The version of kernel installed on the remote host is prior to 5.4.172-90.336. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-021 advisory.

    A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was     found in the way users call some interrupts with high frequency from one of the guests.A local user could     use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28711)

    A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was     found in the way users call some interrupts with high frequency from one of the guests.A local user could     use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28712)

    A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was     found in the way users call some interrupts with high frequency from one of the guests.A local user could     use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28713)

    Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is     ready to process them. There are some measures taken for avoiding to pile up too much data, but those can     be bypassed by the guest: The timeout could even never trigger if the guest manages to have only one free     slot in its RX queue ring page and the next package would require more than one free slot, which may be     the case when using GSO, XDP, or software hashing. (CVE-2021-28714)

    Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is     ready to process them. There are some measures taken for avoiding to pile up too much data, but those can     be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming     new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default).
    Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time.
    (CVE-2021-28715)

    A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a     privileged local account can leak kernel stack information when issuing commands to the     /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it     can be further used to defeat existing kernel protection mechanisms. (CVE-2021-3923)

    A flaw memory leak in the Linux kernel's eBPF for the Simulated networking device driver in the way user     uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this     flaw to get unauthorized access to some data. (CVE-2021-4135)

    A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size     increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS     filesystem otherwise not accessible to them. (CVE-2021-4155)

    An out-of-bounds write flaw was found in the Linux kernel's Aquantia AQtion Ethernet card Atlantic driver     in the way the ethernet card provides malicious input to the driver. This flaw allows a local user to     emulate the networking device and crash the system. The highest threat from this vulnerability is to     confidentiality, integrity, as well as system availability. (CVE-2021-43975)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: use call_rcu to free endpoint (CVE-2021-46929)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: validate user data in compat ioctl

    Wrong user data may cause warning in i2c_transfer(), ex: zero msgs.Userspace should not be able to trigger     warnings, so this patch addsvalidation checks for user data in compact ioctl to prevent reportedwarnings     (CVE-2021-46934)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix use-after-free in tw_timer_handler (CVE-2021-46936)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: elantech - fix stack out of bound access in elantech_change_report_id() (CVE-2021-47097)

    In the Linux kernel, the following vulnerability has been resolved:

    aio: fix use-after-free due to missing POLLFREE handling (CVE-2021-47505)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix use-after-free due to delegation race (CVE-2021-47506)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: Fix nsfd startup race (again) (CVE-2021-47507)

    In the Linux kernel, the following vulnerability has been resolved:

    seg6: fix the iif in the IPv6 socket control block (CVE-2021-47515)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: core: fix transmit-buffer reset and memleak (CVE-2021-47527)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (CVE-2021-47538)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() (CVE-2021-47541)

    In the Linux kernel, the following vulnerability has been resolved:

    net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings() (CVE-2021-47542)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix memory leak in fib6_rule_suppress (CVE-2021-47546)

    In the Linux kernel, the following vulnerability has been resolved:

    ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()     (CVE-2021-47548)

    In the Linux kernel, the following vulnerability has been resolved:

    net: vlan: fix underflow for the real_dev refcnt (CVE-2021-47555)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpt3sas: Fix kernel panic during drive powercycle test (CVE-2021-47565)

    In the Linux kernel, the following vulnerability has been resolved:

    proc/vmcore: fix clearing user buffer by properly using clear_user() (CVE-2021-47566)

    In the Linux kernel, the following vulnerability has been resolved:

    net: nexthop: fix null pointer dereference when IPv6 is not enabled (CVE-2021-47572)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() (CVE-2021-47576)

    In the Linux kernel, the following vulnerability has been resolved:

    ovl: fix warning in ovl_create_real() (CVE-2021-47579)

    In the Linux kernel, the following vulnerability has been resolved:

    sit: do not call ipip6_dev_free() from sit_init_net() (CVE-2021-47588)

    In the Linux kernel, the following vulnerability has been resolved:

    igbvf: fix double free in `igbvf_probe` (CVE-2021-47589)

    In the Linux kernel, the following vulnerability has been resolved:

    inet_diag: fix kernel-infoleak for UDP sockets (CVE-2021-47597)

    In the Linux kernel, the following vulnerability has been resolved:

    sch_cake: do not call cake_destroy() from cake_init() (CVE-2021-47598)

    In the Linux kernel, the following vulnerability has been resolved:

    dm btree remove: fix use after free in rebalance_children() (CVE-2021-47600)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: improve robustness of the audit queue handling (CVE-2021-47603)

    In the Linux kernel, the following vulnerability has been resolved:

    net: netlink: af_netlink: Prevent empty skb by adding a check on len. (CVE-2021-47606)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: arm_scpi: Fix string overflow in SCPI genpd driver (CVE-2021-47609)

    A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem     Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in     case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local     user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to     legacy handling) could use this flaw to escalate their privileges on the system. (CVE-2022-0185)

    In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer     overflow. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-182388481References: Upstream kernel (CVE-2022-20166)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2185-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
    - CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
    - CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
    - CVE-2022-48673: kABI workarounds for struct smc_link (bsc#1223934).
    - CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
    - CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
    - CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
    - CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
    - CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
    - CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
    - CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
    - CVE-2021-47261: Fix initializing CQ fragments buffer (bsc#1224954)
    - CVE-2021-47254: Fix use-after-free in gfs2_glock_shrink_scan (bsc#1224888).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
    - CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve     local privilege escalation (bsc#1215420).
    - CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve     local privilege escalation (bsc#1215420).
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
    - CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-9315 advisory.

    - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56254] {CVE-2024-43892}
    - bnxt_en: Fix double DMA unmapping for XDP_REDIRECT (Michal Schmidt) [RHEL-57259] {CVE-2024-44984}
    - dma: fix call order in dmam_free_coherent (Eder Zulian) [RHEL-54751] {CVE-2024-43856}
    - dmaengine: idxd: Avoid unnecessary destruction of file_ida (Jerry Snitselaar) [RHEL-44508]     {CVE-2024-38629}
    - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55074] {CVE-2024-42284}
    - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57119] {CVE-2024-44970}
    - net/mlx5e: Fix CT entry update leaks of modify header context (Michal Schmidt) [RHEL-55628]     {CVE-2024-43864}
    - net/mlx5: Always drain health in shutdown callback (Michal Schmidt) [RHEL-55616] {CVE-2024-43866}
    - net/mlx5: Fix missing lock on sync reset reload (Michal Schmidt) [RHEL-55121] {CVE-2024-42268}
    - ionic: fix kernel panic in XDP_TX action (CKI Backport Bot) [RHEL-47730] {CVE-2024-40907}
    - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (Izabela Bakollari) [RHEL-44037]     {CVE-2024-38586}
    - KVM: s390: fix validity interception issue when gisa is switched off (CKI Backport Bot) [RHEL-57197]     {CVE-2024-45005}
    - wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() (Jose Ignacio Tornos     Martinez) [RHEL-55579] {CVE-2024-43879}
    - wifi: mac80211: fix NULL dereference at band check in starting tx ba session (Jose Ignacio Tornos     Martinez) [RHEL-56191] {CVE-2024-43911}
    - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (Jose Ignacio Tornos Martinez)     [RHEL-54805] {CVE-2024-43842}
    - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51559] {CVE-2024-42079}
    - x86/mm: Fix pti_clone_pgtable() alignment assumption (Rafael Aquini) [RHEL-57170] {CVE-2024-44965}
    - bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (CKI Backport     Bot) [RHEL-47822] {CVE-2024-40919}
    - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44369]     {CVE-2024-36270}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988947 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    aio: fix use-after-free due to missing POLLFREE handling

    signalfd_poll() and binder_poll() are special in that they use a     waitqueue whose lifetime is the current task, rather than the struct     file as is normally the case.  This is okay for blocking polls, since a     blocking poll occurs within one task; however, non-blocking polls     require another solution.  This solution is for the queue to be cleared     before it is freed, by sending a POLLFREE notification to all waiters.

    Unfortunately, only eventpoll handles POLLFREE.  A second type of     non-blocking poll, aio poll, was added in kernel v4.18, and it doesn't     handle POLLFREE.  This allows a use-after-free to occur if a signalfd or     binder fd is polled with aio poll, and the waitqueue gets freed.

    Fix this by making aio poll handle POLLFREE.

    A patch by Ramji Jiyani <ramjiyani@google.com>     (https://lore.kernel.org/r/20211027011834.2497484-1-ramjiyani@google.com)     tried to do this by making aio_poll_wake() always complete the request     inline if POLLFREE is seen.  However, that solution had two bugs.
    First, it introduced a deadlock, as it unconditionally locked the aio     context while holding the waitqueue lock, which inverts the normal     locking order.  Second, it didn't consider that POLLFREE notifications     are missed while the request has been temporarily de-queued.

    The second problem was solved by my previous patch.  This patch then     properly fixes the use-after-free by handling POLLFREE in a     deadlock-free way.  It does this by taking advantage of the fact that     freeing of the waitqueue is RCU-delayed, similar to what eventpoll does.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0434 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-42104:
    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: add missing check for inode numbers on directory entries

    Syzbot reported that mounting and unmounting a specific pattern of     corrupted nilfs2 filesystem images causes a use-after-free of metadata     file inodes, which triggers a kernel bug in lru_add_fn().

    As Jan Kara pointed out, this is because the link count of a metadata file     gets corrupted to 0, and nilfs_evict_inode(), which is called from iput(),     tries to delete that inode (ifile inode in this case).

    The inconsistency occurs because directories containing the inode numbers     of these metadata files that should not be visible in the namespace are     read without checking.

    Fix this issue by treating the inode numbers of these internal files as     errors in the sanity check helper when reading directory folios/pages.

    Also thanks to Hillf Danton and Matthew Wilcox for their initial mm-layer     analysis.

    CVE-2024-38599:
    In the Linux kernel, the following vulnerability has been resolved:

    jffs2: prevent xattr node from overflowing the eraseblock

    Add a check to make sure that the requested xattr node size is no larger     than the eraseblock minus the cleanmarker.

    Unlike the usual inode nodes, the xattr nodes aren't split into parts     and spread across multiple eraseblocks, which means that a xattr node     must not occupy more than one eraseblock. If the requested xattr value is     too large, the xattr node can spill onto the next eraseblock, overwriting     the nodes and causing errors such as:

    jffs2: argh. node added in wrong place at 0x0000b050(2)     jffs2: nextblock 0x0000a000, expected at 0000b00c     jffs2: error: (823) do_verify_xattr_datum: node CRC failed at 0x01e050,     read=0xfc892c93, calc=0x000000     jffs2: notice: (823) jffs2_get_inode_nodes: Node header CRC failed     at 0x01e00c. {848f,2fc4,0fef511f,59a3d171}     jffs2: Node at 0x0000000c with length 0x00001044 would run over the     end of the erase block     jffs2: Perhaps the file system was created with the wrong erase size?     jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found     at 0x00000010: 0x1044 instead

    This breaks the filesystem and can lead to KASAN crashes such as:

    BUG: KASAN: slab-out-of-bounds in jffs2_sum_add_kvec+0x125e/0x15d0     Read of size 4 at addr ffff88802c31e914 by task repro/830     CPU: 0 PID: 830 Comm: repro Not tainted 6.9.0-rc3+ #1     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),     BIOS Arch Linux 1.16.3-1-1 04/01/2014     Call Trace:
     <TASK>      dump_stack_lvl+0xc6/0x120      print_report+0xc4/0x620      ? __virt_addr_valid+0x308/0x5b0      kasan_report+0xc1/0xf0      ? jffs2_sum_add_kvec+0x125e/0x15d0      ? jffs2_sum_add_kvec+0x125e/0x15d0      jffs2_sum_add_kvec+0x125e/0x15d0      jffs2_flash_direct_writev+0xa8/0xd0      jffs2_flash_writev+0x9c9/0xef0      ? __x64_sys_setxattr+0xc4/0x160      ? do_syscall_64+0x69/0x140      ? entry_SYSCALL_64_after_hwframe+0x76/0x7e      [...]

    Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

    CVE-2024-38583:
    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix use-after-free of timer for log writer thread

    Patch series nilfs2: fix log writer related issues.

    This bug fix series covers three nilfs2 log writer-related issues,     including a timer use-after-free issue and potential deadlock issue on     unmount, and a potential freeze issue in event synchronization found     during their analysis.  Details are described in each commit log.


    This patch (of 3):

    A use-after-free issue has been reported regarding the timer sc_timer on     the nilfs_sc_info structure.

    The problem is that even though it is used to wake up a sleeping log     writer thread, sc_timer is not shut down until the nilfs_sc_info structure     is about to be freed, and is used regardless of the thread's lifetime.

    Fix this issue by limiting the use of sc_timer only while the log writer     thread is alive.

    CVE-2024-36964:
    In the Linux kernel, the following vulnerability has been resolved:

    fs/9p: only translate RWX permissions for plain 9P2000

    Garbage in plain 9P2000's perm bits is allowed through, which causes it     to be able to set (among others) the suid bit. This was presumably not     the intent since the unix extended bits are handled explicitly and     conditionally on .u.

    CVE-2021-47505:
    In the Linux kernel, the following vulnerability has been resolved:

    aio: fix use-after-free due to missing POLLFREE handling

    signalfd_poll() and binder_poll() are special in that they use a     waitqueue whose lifetime is the current task, rather than the struct     file as is normally the case.  This is okay for blocking polls, since a     blocking poll occurs within one task; however, non-blocking polls     require another solution.  This solution is for the queue to be cleared     before it is freed, by sending a POLLFREE notification to all waiters.

    Unfortunately, only eventpoll handles POLLFREE.  A second type of     non-blocking poll, aio poll, was added in kernel v4.18, and it doesn't     handle POLLFREE.  This allows a use-after-free to occur if a signalfd or     binder fd is polled with aio poll, and the waitqueue gets freed.

    Fix this by making aio poll handle POLLFREE.

    A patch by Ramji Jiyani <ramjiyani@google.com>     (https://lore.kernel.org/r/20211027011834.2497484-1-ramjiyani@google.com)     tried to do this by making aio_poll_wake() always complete the request     inline if POLLFREE is seen.  However, that solution had two bugs.
    First, it introduced a deadlock, as it unconditionally locked the aio     context while holding the waitqueue lock, which inverts the normal     locking order.  Second, it didn't consider that POLLFREE notifications     are missed while the request has been temporarily de-queued.

    The second problem was solved by my previous patch.  This patch then     properly fixes the use-after-free by handling POLLFREE in a     deadlock-free way.  It does this by taking advantage of the fact that     freeing of the waitqueue is RCU-delayed, similar to what eventpoll does.

    CVE-2021-46993:
    In the Linux kernel, the following vulnerability has been resolved:

    sched: Fix out-of-bound access in uclamp

    Util-clamp places tasks in different buckets based on their clamp values     for performance reasons. However, the size of buckets is currently     computed using a rounding division, which can lead to an off-by-one     error in some configurations.

    For instance, with 20 buckets, the bucket size will be 1024/20=51. A     task with a clamp of 1024 will be mapped to bucket id 1024/51=20. Sadly,     correct indexes are in range [0,19], hence leading to an out of bound     memory access.

    Clamp the bucket id to fix the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: aio: fix use-after-free due to missing     POLLFREE handling signalfd_poll() and binder_poll() are special in that they use a waitqueue whose     lifetime is the current task, rather than the struct file as is normally the case. This is okay for     blocking polls, since a blocking poll occurs within one task; however, non-blocking polls require another     solution. This solution is for the queue to be cleared before it is freed, by sending a POLLFREE     notification to all waiters. Unfortunately, only eventpoll handles POLLFREE. A second type of non-blocking     poll, aio poll, was added in kernel v4.18, and it doesn't handle POLLFREE. This allows a use-after-free to     occur if a signalfd or binder fd is polled with aio poll, and the waitqueue gets freed. Fix this by making     aio poll handle POLLFREE. A patch by Ramji Jiyani <ramjiyani@google.com>     (https://lore.kernel.org/r/20211027011834.2497484-1-ramjiyani@google.com) tried to do this by making     aio_poll_wake() always complete the request inline if POLLFREE is seen. However, that solution had two     bugs. First, it introduced a deadlock, as it unconditionally locked the aio context while holding the     waitqueue lock, which inverts the normal locking order. Second, it didn't consider that POLLFREE     notifications are missed while the request has been temporarily de-queued. The second problem was solved     by my previous patch. This patch then properly fixes the use-after-free by handling POLLFREE in a     deadlock-free way. It does this by taking advantage of the fact that freeing of the waitqueue is RCU-     delayed, similar to what eventpoll does. (CVE-2021-47505)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0438 advisory.

    This advisory aggregates security fixes for the kernel SRPM in CIQ LTS 9.2. It addresses 135 CVEs:
    CVE-2022-41674, CVE-2022-30594, CVE-2022-2959, CVE-2023-52628, CVE-2025-21727, and 130 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.93-87.444. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-009 advisory.

    A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was     found in the way users call some interrupts with high frequency from one of the guests.A local user could     use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28711)

    A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was     found in the way users call some interrupts with high frequency from one of the guests.A local user could     use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28712)

    A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was     found in the way users call some interrupts with high frequency from one of the guests.A local user could     use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28713)

    Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is     ready to process them. There are some measures taken for avoiding to pile up too much data, but those can     be bypassed by the guest: The timeout could even never trigger if the guest manages to have only one free     slot in its RX queue ring page and the next package would require more than one free slot, which may be     the case when using GSO, XDP, or software hashing. (CVE-2021-28714)

    Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is     ready to process them. There are some measures taken for avoiding to pile up too much data, but those can     be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming     new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default).
    Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time.
    (CVE-2021-28715)

    A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a     privileged local account can leak kernel stack information when issuing commands to the     /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it     can be further used to defeat existing kernel protection mechanisms. (CVE-2021-3923)

    A flaw memory leak in the Linux kernel's eBPF for the Simulated networking device driver in the way user     uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this     flaw to get unauthorized access to some data. (CVE-2021-4135)

    A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size     increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS     filesystem otherwise not accessible to them. (CVE-2021-4155)

    An out-of-bounds write flaw was found in the Linux kernel's Aquantia AQtion Ethernet card Atlantic driver     in the way the ethernet card provides malicious input to the driver. This flaw allows a local user to     emulate the networking device and crash the system. The highest threat from this vulnerability is to     confidentiality, integrity, as well as system availability. (CVE-2021-43975)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: use call_rcu to free endpoint (CVE-2021-46929)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Wrap the tx reporter dump callback to extract the sq (CVE-2021-46931)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: validate user data in compat ioctl

    Wrong user data may cause warning in i2c_transfer(), ex: zero msgs.Userspace should not be able to trigger     warnings, so this patch addsvalidation checks for user data in compact ioctl to prevent reportedwarnings     (CVE-2021-46934)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix use-after-free in tw_timer_handler (CVE-2021-46936)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page() (CVE-2021-47090)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: elantech - fix stack out of bound access in elantech_change_report_id() (CVE-2021-47097)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc (CVE-2021-47501)

    In the Linux kernel, the following vulnerability has been resolved:

    aio: fix use-after-free due to missing POLLFREE handling (CVE-2021-47505)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix use-after-free due to delegation race (CVE-2021-47506)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: Fix nsfd startup race (again) (CVE-2021-47507)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: fq_pie: prevent dismantle issue (CVE-2021-47512)

    In the Linux kernel, the following vulnerability has been resolved:

    devlink: fix netns refcount leak in devlink_nl_cmd_reload() (CVE-2021-47514)

    In the Linux kernel, the following vulnerability has been resolved:

    seg6: fix the iif in the IPv6 socket control block (CVE-2021-47515)

    In the Linux kernel, the following vulnerability has been resolved:

    ethtool: do not perform operations on net devices being unregistered (CVE-2021-47517)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: core: fix transmit-buffer reset and memleak (CVE-2021-47527)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (CVE-2021-47538)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (CVE-2021-47539)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() (CVE-2021-47541)

    In the Linux kernel, the following vulnerability has been resolved:

    net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings() (CVE-2021-47542)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: fix page frag corruption on page fault (CVE-2021-47544)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix memory leak in fib6_rule_suppress (CVE-2021-47546)

    In the Linux kernel, the following vulnerability has been resolved:

    ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()     (CVE-2021-47548)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amd/amdgpu: fix potential memleak (CVE-2021-47550)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/scs: Reset task stack state in bringup_cpu() (CVE-2021-47553)

    In the Linux kernel, the following vulnerability has been resolved:

    net: vlan: fix underflow for the real_dev refcnt (CVE-2021-47555)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_ets: don't peek at classes beyond 'nbands' (CVE-2021-47557)

    In the Linux kernel, the following vulnerability has been resolved:

    mlxsw: spectrum: Protect driver from buggy firmware (CVE-2021-47560)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpt3sas: Fix kernel panic during drive powercycle test (CVE-2021-47565)

    In the Linux kernel, the following vulnerability has been resolved:

    proc/vmcore: fix clearing user buffer by properly using clear_user() (CVE-2021-47566)

    In the Linux kernel, the following vulnerability has been resolved:

    net: nexthop: fix null pointer dereference when IPv6 is not enabled (CVE-2021-47572)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() (CVE-2021-47576)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: scsi_debug: Don't call kcalloc() if size arg is zero (CVE-2021-47578)

    In the Linux kernel, the following vulnerability has been resolved:

    ovl: fix warning in ovl_create_real() (CVE-2021-47579)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: scsi_debug: Fix type in min_t to avoid stack OOB (CVE-2021-47580)

    In the Linux kernel, the following vulnerability has been resolved:

    iocost: Fix divide-by-zero on donation from low hweight cgroup (CVE-2021-47584)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix memory leak in __add_inode_ref() (CVE-2021-47585)

    In the Linux kernel, the following vulnerability has been resolved:

    sit: do not call ipip6_dev_free() from sit_init_net() (CVE-2021-47588)

    In the Linux kernel, the following vulnerability has been resolved:

    igbvf: fix double free in `igbvf_probe` (CVE-2021-47589)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: clear 'kern' flag from fallback sockets (CVE-2021-47593)

    In the Linux kernel, the following vulnerability has been resolved:

    inet_diag: fix kernel-infoleak for UDP sockets (CVE-2021-47597)

    In the Linux kernel, the following vulnerability has been resolved:

    sch_cake: do not call cake_destroy() from cake_init() (CVE-2021-47598)

    In the Linux kernel, the following vulnerability has been resolved:

    dm btree remove: fix use after free in rebalance_children() (CVE-2021-47600)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: improve robustness of the audit queue handling (CVE-2021-47603)

    In the Linux kernel, the following vulnerability has been resolved:

    net: netlink: af_netlink: Prevent empty skb by adding a check on len. (CVE-2021-47606)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: arm_scpi: Fix string overflow in SCPI genpd driver (CVE-2021-47609)

    A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem     Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in     case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local     user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to     legacy handling) could use this flaw to escalate their privileges on the system. (CVE-2022-0185)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
160423	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-021)	Nessus	Amazon Linux Local Security Checks	2022/5/2	2026/2/26	high
200930	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2024:2185-1)	Nessus	SuSE Local Security Checks	2024/6/25	2026/6/26	critical
211575	Oracle Linux 9 : kernel (ELSA-2024-9315)	Nessus	Oracle Linux Local Security Checks	2024/11/19	2026/3/24	high
273452	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988947)	Nessus	Unity Linux Local Security Checks	2025/11/5	2025/11/5	high
276021	TencentOS Server 3: kernel (TSSA-2025:0434)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	high
210815	RHEL 9 : kernel (RHSA-2024:9315)	Nessus	Red Hat Local Security Checks	2024/11/12	2026/3/24	high
224354	Linux Distros Unpatched Vulnerability : CVE-2021-47505	Nessus	Misc.	2025/3/5	2026/11/12	high
356103	Rocky Linux 9.2 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-64k / kernel-64k-core / etc Multiple Vulnerabilities (ciqsa-2026_0438)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/11/14	critical
160451	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-009)	Nessus	Amazon Linux Local Security Checks	2022/5/2	2026/2/26	high

偵測

搜尋 Plugin

high

critical

high

high

high

high

high

critical

high