}
    - x86/fpu:シグナル配信で XFD 状態を確保します(Chang S. Bae 氏)[Orabug: 38773165] {CVE-2025-68171}
    - virtio-net:大きなパケットで受信した長さチェックを修正します(Bui Quang Minh 氏)[Orabug: 38737152] {CVE-2025-40292}
    - ACPI:CPPC:nosmp 使用時の NULL ポインターデリファレンスを修正します(Yunhui Cui 氏)[Orabug: 38641284] {CVE-2025-38113}
    - EDAC/i10nm:無効なメモリコントローラーで DIMM 列挙をスキップ (Qiuxu Zhuo) [Orabug: 38649173] {CVE-2025-40157}
    - sunrpc:ゼロレングスチェックサムの NULL ポインターデリファレンスを修正(Lei Lu 氏)[Orabug: 38649042] {CVE-2025-40129}
    - cpufreq:CPPC:cppc_get_cpu_cost() に対する潜在的な null-ptr-deref を修正(Jinjie Ruan 氏)[Orabug: 38641275] {CVE-2024-53230}
    - cpufreq:CPPC:cpufreq_cpu_get_raw() に対する潜在的な null-ptr-deref を修正(Jinjie Ruan 氏)[Orabug: 38641272] {CVE-2024-53231}
    - vhost:vringh:copy_to_iter戻り値チェックを修正します(Michael S. Tsirkin 氏)[Orabug: 38592117] {CVE-2025-40056}
    - crypto:qat - デバイスのシャットダウン中に misc workqueue をフラッシュ(Giovanni Cabiddu 氏)[Orabug: 38401717] {CVE-2025-39721}
    - vhost:vringh:戻り値のチェックを変更します(Zhang Jiao)[Orabug: 38592085] {CVE-2025-40051}
    - virtio-net:probe() 中の再帰的な rtnl_lock() を修正します(Zigit Zo 氏)[Orabug: 38324330] {CVE-2025-38551}
    - gve:シャットダウン後の ethtool ops を防止します(Jordan Ree)[Orabug: 38401492] {CVE-2025-38735}
    - KVM:SVM:vCPU 作成が実行中の場合、SEV{-ES} ホスト内移行を拒否します(Sean Christopherson 氏)[Orabug: 38254140] {CVE-2025-38455}
    - net:usb:lan78xx:切断時の __netif_napi_del_locked の WARN を修正(Oleksij Rempel 氏)[Orabug: 38253871] {CVE-2025-38385}
    - net/mlx5e:アップリンク表現者プロファイルの MACsec オフロードを無効にします(Carolina Jubran 氏)[Orabug: 38094809] {CVE-2025-38020}
    - dmaengine:idxd:idxd_allocのエラー処理パスのメモリリークを修正(Shuai Xue)[Orabug: 38094794] {CVE-2025-38015}
    - net/mlx5:シャットダウンフローでの ECVF vport アンロードを修正します(Amir Tzin 氏)[Orabug: 38152903] {CVE-2025-38109}
    - bnxt:XDP リダイレクトリストを適切にフラッシュします(Yan Zhai 氏)[Orabug: 38175054] {CVE-2025-38246}
    - eth:bnxt:エラーパスのリングインデックストリムの欠落を修正(Jakub Kicinski 氏)[Orabug: 37937451] {CVE-2025-37873}
    - net/mlx5:mlx5_create_{inner_,}ttc_table() の null-ptr-deref を修正(Henry Martin 氏)[Orabug: 37938078] {CVE-2025-37888}
    - nfsd:FREE_STATEID の潜在的無効性を修正します(Olga Kornievskaia 氏)[Orabug: 37989102] {CVE-2024-50043}
    - devlink:xa_alloc_cyclic() エラー処理を修正(Michal Swiatkowski 氏)[Orabug: 37828271] {CVE-2025-22017}
    - xsk:xp_create_and_assign_umem() の整数オーバーフローを修正(Gavrilov Ilia 氏)[Orabug: 37828202] {CVE-2025-21997}
    - RDMA/mlx5:UMR QP のリカバリフローを修正します(Yishai Hadas 氏)[Orabug: 37766306] {CVE-2025-21892}
    - misc:すべての動的/その他の動的マイナーに ida を使用するようmisc_minor_allocします(Vimal Agrawal 氏)[Orabug: 37678552] {CVE-2024-58078}
    - net/sched:cls_api:NULL デリファレンスを引き起こすエラー処理を修正(Pierre Riteau 氏)[Orabug: 37702083] {CVE-2025-21857}
    - bpf、test_run:eth_skb_pkt_type() の use-after-free の問題を修正します(Shigeru Yoshida 氏)[Orabug: 37766220] {CVE-2025-21867}
    - net: xdp: ジェネリックモードでデバイスバインドプログラムをアタッチすることを許可しません(Toke Hoiland-Jorgensen 氏) [Orabug:
    37650238] {CVE-2025-21808}
    - iommufd/iova_bitmap:iova_bitmap_offset_to_index() の shift-out-of-bounds を修正(Qasim Ijaz 氏)[Orabug:
    37649891] {CVE-2025-21724}
    - xfrm:パケットオフロードモードで中間 secpath エントリを削除します(Alexandre Cassen 氏)[Orabug: 37649866] {CVE-2025-21720}
    - gpiolib:gpiochip_get_ngpios() のエラーによるクラッシュを修正(Andy Shevchenko 氏)[Orabug: 37650154] {CVE-2025-21783}
    - scsi:mpi3mr:bsg のセットアップが失敗する際に起こり得るクラッシュを修正(Guixin Liu 氏)[Orabug: 37649886] {CVE-2025-21723}
    - KVM:x86/mmu:MMIO SPTE の作成時でも既存の SPTE をドロップ/zap します(Sean Christopherson 氏)[Orabug: 39151165、39159089] {CVE-2026-23401}
    - scsi:core:tagset_refcntのrefcountリークを修正(Junxiao Bi)[Orabug: 38976650、39130775] {CVE-2026-23296}
    - net:atm:sigd_send() の検証されない vcc ポインターによるクラッシュを修正します(Jiayuan Chen 氏)[Orabug: 39188477] {CVE-2026-31411}
    - RDMA/umad:ib_umad_write における否定的なdata_lenを拒否します(Yunje Shin 氏)[Orabug: 39103109] {CVE-2026-23243}

Tenable は、前述の記述ブロックを Oracle Linux セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

AlmaLinux 9.2 ホストには、TuxCare ALMALINUX9.2:CLSA-2025:1751916475アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

  - Linux カーネルでは、以下の脆弱性が解決されています: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths Any codepath that zaps page table entries must invoke MMU notifiers to ensure that secondary MMUs (like KVM) don't keep accessing pages which aren't mapped anymore. Secondary MMUs don't hold their own references to pages that are mirrored over, so failing to notify them can lead to page use-after-free. I'm marking this as addressing an issue introduced in commit f3f0e1d2150b (khugepaged: add support of collapse for tmpfs/shmem pages), but most of the security impact of this only came in commit 27e1f8273113 (khugepaged: enable collapse pmd for pte-mapped THP), which actually omitted flushes for the removal of present PTEs, not just for the removal of empty page tables.
    (CVE-2022-48991)

  - Linux カーネルでは、以下の脆弱性が解決されています: nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open Prior to commit 3f29cc82a84c (nfsd: split sc_status out of sc_type) states_show() relied on sc_type field to be of valid type before calling into a subfunction to show content of a particular stateid. From that commit, we split the validity of the stateid into sc_status and no longer changed sc_type to 0 while unhashing the stateid. This resulted in kernel oopsing for nfsv4.0 opens that stay around and in nfs4_show_open() would derefence sc_file which was NULL. Instead, for closed open stateids forgo displaying information that relies of having a valid sc_file. To reproduce: mount the server with 4.0, read and close a file and then on the server cat /proc/fs/nfsd/clients/2/states [513.590804] Call trace: [ 513.590925] _raw_spin_lock+0xcc/0x160 [ 513.591119] nfs4_show_open+0x78/0x2c0 [nfsd] [ 513.591412] states_show+0x44c/0x488 [nfsd] [ 513.591681] seq_read_iter+0x5d8/0x760 [ 513.591896] seq_read+0x188/0x208 [ 513.592075] vfs_read+0x148/0x470 [ 513.592241] ksys_read+0xcc/0x178 (CVE-2024-46682)

  - Linux カーネルでは、以下の脆弱性が解決されています: nfsd: fix possible badness in FREE_STATEID When multiple FREE_STATEIDs are sent for the same delegation stateid, it can lead to a possible either use-after-free or counter refcount underflow errors. In nfsd4_free_stateid() under the client lock we find a delegation stateid, however the code drops the lock before calling nfs4_put_stid(), that allows another FREE_STATE to find the stateid again. The first one will proceed to then free the stateid which leads to either use-after-free or decrementing already zeroed counter. (CVE-2024-50043)

  - Linux カーネルでは、以下の脆弱性が解決されています: bpf: Prevent tail call between progs attached to different hooks bpf progs can be attached to kernel functions, and the attached functions can take different parameters or return different return values. If prog attached to one kernel function tail calls prog attached to another kernel function, the ctx access or return value verification could be bypassed. For example, if prog1 is attached to func1 which takes only 1 parameter and prog2 is attached to func2 which takes two parameters. Since verifier assumes the bpf ctx passed to prog2 is constructed based on func2's prototype, verifier allows prog2 to access the second parameter from the bpf ctx passed to it.
    The problem is that verifier does not prevent prog1 from passing its bpf ctx to prog2 via tail call. In this case, the bpf ctx passed to prog2 is constructed from func1 instead of func2, that is, the assumption for ctx access verification is bypassed. Another example, if BPF LSM prog1 is attached to hook file_alloc_security, and BPF LSM prog2 is attached to hook bpf_lsm_audit_rule_known. Verifier knows the return value rules for these two hooks, e.g. it is legal for bpf_lsm_audit_rule_known to return positive number 1, and it is illegal for file_alloc_security to return positive number. So verifier allows prog2 to return positive number 1, but does not allow prog1 to return positive number. The problem is that verifier does not prevent prog1 from calling prog2 via tail call. In this case, prog2's return value 1 will be used as the return value for prog1's hook file_alloc_security. That is, the return value rule is bypassed. This patch adds restriction for tail call to prevent such bypasses. (CVE-2024-50063)

  - Linux カーネルでは、以下の脆弱性が解決されています: nfsd: fix race between laundromat and free_stateid There is a race between laundromat handling of revoked delegations and a client sending free_stateid operation. Laundromat thread finds that delegation has expired and needs to be revoked so it marks the delegation stid revoked and it puts it on a reaper list but then it unlock the state lock and the actual delegation revocation happens without the lock. Once the stid is marked revoked a racing free_stateid processing thread does the following (1) it calls list_del_init() which removes it from the reaper list and (2) frees the delegation stid structure. The laundromat thread ends up not calling the revoke_delegation() function for this particular delegation but that means it will no release the lock lease that exists on the file. Now, a new open for this file comes in and ends up finding that lease list isn't empty and calls nfsd_breaker_owns_lease() which ends up trying to derefence a freed delegation stateid. Leading to the followint use-after-free KASAN warning: kernel:
    ================================================================== kernel: BUG: KASAN: slab-use-after-free in nfsd_breaker_owns_lease+0x140/0x160 [nfsd] kernel: Read of size 8 at addr ffff0000e73cd0c8 by task nfsd/6205 kernel: kernel: CPU: 2 UID: 0 PID: 6205 Comm: nfsd Kdump: loaded Not tainted 6.11.0-rc7+ #9 kernel: Hardware name: Apple Inc. Apple Virtualization Generic Platform, BIOS 2069.0.0.0.0 08/03/2024 kernel: Call trace: kernel: dump_backtrace+0x98/0x120 kernel: show_stack+0x1c/0x30 kernel:
    dump_stack_lvl+0x80/0xe8 kernel: print_address_description.constprop.0+0x84/0x390 kernel:
    print_report+0xa4/0x268 kernel: kasan_report+0xb4/0xf8 kernel: __asan_report_load8_noabort+0x1c/0x28 kernel: nfsd_breaker_owns_lease+0x140/0x160 [nfsd] kernel: nfsd_file_do_acquire+0xb3c/0x11d0 [nfsd] kernel: nfsd_file_acquire_opened+0x84/0x110 [nfsd] kernel: nfs4_get_vfs_file+0x634/0x958 [nfsd] kernel:
    nfsd4_process_open2+0xa40/0x1a40 [nfsd] kernel: nfsd4_open+0xa08/0xe80 [nfsd] kernel:
    nfsd4_proc_compound+0xb8c/0x2130 [nfsd] kernel: nfsd_dispatch+0x22c/0x718 [nfsd] kernel:
    svc_process_common+0x8e8/0x1960 [sunrpc] kernel: svc_process+0x3d4/0x7e0 [sunrpc] kernel:
    svc_handle_xprt+0x828/0xe10 [sunrpc] kernel: svc_recv+0x2cc/0x6a8 [sunrpc] kernel: nfsd+0x270/0x400 [nfsd] kernel: kthread+0x288/0x310 kernel: ret_from_fork+0x10/0x20 This patch proposes a fixed that's based on adding 2 new additional stid's sc_status values that help coordinate between the laundromat and other operations (nfsd4_free_stateid() and nfsd4_delegreturn()). First to make sure, that once the stid is marked revoked, it is not removed by the nfsd4_free_stateid(), the laundromat take a reference on the stateid. Then, coordinating whether the stid has been put on the cl_revoked list or we are processing FREE_STATEID and need to make sure to remove it from the list, each check that state and act accordingly.
    If laundromat has added to the cl_revoke list before the arrival of FREE_STATEID, then nfsd4_free_stateid() knows to remove it from the list. If nfsd4_free_stateid() finds that operations arrived before laundromat has placed it on cl_revoke list, it marks the state freed and then laundromat will no longer add it to the list. Also, for nfsd4_delegreturn() when looking for the specified stid, we need to access stid that are marked removed or freeable, it means the laundromat has started processing it but hasn't finished and this delegreturn needs to return nfserr_deleg_revoked and not nfserr_bad_stateid.
    The latter will not trigger a FREE_STATEID and the lack of it will leave this stid on the cl_revoked list indefinitely. (CVE-2024-50106)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

CentOS Linux 8.4 ホストには、TuxCare CENTOS8.4:CLSA-2025:1753297988アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

  - Linux カーネルでは、以下の脆弱性が解決されています: mptcp: fix race on unaccepted mptcp sockets When the listener socket owning the relevant request is closed, it frees the unaccepted subflows and that causes later deletion of the paired MPTCP sockets. The mptcp socket's worker can run in the time interval between such delete operations. When that happens, any access to msk->first will cause an UaF access, as the subflow cleanup did not cleared such field in the mptcp socket. Address the issue explicitly traversing the listener socket accept queue at close time and performing the needed cleanup on the pending msk. Note that the locking is a bit tricky, as we need to acquire the msk socket lock, while still owning the subflow socket one. (CVE-2022-49669)

  - Linux カーネルでは、以下の脆弱性が解決されています: tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() A null pointer dereference can happen when attempting to access the gsm->receive() function in gsmld_receive_buf(). Currently, the code assumes that gsm->recieve is only called after MUX activation. Since the gsmld_receive_buf() function can be accessed without the need to initialize the MUX, the gsm->receive() function will not be set and a NULL pointer dereference will occur.
    Fix this by avoiding the call to gsm->receive() in case the function is not initialized by adding a sanity check. Call Trace: <TASK> gsmld_receive_buf+0x1c2/0x2f0 drivers/tty/n_gsm.c:2861 tiocsti drivers/tty/tty_io.c:2293 [inline] tty_ioctl+0xa75/0x15d0 drivers/tty/tty_io.c:2692 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline]
    __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2022-49940)

  - Linux カーネルでは、以下の脆弱性が解決されています: drm/amd/display: clear optc underflow before turn off odm clock [Why] After ODM clock off, optc underflow bit will be kept there always and clear not work. We need to clear that before clock off. [How] Clear that if have when clock off.
    (CVE-2022-49969)

  - Linux カーネルでは、以下の脆弱性が解決されています: net: atlantic: fix aq_vec index out of range error The final update statement of the for loop exceeds the array range, the dereference of self->aq_vec[i] is not checked and then leads to the index out of range error. Also fixed this kind of coding style in other for loop. [ 97.937604] UBSAN: array-index-out-of-bounds in drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1404:48 [ 97.937607] index 8 is out of range for type 'aq_vec_s *[8]' [ 97.937608] CPU: 38 PID: 3767 Comm: kworker/u256:18 Not tainted 5.19.0+ #2 [ 97.937610] Hardware name: Dell Inc. Precision 7865 Tower/, BIOS 1.0.0 06/12/2022 [ 97.937611] Workqueue:
    events_unbound async_run_entry_fn [ 97.937616] Call Trace: [ 97.937617] <TASK> [ 97.937619] dump_stack_lvl+0x49/0x63 [ 97.937624] dump_stack+0x10/0x16 [ 97.937626] ubsan_epilogue+0x9/0x3f [97.937627] __ubsan_handle_out_of_bounds.cold+0x44/0x49 [ 97.937629] ? __scm_send+0x348/0x440 [ 97.937632] ? aq_vec_stop+0x72/0x80 [atlantic] [ 97.937639] aq_nic_stop+0x1b6/0x1c0 [atlantic] [ 97.937644] aq_suspend_common+0x88/0x90 [atlantic] [ 97.937648] aq_pm_suspend_poweroff+0xe/0x20 [atlantic] [97.937653] pci_pm_suspend+0x7e/0x1a0 [ 97.937655] ? pci_pm_suspend_noirq+0x2b0/0x2b0 [ 97.937657] dpm_run_callback+0x54/0x190 [ 97.937660] __device_suspend+0x14c/0x4d0 [ 97.937661] async_suspend+0x23/0x70 [ 97.937663] async_run_entry_fn+0x33/0x120 [ 97.937664] process_one_work+0x21f/0x3f0 [ 97.937666] worker_thread+0x4a/0x3c0 [ 97.937668] ? process_one_work+0x3f0/0x3f0 [ 97.937669] kthread+0xf0/0x120 [97.937671] ? kthread_complete_and_exit+0x20/0x20 [ 97.937672] ret_from_fork+0x22/0x30 [ 97.937676] </TASK> v2. fixed warning: variable 'aq_vec' set but not used v3. simplified a for loop (CVE-2022-50066)

  - Linux カーネルでは、以下の脆弱性が解決されています: NFSv4/pnfs: Fix a use-after-free bug in open If someone cancels the open RPC call, then we must not try to free either the open slot or the layoutget operation arguments, since they are likely still in use by the hung RPC call. (CVE-2022-50072)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

ID	名前	製品	ファミリー	公開日	更新日	深刻度
231086	Linux Distros のパッチ未適用の脆弱性: CVE-2024-50043	Nessus	Misc.	2025/3/6	2026/7/17	high
216943	Ubuntu 24.04 LTS : Linux カーネルの脆弱性 (USN-7310-1)	Nessus	Ubuntu Local Security Checks	2025/2/28	2025/9/24	critical
351710	CentOS Linux 8.5 [TuxCare] セキュリティ更新プログラム:kernel-cross-headers / kernel-debug-modules-extra / etcの複数の脆弱性(CENTOS8.5:CLSA-2025:1753298320)	Nessus	CentOS Local Security Checks	2026/9/30	2026/9/30	high
314332	Oracle Linux 8 / 9 : Unbreakable Enterprise カーネル (ELSA-2026-50261)	Nessus	Oracle Linux Local Security Checks	2026/5/12	2026/5/13	high
216492	Ubuntu 24.10 : Linux カーネルの脆弱性 (USN-7277-1)	Nessus	Ubuntu Local Security Checks	2025/2/19	2026/6/3	critical
216493	Ubuntu 24.10 : Linux カーネルの脆弱性 (USN-7276-1)	Nessus	Ubuntu Local Security Checks	2025/2/19	2025/9/24	critical
360282	AlmaLinux 9.2 [TuxCare] セキュリティ更新プログラム:bpftool/kernel/kernel-abi-stablelists/kernel-core/etcの複数の脆弱性(ALMALINUX9.2:CLSA-2025:1751916475)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	high
360874	CentOS Linux 8.4 [TuxCare] セキュリティ更新プログラム:bpftool/kernel-core/kernel-debug/kernel-debug-core/etcの複数の脆弱性(CENTOS8.4:CLSA-2025:1753297988)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	high

検出

プラグインの検索

high

critical

high

high

critical

critical

high

high