Rocky Linux 9.6 [TuxCare] 安全更新：kernel / kernel-abi-stablelists / kernel-core / 等多个漏洞 （ALMALINUX9.6：CLSA-2026：1777633439）
high Nessus 插件 ID 360870
语言：
简介
Rocky Linux 主机缺少一个或多个安全更新。描述
Rocky Linux 9.6 主机上存在安装的程序包，该程序包受到 TuxCare ALMALINUX9.6：CLSA-2026：2026：1777633439 公告中提及的多个漏洞的影响。- 已修复 Linux 内核中的下列漏洞：capabilities: fix undefined behavior in bit shift for CAP_TO_MASK Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in security/commoncap.c:1252:2 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace:
<TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e
__ubsan_handle_shift_out_of_bounds+0x1e7/0x20c cap_task_prctl+0x561/0x6f0 security_task_prctl+0x5a/0xb0
__x64_sys_prctl+0x61/0x8f0 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> (CVE-2022-49870)
- 已修复 Linux 内核中的下列漏洞：intel_th: Fix a resource leak in an error handling path If an error occurs after calling 'pci_alloc_irq_vectors()', 'pci_free_irq_vectors()' must be called as already done in the remove function. (CVE-2022-50143)
- 已修复 Linux 内核中的下列漏洞：xsk: Fix xsk_diag use-after-free error during socket cleanup Fix a use-after-free error that is possible if the xsk_diag interface is used after the socket has been unbound from the device. This can happen either due to the socket being closed or the device disappearing. In the early days of AF_XDP, the way we tested that a socket was not bound to a device was to simply check if the netdevice pointer in the xsk socket structure was NULL. Later, a better system was introduced by having an explicit state variable in the xsk socket struct. For example, the state of a socket that is on the way to being closed and has been unbound from the device is XSK_UNBOUND.
The commit in the Fixes tag below deleted the old way of signalling that a socket is unbound, setting dev to NULL. This in the belief that all code using the old way had been exterminated. That was unfortunately not true as the xsk diagnostics code was still using the old way and thus does not work as intended when a socket is going down. Fix this by introducing a test against the state variable. If the socket is in the state XSK_UNBOUND, simply abort the diagnostic's netlink operation. (CVE-2023-53426)
- 已修复 Linux 内核中的下列漏洞：VMCI: Fix use-after-free when removing resource in vmci_resource_remove() When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239
__kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143
__fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220
__syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). (CVE-2024-46738)
- 已修复 Linux 内核中的下列漏洞：tracing: Consider the NULL character when validating the event length strlen() returns a string length excluding the null byte. If the string length equals to the maximum buffer length, the buffer will have no space for the NULL terminating character. This commit checks this condition and returns failure for it. (CVE-2024-50131)
请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。
解决方案
根据 TuxCare 公告 ALMALINUX9.6：CLSA-2026：1777633439 中的指南更新受影响的程序包。另见
插件详情
严重性: High
ID: 360870
文件名: tuxcare_rocky_linux_9.6_CLSA-2026-1777633439.nasl
版本: 1.2
类型: Local
发布时间: 2026/10/1
最近更新时间: 2026/10/2
支持的传感器: Continuous Assessment, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
风险信息
VPR
风险因素: Critical
分数: 9.5
百分位: 99.87
Vendor
Vendor Severity: Important
CVSS v2
风险因素: Medium
基本分数: 6.8
时间分数: 5.9
矢量: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C
CVSS 分数来源: CVE-2026-23231
CVSS v3
风险因素: High
基本分数: 7.8
时间分数: 7.5
矢量: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
时间矢量: CVSS:3.0/E:H/RL:O/RC:C
CVSS v4
风险因素: High
Base Score: 8.6
Threat Score: 8.6
Threat Vector: CVSS:4.0/E:A
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 分数来源: CVE-2026-31431
漏洞信息
必需的 KB 项: Host/OS/extended-third-party, Host/local_checks_enabled, Host/RockyLinux/release, Host/RockyLinux/rpm-list, Host/cpu
可利用: true
易利用性: Exploits are available
补丁发布日期: 2026/5/1
漏洞发布日期: 2021/7/21
CISA 已知可遭利用的漏洞到期日期: 2026/5/15
可利用的方式
Core Impact
Metasploit (Copy Fail AF_ALG + authencesn Page-Cache Write)
参考资料信息
CVE: CVE-2022-49870, CVE-2022-49900, CVE-2022-50143, CVE-2022-50422, CVE-2023-53426, CVE-2023-54119, CVE-2024-40994, CVE-2024-46738, CVE-2024-50131, CVE-2025-37940, CVE-2025-37949, CVE-2025-37959, CVE-2025-37967, CVE-2025-37985, CVE-2025-37990, CVE-2025-37995, CVE-2025-37997, CVE-2025-37998, CVE-2025-38009, CVE-2025-38023, CVE-2025-38035, CVE-2025-38037, CVE-2025-38040, CVE-2025-38043, CVE-2025-38044, CVE-2025-38058, CVE-2025-38061, CVE-2025-38063, CVE-2025-38066, CVE-2025-38071, CVE-2025-38072, CVE-2025-38083, CVE-2025-38095, CVE-2025-38100, CVE-2025-38112, CVE-2025-38115, CVE-2025-38122, CVE-2025-38125, CVE-2025-38148, CVE-2025-38166, CVE-2025-38174, CVE-2025-38181, CVE-2025-38184, CVE-2025-38190, CVE-2025-38214, CVE-2025-38215, CVE-2025-38222, CVE-2025-38231, CVE-2025-38251, CVE-2025-38285, CVE-2025-38293, CVE-2025-38310, CVE-2025-38312, CVE-2025-38319, CVE-2025-38324, CVE-2025-38334, CVE-2025-38337, CVE-2025-38344, CVE-2025-38345, CVE-2025-38363, CVE-2025-38386, CVE-2025-38387, CVE-2025-38514, CVE-2025-38515, CVE-2025-38528, CVE-2025-38540, CVE-2025-38553, CVE-2025-38563, CVE-2025-38581, CVE-2025-38601, CVE-2025-38602, CVE-2025-38608, CVE-2025-38609, CVE-2025-38617, CVE-2025-38622, CVE-2025-38644, CVE-2025-38668, CVE-2025-38671, CVE-2025-38695, CVE-2025-38700, CVE-2025-38701, CVE-2025-38706, CVE-2025-38721, CVE-2025-38730, CVE-2025-39675, CVE-2025-39676, CVE-2025-39703, CVE-2025-39706, CVE-2025-39713, CVE-2025-39736, CVE-2025-39737, CVE-2025-39742, CVE-2025-39756, CVE-2025-39773, CVE-2025-39782, CVE-2025-39795, CVE-2025-39798, CVE-2025-39808, CVE-2025-39812, CVE-2025-39813, CVE-2025-39835, CVE-2025-39844, CVE-2025-39845, CVE-2025-39847, CVE-2025-39876, CVE-2025-39929, CVE-2025-39932, CVE-2025-39937, CVE-2025-39953, CVE-2025-40096, CVE-2025-40322, CVE-2025-68223, CVE-2025-68340, CVE-2025-68725, CVE-2025-68741, CVE-2025-68800, CVE-2025-71089, CVE-2025-71091, CVE-2025-71112, CVE-2025-71147, CVE-2025-71154, CVE-2026-22977, CVE-2026-22980, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-23001, CVE-2026-23060, CVE-2026-23061, CVE-2026-23084, CVE-2026-23089, CVE-2026-23097, CVE-2026-23111, CVE-2026-23133, CVE-2026-23144, CVE-2026-23191, CVE-2026-23193, CVE-2026-23204, CVE-2026-23216, CVE-2026-23231, CVE-2026-31431
CLSA: 2026:1777633439