The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6008 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6008-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     September 22, 2025                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2025-21751 CVE-2025-22103 CVE-2025-22113 CVE-2025-22124                      CVE-2025-22125 CVE-2025-23133 CVE-2025-38272 CVE-2025-38306                      CVE-2025-38453 CVE-2025-38502 CVE-2025-38556 CVE-2025-38676                      CVE-2025-38677 CVE-2025-38730 CVE-2025-38732 CVE-2025-38733                      CVE-2025-38734 CVE-2025-38735 CVE-2025-38736 CVE-2025-38737                      CVE-2025-39673 CVE-2025-39675 CVE-2025-39676 CVE-2025-39679                      CVE-2025-39681 CVE-2025-39682 CVE-2025-39683 CVE-2025-39684                      CVE-2025-39685 CVE-2025-39686 CVE-2025-39687 CVE-2025-39689                      CVE-2025-39691 CVE-2025-39692 CVE-2025-39693 CVE-2025-39694                      CVE-2025-39695 CVE-2025-39697 CVE-2025-39698 CVE-2025-39700                      CVE-2025-39701 CVE-2025-39702 CVE-2025-39703 CVE-2025-39705                      CVE-2025-39706 CVE-2025-39707 CVE-2025-39709 CVE-2025-39710                      CVE-2025-39711 CVE-2025-39712 CVE-2025-39713 CVE-2025-39714                      CVE-2025-39715 CVE-2025-39716 CVE-2025-39718 CVE-2025-39719                      CVE-2025-39720 CVE-2025-39721 CVE-2025-39722 CVE-2025-39723                      CVE-2025-39724 CVE-2025-39759 CVE-2025-39765 CVE-2025-39766                      CVE-2025-39767 CVE-2025-39770 CVE-2025-39772 CVE-2025-39773                      CVE-2025-39776 CVE-2025-39779 CVE-2025-39780 CVE-2025-39781                      CVE-2025-39782 CVE-2025-39783 CVE-2025-39787 CVE-2025-39788                      CVE-2025-39790 CVE-2025-39791 CVE-2025-39800 CVE-2025-39801                      CVE-2025-39805 CVE-2025-39806 CVE-2025-39807 CVE-2025-39808                      CVE-2025-39810 CVE-2025-39811 CVE-2025-39812 CVE-2025-39813                      CVE-2025-39815 CVE-2025-39817 CVE-2025-39819 CVE-2025-39823                      CVE-2025-39824 CVE-2025-39825 CVE-2025-39826 CVE-2025-39827                      CVE-2025-39828 CVE-2025-39829 CVE-2025-39831 CVE-2025-39832                      CVE-2025-39835 CVE-2025-39836 CVE-2025-39838 CVE-2025-39839                      CVE-2025-39841 CVE-2025-39842 CVE-2025-39843 CVE-2025-39844                      CVE-2025-39845 CVE-2025-39846 CVE-2025-39847 CVE-2025-39848                      CVE-2025-39849 CVE-2025-39850 CVE-2025-39851 CVE-2025-39852                      CVE-2025-39853 CVE-2025-39854 CVE-2025-39857 CVE-2025-39860                      CVE-2025-39861 CVE-2025-39863 CVE-2025-39864 CVE-2025-39865                      CVE-2025-39866 CVE-2025-40300

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (trixie), these problems have been fixed in     version 6.12.48-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - mediaivsc修复因缺少 mei_cldev_disable() 调用而导致的关闭时的崩溃 ACE 和 CSI 驱动程序在其 remove() 函数中都缺少 mei_cldev_disable() 调用。这导致 mei_cl 客户端保留在 mei_device->file_list 列表的一部分即使其内存已通过 mei_cl_bus_dev_release() 调用 kfree(cldev->cl) 释放。这会导致当 mei_vsc_remove() 运行 mei_stop() 时释放后使用首先删除所有调用 mei_ace_remove() 和 mei_csi_remove() 的 mei 总线设备然后删除 mei_cl_bus_dev_release()然后调用遍历 mei_device->file_list 的 mei_cl_all_disconnect()取消引用刚释放的 cldev->cl。且 mei_vsc_remove() 自身会在关机时运行因为 vsc_tp_shutdown() 中的 platform_device_unregister(tp->pdev)。当使用 KASAN 构建内核时这会导致出现以下 KASAN 报告[ 106.634504] ======== ================================================== ======== [ 106.634623] 缺陷KASANmei_cl_set_disconnected 中的 slab-use-after-free (drivers/misc/mei/client.c:783) mei [ 106.634683] 地址 ffff88819cb62018 处大小 4 的读取通过任务 systemd-shutdow/1 [ 106.634729] [ 106.634767] 受感染[E]=UNSIGNED_MODULE [106.634770] 硬件名称Dell Inc. XPS 16 9640/09CK4V、BIOS 1.12.0 02/10/2025 [ 106.634773]调用跟踪
    [ 106.634777] <TASK>... [ 106.634871] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:636) [106.634901] mei_cl_set_disconnected (drivers/misc/mei/client.c) 783) mei [ 106.634921] mei_cl_all_disconnect (drivers/misc/mei/client.c:2165 (dispensator 4)) mei [ 106.634941] mei_reset (drivers/misc/mei/init.c:163) mei ... [ 106.635042] mei_stop (drivers/misc/mei/init.c:348) mei [106.635062] mei_vsc_remove (drivers/misc/mei/mei_dev.h:784 drivers/misc/mei/platform-vsc.c:393) mei_vsc [106.635066] platform_remove (drivers/base/platform.c:1424) 添加缺少的 mei_cldev_disable() 调用以便在释放 mei_cl 之前将其从 mei_device->file_list 中删除以修复此问题。 (CVE-2025-39711)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls Both the ACE and CSI driver     are missing a mei_cldev_disable() call in their remove() function. This causes the mei_cl client to stay     part of the mei_device->file_list list even though its memory is freed by mei_cl_bus_dev_release() calling     kfree(cldev->cl). This leads to a use-after-free when mei_vsc_remove() runs mei_stop() which first removes     all mei bus devices calling mei_ace_remove() and mei_csi_remove() followed by mei_cl_bus_dev_release() and     then calls mei_cl_all_disconnect() which walks over mei_device->file_list dereferecing the just freed     cldev->cl. And mei_vsc_remove() it self is run at shutdown because of the     platform_device_unregister(tp->pdev) in vsc_tp_shutdown() When building a kernel with KASAN this leads to     the following KASAN report: [ 106.634504]     ================================================================== [ 106.634623] BUG: KASAN: slab-use-     after-free in mei_cl_set_disconnected (drivers/misc/mei/client.c:783) mei [ 106.634683] Read of size 4 at     addr ffff88819cb62018 by task systemd-shutdow/1 [ 106.634729] [ 106.634767] Tainted: [E]=UNSIGNED_MODULE [     106.634770] Hardware name: Dell Inc. XPS 16 9640/09CK4V, BIOS 1.12.0 02/10/2025 [ 106.634773] Call Trace:
    [ 106.634777] <TASK> ... [ 106.634871] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:636) [     106.634901] mei_cl_set_disconnected (drivers/misc/mei/client.c:783) mei [ 106.634921]     mei_cl_all_disconnect (drivers/misc/mei/client.c:2165 (discriminator 4)) mei [ 106.634941] mei_reset     (drivers/misc/mei/init.c:163) mei ... [ 106.635042] mei_stop (drivers/misc/mei/init.c:348) mei [     106.635062] mei_vsc_remove (drivers/misc/mei/mei_dev.h:784 drivers/misc/mei/platform-vsc.c:393) mei_vsc [     106.635066] platform_remove (drivers/base/platform.c:1424) Add the missing mei_cldev_disable() calls so     that the mei_cl gets removed from mei_device->file_list before it is freed to fix this. (CVE-2025-39711)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - メディアivscmei_cldev_disable() 呼び出しがないことによるシャットダウン時のクラッシュを修正します。ACE と CSI ドライバーの両方で、remove() 関数に mei_cldev_disable() 呼び出しがありません。これにより、mei_cl クライアントは、kfree(cldev->cl) を呼び出す mei_cl_bus_dev_release() により解放されるにもかかわらず、mei_device->file_list リストの一部のままになります。これは、mei_vsc_remove()がmei_stop()を実行するとき、メモリ解放後使用Use After Freeを引き起こします。これは、mei_ace_remove()とmei_csi_remove()を呼び出しているすべてのmeiバスデバイスを削除し、続いてmei_cl_bus_dev_release()を呼び出し、mei_device->file_listをウォークオーバーするmei_cl_all_disconnect()を呼び出します。解放されたばかりの cldev->cl を逆参照します。そして、mei_vsc_remove() 自体は、vsc_tp_shutdown() の platform_device_unregister(tp->pdev) のためにシャットダウン時に実行されます。KASAN でカーネルを構築するとき、これは以下の KASAN レポートにつながります[ 106.634504] ========= ======================================================== ====================================================== mei 106.634623106.634683addr ffff88819cb62018 におけるサイズ 4 の読み取りタスク systemd-shutdow/1 別 [ 106.634729] [ 106.634767] 汚染: [E]=UNSIGNED_MODULE [106.634770] ハードウェア名Dell Inc. XPS 16 9640/09CK4V、 1.12.0 BIOS 2025 年 2 月 10 日 106.634773] Call Trace
    [ 106.634777] <TASK>... [ 106.634871] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:636) [106.634901] mei_cl_set_disconnecteddrivers/misc/mei/client.c: 783) mei [ 106.634921] mei_cl_all_disconnect (drivers/misc/mei/client.c:2165 (discriminator 4)) mei [ 106.634941] mei_reset (drivers/misc/mei/init.c:163) mei ... [ 106.635042] mei_stop (drivers/misc/mei/init.c:348) mei [106.635062] mei_vsc_remove (drivers/misc/mei/mei_dev.h:784 drivers/misc/mei/platform-vsc.c:393) mei_vsc []106.635066] platform_removedrivers/base/platform.c:1424欠落している mei_cldev_disable() 呼び出しを追加し、これを修正するために解放される前に mei_device->file_list から mei_cl が削除されます。CVE-2025-39711

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - mediaivsc修正因缺少 mei_cldev_disable() 呼叫而導致的關機時當機ACE 和 CSI 驅動程式的 remove() 函式中都缺少 mei_cldev_disable() 呼叫。即使 mei_cl_bus_dev_release() 呼叫 kfree(cldev->cl) 釋放了 mei_cl 用戶端的記憶體這也會導致其保留在 mei_device->file_list 清單中。這會在 mei_vsc_remove() 執行 mei_stop() (先移除呼叫 mei_ace_remove() 和 mei_csi_remove() (隨後是 mei_cl_bus_dev_release() 的 mei_cl_bus_dev_release() 之後呼叫 mei_cl_all_disconnect()) (其會繞過 mei_device->file_list) 時導致釋放後使用。解除參照剛剛釋放的 cldev->cl。因為 vsc_tp_shutdown() 中的 platform_device_unregister(tp->pdev)它會在關機時自行執行 mei_vsc_remove()。當使用 KASAN 構建核心時這會導致下列 KASAN 報告[ 106.634504] ======== ================================================== ======== [ 106.634623] 錯誤: KASAN在 mei_cl_set_disconnected 中發生平台釋放後使用 (drivers/misc/mei/client.c:783) mei [ 106.634683] 位址 ffff88819cb62018 的大小為 4 的讀取依 task systemd-shutdow/1 [ 106.634729] [ 106.634767] 受污染 [E]=UNSIGNED_MODULE [106.634770] 硬體名稱Dell Inc. XPS 16 9640/09CK4V、BIOS 1.12.0 2025 年 2 月 10 日 [ 106.634773]呼叫追踪
    [ 106.634777] <TASK>... [ 106.634871] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:636) [106.634901] mei_cl_set_disconnected (drivers/misc/mei/client.c 783) mei [ 106.634921] mei_cl_all_disconnect (drivers/misc/mei/client.c:2165 (discriminator 4)) mei [ 106.634941] mei_reset (drivers/misc/mei/init.c:163) mei ... [ 106.635042] mei_stop (drivers/misc/mei/init.c:348) mei [106.635062] mei_vsc_remove (drivers/misc/mei/mei_dev.h:784 drivers/misc/mei/platform-vsc.c:393) mei_vsc [106.635066] platform_remove (drivers/base/platform.c:1424) 新增遺漏的 mei_cldev_disable() 呼叫以便在將 mei_cl 釋出之前先將 mei_device->file_list 移除以修正此問題。 (CVE-2025-39711)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

ID	名稱	產品	系列	已發布	已更新	嚴重性
265710	Debian dsa-6008 : ata-modules-6.12.31-armmp-di - security update	Nessus	Debian Local Security Checks	2025/9/22	2025/9/22	high
261605	Linux Distros 未修补的漏洞：CVE-2025-39711	Nessus	Misc.	2025/9/6	2025/9/20	high
261605	Linux Distros Unpatched Vulnerability : CVE-2025-39711	Nessus	Misc.	2025/9/6	2025/9/20	high
261605	Linux Distros のパッチ未適用の脆弱性: CVE-2025-39711	Nessus	Misc.	2025/9/6	2025/9/20	high
261605	Linux Distros 未修補的弱點：CVE-2025-39711	Nessus	Misc.	2025/9/6	2025/9/20	high

偵測

搜尋 Plugin

high

high

high

high

high