CentOS Linux 6 [TuxCare] 安全更新：kernel / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / 等多个漏洞 （CENTOS6：CLSA-2026：1791949745）
high Nessus 插件 ID 367921
语言：
简介
CentOS Linux 主机缺少一个或多个安全更新。描述
CentOS Linux 6 主机上存在安装的程序包，该程序包受到 TuxCare CENTOS6：CLSA-2026：1791949745 2公告中提及的多个漏洞的影响。- 已修复 Linux 内核中的下列漏洞：HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report. (CVE-2024-50302)
- 已修复 Linux 内核中的下列漏洞：ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration. (CVE-2024-53197)
- 已修复 Linux 内核中的下列漏洞：smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key. (CVE-2026-46243)
- 已修复 Linux 内核中的下列漏洞：Bluetooth: serialize accept_q access bt_sock_poll() walks the accept queue without synchronization, while child teardown can unlink the same socket and drop its last reference. The unsynchronized accept queue walk has existed since the initial Bluetooth import. Protect accept_q with a dedicated lock for queue updates and polling. Also rework bt_accept_dequeue() to take temporary child references under the queue lock before dropping it and locking the child socket. (CVE-2026-52918)
- 已修复 Linux 内核中的下列漏洞：netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits(). (CVE-2026-53266)
请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。
解决方案
根据 TuxCare 公告 CENTOS6：CLSA-2026：1791949745 中的指南更新受影响的程序包。另见
插件详情
严重性: High
ID: 367921
文件名: tuxcare_centos_6_CLSA-2026-1791949745.nasl
版本: 1.2
类型: Local
代理: unix
发布时间: 2026/10/20
最近更新时间: 2026/10/22
支持的传感器: Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
风险信息
VPR
风险因素: Critical
分数: 9.2
百分位: 99.77
Vendor
Vendor Severity: Critical
CVSS v2
风险因素: Medium
基本分数: 6.8
时间分数: 5.9
矢量: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C
CVSS 分数来源: CVE-2026-64340
CVSS v3
风险因素: High
基本分数: 7.8
时间分数: 7.5
矢量: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
时间矢量: CVSS:3.0/E:H/RL:O/RC:C
漏洞信息
必需的 KB 项: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list, Host/OS/extended-third-party
可利用: true
易利用性: Exploits are available
补丁发布日期: 2026/10/14
漏洞发布日期: 2024/4/9
CISA 已知可遭利用的漏洞到期日期: 2025/3/25, 2025/4/30, 2026/9/21
参考资料信息
CVE: CVE-2024-50302, CVE-2024-53197, CVE-2026-46243, CVE-2026-52918, CVE-2026-53266, CVE-2026-63826, CVE-2026-63922, CVE-2026-63983, CVE-2026-64322, CVE-2026-64340, CVE-2026-64422, CVE-2026-64471, CVE-2026-68093, CVE-2026-68202, CVE-2026-68320, CVE-2026-68365, CVE-2026-72070, CVE-2026-72322, CVE-2026-72389, CVE-2026-72398, CVE-2026-72413, CVE-2026-74287, CVE-2026-74359, CVE-2026-74387, CVE-2026-74388, CVE-2026-74556, CVE-2026-74588, CVE-2026-74630, CVE-2026-74641, CVE-2026-74689, CVE-2026-80536, CVE-2026-80590, CVE-2026-80622, CVE-2026-80829, CVE-2026-81001, CVE-2026-89478, CVE-2026-89549, CVE-2026-89550, CVE-2026-89575, CVE-2026-89607, CVE-2026-89633, CVE-2026-89671, CVE-2026-89699, CVE-2026-89893, CVE-2026-90033, CVE-2026-90057, CVE-2026-90116, CVE-2026-90203, CVE-2026-90383, CVE-2026-90421, CVE-2026-93803, CVE-2026-97408, CVE-2026-97445, CVE-2026-97455, CVE-2026-97536, CVE-2026-97539, CVE-2026-97540, CVE-2026-97931, CVE-2026-97938, CVE-2026-97949, CVE-2026-98077, CVE-2026-98193, CVE-2026-98194, CVE-2026-98266, CVE-2026-98276, CVE-2026-98348, CVE-2026-98349, CVE-2026-98364, CVE-2026-98375
CLSA: 2026:1791949745