The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mm/hugetlb: fix kernel NULL pointer dereference when replacing free hugetlb folios A kernel crash was     observed when replacing free hugetlb folios: BUG: kernel NULL pointer dereference, address:
    0000000000000028 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 28 UID: 0 PID: 29639 Comm: test_cma.sh     Tainted 6.15.0-rc6-zp #41 PREEMPT(voluntary) RIP: 0010:alloc_and_dissolve_hugetlb_folio+0x1d/0x1f0 RSP:
    0018:ffffc9000b30fa90 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000342cca RCX: ffffea0043000000     RDX: ffffc9000b30fb08 RSI: ffffea0043000000 RDI: 0000000000000000 RBP: ffffc9000b30fb20 R08:
    0000000000001000 R09: 0000000000000000 R10: ffff88886f92eb00 R11: 0000000000000000 R12: ffffea0043000000     R13: 0000000000000000 R14: 00000000010c0200 R15: 0000000000000004 FS: 00007fcda5f14740(0000)     GS:ffff8888ec1d8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
    0000000000000028 CR3: 0000000391402000 CR4: 0000000000350ef0 Call Trace: <TASK>     replace_free_hugepage_folios+0xb6/0x100 alloc_contig_range_noprof+0x18a/0x590 ? srso_return_thunk+0x5/0x5f     ? down_read+0x12/0xa0 ? srso_return_thunk+0x5/0x5f cma_range_alloc.constprop.0+0x131/0x290
    __cma_alloc+0xcf/0x2c0 cma_alloc_write+0x43/0xb0 simple_attr_write_xsigned.constprop.0.isra.0+0xb2/0x110     debugfs_attr_write+0x46/0x70 full_proxy_write+0x62/0xa0 vfs_write+0xf8/0x420 ? srso_return_thunk+0x5/0x5f     ? filp_flush+0x86/0xa0 ? srso_return_thunk+0x5/0x5f ? filp_close+0x1f/0x30 ? srso_return_thunk+0x5/0x5f ?     do_dup2+0xaf/0x160 ? srso_return_thunk+0x5/0x5f ksys_write+0x65/0xe0 do_syscall_64+0x64/0x170     entry_SYSCALL_64_after_hwframe+0x76/0x7e There is a potential race between
    __update_and_free_hugetlb_folio() and replace_free_hugepage_folios(): CPU1 CPU2
    __update_and_free_hugetlb_folio replace_free_hugepage_folios folio_test_hugetlb(folio) -- It's still     hugetlb folio. __folio_clear_hugetlb(folio) hugetlb_free_folio(folio) h = folio_hstate(folio) -- Here, h     is NULL pointer When the above race condition occurs, folio_hstate(folio) returns NULL, and subsequent     access to this NULL pointer will cause the system to crash. To resolve this issue, execute     folio_hstate(folio) under the protection of the hugetlb_lock lock, ensuring that folio_hstate(folio) does     not return NULL. (CVE-2025-38050)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - mm/hugetlbフリーな hugetlb folios を置き換えるカーネル NULL ポインターデリファレンスを修正します。フリーな hugetlb folios を置き換える際に、カーネルのクラッシュが見つかりましたバグカーネル NULL ポインターデリファレンス、アドレス
    000000000000028 PGD 0 P4D 0 Oops Oops 0000 [#1] SMP NOPTI CPU 28 UID 0 PID 29639 Comm test_cma.sh 汚染された 6.15.0-rc6-zp #41 PREEMPT(voluntary) RIP 0010:alloc_and_dissolve_hugetlb_folio+ 0x1d/0x1f0 RSP
    0018:ffffc9000b30fa90 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000342cca RCX: ffffea0043000000 RDX: ffffc9000b30fb08 RSI: ffffea0043000000 RDI: 0000000000000000 RBP: ffffc9000b30fb20 R08:
     R090000000000001000  : 0000000000000000 R10: ffff88886f92eb00 R11: 0000000000000000 R12: ffffea0043000000 R13: 0000000000000000 R14: 00000000010c0200 R15: 0000000000000004 FS: 00007fcda5f14740(0000) GS:ffff8888ec1d8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
    000000000000028 CR3: 0000000391402000 CR4: 0000000000350ef0 呼び出しトレース <TASK> replace_free_hugepage_folios+0xb6/0x100 alloc_contig_range_noprof+0x18a/0x590 ? srso_return_thunk+0x5/0x5f ? down_read+0x12/0xa0 ? srso_return_thunk+0x5/0x5f cma_range_alloc.constprop.0+0x131/0x290
    __cma_alloc+0xcf/0x2c0 cma_alloc_write+0x43/0xb0 simple_attr_write_xsigned.constprop.0.isra.0+0xb2/0x110 debugfs_attr_write+0x46/0x70 full_proxy_write+0x62/0xa0 vfs_write+0xf8/0x420 ? srso_return_thunk+0x5/0x5f ? filp_flush+0x86/0xa0 ? srso_return_thunk+0x5/0x5f ? filp_close+0x1f/0x30 ? srso_return_thunk+0x5/0x5f ? do_dup2+0xaf/0x160 ? srso_return_thunk+0x5/0x5f ksys_write+0x65/0xe0 do_syscall_64+0x64/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e の間に競合が発生する可能性があります。
    __update_and_free_hugetlb_folio() および replace_free_hugepage_folios()CPU1 CPU2
    __update_and_free_hugetlb_folio replace_free_hugepage_folios folio_test_hugetlb(folio) -- これは、依然として hugetlb folio です。 __folio_clear_hugetlb(folio) hugetlb_free_folio(folio) h = folio_hstate(folio) -- ここでは、h は NULL ポインターです。上記の競合状態が発生すると、folio_hstate(folio) は NULL を返し、その後、この NULL ポインターへのアクセスにより、システムがクラッシュします。この問題を解決するには、hugetlb_lock ロックの保護下で folio_hstate(folio) を実行し、folio_hstate(folio) が NULL を返さないようにします。CVE-2025-38050

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - mm/hugetlb取代可用 hugetlb 作品集時修正核心 NULL 指標解除參照。當取代可用 hugetlb 作品集時發現核心損毀錯誤核心 NULL 指標解除參照解決
    0000000000000028 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 28 UID: 0 PID: 29639 Comm: test_cma.sh 受污染的 6.15.0-rc6-zp #41 PREEMPT(vulnerable) RIP0010:alloc_and_dissolve_hugetlb_folio+ 0x1d/0x1f0 RSP
    0018:ffffc9000b30fa90 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000342cca RCX: ffffea0043000000 RDX: ffffc9000b30fb08 RSI: ffffea0043000000 RDI: 0000000000000000 RBP: ffffc9000b30fb20 R08:
     R090000000000001000  : 0000000000000000 R10: ffff88886f92eb00 R11: 0000000000000000 R12: ffffea0043000000 R13: 0000000000000000 R14: 00000000010c0200 R15: 0000000000000004 FS: 00007fcda5f14740(0000) GS:ffff8888ec1d8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
    0000000000000028 CR3: 0000000391402000 CR4: 0000000000350ef0 呼叫追踪 <TASK> replace_free_hugepage_folios+0xb6/0x100 alloc_contig_range_noprof+0x18a/0x590 srso_return_thunk+0x5/0x5f ? down_read+0x12/0xa0 ? srso_return_thunk+0x5/0x5f cma_range_alloc.constprop.0+0x131/0x290
    __cma_alloc+0xcf/0x2c0 cma_alloc_write+0x43/0xb0 simple_attr_write_xsigned.constprop.0.isra.0+0xb2/0x110 debugfs_attr_write+0x46/0x70 full_proxy_write+0x62/0xa0 vfs_write+0xf8/0x420 ? srso_return_thunk+0x5/0x5f ? filp_flush+0x86/0xa0 ? srso_return_thunk+0x5/0x5f ? filp_close+0x1f/0x30 ? srso_return_thunk+0x5/0x5f ? do_dup2+0xaf/0x160 ? srso_return_thunk+0x5/0x5f ksys_write+0x65/0xe0 do_syscall_64+0x64/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e 之間可能存在爭用
    __update_and_free_hugetlb_folio() 和 replace_free_hugepage_folios(): CPU1 CPU2
    __update_and_free_hugetlb_folio replace_free_hugepage_folios folio_test_hugetlb(folio) -- 仍然是 hugetlb 作品集。 __folio_clear_hugetlb(folio) hugetlb_free_folio(folio) h = folio_hstate(folio) -- 此處的 h 為 NULL 指標。發生上述爭用情形時folio_hstate(folio) 會傳回 NULL且後續存取此 NULL 指標時會造成系統當機。若要解決此問題請在 hugetlb_lock 鎖定的保護下執行 folio_hstate(folio)確保 folio_hstate(folio) 不會傳回 NULL。 (CVE-2025-38050)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - mm/hugetlb修复替换可用 hugetlb folios 时的内核空指针取消引用。在替换可用 hugetlb folios 时发现内核崩溃缺陷内核空指针取消引用地址
    0000000000000028 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 28 UID: 0 PID: 29639 Comm: test_cma.sh Tainted 6.15.0-rc6-zp #41 PREEMPT(optional) RIP: 0010:alloc_and_dissolve_hugetlb_folio+ 0x1d/0x1f0 RSP
    0018:ffffc9000b30fa90 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000342cca RCX: ffffea0043000000 RDX: ffffc9000b30fb08 RSI: ffffea0043000000 RDI: 0000000000000000 RBP: ffffc9000b30fb20 R08:
     R090000000000001000  : 0000000000000000 R10: ffff88886f92eb00 R11: 0000000000000000 R12: ffffea0043000000 R13: 0000000000000000 R14: 00000000010c0200 R15: 0000000000000004 FS: 00007fcda5f14740(0000) GS:ffff8888ec1d8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES0000 CR00000000080050033 CR2
    0000000000000028 CR3: 0000000391402000 CR4: 0000000000350ef0 调用跟踪 <TASK> replace_free_hugepage_folios+0xb6/0x100 alloc_contig_range_noprof+0x18a/0x590 ? srso_return_thunk+0x5/0x5f ? down_read+0x12/0xa0 ? srso_return_thunk+0x5/0x5f cma_range_alloc.constprop.0+0x131/0x290
    __cma_alloc+0xcf/0x2c0 cma_alloc_write+0x43/0xb0 simple_attr_write_xsigned.constprop.0.isra.0+0xb2/0x110 debugfs_attr_write+0x46/0x70 full_proxy_write+0x62/0xa0 vfs_write+0xf8/0x420 srso_return_thunk+0x5/0x5f ? filp_flush+0x86/0xa0 ? srso_return_thunk+0x5/0x5f ? filp_close+0x1f/0x30 ? srso_return_thunk+0x5/0x5f ? do_dup2+0xaf/0x160 ? srso_return_thunk+0x5/0x5f ksys_write+0x65/0xe0 do_syscall_64+0x64/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e 之间存在潜在的争用
    __update_and_free_hugetlb_folio() 和 replace_free_hugepage_folios()CPU1 CPU2
    __update_and_free_hugetlb_folio replace_free_hugepage_folios folio_test_hugetlb(folio) -- 仍为 hugetlb folio。 __folio_clear_hugetlb(folio) hugetlb_free_folio(folio) h = folio_hstate(folio) -- 此处 h 是空指针当发生上述争用条件时 folio_hstate(folio) 返回空并且随后访问此空指针将导致系统崩溃。要解决此问题请在 hugetlb_lock 锁的保护下执行 folio_hstate(folio)从而确保 folio_hstate(folio) 不会返回 NULL。 (CVE-2025-38050)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

ID	名稱	產品	系列	已發布	已更新	嚴重性
247081	Linux Distros Unpatched Vulnerability : CVE-2025-38050	Nessus	Misc.	2025/8/9	2025/8/9	medium
247081	Linux Distros のパッチ未適用の脆弱性: CVE-2025-38050	Nessus	Misc.	2025/8/9	2025/8/9	medium
247081	Linux Distros 未修補的弱點：CVE-2025-38050	Nessus	Misc.	2025/8/9	2025/8/9	medium
247081	Linux Distros 未修补的漏洞：CVE-2025-38050	Nessus	Misc.	2025/8/9	2025/8/9	medium

偵測

搜尋 Plugin

medium

medium

medium

medium