Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - sched/deadline修复 PI de-boosting 期间缺少的 ENQUEUE_REPLENISH 在大型计算机的 RT 内核上运行 stress-ng --schedpolicy 0 可能导致以下警告已编辑。 schedDL 提升任务 PID 22725缺少 REPLENISH 标记警告CPU: 93 PID: 0 at kernel/sched/deadline.c:239 dequeue_task_dl+0x15c/0x1f8 ...running_bw 下溢调用跟踪dequeue_task_dl+0x15c/ 0x1f8 (P) dequeue_task+0x80/0x168 deactivate_task+0x24/0x50 push_dl_task+0x264/0x2e0 dl_task_timer+0x1b0/0x228
    __hrtimer_run_queues+0x188/0x378 hrtimer_interrupt+0xfc/0x260 ... 该问题是当通过 sched_setscheduler() 将 SCHED_DEADLINE 任务锁定持有者更改为较低优先级时它可能无法正确继承潜在 DEADLINE 提供者的参数如果它在过去较短的期限内未继承这些参数而非当时的供体。这可能导致带宽核算损坏因为 enqueue_task_dl() 不会将锁定持有者识别为已提升。在以下情况下出现此场景： 1. DEADLINE 任务（供给者）在另一个 DEADLINE 任务（持有者）持有的 PI 互斥体上阻断，但持有者未继承参数（例如，其已有更短的期限）。 2. sched_setscheduler()将持有者从 DEADLINE 更改为较低类同时仍然持有互斥体 3。持有者现在应继承提供者的 DEADLINE 参数并使用 ENQUEUE_REPLENISH 排队但不会发生这种情况通过引入 __setscheduler_dl_pi() 修复此问题该函数会在何时检测DEADLINE正常任务或升级任务被设置为降低的优先级类别。万一该函数使任务继承提供者 (pi_se) 的 DEADLINE 参数并设置 ENQUEUE_REPLENISH 标记以确保在下一个入列操作期间正确计算带宽。 (CVE-2026-23371)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - sched/deadline修正 PI 解除增強期間缺少的 ENQUEUE_REPLENISH 在大型機器上的 RT 核心上執行stress-ng --schedpolicy 0 時可能會導致下列警告 (已編輯)。 schedDL 取消提升工作 PID 22725REPLENISH 旗標遺失0x1f8 (P) dequeue_task+0x80/0x168 deactivate_task+0x24/0x50 push_dl_task+0x264/0x2e0 dl_task_timer+0x1b0/0x228
    __hrtimer_run_queues+0x188/0x378 hrtimer_interrupt+0xfc/0x260 ... 問題在於透過 sched_setscheduler() 將 SCHED_DEADLINE 工作 (鎖定持有者) 變更為優先順序較低的類別時如果過去未繼承潛在 DEADLINE 提供者的參數 (較短的期限比當時的授權者)。這可能會導致頻寬計量損毀因為 enqueue_task_dl() 不會將鎖定持有者識別為已提升。在以下情況下會發生此狀況 1. DEADLINE 工作 (提供者) 在由另一個 DEADLINE 工作 (持有者) 持有的 PI mutex 上封鎖但該持有者並未繼承參數 (例如其已有較短的期限) 2. sched_setscheduler()將持有者從 DEADLINE 變更為較低類別同時仍持有 mutex 3. 持有者現在應繼承提供者的 DEADLINE 參數並使用 ENQUEUE_REPLENISH 加入佇列但是這不會發生 透過引入 __setscheduler_dl_pi() 來修正問題其會偵測時間DEADLINE (適當或提升) 工作被設定為較低優先順序的類別。在此情況下函式會使工作繼承提供者 (pi_se) 的 DEADLINE 參數並設定 ENQUEUE_REPLENISH 旗標以確保下次加入佇列作業期間的頻寬計量正確。 (CVE-2026-23371)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - sched/deadlinePI de-boosting 実行中の ENQUEUE_REPLENISH の欠落を修正します大型マシンの RT カーネルで --schedpolicy 0を実行すると、以下の警告が発生する可能性があります編集済み。 schedDL deboosted タスク PID 22725REPLENISH フラグがありません 警告CPU93 PIDkernel/sched/deadline.c:239 dequeue_task_dl+0x15c/0x1f8 で 0実行中_bw アンダーフローCall trace: dequeue_task_dl+0x15c/ 0x1f8 (P) dequeue_task+0x80/0x168 deactivate_task+0x24/0x50 push_dl_task+0x264/0x2e0 dl_task_timer+0x1b0/0x228
    __hrtimer_run_queues+0x188/0x378 hrtimer_interrupt+0xfc/0x260 ... 問題は、SCHED_DEADLINE タスクロック保持者が sched_setscheduler() 経由で低い優先度クラスに変更される際に、過去にまだ継承していない場合、潜在的な DEADLINE ドナーのパラメーターを適切に継承できない可能性があります短い期限引き起こす可能性があります。これにより、enqueue_task_dl() がロック所有者をブースト済みとして認識しないため、帯域幅アカウントの破損が発生する可能性があります。このシナリオは、次の場合に発生します。1. DEADLINEタスクdonorが別のDEADLINEタスクholderによって保持されているPI mutexでブロックするが、保持者がパラメーターを継承しないたとえば、すでにより短い期限がある2. sched_setscheduler() mutex 3 を保持している間に、オーナーが DEADLINE から低いクラスに変更されます。 保持者は現在、ドナーから DEADLINE パラメーターを継承し、ENQUEUE_REPLENISH でエンキューされるべきですが、これは発生しません __setscheduler_dl_pi() を導入することで の問題を修正します。これにより、 が検出されます。 DEADLINE適切なまたはブーストされたタスクが、低い優先度クラスに設定されます。場合によっては、関数はタスクに donoer (pi_se) の DEADLINE パラメーターを継承させ、次の enqueue 操作中に適切な帯域幅のアカウンティングを確保するために ENQUEUE_REPLENISH フラグを設定します。CVE-2026-23371

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting Running stress-ng --schedpolicy 0 on     an RT kernel on a big machine might lead to the following WARNINGs (edited). sched: DL de-boosted task PID     22725: REPLENISH flag missing WARNING: CPU: 93 PID: 0 at kernel/sched/deadline.c:239     dequeue_task_dl+0x15c/0x1f8 ... (running_bw underflow) Call trace: dequeue_task_dl+0x15c/0x1f8 (P)     dequeue_task+0x80/0x168 deactivate_task+0x24/0x50 push_dl_task+0x264/0x2e0 dl_task_timer+0x1b0/0x228
    __hrtimer_run_queues+0x188/0x378 hrtimer_interrupt+0xfc/0x260 ... The problem is that when a     SCHED_DEADLINE task (lock holder) is changed to a lower priority class via sched_setscheduler(), it may     fail to properly inherit the parameters of potential DEADLINE donors if it didn't already inherit them in     the past (shorter deadline than donor's at that time). This might lead to bandwidth accounting corruption,     as enqueue_task_dl() won't recognize the lock holder as boosted. The scenario occurs when: 1. A DEADLINE     task (donor) blocks on a PI mutex held by another DEADLINE task (holder), but the holder doesn't inherit     parameters (e.g., it already has a shorter deadline) 2. sched_setscheduler() changes the holder from     DEADLINE to a lower class while still holding the mutex 3. The holder should now inherit DEADLINE     parameters from the donor and be enqueued with ENQUEUE_REPLENISH, but this doesn't happen Fix the issue by     introducing __setscheduler_dl_pi(), which detects when a DEADLINE (proper or boosted) task gets     setscheduled to a lower priority class. In case, the function makes the task inherit DEADLINE parameters     of the donoer (pi_se) and sets ENQUEUE_REPLENISH flag to ensure proper bandwidth accounting during the     next enqueue operation. (CVE-2026-23371)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Input: alps - fix use-after-free bugs caused by dev3_register_work(CVE-2025-68822)

    ext4: reject mount if bigalloc with s_first_data_block != 0(CVE-2026-31447)

    tls: Fix race condition in tls_sw_cancel_work_tx()(CVE-2026-23240)

    apparmor: replace recursive profile removal with iterative approach(CVE-2026-23404)

    ethtool: Avoid overflowing userspace buffer on stats query(CVE-2025-68795)

    ipv6: avoid overflows in ip6_datagram_send_ctl()(CVE-2026-31415)

    ceph: add a bunch of missing ceph_path_info initializers(CVE-2026-43408)

    netfilter: nf_conntrack_helper: pass helper to expect cleanup(CVE-2026-43027)

    netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()(CVE-2026-23457)

    PM: runtime: Fix a race condition related to device removal(CVE-2026-23452)

    net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()(CVE-2026-31423)

    mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()(CVE-2026-31586)

    drm/ioc32: stop speculation on the drm_compat_ioctl path(CVE-2026-31781)

    module: Fix kernel panic when a symbol st_shndx is out of bounds(CVE-2026-31521)

    serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN(CVE-2026-23472)

    net/tcp-md5: Fix MAC comparison to be constant-time(CVE-2026-43383)

    ext4: avoid infinite loops caused by residual data(CVE-2026-31448)

    smb: client: Don#39;t log plaintext credentials in cifs_set_cifscreds(CVE-2026-23303)

    dmaengine: idxd: Fix memory leak when a wq is reset(CVE-2026-31441)

    bridge: br_nd_send: linearize skb before parsing ND options(CVE-2026-31682)

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit(CVE-2026-23277)

    crypto: af_alg - limit RX SG extraction by receive buffer budget(CVE-2026-31677)

    netfilter: xt_CT: drop pending enqueued packets on template removal(CVE-2026-23391)

    apparmor: validate DFA start states are in bounds in unpack_pdb(CVE-2026-23269)

    net: bonding: fix use-after-free in bond_xmit_broadcast()(CVE-2026-31419)

    NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd(CVE-2026-31403)

    ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()(CVE-2026-31531)

    netfilter: ipset: drop logically empty buckets in mtype_del(CVE-2026-31418)

    dcache: Limit the minimal number of bucket to two(CVE-2026-43071)

    HID: multitouch: Check to ensure report responses match the request(CVE-2026-43047)

    smb: client: fix krb5 mount with username option(CVE-2026-31392)

    net: usb: kaweth: validate USB endpoints(CVE-2026-23312)

    net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check(CVE-2026-23448)

    nvmet: move async event work off nvmet-wq(CVE-2026-31557)

    NFSD: Defer sub-object cleanup in export put callbacks(CVE-2026-31404)

    apparmor: fix side-effect bug in match_char() macro usage(CVE-2026-23406)

    nfnetlink_osf: validate individual option lengths in fingerprints(CVE-2026-23397)

    Squashfs: check metadata block offset is within range(CVE-2026-23388)

    net: add xmit recursion limit to tunnel xmit functions(CVE-2026-23276)

    libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()(CVE-2026-43407)

    xfs: fix undersized l_iclog_roundoff values(CVE-2026-43365)

    ixgbevf: add missing negotiate_features op to Hyper-V ops table(CVE-2026-43094)

    drm/vmwgfx: Return the correct value in vmw_translate_ptr functions(CVE-2026-23317)

    af_unix: read UNIX_DIAG_VFS data under unix_state_lock(CVE-2026-31673)

    af_key: validate families in pfkey_send_migrate()(CVE-2026-31515)

    smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path(CVE-2026-31708)

    usb: cdns3: gadget: fix NULL pointer dereference in ep_queue(CVE-2026-31755)

    netfilter: nfnetlink_log: account for netlink header size(CVE-2026-31416)

    sunrpc: fix cache_request leak in cache_release(CVE-2026-31400)

    dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()(CVE-2026-31436)

    net: usb: kalmia: validate USB endpoints(CVE-2026-23365)

    ptrace: slightly saner #39;get_dumpable()#39; logic(CVE-2026-46333)

    net: usb: pegasus: validate USB endpoints(CVE-2026-23290)

    bonding: provide a net pointer to __skb_flow_dissect()(CVE-2026-23119)

    KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION(CVE-2026-31590)

    nvme-fc: release admin tagset if init fails(CVE-2026-23261)

    icmp: fix NULL pointer dereference in icmp_tag_validation()(CVE-2026-23398)

    netfilter: nft_ct: fix use-after-free in timeout object destroy(CVE-2026-31665)

    net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback(CVE-2026-43057)

    netfilter: nf_conntrack_expect: skip expectations in other netns via proc(CVE-2026-31496)

    HID: alps: fix NULL pointer dereference in alps_raw_event()(CVE-2026-31625)

    net: usb: pegasus: enable basic endpoint checking(CVE-2026-43156)

    udp: Fix wildcard bind conflict check when using hash2(CVE-2026-31503)

    net/sched: sch_netem: fix out-of-bounds access in packet corruption(CVE-2026-31675)

    net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check(CVE-2026-23447)

    netfilter: ip6t_eui64: reject invalid MAC header for all packets(CVE-2026-31685)

    net: openvswitch: Avoid releasing netdev before teardown completes(CVE-2026-31508)

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23293)

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels(CVE-2026-23274)

    HID: core: Mitigate potential OOB by removing bogus memset()(CVE-2026-43048)

    x86/CPU/AMD: Add RDSEED fix for Zen5(CVE-2025-68313)

    net: ipv6: flowlabel: defer exclusive option free until RCU teardown(CVE-2026-31680)

    mmc: vub300: fix NULL-deref on disconnect(CVE-2026-31651)

    ipv6: add NULL checks for idev in SRv6 paths(CVE-2026-23442)

    openvswitch: defer tunnel netdev_put to RCU release(CVE-2026-31678)

    x86/apic: Disable x2apic on resume if the kernel expects so(CVE-2026-43363)

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()(CVE-2026-23455)

    virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false(CVE-2026-31469)

    netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()(CVE-2026-23458)

    net: consume xmit errors of GSO frames(CVE-2026-43194)

    dmaengine: idxd: Fix not releasing workqueue on .release()(CVE-2026-43064)

    nvdimm/bus: Fix potential use after free in asynchronous initialization(CVE-2026-31399)

    nfsd: fix heap overflow in NFSv4.0 LOCK replay cache(CVE-2026-31402)

    ext4: publish jinode after initialization(CVE-2026-31450)

    net/sched: teql: Fix double-free in teql_master_xmit(CVE-2026-23449)

    media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex(CVE-2026-31473)

    ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()(CVE-2026-31426)

    crypto: af-alg - fix NULL pointer dereference in scatterwalk(CVE-2026-43043)

    netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()(CVE-2026-31674)

    sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting(CVE-2026-23371)

    apparmor: fix race on rawdata dereference(CVE-2026-23410)

    apparmor: Fix double free of ns_name in aa_replace_profiles()(CVE-2026-23408)

    e1000/e1000e: Fix leak in DMA error cleanup(CVE-2026-43445)

    futex: Clear stale exiting pointer in futex_lock_pi() retry path(CVE-2026-31555)

    apparmor: fix race between freeing data and fs accessing it(CVE-2026-23411)

    netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case(CVE-2026-23456)

    driver core: platform: use generic driver_override infrastructure(CVE-2026-31527)

    xfs: stop reclaim before pushing AIL during unmount(CVE-2026-31455)

    netfilter: nf_tables: unconditionally bump set-gt;nelems before insertion(CVE-2026-23272)

    ceph: supply snapshot context in ceph_zero_partial_object()(CVE-2026-43273)

    ext4: convert inline data to extents when truncate exceeds inline size(CVE-2026-31452)

    apparmor: fix differential encoding verification(CVE-2026-23409)

    HID: core: clamp report_size in s32ton() to avoid undefined shift(CVE-2026-31624)

    EFI/CPER: don#39;t dump the entire memory region(CVE-2026-43171)

    pstore: ram_core: fix incorrect success return when vmap() fails(CVE-2026-43124)

    USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts(CVE-2026-43429)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    scsi: target: Fix recursive locking in __configfs_open_file()(CVE-2026-23292)

    netfilter: ctnetlink: use netlink policy range checks(CVE-2026-31495)

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase(CVE-2026-23351)

    kprobes: avoid crash when rmmod/insmod after ftrace killed(CVE-2026-43409)

    xfs: avoid dereferencing log items after push callbacks(CVE-2026-31453)

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop(CVE-2026-23300)

    netfilter: x_tables: ensure names are nul-terminated(CVE-2026-43028)

    apparmor: fix: limit the number of levels of policy namespaces(CVE-2026-23405)

    net/sched: cls_fw: fix NULL pointer dereference on shared blocks(CVE-2026-31421)

    openvswitch: validate MPLS set/set_masked payload length(CVE-2026-31679)

    perf: Fix __perf_event_overflow() vs perf_remove_from_context() race(CVE-2026-23271)

    bpf: Fix regsafe() for pointers to packet(CVE-2026-43030)

    tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG(CVE-2026-31662)

    net/sched: cls_flow: fix NULL pointer dereference on shared blocks(CVE-2026-31422)

    KVM: x86: Use scratch field in MMIO fragment to hold small write values(CVE-2026-31588)

    PCI: Fix pci_slot_trylock() error handling(CVE-2026-43211)

    net: rfkill: prevent unlimited numbers of rfkill events from being created(CVE-2026-31670)

    apparmor: fix unprivileged local user can do privileged policy management(CVE-2026-23268)

    comedi: dt2815: add hardware detection to prevent crash(CVE-2026-31751)

    netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp(CVE-2026-31427)

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()(CVE-2026-23304)

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()(CVE-2026-23407)

    xfs: save ailp before dropping the AIL lock in push callbacks(CVE-2026-31454)

    ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()(CVE-2026-43068)

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen(CVE-2026-23253)

    ext4: validate p_idx bounds in ext4_ext_correct_indexes(CVE-2026-31449)

    netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD(CVE-2026-31428)

    xfrm: prevent policy_hthresh.work from racing with netns teardown(CVE-2026-31516)

    media: dvb-net: fix OOB access in ULE extension header tables(CVE-2026-31405)

    perf/x86/intel/uncore: Fix die ID init and look up bugs(CVE-2026-43344)

    crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption(CVE-2026-43033)

    powerpc, perf: Check that current-gt;mm is alive before getting user callchain(CVE-2026-43416)

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock(CVE-2026-23368)

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23381)

    perf/x86/intel/uncore: Skip discovery table for offline dies(CVE-2026-43079)

    apparmor: fix memory leak in verify_header(CVE-2026-23403)

    nvme-pci: ensure we#39;re polling a polled queue(CVE-2026-31523)

    xfrm: clear trailing padding in build_polexpire()(CVE-2026-31664)

    x86/efi: defer freeing of boot services memory(CVE-2026-23352)

    netfilter: nf_conntrack_expect: use expect-gt;helper(CVE-2026-31414)

    net: add proper RCU protection to /proc/net/ptype(CVE-2026-23255)

    ice: Fix memory leak in ice_set_ringparam()(CVE-2026-23389)

    usb: typec: ucsi: validate connector number in ucsi_notify_common()(CVE-2026-31729)

    ipv6: icmp: clear skb2-gt;cb[] in ip6_err_gen_icmpv6_unreach()(CVE-2026-43038)

    netfilter: nf_conntrack_h323: fix OOB read in decode_choice()(CVE-2026-43233)

    net: skbuff: propagate shared-frag marker through frag-transfer helpers(CVE-2026-43503)

    mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()(CVE-2026-43281)

    netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()(CVE-2026-43453)

    xfs: fix freemap adjustments when adding xattrs to leaf blocks(CVE-2026-43158)

    xfs: delete attr leaf freemap entries when empty(CVE-2026-43187)

    netfilter: x_tables: guard option walkers against 1-byte tail reads(CVE-2026-43452)

    crypto: pcrypt - Fix handling of MAY_BACKLOG requests(CVE-2026-43493)

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()(CVE-2026-43450)

    usb: ulpi: fix double free in ulpi_register_interface() error path(CVE-2026-31759)

    net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-     leak(CVE-2026-43040)

    ip6_tunnel: clear skb2-gt;cb[] in ip4ip6_err()(CVE-2026-43037)

    net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode(CVE-2026-43180)

    usb: usbtmc: Flush anchored URBs in usbtmc_release(CVE-2026-31758)

    netfilter: nft_ct: drop pending enqueued packets on removal(CVE-2026-43060)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    crypto: algif_aead - Revert to operating out-of-place(CVE-2026-31431)

    bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN(CVE-2026-31525)

    can: bcm: fix locking for bcm_op runtime updates(CVE-2026-23362)

    media: mediatek: vcodec: Use spinlock for context list protection lock(CVE-2025-71140)

    smb: client: Don#39;t log plaintext credentials in cifs_set_cifscreds(CVE-2026-23303)

    media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex(CVE-2026-31473)

    regmap: maple: free entry on mas_store_gfp() failure(CVE-2026-23260)

    ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()(CVE-2026-31426)

    apparmor: replace recursive profile removal with iterative approach(CVE-2026-23404)

    tls: Fix race condition in tls_sw_cancel_work_tx()(CVE-2026-23240)

    macvlan: observe an RCU grace period in macvlan_common_newlink() error path(CVE-2026-23273)

    i40e: Fix preempt count leak in napi poll tracepoint(CVE-2026-23313)

    PM: runtime: Fix a race condition related to device removal(CVE-2026-23452)

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23381)

    p data-testid='vuln-description'Rejected reason: This CVE ID has been rejected or withdrawn by its     CVE Numbering Authority./pbr/(CVE-2026-23473)

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock(CVE-2026-23368)

    net: add proper RCU protection to /proc/net/ptype(CVE-2026-23255)

    ice: Fix memory leak in ice_set_ringparam()(CVE-2026-23389)

    ipv6: add NULL checks for idev in SRv6 paths(CVE-2026-23442)

    tracing: Fix potential deadlock in cpu hotplug with osnoise(CVE-2026-31480)

    ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz(CVE-2026-23377)

    tls: Purge async_hold in tls_decrypt_async_wait()(CVE-2026-23414)

    icmp: fix NULL pointer dereference in icmp_tag_validation()(CVE-2026-23398)

    apparmor: fix memory leak in verify_header(CVE-2026-23403)

    x86/efi: defer freeing of boot services memory(CVE-2026-23352)

    netfilter: nf_tables: always walk all pending catchall elements(CVE-2026-23278)

    nvme: fix admin queue leak on controller reset(CVE-2026-23360)

    media: dvb-net: fix OOB access in ULE extension header tables(CVE-2026-31405)

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels(CVE-2026-23274)

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23293)

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen(CVE-2026-23253)

    nvme-fc: release admin tagset if init fails(CVE-2026-23261)

    tcp: secure_seq: add back ports to TS offset(CVE-2026-23247)

    KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE(CVE-2026-23401)

    netfilter: bpf: defer hook memory release until rcu readers are done(CVE-2026-23412)

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()(CVE-2026-23407)

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()(CVE-2026-23304)

    ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref(CVE-2026-23145)

    net: gro: fix outer network offset(CVE-2026-23254)

    netfilter: nf_tables: release flowtable after rcu grace period on error(CVE-2026-23392)

    perf: Fix __perf_event_overflow() vs perf_remove_from_context() race(CVE-2026-23271)

    sunrpc: fix cache_request leak in cache_release(CVE-2026-31400)

    RDMA/umad: Reject negative data_len in ib_umad_write(CVE-2026-23243)

    af_unix: Give up GC if MSG_PEEK intervened.(CVE-2026-23394)

    clsact: Fix use-after-free in init/destroy rollback asymmetry(CVE-2026-23413)

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop(CVE-2026-23300)

    apparmor: fix unprivileged local user can do privileged policy management(CVE-2026-23268)

    blktrace: fix __this_cpu_read/write in preemptible context(CVE-2026-23374)

    arm64: io: Extract user memory type in ioremap_prot()(CVE-2026-23346)

    xdp: produce a warning when calculated tailroom is negative(CVE-2026-23343)

    mm: thp: deny THP for files on anonymous inodes(CVE-2026-23375)

    drm/vmwgfx: Return the correct value in vmw_translate_ptr functions(CVE-2026-23317)

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase(CVE-2026-23351)

    Squashfs: check metadata block offset is within range(CVE-2026-23388)

    net: add xmit recursion limit to tunnel xmit functions(CVE-2026-23276)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    scsi: target: Fix recursive locking in __configfs_open_file()(CVE-2026-23292)

    netfilter: nf_tables: unconditionally bump set-gt;nelems before insertion(CVE-2026-23272)

    apparmor: fix differential encoding verification(CVE-2026-23409)

    dmaengine: idxd: Fix leaking event log memory(CVE-2026-31440)

    bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded(CVE-2026-23310)

    apparmor: fix: limit the number of levels of policy namespaces(CVE-2026-23405)

    net: annotate data-races around sk-gt;sk_{data_ready,write_space}(CVE-2026-23302)

    nfnetlink_osf: validate individual option lengths in fingerprints(CVE-2026-23397)

    erofs: add GFP_NOIO in the bio completion if needed(CVE-2026-31467)

    nvme: fix memory allocation in nvme_pr_read_keys()(CVE-2026-23244)

    arm64: Set __nocfi on swsusp_arch_resume()(CVE-2026-23128)

    nf_tables: nft_dynset: fix possible stateful expression memleak in error path(CVE-2026-23399)

    apparmor: fix side-effect bug in match_char() macro usage(CVE-2026-23406)

    NFSD: Defer sub-object cleanup in export put callbacks(CVE-2026-31404)

    audit: add fchmodat2() to change attributes class(CVE-2025-71239)

    netfilter: xt_CT: drop pending enqueued packets on template removal(CVE-2026-23391)

    bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim(CVE-2026-23319)

    apparmor: validate DFA start states are in bounds in unpack_pdb(CVE-2026-23269)

    bpf: Fix stack-out-of-bounds write in devmap(CVE-2026-23359)

    spi: fix use-after-free on controller registration failure(CVE-2026-31389)

    apparmor: Fix double free of ns_name in aa_replace_profiles()(CVE-2026-23408)

    spi: fix statistics allocation(CVE-2026-23475)

    smb: client: fix krb5 mount with username option(CVE-2026-31392)

    NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd(CVE-2026-31403)

    apparmor: fix race between freeing data and fs accessing it(CVE-2026-23411)

    apparmor: fix race on rawdata dereference(CVE-2026-23410)

    sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting(CVE-2026-23371)

    dmaengine: idxd: Fix memory leak when a wq is reset(CVE-2026-31441)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the  packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    Input: alps - fix use-after-free bugs caused by dev3_register_work(CVE-2025-68822)

    ext4: reject mount if bigalloc with s_first_data_block != 0(CVE-2026-31447)

    tls: Fix race condition in tls_sw_cancel_work_tx()(CVE-2026-23240)

    apparmor: replace recursive profile removal with iterative approach(CVE-2026-23404)

    ethtool: Avoid overflowing userspace buffer on stats query(CVE-2025-68795)

    ipv6: avoid overflows in ip6_datagram_send_ctl()(CVE-2026-31415)

    ceph: add a bunch of missing ceph_path_info initializers(CVE-2026-43408)

    netfilter: nf_conntrack_helper: pass helper to expect cleanup(CVE-2026-43027)

    netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()(CVE-2026-23457)

    PM: runtime: Fix a race condition related to device removal(CVE-2026-23452)

    net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()(CVE-2026-31423)

    mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()(CVE-2026-31586)

    drm/ioc32: stop speculation on the drm_compat_ioctl path(CVE-2026-31781)

    module: Fix kernel panic when a symbol st_shndx is out of bounds(CVE-2026-31521)

    serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN(CVE-2026-23472)

    net/tcp-md5: Fix MAC comparison to be constant-time(CVE-2026-43383)

    ext4: avoid infinite loops caused by residual data(CVE-2026-31448)

    smb: client: Don#39;t log plaintext credentials in cifs_set_cifscreds(CVE-2026-23303)

    dmaengine: idxd: Fix memory leak when a wq is reset(CVE-2026-31441)

    bridge: br_nd_send: linearize skb before parsing ND options(CVE-2026-31682)

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit(CVE-2026-23277)

    crypto: af_alg - limit RX SG extraction by receive buffer budget(CVE-2026-31677)

    netfilter: xt_CT: drop pending enqueued packets on template removal(CVE-2026-23391)

    apparmor: validate DFA start states are in bounds in unpack_pdb(CVE-2026-23269)

    net: bonding: fix use-after-free in bond_xmit_broadcast()(CVE-2026-31419)

    NFSD: Hold net reference for the lifetime of /proc/fs     fs/exports fd(CVE-2026-31403)

    ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()(CVE-2026-31531)

    netfilter: ipset: drop logically empty buckets in mtype_del(CVE-2026-31418)

    dcache: Limit the minimal number of bucket to two(CVE-2026-43071)

    HID: multitouch: Check to ensure report responses match the request(CVE-2026-43047)

    smb: client: fix krb5 mount with username option(CVE-2026-31392)

    net: usb: kaweth: validate USB endpoints(CVE-2026-23312)

    net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check(CVE-2026-23448)

    nvmet: move async event work off nvmet-wq(CVE-2026-31557)

    NFSD: Defer sub-object cleanup in export put callbacks(CVE-2026-31404)

    apparmor: fix side-effect bug in match_char() macro usage(CVE-2026-23406)

    nfnetlink_osf: validate individual option lengths in fingerprints(CVE-2026-23397)

    Squashfs: check metadata block offset is within range(CVE-2026-23388)

    net: add xmit recursion limit to tunnel xmit functions(CVE-2026-23276)

    libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()(CVE-2026-43407)

    xfs: fix undersized l_iclog_roundoff values(CVE-2026-43365)

    ixgbevf: add missing negotiate_features op to Hyper-V ops table(CVE-2026-43094)

    drm/vmwgfx: Return the correct value in vmw_translate_ptr functions(CVE-2026-23317)

    af_unix: read UNIX_DIAG_VFS data under unix_state_lock(CVE-2026-31673)

    af_key: validate families in pfkey_send_migrate()(CVE-2026-31515)

    smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path(CVE-2026-31708)

    usb: cdns3: gadget: fix NULL pointer dereference in ep_queue(CVE-2026-31755)

    netfilter: nfnetlink_log: account for netlink header size(CVE-2026-31416)

    sunrpc: fix cache_request leak in cache_release(CVE-2026-31400)

    dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()(CVE-2026-31436)

    net: usb: kalmia: validate USB endpoints(CVE-2026-23365)

    ptrace: slightly saner #39;get_dumpable()#39; logic(CVE-2026-46333)

    net: usb: pegasus: validate USB endpoints(CVE-2026-23290)

    bonding: provide a net pointer to __skb_flow_dissect()(CVE-2026-23119)

    KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION(CVE-2026-31590)

    nvme-fc: release admin tagset if init fails(CVE-2026-23261)

    icmp: fix NULL pointer dereference in icmp_tag_validation()(CVE-2026-23398)

    netfilter: nft_ct: fix use-after-free in timeout object destroy(CVE-2026-31665)

    net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback(CVE-2026-43057)

    netfilter: nf_conntrack_expect: skip expectations in other netns via proc(CVE-2026-31496)

    HID: alps: fix NULL pointer dereference in alps_raw_event()(CVE-2026-31625)

    net: usb: pegasus: enable basic endpoint checking(CVE-2026-43156)

    udp: Fix wildcard bind conflict check when using hash2(CVE-2026-31503)

    net/sched: sch_netem: fix out-of-bounds access in packet corruption(CVE-2026-31675)

    net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check(CVE-2026-23447)

    netfilter: ip6t_eui64: reject invalid MAC header for all packets(CVE-2026-31685)

    net: openvswitch: Avoid releasing netdev before teardown completes(CVE-2026-31508)

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23293)

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels(CVE-2026-23274)

    HID: core: Mitigate potential OOB by removing bogus memset()(CVE-2026-43048)

    x86/CPU/AMD: Add RDSEED fix for Zen5(CVE-2025-68313)

    net: ipv6: flowlabel: defer exclusive option free until RCU teardown(CVE-2026-31680)

    mmc: vub300: fix NULL-deref on disconnect(CVE-2026-31651)

    ipv6: add NULL checks for idev in SRv6 paths(CVE-2026-23442)

    openvswitch: defer tunnel netdev_put to RCU release(CVE-2026-31678)

    x86/apic: Disable x2apic on resume if the kernel expects so(CVE-2026-43363)

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()(CVE-2026-23455)

    virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false(CVE-2026-31469)

    netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()(CVE-2026-23458)

    net: consume xmit errors of GSO frames(CVE-2026-43194)

    dmaengine: idxd: Fix not releasing workqueue on .release()(CVE-2026-43064)

    nvdimm/bus: Fix potential use after free in asynchronous initialization(CVE-2026-31399)

    nfsd: fix heap overflow in NFSv4.0 LOCK replay cache(CVE-2026-31402)

    ext4: publish jinode after initialization(CVE-2026-31450)

    net/sched: teql: Fix double-free in teql_master_xmit(CVE-2026-23449)

    media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex(CVE-2026-31473)

    ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()(CVE-2026-31426)

    crypto: af-alg - fix NULL pointer dereference in scatterwalk(CVE-2026-43043)

    netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()(CVE-2026-31674)

    sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting(CVE-2026-23371)

    apparmor: fix race on rawdata dereference(CVE-2026-23410)

    apparmor: Fix double free of ns_name in aa_replace_profiles()(CVE-2026-23408)

    e1000/e1000e: Fix leak in DMA error cleanup(CVE-2026-43445)

    futex: Clear stale exiting pointer in futex_lock_pi() retry path(CVE-2026-31555)

    apparmor: fix race between freeing data and fs accessing it(CVE-2026-23411)

    netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case(CVE-2026-23456)

    driver core: platform: use generic driver_override infrastructure(CVE-2026-31527)

    xfs: stop reclaim before pushing AIL during unmount(CVE-2026-31455)

    netfilter: nf_tables: unconditionally bump set-gt;nelems before insertion(CVE-2026-23272)

    ceph: supply snapshot context in ceph_zero_partial_object()(CVE-2026-43273)

    ext4: convert inline data to extents when truncate exceeds inline size(CVE-2026-31452)

    apparmor: fix differential encoding verification(CVE-2026-23409)

    HID: core: clamp report_size in s32ton() to avoid undefined shift(CVE-2026-31624)

    EFI/CPER: don#39;t dump the entire memory region(CVE-2026-43171)

    pstore: ram_core: fix incorrect success return when vmap() fails(CVE-2026-43124)

    USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts(CVE-2026-43429)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    scsi: target: Fix recursive locking in __configfs_open_file()(CVE-2026-23292)

    netfilter: ctnetlink: use netlink policy range checks(CVE-2026-31495)

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase(CVE-2026-23351)

    kprobes: avoid crash when rmmod/insmod after ftrace killed(CVE-2026-43409)

    xfs: avoid dereferencing log items after push callbacks(CVE-2026-31453)

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop(CVE-2026-23300)

    netfilter: x_tables: ensure names are nul-terminated(CVE-2026-43028)

    apparmor: fix: limit the number of levels of policy namespaces(CVE-2026-23405)

    net/sched: cls_fw: fix NULL pointer dereference on shared blocks(CVE-2026-31421)

    openvswitch: validate MPLS set/set_masked payload length(CVE-2026-31679)

    perf: Fix __perf_event_overflow() vs perf_remove_from_context() race(CVE-2026-23271)

    bpf: Fix regsafe() for pointers to packet(CVE-2026-43030)

    tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG(CVE-2026-31662)

    net/sched: cls_flow: fix NULL pointer dereference on shared blocks(CVE-2026-31422)

    KVM: x86: Use scratch field in MMIO fragment to hold small write values(CVE-2026-31588)

    PCI: Fix pci_slot_trylock() error handling(CVE-2026-43211)

    net: rfkill: prevent unlimited numbers of rfkill events from being created(CVE-2026-31670)

    apparmor: fix unprivileged local user can do privileged policy management(CVE-2026-23268)

    comedi: dt2815: add hardware detection to prevent crash(CVE-2026-31751)

    netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp(CVE-2026-31427)

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()(CVE-2026-23304)

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()(CVE-2026-23407)

    xfs: save ailp before dropping the AIL lock in push callbacks(CVE-2026-31454)

    ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()(CVE-2026-43068)

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen(CVE-2026-23253)

    ext4: validate p_idx bounds in ext4_ext_correct_indexes(CVE-2026-31449)

    netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD(CVE-2026-31428)

    xfrm: prevent policy_hthresh.work from racing with netns teardown(CVE-2026-31516)

    media: dvb-net: fix OOB access in ULE extension header tables(CVE-2026-31405)

    perf/x86/intel/uncore: Fix die ID init and look up bugs(CVE-2026-43344)

    crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption(CVE-2026-43033)

    powerpc, perf: Check that current-gt;mm is alive before getting user callchain(CVE-2026-43416)

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock(CVE-2026-23368)

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23381)

    perf/x86/intel/uncore: Skip discovery table for offline dies(CVE-2026-43079)

    apparmor: fix memory leak in verify_header(CVE-2026-23403)

    nvme-pci: ensure we#39;re polling a polled queue(CVE-2026-31523)

    xfrm: clear trailing padding in build_polexpire()(CVE-2026-31664)

    x86/efi: defer freeing of boot services memory(CVE-2026-23352)

    netfilter: nf_conntrack_expect: use expect-gt;helper(CVE-2026-31414)

    net: add proper RCU protection to /proc     et/ptype(CVE-2026-23255)

    ice: Fix memory leak in ice_set_ringparam()(CVE-2026-23389)

    usb: typec: ucsi: validate connector number in ucsi_notify_common()(CVE-2026-31729)

    ipv6: icmp: clear skb2-gt;cb[] in ip6_err_gen_icmpv6_unreach()(CVE-2026-43038)

    netfilter: nf_conntrack_h323: fix OOB read in decode_choice()(CVE-2026-43233)

    net: skbuff: propagate shared-frag marker through frag-transfer helpers(CVE-2026-43503)

    mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()(CVE-2026-43281)

    netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()(CVE-2026-43453)

    xfs: fix freemap adjustments when adding xattrs to leaf blocks(CVE-2026-43158)

    xfs: delete attr leaf freemap entries when empty(CVE-2026-43187)

    netfilter: x_tables: guard option walkers against 1-byte tail reads(CVE-2026-43452)

    crypto: pcrypt - Fix handling of MAY_BACKLOG requests(CVE-2026-43493)

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()(CVE-2026-43450)

    usb: ulpi: fix double free in ulpi_register_interface() error path(CVE-2026-31759)

    net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-     leak(CVE-2026-43040)

    ip6_tunnel: clear skb2-gt;cb[] in ip4ip6_err()(CVE-2026-43037)

    net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode(CVE-2026-43180)

    usb: usbtmc: Flush anchored URBs in usbtmc_release(CVE-2026-31758)

    netfilter: nft_ct: drop pending enqueued packets on removal(CVE-2026-43060)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    iommu/sva: invalidate stale IOTLB entries for kernel address space(CVE-2025-71202)

    iommu: disable SVA when CONFIG_X86 is set(CVE-2025-71089)

    tls: Fix race condition in tls_sw_cancel_work_tx()(CVE-2026-23240)

    apparmor: replace recursive profile removal with iterative approach(CVE-2026-23404)

    macvlan: observe an RCU grace period in macvlan_common_newlink() error path(CVE-2026-23273)

    mm/hugetlb: fix hugetlb_pmd_shared()(CVE-2026-23100)

    leds: led-class: Only Add LED to leds_list when it is fully ready(CVE-2026-23101)

    smb: client: Don#39;t log plaintext credentials in cifs_set_cifscreds(CVE-2026-23303)

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit(CVE-2026-23277)

    crypto: algif_aead - Revert to operating out-of-place(CVE-2026-31431)

    netfilter: xt_CT: drop pending enqueued packets on template removal(CVE-2026-23391)

    apparmor: validate DFA start states are in bounds in unpack_pdb(CVE-2026-23269)

    net: usb: kaweth: validate USB endpoints(CVE-2026-23312)

    NFSD: Defer sub-object cleanup in export put callbacks(CVE-2026-31404)

    apparmor: fix side-effect bug in match_char() macro usage(CVE-2026-23406)

    nfnetlink_osf: validate individual option lengths in fingerprints(CVE-2026-23397)

    crypto: virtio - Add spinlock protection with virtqueue notification(CVE-2026-23229)

    Squashfs: check metadata block offset is within range(CVE-2026-23388)

    net: add xmit recursion limit to tunnel xmit functions(CVE-2026-23276)

    RDMA/umad: Reject negative data_len in ib_umad_write(CVE-2026-23243)

    net: annotate data-races around sk-gt;sk_{data_ready,write_space}(CVE-2026-23302)

    drm/vmwgfx: Return the correct value in vmw_translate_ptr functions(CVE-2026-23317)

    net: usb: kalmia: validate USB endpoints(CVE-2026-23365)

    tcp: secure_seq: add back ports to TS offset(CVE-2026-23247)

    net: usb: pegasus: validate USB endpoints(CVE-2026-23290)

    bonding: provide a net pointer to __skb_flow_dissect()(CVE-2026-23119)

    nvme-fc: release admin tagset if init fails(CVE-2026-23261)

    sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT(CVE-2026-23125)

    icmp: fix NULL pointer dereference in icmp_tag_validation()(CVE-2026-23398)

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23293)

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels(CVE-2026-23274)

    vsock/virtio: fix potential underflow in virtio_transport_get_credit()(CVE-2026-23069)

    platform/x86: classmate-laptop: Add missing NULL pointer checks(CVE-2026-23237)

    ipv6: add NULL checks for idev in SRv6 paths(CVE-2026-23442)

    scsi: qla2xxx: Fix bsg_done() causing double free(CVE-2025-71238)

    vsock/virtio: cap TX credit to local buffer size(CVE-2026-23086)

    sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting(CVE-2026-23371)

    apparmor: fix race on rawdata dereference(CVE-2026-23410)

    apparmor: Fix double free of ns_name in aa_replace_profiles()(CVE-2026-23408)

    apparmor: fix race between freeing data and fs accessing it(CVE-2026-23411)

    netfilter: nf_tables: unconditionally bump set-gt;nelems before insertion(CVE-2026-23272)

    apparmor: fix differential encoding verification(CVE-2026-23409)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    scsi: target: Fix recursive locking in __configfs_open_file()(CVE-2026-23292)

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase(CVE-2026-23351)

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop(CVE-2026-23300)

    apparmor: fix: limit the number of levels of policy namespaces(CVE-2026-23405)

    perf: Fix __perf_event_overflow() vs perf_remove_from_context() race(CVE-2026-23271)

    blktrace: fix __this_cpu_read/write in preemptible context(CVE-2026-23374)

    apparmor: fix unprivileged local user can do privileged policy management(CVE-2026-23268)

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()(CVE-2026-23304)

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()(CVE-2026-23407)

    ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref(CVE-2026-23145)

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen(CVE-2026-23253)

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock(CVE-2026-23368)

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23381)

    apparmor: fix memory leak in verify_header(CVE-2026-23403)

    x86/efi: defer freeing of boot services memory(CVE-2026-23352)

    net: add proper RCU protection to /proc/net/ptype(CVE-2026-23255)

    ice: Fix memory leak in ice_set_ringparam()(CVE-2026-23389)

    bonding: limit BOND_MODE_8023AD to Ethernet devices(CVE-2026-23099)

    uacce: ensure safe queue release with state management(CVE-2026-23063)

    uacce: implement mremap in uacce_vm_ops to return -EPERM(CVE-2026-23056)

    macvlan: fix error recovery in macvlan_common_newlink()(CVE-2026-23209)

    regmap: Fix race condition in hwspinlock irqsave routine(CVE-2026-23071)

    net/sched: Enforce that teql can only be used as root qdisc(CVE-2026-23074)

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()(CVE-2026-23216)

    net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag(CVE-2026-23105)

    nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()(CVE-2026-23179)

    scsi: qla2xxx: Delay module unload while fabric scan in progress(CVE-2025-71235)

    tracing: Add recursion protection in kernel stack trace recording(CVE-2026-23138)

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()(CVE-2026-23193)

    bonding: annotate data-races around slave-gt;last_rx(CVE-2026-23212)

    be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list(CVE-2026-23084)

    net/sched: cls_u32: use skb_header_pointer_careful()(CVE-2026-23204)

    scsi: qla2xxx: Validate sp before freeing associated memory(CVE-2025-71236)

    nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec(CVE-2026-23112)

    scsi: qla2xxx: Free sp in error path to fix system crash(CVE-2025-71232)

    net: fix segmentation of forwarding fraglist GRO(CVE-2026-23154)

    crypto: authencesn - reject too-short AAD (assoclenlt;8) to match ESP/ESN spec(CVE-2026-23060)

    l2tp: avoid one data-race in l2tp_tunnel_del_work()(CVE-2026-23120)

    KVM: Don#39;t clobber irqfd routing type when deassigning irqfd(CVE-2026-23198)

    netdevsim: fix a race issue related to the operation on bpf_bound_progs list(CVE-2026-23126)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    iommu/sva: invalidate stale IOTLB entries for kernel address space(CVE-2025-71202)

    iommu: disable SVA when CONFIG_X86 is set(CVE-2025-71089)

    tls: Fix race condition in tls_sw_cancel_work_tx()(CVE-2026-23240)

    apparmor: replace recursive profile removal with iterative approach(CVE-2026-23404)

    macvlan: observe an RCU grace period in macvlan_common_newlink() error path(CVE-2026-23273)

    mm/hugetlb: fix hugetlb_pmd_shared()(CVE-2026-23100)

    leds: led-class: Only Add LED to leds_list when it is fully ready(CVE-2026-23101)

    smb: client: Don#39;t log plaintext credentials in cifs_set_cifscreds(CVE-2026-23303)

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit(CVE-2026-23277)

    crypto: algif_aead - Revert to operating out-of-place(CVE-2026-31431)

    netfilter: xt_CT: drop pending enqueued packets on template removal(CVE-2026-23391)

    apparmor: validate DFA start states are in bounds in unpack_pdb(CVE-2026-23269)

    net: usb: kaweth: validate USB endpoints(CVE-2026-23312)

    NFSD: Defer sub-object cleanup in export put callbacks(CVE-2026-31404)

    apparmor: fix side-effect bug in match_char() macro usage(CVE-2026-23406)

    nfnetlink_osf: validate individual option lengths in fingerprints(CVE-2026-23397)

    crypto: virtio - Add spinlock protection with virtqueue notification(CVE-2026-23229)

    Squashfs: check metadata block offset is within range(CVE-2026-23388)

    net: add xmit recursion limit to tunnel xmit functions(CVE-2026-23276)

    RDMA/umad: Reject negative data_len in ib_umad_write(CVE-2026-23243)

    net: annotate data-races around sk-gt;sk_{data_ready,write_space}(CVE-2026-23302)

    drm/vmwgfx: Return the correct value in vmw_translate_ptr functions(CVE-2026-23317)

    net: usb: kalmia: validate USB endpoints(CVE-2026-23365)

    tcp: secure_seq: add back ports to TS offset(CVE-2026-23247)

    net: usb: pegasus: validate USB endpoints(CVE-2026-23290)

    bonding: provide a net pointer to __skb_flow_dissect()(CVE-2026-23119)

    nvme-fc: release admin tagset if init fails(CVE-2026-23261)

    sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT(CVE-2026-23125)

    icmp: fix NULL pointer dereference in icmp_tag_validation()(CVE-2026-23398)

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23293)

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels(CVE-2026-23274)

    vsock/virtio: fix potential underflow in virtio_transport_get_credit()(CVE-2026-23069)

    platform/x86: classmate-laptop: Add missing NULL pointer checks(CVE-2026-23237)

    ipv6: add NULL checks for idev in SRv6 paths(CVE-2026-23442)

    scsi: qla2xxx: Fix bsg_done() causing double free(CVE-2025-71238)

    vsock/virtio: cap TX credit to local buffer size(CVE-2026-23086)

    sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting(CVE-2026-23371)

    apparmor: fix race on rawdata dereference(CVE-2026-23410)

    apparmor: Fix double free of ns_name in aa_replace_profiles()(CVE-2026-23408)

    apparmor: fix race between freeing data and fs accessing it(CVE-2026-23411)

    netfilter: nf_tables: unconditionally bump set-gt;nelems before insertion(CVE-2026-23272)

    apparmor: fix differential encoding verification(CVE-2026-23409)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    scsi: target: Fix recursive locking in __configfs_open_file()(CVE-2026-23292)

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase(CVE-2026-23351)

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop(CVE-2026-23300)

    apparmor: fix: limit the number of levels of policy namespaces(CVE-2026-23405)

    perf: Fix __perf_event_overflow() vs perf_remove_from_context() race(CVE-2026-23271)

    blktrace: fix __this_cpu_read/write in preemptible context(CVE-2026-23374)

    apparmor: fix unprivileged local user can do privileged policy management(CVE-2026-23268)

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()(CVE-2026-23304)

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()(CVE-2026-23407)

    ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref(CVE-2026-23145)

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen(CVE-2026-23253)

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock(CVE-2026-23368)

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23381)

    apparmor: fix memory leak in verify_header(CVE-2026-23403)

    x86/efi: defer freeing of boot services memory(CVE-2026-23352)

    net: add proper RCU protection to /proc/net/ptype(CVE-2026-23255)

    ice: Fix memory leak in ice_set_ringparam()(CVE-2026-23389)

    bonding: limit BOND_MODE_8023AD to Ethernet devices(CVE-2026-23099)

    uacce: ensure safe queue release with state management(CVE-2026-23063)

    uacce: implement mremap in uacce_vm_ops to return -EPERM(CVE-2026-23056)

    macvlan: fix error recovery in macvlan_common_newlink()(CVE-2026-23209)

    regmap: Fix race condition in hwspinlock irqsave routine(CVE-2026-23071)

    net/sched: Enforce that teql can only be used as root qdisc(CVE-2026-23074)

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()(CVE-2026-23216)

    net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag(CVE-2026-23105)

    nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()(CVE-2026-23179)

    scsi: qla2xxx: Delay module unload while fabric scan in progress(CVE-2025-71235)

    tracing: Add recursion protection in kernel stack trace recording(CVE-2026-23138)

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()(CVE-2026-23193)

    bonding: annotate data-races around slave-gt;last_rx(CVE-2026-23212)

    be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list(CVE-2026-23084)

    net/sched: cls_u32: use skb_header_pointer_careful()(CVE-2026-23204)

    scsi: qla2xxx: Validate sp before freeing associated memory(CVE-2025-71236)

    nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec(CVE-2026-23112)

    scsi: qla2xxx: Free sp in error path to fix system crash(CVE-2025-71232)

    net: fix segmentation of forwarding fraglist GRO(CVE-2026-23154)

    crypto: authencesn - reject too-short AAD (assoclenlt;8) to match ESP/ESN spec(CVE-2026-23060)

    l2tp: avoid one data-race in l2tp_tunnel_del_work()(CVE-2026-23120)

    KVM: Don#39;t clobber irqfd routing type when deassigning irqfd(CVE-2026-23198)

    netdevsim: fix a race issue related to the operation on bpf_bound_progs list(CVE-2026-23126)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    Input: alps - fix use-after-free bugs caused by dev3_register_work(CVE-2025-68822)

    ext4: reject mount if bigalloc with s_first_data_block != 0(CVE-2026-31447)

    tls: Fix race condition in tls_sw_cancel_work_tx()(CVE-2026-23240)

    apparmor: replace recursive profile removal with iterative approach(CVE-2026-23404)

    ethtool: Avoid overflowing userspace buffer on stats query(CVE-2025-68795)

    ipv6: avoid overflows in ip6_datagram_send_ctl()(CVE-2026-31415)

    ceph: add a bunch of missing ceph_path_info initializers(CVE-2026-43408)

    netfilter: nf_conntrack_helper: pass helper to expect cleanup(CVE-2026-43027)

    netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()(CVE-2026-23457)

    PM: runtime: Fix a race condition related to device removal(CVE-2026-23452)

    net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()(CVE-2026-31423)

    mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()(CVE-2026-31586)

    drm/ioc32: stop speculation on the drm_compat_ioctl path(CVE-2026-31781)

    module: Fix kernel panic when a symbol st_shndx is out of bounds(CVE-2026-31521)

    serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN(CVE-2026-23472)

    net/tcp-md5: Fix MAC comparison to be constant-time(CVE-2026-43383)

    ext4: avoid infinite loops caused by residual data(CVE-2026-31448)

    smb: client: Don#39;t log plaintext credentials in cifs_set_cifscreds(CVE-2026-23303)

    dmaengine: idxd: Fix memory leak when a wq is reset(CVE-2026-31441)

    bridge: br_nd_send: linearize skb before parsing ND options(CVE-2026-31682)

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit(CVE-2026-23277)

    crypto: af_alg - limit RX SG extraction by receive buffer budget(CVE-2026-31677)

    netfilter: xt_CT: drop pending enqueued packets on template removal(CVE-2026-23391)

    apparmor: validate DFA start states are in bounds in unpack_pdb(CVE-2026-23269)

    net: bonding: fix use-after-free in bond_xmit_broadcast()(CVE-2026-31419)

    NFSD: Hold net reference for the lifetime of /proc/fs     fs/exports fd(CVE-2026-31403)

    ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()(CVE-2026-31531)

    netfilter: ipset: drop logically empty buckets in mtype_del(CVE-2026-31418)

    dcache: Limit the minimal number of bucket to two(CVE-2026-43071)

    HID: multitouch: Check to ensure report responses match the request(CVE-2026-43047)

    smb: client: fix krb5 mount with username option(CVE-2026-31392)

    net: usb: kaweth: validate USB endpoints(CVE-2026-23312)

    net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check(CVE-2026-23448)

    nvmet: move async event work off nvmet-wq(CVE-2026-31557)

    NFSD: Defer sub-object cleanup in export put callbacks(CVE-2026-31404)

    apparmor: fix side-effect bug in match_char() macro usage(CVE-2026-23406)

    nfnetlink_osf: validate individual option lengths in fingerprints(CVE-2026-23397)

    Squashfs: check metadata block offset is within range(CVE-2026-23388)

    net: add xmit recursion limit to tunnel xmit functions(CVE-2026-23276)

    libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()(CVE-2026-43407)

    xfs: fix undersized l_iclog_roundoff values(CVE-2026-43365)

    ixgbevf: add missing negotiate_features op to Hyper-V ops table(CVE-2026-43094)

    drm/vmwgfx: Return the correct value in vmw_translate_ptr functions(CVE-2026-23317)

    af_unix: read UNIX_DIAG_VFS data under unix_state_lock(CVE-2026-31673)

    af_key: validate families in pfkey_send_migrate()(CVE-2026-31515)

    smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path(CVE-2026-31708)

    usb: cdns3: gadget: fix NULL pointer dereference in ep_queue(CVE-2026-31755)

    netfilter: nfnetlink_log: account for netlink header size(CVE-2026-31416)

    sunrpc: fix cache_request leak in cache_release(CVE-2026-31400)

    dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()(CVE-2026-31436)

    net: usb: kalmia: validate USB endpoints(CVE-2026-23365)

    ptrace: slightly saner #39;get_dumpable()#39; logic(CVE-2026-46333)

    net: usb: pegasus: validate USB endpoints(CVE-2026-23290)

    bonding: provide a net pointer to __skb_flow_dissect()(CVE-2026-23119)

    KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION(CVE-2026-31590)

    nvme-fc: release admin tagset if init fails(CVE-2026-23261)

    icmp: fix NULL pointer dereference in icmp_tag_validation()(CVE-2026-23398)

    netfilter: nft_ct: fix use-after-free in timeout object destroy(CVE-2026-31665)

    net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback(CVE-2026-43057)

    netfilter: nf_conntrack_expect: skip expectations in other netns via proc(CVE-2026-31496)

    HID: alps: fix NULL pointer dereference in alps_raw_event()(CVE-2026-31625)

    net: usb: pegasus: enable basic endpoint checking(CVE-2026-43156)

    udp: Fix wildcard bind conflict check when using hash2(CVE-2026-31503)

    net/sched: sch_netem: fix out-of-bounds access in packet corruption(CVE-2026-31675)

    net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check(CVE-2026-23447)

    netfilter: ip6t_eui64: reject invalid MAC header for all packets(CVE-2026-31685)

    net: openvswitch: Avoid releasing netdev before teardown completes(CVE-2026-31508)

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23293)

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels(CVE-2026-23274)

    HID: core: Mitigate potential OOB by removing bogus memset()(CVE-2026-43048)

    x86/CPU/AMD: Add RDSEED fix for Zen5(CVE-2025-68313)

    net: ipv6: flowlabel: defer exclusive option free until RCU teardown(CVE-2026-31680)

    mmc: vub300: fix NULL-deref on disconnect(CVE-2026-31651)

    ipv6: add NULL checks for idev in SRv6 paths(CVE-2026-23442)

    openvswitch: defer tunnel netdev_put to RCU release(CVE-2026-31678)

    x86/apic: Disable x2apic on resume if the kernel expects so(CVE-2026-43363)

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()(CVE-2026-23455)

    virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false(CVE-2026-31469)

    netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()(CVE-2026-23458)

    net: consume xmit errors of GSO frames(CVE-2026-43194)

    dmaengine: idxd: Fix not releasing workqueue on .release()(CVE-2026-43064)

    nvdimm/bus: Fix potential use after free in asynchronous initialization(CVE-2026-31399)

    nfsd: fix heap overflow in NFSv4.0 LOCK replay cache(CVE-2026-31402)

    ext4: publish jinode after initialization(CVE-2026-31450)

    net/sched: teql: Fix double-free in teql_master_xmit(CVE-2026-23449)

    media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex(CVE-2026-31473)

    ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()(CVE-2026-31426)

    crypto: af-alg - fix NULL pointer dereference in scatterwalk(CVE-2026-43043)

    netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()(CVE-2026-31674)

    sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting(CVE-2026-23371)

    apparmor: fix race on rawdata dereference(CVE-2026-23410)

    apparmor: Fix double free of ns_name in aa_replace_profiles()(CVE-2026-23408)

    e1000/e1000e: Fix leak in DMA error cleanup(CVE-2026-43445)

    futex: Clear stale exiting pointer in futex_lock_pi() retry path(CVE-2026-31555)

    apparmor: fix race between freeing data and fs accessing it(CVE-2026-23411)

    netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case(CVE-2026-23456)

    driver core: platform: use generic driver_override infrastructure(CVE-2026-31527)

    xfs: stop reclaim before pushing AIL during unmount(CVE-2026-31455)

    netfilter: nf_tables: unconditionally bump set-gt;nelems before insertion(CVE-2026-23272)

    ceph: supply snapshot context in ceph_zero_partial_object()(CVE-2026-43273)

    ext4: convert inline data to extents when truncate exceeds inline size(CVE-2026-31452)

    apparmor: fix differential encoding verification(CVE-2026-23409)

    HID: core: clamp report_size in s32ton() to avoid undefined shift(CVE-2026-31624)

    EFI/CPER: don#39;t dump the entire memory region(CVE-2026-43171)

    pstore: ram_core: fix incorrect success return when vmap() fails(CVE-2026-43124)

    USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts(CVE-2026-43429)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    scsi: target: Fix recursive locking in __configfs_open_file()(CVE-2026-23292)

    netfilter: ctnetlink: use netlink policy range checks(CVE-2026-31495)

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase(CVE-2026-23351)

    kprobes: avoid crash when rmmod/insmod after ftrace killed(CVE-2026-43409)

    xfs: avoid dereferencing log items after push callbacks(CVE-2026-31453)

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop(CVE-2026-23300)

    netfilter: x_tables: ensure names are nul-terminated(CVE-2026-43028)

    apparmor: fix: limit the number of levels of policy namespaces(CVE-2026-23405)

    net/sched: cls_fw: fix NULL pointer dereference on shared blocks(CVE-2026-31421)

    openvswitch: validate MPLS set/set_masked payload length(CVE-2026-31679)

    perf: Fix __perf_event_overflow() vs perf_remove_from_context() race(CVE-2026-23271)

    bpf: Fix regsafe() for pointers to packet(CVE-2026-43030)

    tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG(CVE-2026-31662)

    net/sched: cls_flow: fix NULL pointer dereference on shared blocks(CVE-2026-31422)

    KVM: x86: Use scratch field in MMIO fragment to hold small write values(CVE-2026-31588)

    PCI: Fix pci_slot_trylock() error handling(CVE-2026-43211)

    net: rfkill: prevent unlimited numbers of rfkill events from being created(CVE-2026-31670)

    apparmor: fix unprivileged local user can do privileged policy management(CVE-2026-23268)

    comedi: dt2815: add hardware detection to prevent crash(CVE-2026-31751)

    netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp(CVE-2026-31427)

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()(CVE-2026-23304)

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()(CVE-2026-23407)

    xfs: save ailp before dropping the AIL lock in push callbacks(CVE-2026-31454)

    ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()(CVE-2026-43068)

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen(CVE-2026-23253)

    ext4: validate p_idx bounds in ext4_ext_correct_indexes(CVE-2026-31449)

    netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD(CVE-2026-31428)

    xfrm: prevent policy_hthresh.work from racing with netns teardown(CVE-2026-31516)

    media: dvb-net: fix OOB access in ULE extension header tables(CVE-2026-31405)

    perf/x86/intel/uncore: Fix die ID init and look up bugs(CVE-2026-43344)

    crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption(CVE-2026-43033)

    powerpc, perf: Check that current-gt;mm is alive before getting user callchain(CVE-2026-43416)

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock(CVE-2026-23368)

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23381)

    perf/x86/intel/uncore: Skip discovery table for offline dies(CVE-2026-43079)

    apparmor: fix memory leak in verify_header(CVE-2026-23403)

    nvme-pci: ensure we#39;re polling a polled queue(CVE-2026-31523)

    xfrm: clear trailing padding in build_polexpire()(CVE-2026-31664)

    x86/efi: defer freeing of boot services memory(CVE-2026-23352)

    netfilter: nf_conntrack_expect: use expect-gt;helper(CVE-2026-31414)

    net: add proper RCU protection to /proc     et/ptype(CVE-2026-23255)

    ice: Fix memory leak in ice_set_ringparam()(CVE-2026-23389)

    usb: typec: ucsi: validate connector number in ucsi_notify_common()(CVE-2026-31729)

    ipv6: icmp: clear skb2-gt;cb[] in ip6_err_gen_icmpv6_unreach()(CVE-2026-43038)

    netfilter: nf_conntrack_h323: fix OOB read in decode_choice()(CVE-2026-43233)

    net: skbuff: propagate shared-frag marker through frag-transfer helpers(CVE-2026-43503)

    mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()(CVE-2026-43281)

    netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()(CVE-2026-43453)

    xfs: fix freemap adjustments when adding xattrs to leaf blocks(CVE-2026-43158)

    xfs: delete attr leaf freemap entries when empty(CVE-2026-43187)

    netfilter: x_tables: guard option walkers against 1-byte tail reads(CVE-2026-43452)

    crypto: pcrypt - Fix handling of MAY_BACKLOG requests(CVE-2026-43493)

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()(CVE-2026-43450)

    usb: ulpi: fix double free in ulpi_register_interface() error path(CVE-2026-31759)

    net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-     leak(CVE-2026-43040)

    ip6_tunnel: clear skb2-gt;cb[] in ip4ip6_err()(CVE-2026-43037)

    net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode(CVE-2026-43180)

    usb: usbtmc: Flush anchored URBs in usbtmc_release(CVE-2026-31758)

    netfilter: nft_ct: drop pending enqueued packets on removal(CVE-2026-43060)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
303726	Linux Distros 未修补的漏洞：CVE-2026-23371	Nessus	Misc.	2026/3/25	2026/7/25	medium
303726	Linux Distros 未修補的弱點：CVE-2026-23371	Nessus	Misc.	2026/3/25	2026/7/25	medium
303726	Linux Distros のパッチ未適用の脆弱性: CVE-2026-23371	Nessus	Misc.	2026/3/25	2026/7/25	medium
303726	Linux Distros Unpatched Vulnerability : CVE-2026-23371	Nessus	Misc.	2026/3/25	2026/7/25	medium
326222	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-2535)	Nessus	Huawei Local Security Checks	2026/7/10	2026/7/13	high
323152	EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-2444)	Nessus	Huawei Local Security Checks	2026/6/27	2026/6/29	high
323212	EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-2485)	Nessus	Huawei Local Security Checks	2026/6/27	2026/6/29	high
328619	EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2730)	Nessus	Huawei Local Security Checks	2026/7/21	2026/7/22	high
320254	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-2336)	Nessus	Huawei Local Security Checks	2026/6/10	2026/6/11	high
320255	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-2293)	Nessus	Huawei Local Security Checks	2026/6/10	2026/6/11	high
320742	EulerOS Virtualization 2.13.0 : kernel (EulerOS-SA-2026-2400)	Nessus	Huawei Local Security Checks	2026/6/12	2026/6/15	high
326126	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-2595)	Nessus	Huawei Local Security Checks	2026/7/10	2026/7/13	high
320698	EulerOS Virtualization 2.13.1 : kernel (EulerOS-SA-2026-2371)	Nessus	Huawei Local Security Checks	2026/6/12	2026/6/15	high
328635	EulerOS Virtualization 2.12.0 : kernel (EulerOS-SA-2026-2776)	Nessus	Huawei Local Security Checks	2026/7/21	2026/7/22	high

检测

插件搜索

medium

medium

medium

medium

high

high

high

high

high

high

high

high

high

high