CentOS Linux 7 [TuxCare] 安全更新：bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / 等多个漏洞 （CENTOS7：CLSA-2026：1792234299）
high Nessus 插件 ID 369489
语言：
简介
CentOS Linux 主机缺少一个或多个安全更新。描述
如 TuxCare CENTOS7：CLSA-2026：1792234299公告所述，CentOS Linux 7 主机上存在安装的程序包，该漏洞会受到多个漏洞的影响。- 在 Linux 内核 5.18.14 及之前版本中，net/netfilter/nfnetlink_queue.c 中的 nfqnl_mangle 允许远程攻击者造成拒绝服务攻击（错误），这是因为 nf_queue 的判断结果若包含单字节 nfta_payload 属性，则 skb_pull 可能遇到负值 skb->len。(CVE-2022-36946)
- 已修复 Linux 内核中的下列漏洞：wifi: iwlwifi: mvm: Fix a memory corruption issue A few lines above, space is kzalloc()'ed for: sizeof(struct iwl_nvm_data) + sizeof(struct ieee80211_channel) + sizeof(struct ieee80211_rate) 'mvm->nvm_data' is a 'struct iwl_nvm_data', so it is fine. At the end of this structure, there is the 'channels' flex array. Each element is of type 'struct ieee80211_channel'. So only 1 element is allocated in this array. When doing:
mvm->nvm_data->bands[0].channels = mvm->nvm_data->channels; We point at the first element of the 'channels' flex array. So this is fine. However, when doing: mvm->nvm_data->bands[0].bitrates = (void
*)((u8 *)mvm->nvm_data->channels + 1); because of the (u8 *) cast, we add only 1 to the address of the beginning of the flex array. It is likely that we want point at the 'struct ieee80211_rate' allocated just after. Remove the spurious casting so that the pointer arithmetic works as expected. (CVE-2023-52531)
- 已修复 Linux 内核中的下列漏洞：KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instruction execution, i.e. has already committed to allowing L2 to perform I/O. If L1 (or host userspace) modifies the I/O permission bitmaps during the exit to userspace, KVM will treat the access as being intercepted despite already having emulated the I/O access. Pivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation. Of the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the intended recipient) can reach the code in question. gp_interception()'s use is mutually exclusive with is_guest_mode(), and complete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with EMULTYPE_SKIP. The bad behavior was detected by a syzkaller program that toggles port I/O interception during the userspace I/O exit, ultimately resulting in a WARN on vcpu->arch.pio.count being non-zero due to KVM no completing emulation of the I/O instruction. WARNING: CPU: 23 PID: 1083 at arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm] Modules linked in: kvm_intel kvm irqbypass CPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next-vm #74 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:emulator_pio_in_out+0x154/0x170 [kvm] PKRU: 55555554 Call Trace: <TASK> kvm_fast_pio+0xd6/0x1d0 [kvm] vmx_handle_exit+0x149/0x610 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm] kvm_vcpu_ioctl+0x244/0x8c0 [kvm]
__x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0x5d/0xc60 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> (CVE-2025-40026)
- 已修复 Linux 内核中的下列漏洞：Bluetooth: btusb: fix use-after-free on registration failure Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected. This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths. (CVE-2026-64471)
- 已修复 Linux 内核中的下列漏洞：ALSA: firewire: isight: bound the sample count to the packet payload isight_packet() takes the frame count from the device iso packet and checks it only against the device claimed iso length. count = be32_to_cpu(payload->sample_count); if (likely(count <= (length - 16) / 4)) isight_samples(isight, payload->samples, count); length is the iso header data_length. It can be up to 0xffff. So the gate allows a count up to about 16379. isight_samples() then copies count frames out of payload->samples into the PCM DMA buffer. payload->samples holds only 2 * MAX_FRAMES_PER_PACKET values. The device multiplexes two samples per frame. A count past MAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer size writes past runtime->dma_area.
The smallest PCM buffer is larger than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET keeps both the read and the write in range. A malicious or faulty Apple iSight on the FireWire bus reaches this during a normal capture. Add the MAX_FRAMES_PER_PACKET bound to the gate. (CVE-2026-64483)
请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。
解决方案
根据 TuxCare 公告 CENTOS7：CLSA-2026：1792234299 中的指南更新受影响的程序包。另见
插件详情
严重性: High
ID: 369489
文件名: tuxcare_centos_7_CLSA-2026-1792234299.nasl
版本: 1.1
类型: Local
代理: unix
发布时间: 2026/10/21
最近更新时间: 2026/10/21
支持的传感器: Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
风险信息
VPR
风险因素: High
分数: 8
百分位: 99.7
Vendor
Vendor Severity: Critical
CVSS v2
风险因素: Medium
基本分数: 6.8
时间分数: 5.3
矢量: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C
CVSS 分数来源: CVE-2023-52531
CVSS v3
风险因素: High
基本分数: 7.8
时间分数: 7
矢量: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
时间矢量: CVSS:3.0/E:P/RL:O/RC:C
漏洞信息
必需的 KB 项: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list, Host/OS/extended-third-party
可利用: true
易利用性: Exploits are available
补丁发布日期: 2026/10/17
漏洞发布日期: 2021/7/21
参考资料信息
CVE: CVE-2022-36946, CVE-2022-48702, CVE-2023-52531, CVE-2025-40026, CVE-2026-64471, CVE-2026-64483, CVE-2026-68329, CVE-2026-72129, CVE-2026-72323, CVE-2026-72383, CVE-2026-72413, CVE-2026-72476, CVE-2026-74287, CVE-2026-74359, CVE-2026-74408, CVE-2026-74444, CVE-2026-74479, CVE-2026-74498, CVE-2026-74505, CVE-2026-74550, CVE-2026-74556, CVE-2026-74569, CVE-2026-80536, CVE-2026-80584, CVE-2026-80622, CVE-2026-80681, CVE-2026-80829, CVE-2026-81001, CVE-2026-81003, CVE-2026-89448, CVE-2026-89542, CVE-2026-89548, CVE-2026-89549, CVE-2026-89550, CVE-2026-89553, CVE-2026-89574, CVE-2026-89575, CVE-2026-89633, CVE-2026-89637, CVE-2026-89699, CVE-2026-89778, CVE-2026-89786, CVE-2026-89893, CVE-2026-90011, CVE-2026-90033, CVE-2026-90057, CVE-2026-90116, CVE-2026-90203, CVE-2026-90329, CVE-2026-90413, CVE-2026-90414, CVE-2026-90421, CVE-2026-93117, CVE-2026-93189, CVE-2026-97408, CVE-2026-97445, CVE-2026-97455, CVE-2026-97536, CVE-2026-97539, CVE-2026-97564, CVE-2026-97608, CVE-2026-97931, CVE-2026-97949, CVE-2026-98077, CVE-2026-98185, CVE-2026-98186, CVE-2026-98196, CVE-2026-98217, CVE-2026-98222, CVE-2026-98266, CVE-2026-98269, CVE-2026-98312, CVE-2026-98342, CVE-2026-98354, CVE-2026-98375, CVE-2026-99999
CLSA: 2026:1792234299