Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - smb用戶端修正非線性記憶體中的 crypto 緩衝區。crypto API (透過 scatterlist API) 預期輸入緩衝區位於線性記憶體中。我們使用 cifs_sg_set_buf() 協助程式處理此問題其可將 vmalloc 的記憶體轉換至其對應頁面。但是當我們配置 aead_request 緩衝區 (smb2ops.c::crypt_message() 中的 @creq) 時會使用 kvzalloc() 執行此動作進而可能會將 aead_request->__ctx 放在 vmalloc 區域中。然後AEAD 演算法針對其私人/內部資料和作業使用 ->__ctx並針對少數位置的此類資料使用 sg_set_buf()。只要 @creq 屬於 kmalloc 區域 (小型要求) 或 vmalloc 的記憶體仍在線性範圍內此即可正常運作。工作的堆疊預設為 vmalloc (CONFIG_VMAP_STACK=y)因此若發生此情況太多工作會將基本堆疊的位址遞增到 virt_addr_valid(buf) 會失敗的程度 (sg_set_buf() 中的 BUG())。實作加密掛載上有太多平行讀取和寫入將會觸發此錯誤。若要修正此請一律改為以 kmalloc() 配置 @creq。同時中斷 kfree_sensitive() 所需要的 @sensitive_size 變數/引數。反向追踪 [ 945.272081] ------------[cut here ]------------ [ 945.272774] include/linux/scatterlist.h:209 的核心錯誤! [ 945.273520] Oops無效 opcode0000 [#1] SMP DEBUG_PAGEALLOC NOPTI [945.274412] CPU7 UID0 PID 56 Commkworker/u33:0 Kdump 已載入 未受污染的 6.15.0-lku-11779- g8e9d6efccdd7-dirty #1 PREEMPT(vulnerable) [ 945.275736] 硬體名稱QEMU Standard PC (Q35 + ICH9, 2009)BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014 [ 945.276877] 工作佇列
    writeback wb_workfn (flush-cifs-2) [ 945.277457] RIP0010:crypto_gcm_init_common+0x1f9/0x220 [945.278018] 程式碼b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b [ 945.279992] RSP00 ffffc90000a27360 EFLAGS00010246 [ 945.280578] RAX 0000000000000000 RBX
    ffffc90001d85060 RCX 0000000000000030 [ 945.281376] RDX 0000000000080000 RSI 0000000000000000 RDI
    ffffc90081d85070 [ 945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000 [945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070 [ 945.283656] R13:
     R14ffff888113522948  : ffffc90001d85060 R15: ffffc90001d85010 [ 945.284407] FS: 0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000 [ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [ 945.285884] CR2 00007fa7ffdd31f4 CR3 000000010540d000 CR4 0000000000350ef0 [945.286683] 呼叫追踪 [ 945.286952] <TASK> [ 945.287184] crypt_message+0x33f/0xad0 [cifs] [945.287719] crypto_gcm_encrypt+0x36/0xe0 [ 945.288152] crypt_message+0x54a/0xad0 [cifs] [ 945.288724] smb3_init_transform_rq+0x277/0x300 [cifs] [ 945.289300] smb_send_rqst+0xa3/0x160x16 [cifs] [ 945.289944] cifs_call_async+0x178/0x340 [cifs] [ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] [945.291177] smb2_async_writev+0x3e3/0x670 [cifs] [ 945.291759] ? find_held_lock+0x32/0x90 [ 945.292212] ? netfs_advance_write+0xf2/0x310 [ 945.292723] netfs_advance_write+0xf2/0x310 [ 945.293210] netfs_write_folio+0x346/0xcc0 [ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10 [ 945.294250] netfs_writepages+0x117/0x460 [ 945.294724] do_writepages+0xbe/0x170 [ 945.295152] find_held_lock+0x32/0x90 [ 945.295600] ? kvm_sched_clock_read+0x11/0x20 [ 945.296103]
    __writeback_single_inode+0x56/0x4b0 [ 945.296643] writeback_sb_inodes+0x229/0x550 [ 945.297140]
    __writeback_inodes_wb+0x4c/0xe0 [ 945.297642] wb_writeback+0x2f1/0x3f0 [ 945.298069] ] wb_workfn+0x300/0x490 [ 945.298472] process_one_work+0x1fe/0x590 [ 945.298949] worker_thread+0x1ce/0x3c0 [ 945.299397]
    __pfx_worker_thread+0x10/0x10 [ 945.299900] kthr ---truncated--- (CVE-2025-40052)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4057-1 advisory.

    The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
    - CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).
    - CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).
    - CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al     (bsc#1248630).
    - CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).
    - CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated     (bsc#1249182).
    - CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
    - CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).
    - CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).
    - CVE-2025-39683: tracing: Limit access to parser->buffer when trace_get_user failed (bsc#1249286).
    - CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).
    - CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).
    - CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).
    - CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).
    - CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
    - CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).
    - CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).
    - CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).
    - CVE-2025-39832: net/mlx5: Add sync reset drop mode support (bsc#1249901).
    - CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
    - CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
    - CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).
    - CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
    - CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
    - CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).
    - CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).
    - CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).
    - CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).
    - CVE-2025-39898: e1000e: fix heap overflow in e1000_set_eeprom (bsc#1250742).
    - CVE-2025-39900: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (bsc#1250758).
    - CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).
    - CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).
    - CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
    - CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).
    - CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).
    - CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).
    - CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).
    - CVE-2025-39955: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (bsc#1251804).
    - CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
    - CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).
    - CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).
    - CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052).
    - CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).
    - CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
    - CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).
    - CVE-2025-39984: net: tun: Update napi->skb after XDP process (bsc#1252081).
    - CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062).
    - CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349).
    - CVE-2025-40012: net/smc: fix warning in smc_rx_splice() when calling get_page() (bsc#1252330).
    - CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
    - CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858).
    - CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826).
    - CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848).
    - CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).
    - CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree     (bsc#1252918).

    The following non security issues were fixed:

    - ACPI/processor_idle: Add FFH state handling (jsc#PED-13815).
    - ACPI/processor_idle: Export acpi_processor_ffh_play_dead() (jsc#PED-13815).
    - ACPI: battery: Add synchronization between interface updates (git-fixes).
    - ACPI: processor: Rescan 'dead' SMT siblings during initialization (jsc#PED-13815).
    - KVM: PPC: Fix misleading interrupts comment in kvmppc_prepare_to_enter() (bsc#1215199).
    - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() (git-fixes).
    - KVM: x86: Process 'guest stopped request' once per guest time update (git-fixes).
    - PM: hibernate: Add pm_hibernation_mode_is_suspend() (bsc#1243112).
    - PM: hibernate: Add stub for pm_hibernate_is_recovering() (bsc#1243112).
    - PM: hibernate: Fix pm_hibernation_mode_is_suspend() build breakage (bsc#1243112).
    - PM: hibernate: add new api pm_hibernate_is_recovering() (bsc#1243112).
    - bpf: Allow helper bpf_get_[ns_]current_pid_tgid() for all prog types (bsc#1252364).
    - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (stable-fixes git-fixes).
    - cpuidle: Do not return from cpuidle_play_dead() on callback failures (jsc#PED-13815).
    - dpll: Make ZL3073X invisible (bsc#1252253).
    - dpll: zl3073x: Add firmware loading functionality (bsc#1252253).
    - dpll: zl3073x: Add functions to access hardware registers (bsc#1252253).
    - dpll: zl3073x: Add low-level flash functions (bsc#1252253).
    - dpll: zl3073x: Add support to get fractional frequency offset (bsc#1252253).
    - dpll: zl3073x: Add support to get phase offset on connected input pin (bsc#1252253).
    - dpll: zl3073x: Add support to get/set esync on pins (bsc#1252253).
    - dpll: zl3073x: Fix build failure (bsc#1252253).
    - dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() (bsc#1252253).
    - dpll: zl3073x: Handle missing or corrupted flash configuration (bsc#1252253).
    - dpll: zl3073x: Implement devlink flash callback (bsc#1252253).
    - dpll: zl3073x: Increase maximum size of flash utility (bsc#1252253).
    - dpll: zl3073x: Refactor DPLL initialization (bsc#1252253).
    - dpll: zl3073x: ZL3073X_I2C and ZL3073X_SPI should depend on NET (bsc#1252253).
    - drm/amd : Update MES API header file for v11 & v12 (stable-fixes).
    - drm/amd/amdgpu: Implement MES suspend/resume gang functionality for v12 (bsc#1243112).
    - drm/amd/display: Add NULL check for stream before dereference in 'dm_vupdate_high_irq' (bsc#1243112).
    - drm/amd/display: Enable Dynamic DTBCLK Switch (bsc#1243112).
    - drm/amd/display: Fix vupdate_offload_work doc (bsc#1243112).
    - drm/amd/display: fix dmub access race condition (bsc#1243112).
    - drm/amd/display: more liberal vmin/vmax update for freesync (bsc#1243112).
    - drm/amd/include : MES v11 and v12 API header update (stable-fixes).
    - drm/amd/include : Update MES v12 API for fence update (stable-fixes).
    - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes).
    - drm/amd: Avoid evicting resources at S5 (bsc#1243112).
    - drm/amd: Check whether secure display TA loaded successfully (bsc#1243112).
    - drm/amd: Fix hybrid sleep (bsc#1243112).
    - drm/amd: Only restore cached manual clock settings in restore if OD enabled (bsc#1243112).
    - drm/amd: Restore cached manual clock settings during resume (bsc#1243112).
    - drm/amdgpu/mes11: implement detect and reset callback (bsc#1243112).
    - drm/amdgpu/mes12: implement detect and reset callback (bsc#1243112).
    - drm/amdgpu/mes: add front end for detect and reset hung queue (bsc#1243112).
    - drm/amdgpu/vpe: cancel delayed work in hw_fini (bsc#1243112).
    - drm/amdgpu: Avoid rma causes GPU duplicate reset (bsc#1243112).
    - drm/amdgpu: Fix for GPU reset being blocked by KIQ I/O (bsc#1243112).
    - drm/amdgpu: Report individual reset error (bsc#1243112).
    - drm/amdgpu: do not resume device in thaw for normal hibernation (bsc#1243112).
    - drm/amdgpu: fix link error for !PM_SLEEP (bsc#1243112).
    - drm/amdkfd: Fix mmap write lock not release (bsc#1243112).
    - drm/xe/guc: Prepare GuC register list and update ADS size for error capture (stable-fixes).
    - ext4: fix checks for orphan inodes (bsc#1250119).
    - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (git-fixes).
    - intel_idle: Provide the default enter_dead() handler (jsc#PED-13815).
    - intel_idle: Rescan 'dead' SMT siblings during initialization (jsc#PED-13815).
    - intel_idle: Use subsys_initcall_sync() for initialization (jsc#PED-13815).
    - ixgbe: handle IXGBE_VF_FEATURES_NEGOTIATE mbox cmd (bsc#1247222).
    - ixgbe: handle IXGBE_VF_GET_PF_LINK_STATE mailbox operation (bsc#1247222).
    - ixgbevf: fix getting link speed data for E610 devices (bsc#1247222).
    - ixgbevf: fix mailbox API compatibility by negotiating supported features (bsc#1247222).
    - kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939).
    - net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency     (bsc#1248754).
    - netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237).
    - nvme-auth: update bi_directional flag (git-fixes bsc#1249735).
    - nvme-auth: update sc_c in host response (git-fixes bsc#1249397).
    - nvme-fc: use lock accessing port_state and rport state (bsc#1245193 bsc#1247500).
    - nvme-tcp: send only permitted commands for secure concat (git-fixes bsc#1247683).
    - nvmet-fc: avoid scheduling association deletion twice (bsc#1245193 bsc#1247500).
    - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (bsc#1245193 bsc#1247500).
    - nvmet-fcloop: call done callback even when remote port is gone (bsc#1245193 bsc#1247500).
    - perf/x86/intel: Allow to update user space GPRs from PEBS records (git-fixes).
    - perf/x86/intel: Fix crash in icl_update_topdown_event() (git-fixes).
    - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes).
    - platform/x86/amd/pmc: Add 1Ah family series to STB support list (bsc#1243112).
    - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (bsc#1243112).
    - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (bsc#1243112).
    - platform/x86/amd/pmc: Add VPE information for AMDI000A platform (bsc#1243112).
    - platform/x86/amd/pmc: Add idlemask support for 1Ah family (bsc#1243112).
    - platform/x86/amd/pmc: Extend support for PMC features on new AMD platform (bsc#1243112).
    - platform/x86/amd/pmc: Fix SMU command submission path on new AMD platform (bsc#1243112).
    - platform/x86/amd/pmc: Modify SMU message port for latest AMD platform (bsc#1243112).
    - platform/x86/amd/pmc: Notify user when platform does not support s0ix transition (bsc#1243112).
    - platform/x86/amd/pmc: Remove unnecessary line breaks (bsc#1243112).
    - platform/x86/amd/pmc: Send OS_HINT command for AMDI000A platform (bsc#1243112).
    - platform/x86/amd/pmc: Send OS_HINT command for new AMD platform (bsc#1243112).
    - platform/x86/amd/pmc: Update IP information structure for newer SoCs (bsc#1243112).
    - platform/x86/amd/pmc: Use ARRAY_SIZE() to fill num_ips information (bsc#1243112).
    - platform/x86/amd/pmc: call amd_pmc_get_ip_info() during driver probe (bsc#1243112).
    - platform/x86/amd: pmc: Add new ACPI ID AMDI000B (bsc#1243112).
    - platform/x86/amd: pmc: Drop SMU F/W match for Cezanne (bsc#1243112).
    - platform/x86/amd: pmc: Use guard(mutex) (bsc#1243112).
    - powerpc/boot: Fix build with gcc 15 (bsc#1215199).
    - powerpc/fadump: skip parameter area allocation when fadump is disabled (jsc#PED-9891 git-fixes).
    - powerpc/kvm: Fix ifdef to remove build warning (bsc#1215199).
    - powerpc/powernv/pci: Fix underflow and leak issue (bsc#1215199).
    - powerpc/pseries/msi: Fix potential underflow and leak issue (bsc#1215199).
    - powerpc: floppy: Add missing checks after DMA map (bsc#1215199).
    - proc: fix missing pde_set_flags() for net proc files (bsc#1248630)
    - proc: fix type confusion in pde_set_flags() (bsc#1248630)
    - sched/idle: Conditionally handle tick broadcast in default_idle_call() (bsc#1248517).
    - scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (bsc#1250519).
    - scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (bsc#1250519).
    - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (bsc#1250519).
    - scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (bsc#1250519).
    - scsi: lpfc: Copyright updates for 14.4.0.11 patches (bsc#1250519).
    - scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (bsc#1250519).
    - scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (bsc#1250519).
    - scsi: lpfc: Fix buffer free/clear order in deferred receive path (bsc#1250519).
    - scsi: lpfc: Fix wrong function reference in a comment (bsc#1250519).
    - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (bsc#1250519).
    - scsi: lpfc: Remove redundant assignment to avoid memory leak (bsc#1250519).
    - scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (bsc#1250519).
    - scsi: lpfc: Update lpfc version to 14.4.0.11 (bsc#1250519).
    - scsi: lpfc: Use int type to store negative error codes (bsc#1250519).
    - scsi: lpfc: use min() to improve code (bsc#1250519).
    - serial: sc16is7xx: rename Kconfig CONFIG_SERIAL_SC16IS7XX_CORE (bsc#1252469) Re-enable     CONFIG_SERIAL_SC16IS7X for aarch64 and x86_64 default configurations, but keep it disabled for kvmsmall     configurations. For ppc64 and s390x drivers was not enabled, so keep it that way. Add sc16is7xx_spi and     sc16is7xx_i2c drivers to supported list.
    - skmsg: Return copied bytes in sk_msg_memcopy_from_iter (bsc#1250650).
    - smb: client: fix crypto buffers in non-linear memory (bsc#1250491, bsc#1239206).
    - smb: client: fix potential cfid UAF in smb2_query_info_compound (bsc#1248886).
    - tcp_bpf: Fix copied value in tcp_bpf_sendmsg (bsc#1250650).
    - tracing: Remove unneeded goto out logic (bsc#1249286).
    - x86/idle: Sanitize X86_BUG_AMD_E400 handling (bsc#1248517).
    - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID     (bsc#1252734).
    - x86/resctrl: Refactor resctrl_arch_rmid_read() (bsc#1252734).
    - x86/smp: Allow calling mwait_play_dead with an arbitrary hint (jsc#PED-13815).
    - x86/smp: Fix mwait_play_dead() and acpi_processor_ffh_play_dead() noreturn behavior (jsc#PED-13815).
    - x86/smp: PM/hibernate: Split arch_resume_nosmt() (jsc#PED-13815).
    - x86/topology: Implement topology_is_core_online() to address SMT regression (jsc#PED-13815).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - smb: client: fix crypto buffers in non-linear memory The crypto API, through the scatterlist API, expects     input buffers to be in linear memory. We handle this with the cifs_sg_set_buf() helper that converts     vmalloc'd memory to their corresponding pages. However, when we allocate our aead_request buffer (@creq in     smb2ops.c::crypt_message()), we do so with kvzalloc(), which possibly puts aead_request->__ctx in vmalloc     area. AEAD algorithm then uses ->__ctx for its private/internal data and operations, and uses sg_set_buf()     for such data on a few places. This works fine as long as @creq falls into kmalloc zone (small requests)     or vmalloc'd memory is still within linear range. Tasks' stacks are vmalloc'd by default     (CONFIG_VMAP_STACK=y), so too many tasks will increment the base stacks' addresses to a point where     virt_addr_valid(buf) will fail (BUG() in sg_set_buf()) when that happens. In practice: too many parallel     reads and writes on an encrypted mount will trigger this bug. To fix this, always alloc @creq with     kmalloc() instead. Also drop the @sensitive_size variable/arguments since kfree_sensitive() doesn't need     it. Backtrace: [ 945.272081] ------------[ cut here ]------------ [ 945.272774] kernel BUG at     include/linux/scatterlist.h:209! [ 945.273520] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI [     945.274412] CPU: 7 UID: 0 PID: 56 Comm: kworker/u33:0 Kdump: loaded Not tainted     6.15.0-lku-11779-g8e9d6efccdd7-dirty #1 PREEMPT(voluntary) [ 945.275736] Hardware name: QEMU Standard PC     (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014 [ 945.276877] Workqueue:
    writeback wb_workfn (flush-cifs-2) [ 945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220 [     945.278018] Code: b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00     80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b     [ 945.279992] RSP: 0018:ffffc90000a27360 EFLAGS: 00010246 [ 945.280578] RAX: 0000000000000000 RBX:
    ffffc90001d85060 RCX: 0000000000000030 [ 945.281376] RDX: 0000000000080000 RSI: 0000000000000000 RDI:
    ffffc90081d85070 [ 945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000 [     945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070 [ 945.283656] R13:
    ffff888113522948 R14: ffffc90001d85060 R15: ffffc90001d85010 [ 945.284407] FS: 0000000000000000(0000)     GS:ffff8882e66cf000(0000) knlGS:0000000000000000 [ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [ 945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0 [     945.286683] Call Trace: [ 945.286952] <TASK> [ 945.287184] ? crypt_message+0x33f/0xad0 [cifs] [     945.287719] crypto_gcm_encrypt+0x36/0xe0 [ 945.288152] crypt_message+0x54a/0xad0 [cifs] [ 945.288724]     smb3_init_transform_rq+0x277/0x300 [cifs] [ 945.289300] smb_send_rqst+0xa3/0x160 [cifs] [ 945.289944]     cifs_call_async+0x178/0x340 [cifs] [ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] [     945.291177] smb2_async_writev+0x3e3/0x670 [cifs] [ 945.291759] ? find_held_lock+0x32/0x90 [ 945.292212] ?     netfs_advance_write+0xf2/0x310 [ 945.292723] netfs_advance_write+0xf2/0x310 [ 945.293210]     netfs_write_folio+0x346/0xcc0 [ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10 [ 945.294250]     netfs_writepages+0x117/0x460 [ 945.294724] do_writepages+0xbe/0x170 [ 945.295152] ?     find_held_lock+0x32/0x90 [ 945.295600] ? kvm_sched_clock_read+0x11/0x20 [ 945.296103]
    __writeback_single_inode+0x56/0x4b0 [ 945.296643] writeback_sb_inodes+0x229/0x550 [ 945.297140]
    __writeback_inodes_wb+0x4c/0xe0 [ 945.297642] wb_writeback+0x2f1/0x3f0 [ 945.298069] wb_workfn+0x300/0x490     [ 945.298472] process_one_work+0x1fe/0x590 [ 945.298949] worker_thread+0x1ce/0x3c0 [ 945.299397] ?
    __pfx_worker_thread+0x10/0x10 [ 945.299900] kthr ---truncated--- (CVE-2025-40052)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - smbclient非リニアメモリの暗号バッファを修正。crypto API は、scatterlist API を通じて、入力バッファがリニアメモリにあると想定します。vmalloc'd メモリを対応するページに変換する cifs_sg_set_buf() ヘルパーで、これを処理します。ただし、aead_request バッファsmb2ops.c::crypt_message() での @creqを割り当てるときは、kvzalloc() で行います。これにより、aed_request->__ctx が vmalloc 領域に配置される可能性があります。AEAD アルゴリズムはその後、プライベート/内部データおよび操作のために ->__ctx を使用し、いくつかの場所でそのようなデータに対して sg_set_buf() を使用します。@creq が kmalloc ゾーン小さなリクエストに入るか、vmalloc'd メモリが線形範囲内にある限り、これは問題なく動作します。タスクのスタックはデフォルトで vmalloc'dCONFIG_VMAP_STACK=yであるため、多すぎるタスクが、virt_addr_valid(buf) が失敗するポイントまでベーススタックのアドレスをインクリメントします sg_set_buf() の BUG()。実際には、暗号化されたマウントで並行する読み取りと書き込みが多すぎると、このバグがトリガーされます。これを修正するには、代わりに kmalloc() で常に @creq を割り当てます。また、@senscient_size 変数/引数は、kfree_senscient() で必要ないため、ドロップされます。Backtrace[ 945.272081] ------------[ここで変換]----------------------- [ 945.272774] include/linux/scatterlist.h:209 でのカーネルのバグ! [ 945.273520] Oops無効な opcode0000 [#1] SMP DEBUG_PALLOC NOPTI [945.274412] CPU7 UID0 PID56 通信kworker/u33:0 Kdumpロードは汚染されていない 6.15.0-lku-11779- g8e9d6efccdd7-dirty #1 PREEMPT(voluntary) [ 945.275736] ハードウェア名QEMU Standard PCQ35 + ICH9、2009、BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014 [] 945.276877] ワークキュー
    writeback wb_workfnflush-cifs-2[ 945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220945.278018] コード: b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0b 48 c7 04 24 01 00 00 00 48 18b [ 945.279992RSP :ffffc90000a27360 EFLAGS: 00010246 [ 945.280578] RAX: 0000000000000000 RBX:
    fffc90001d85060 RCX: 945.281376000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    ffffc90081d85070 945.282145RBP: ffffc90001d85010 R08ffffc90001d85000 R09: 0000000000000000 [945.282898 ] R10R11ffffc90001d85090 [ R12R13: 945.28365600000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
     R14ffff888113522948  : ffffc90001d85060 R15: ffffc90001d85010 [ 945.284407] FS: 0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000 [ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [ 945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0945.286683] Call Trace: [ 945.286952] <TASK> [ 945.287184] ? crypt_message+0x33f/0xad0 [cifs] [945.287719] crypto_gcm_encrypt+0x36/0xe0 [ 945.288152] crypt_message+0x54a/0xad0 [cifs] [ 945.288724] smb3_init_transform_rq+0x277/0x300 [cifs] 945.289300] smb_send1rqst+0xa3/0xa3/0x0606 [cifs] [ 945.289944] cifs_call_async+0x178/0x340 [cifs] [ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] [945.291177] smb2_async_writev+0x3e3/0x670 [cifs] [ 945.291759] ? find_held_lock+0x32/0x90 [ 945.292212] ? netfs_advance_write+0xf2/0x310 [ 945.292723] netfs_advance_write+0xf2/0x310 [ 945.293210] netfs_write_folio+0x346/0xcc0 [ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10 [ 945.294250] netfs_writepages+0x117/0x460 [ 945.294724] do_writepages+0xbe/0x170 [ 945.295152] ? find_held_lock+0x32/0x90 [ 945.295600] ? kvm_sched_clock_read+0x11/0x20 [ 945.296103]
    __writeback_single_inode+0x56/0x4b0 [ 945.296643] writeback_sb_inodes+0x229/0x550 [ 945.297140]
    __writeback_inodes_wb+0x4c/0xe0 [ 945.297642] wb_writeback+0x2f1/0x3f0 [ 945.298069] wb_workfn+0x300/0x490 [ 945.298472]  、process_one_work+0x1fe/0x590 [ 945.298949]  、 worker_thread+0x1ce/0x3c0 [ 945.299397、[ ] 、?
    __pfx_worker_thread+0x10/0x10 [ 945.299900] kthr ---truncated---CVE-2025-40052]

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - smbclient修复线性内存中的 crypto 缓冲区 crypto API 通过 scatterlist API 预期输入缓冲区位于线性内存中。我们使用 cifs_sg_set_buf() 辅助函数处理此问题该函数将 vmalloc 的内存转换到其相应的页面。但是我们在分配 aead_request 缓冲区smb2ops.c::crypt_message() 中的@creq)时使用 kvzalloc() 执行此操作这可能将 aead_request->__ctx 放入 vmalloc 区域。然后，AEAD 算法对其私有/内部数据和操作使用 ->__ctx，并在少数位置针对此类数据使用 sg_set_buf()。只要 @creq 落入 kmalloc 区域小请求或 vmalloc 的内存仍在线性范围内此功能就可以正常工作。任务的堆栈会默认进行 vmalloc (CONFIG_VMAP_STACK=y)因此过多的任务会将堆栈的基址递增到 virt_addr_valid(buf) 将会失败 (sg_set_buf() 中的 BUG())。实践中加密挂载上的并行读取和写入过多将触发此缺陷。要修复此问题请始终使用 kmalloc() 代替分配 @creq。同时删除 @sensitive_size 变量/参数因为 kfree_sensitive() 不需要它。Backtrace[ 945.272081] ------------[在此剪切 ]------------ [ 945.272774] kernel BUG include/linux/scatterlist.h:209问题[ 945.273520] Oops无效的 opcode0000 [#1] SMP DEBUG_PAGEALLOC NOPTI [945.274412] CPU7 UID0 PID56 Commkworker/u33:0 Kdump 已加载未受感染 6.15.0-lku-11779- g8e9d6efccdd7-dirty #1 PREEMPT(随意) [ 945.275736] 硬件名称QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014 [ 945.276877] Workqueue
    writeback wb_workfn (flush-cifs-2) [ 945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220 [945.278018] 代码b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b [ 945.279992] RSP: 0018 :ffffc90000a27360 EFLAGS00010246 [ 945.280578] RAX: 00000000000000000 RBX
    ffffc90001d85060 RCX 0000000000000030 [ 945.281376] RDX0000000000080000 RSI0000000000000000 RDI
    ffffc90081d85070 [ 945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000 [945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070 [ 945.283656] R13:
     R14ffff888113522948  : ffffc90001d85060 R15: ffffc90001d85010 [ 945.284407] FS: 0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000 [ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [ 945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0 [945.286683] 调用跟踪 [ 945.286952] <TASK> [ 945.287184] ? crypt_message+0x33f/0xad0 [cifs] [945.287719] crypto_gcm_encrypt+0x36/0xe0 [ 945.288152] crypt_message+0x54a/0xad0 [cifs] [ 945.288724] smb3_init_transform_rq+0x277/0x300 [cifs] [ 945.289300] smb_send_rqst+0x1603/0x1603 [cifs] [ 945.289944] cifs_call_async+0x178/0x340 [cifs] [ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] [945.291177] smb2_async_writev+0x3e3/0x670 [cifs] [ 945.291759] ? find_held_lock+0x32/0x90 [ 945.292212] ? netfs_advance_write+0xf2/0x310 [ 945.292723] netfs_advance_write+0xf2/0x310 [ 945.293210] netfs_write_folio+0x346/0xcc0 [ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10 [ 945.294250] netfs_writepages+0x117/0x460 [ 945.294724] do_writepages+0xbe/0x170 [ 945.295152] ? find_held_lock+0x32/0x90 [ 945.295600] ? kvm_sched_clock_read+0x11/0x20 [ 945.296103]
    __writeback_single_inode+0x56/0x4b0 [ 945.296643] writeback_sb_inodes+0x229/0x550 [ 945.297140]
    __writeback_inodes_wb+0x4c/0xe0 [ 945.297642] wb_writeback+0x2f1/0x3f0 [ 945.298069] wb_workfn+0x300/0x490 [ 945.298472] process_one_work+0x1fe/0x590 [ 945.298949] work_thread+0x1ce/0x3c0 [ 945.299397] ?
    __pfx_worker_thread+0x10/0x10 [ 945.299900] kthr ---truncated--- (CVE-2025-40052)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

ID	名稱	產品	系列	已發布	已更新	嚴重性
271900	Linux Distros 未修補的弱點：CVE-2025-40052	Nessus	Misc.	2025/10/28	2025/11/14	high
275294	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2025:4057-1)	Nessus	SuSE Local Security Checks	2025/11/13	2025/11/13	high
275294	SUSE SLED15 / SLES15 セキュリティ更新 : kernel (SUSE-SU-2025:4057-1)	Nessus	SuSE Local Security Checks	2025/11/13	2025/11/13	high
271900	Linux Distros Unpatched Vulnerability : CVE-2025-40052	Nessus	Misc.	2025/10/28	2025/11/14	high
271900	Linux Distros のパッチ未適用の脆弱性: CVE-2025-40052	Nessus	Misc.	2025/10/28	2025/11/14	high
271900	Linux Distros 未修补的漏洞：CVE-2025-40052	Nessus	Misc.	2025/10/28	2025/11/14	high

偵測

搜尋 Plugin

high

high

high

high

high

high