According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    iommu/sva: invalidate stale IOTLB entries for kernel address space(CVE-2025-71202)

    iommu: disable SVA when CONFIG_X86 is set(CVE-2025-71089)

    tls: Fix race condition in tls_sw_cancel_work_tx()(CVE-2026-23240)

    apparmor: replace recursive profile removal with iterative approach(CVE-2026-23404)

    macvlan: observe an RCU grace period in macvlan_common_newlink() error path(CVE-2026-23273)

    mm/hugetlb: fix hugetlb_pmd_shared()(CVE-2026-23100)

    leds: led-class: Only Add LED to leds_list when it is fully ready(CVE-2026-23101)

    smb: client: Don#39;t log plaintext credentials in cifs_set_cifscreds(CVE-2026-23303)

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit(CVE-2026-23277)

    crypto: algif_aead - Revert to operating out-of-place(CVE-2026-31431)

    netfilter: xt_CT: drop pending enqueued packets on template removal(CVE-2026-23391)

    apparmor: validate DFA start states are in bounds in unpack_pdb(CVE-2026-23269)

    net: usb: kaweth: validate USB endpoints(CVE-2026-23312)

    NFSD: Defer sub-object cleanup in export put callbacks(CVE-2026-31404)

    apparmor: fix side-effect bug in match_char() macro usage(CVE-2026-23406)

    nfnetlink_osf: validate individual option lengths in fingerprints(CVE-2026-23397)

    crypto: virtio - Add spinlock protection with virtqueue notification(CVE-2026-23229)

    Squashfs: check metadata block offset is within range(CVE-2026-23388)

    net: add xmit recursion limit to tunnel xmit functions(CVE-2026-23276)

    RDMA/umad: Reject negative data_len in ib_umad_write(CVE-2026-23243)

    net: annotate data-races around sk-gt;sk_{data_ready,write_space}(CVE-2026-23302)

    drm/vmwgfx: Return the correct value in vmw_translate_ptr functions(CVE-2026-23317)

    net: usb: kalmia: validate USB endpoints(CVE-2026-23365)

    tcp: secure_seq: add back ports to TS offset(CVE-2026-23247)

    net: usb: pegasus: validate USB endpoints(CVE-2026-23290)

    bonding: provide a net pointer to __skb_flow_dissect()(CVE-2026-23119)

    nvme-fc: release admin tagset if init fails(CVE-2026-23261)

    sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT(CVE-2026-23125)

    icmp: fix NULL pointer dereference in icmp_tag_validation()(CVE-2026-23398)

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23293)

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels(CVE-2026-23274)

    vsock/virtio: fix potential underflow in virtio_transport_get_credit()(CVE-2026-23069)

    platform/x86: classmate-laptop: Add missing NULL pointer checks(CVE-2026-23237)

    ipv6: add NULL checks for idev in SRv6 paths(CVE-2026-23442)

    scsi: qla2xxx: Fix bsg_done() causing double free(CVE-2025-71238)

    vsock/virtio: cap TX credit to local buffer size(CVE-2026-23086)

    sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting(CVE-2026-23371)

    apparmor: fix race on rawdata dereference(CVE-2026-23410)

    apparmor: Fix double free of ns_name in aa_replace_profiles()(CVE-2026-23408)

    apparmor: fix race between freeing data and fs accessing it(CVE-2026-23411)

    netfilter: nf_tables: unconditionally bump set-gt;nelems before insertion(CVE-2026-23272)

    apparmor: fix differential encoding verification(CVE-2026-23409)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    scsi: target: Fix recursive locking in __configfs_open_file()(CVE-2026-23292)

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase(CVE-2026-23351)

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop(CVE-2026-23300)

    apparmor: fix: limit the number of levels of policy namespaces(CVE-2026-23405)

    perf: Fix __perf_event_overflow() vs perf_remove_from_context() race(CVE-2026-23271)

    blktrace: fix __this_cpu_read/write in preemptible context(CVE-2026-23374)

    apparmor: fix unprivileged local user can do privileged policy management(CVE-2026-23268)

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()(CVE-2026-23304)

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()(CVE-2026-23407)

    ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref(CVE-2026-23145)

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen(CVE-2026-23253)

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock(CVE-2026-23368)

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23381)

    apparmor: fix memory leak in verify_header(CVE-2026-23403)

    x86/efi: defer freeing of boot services memory(CVE-2026-23352)

    net: add proper RCU protection to /proc/net/ptype(CVE-2026-23255)

    ice: Fix memory leak in ice_set_ringparam()(CVE-2026-23389)

    bonding: limit BOND_MODE_8023AD to Ethernet devices(CVE-2026-23099)

    uacce: ensure safe queue release with state management(CVE-2026-23063)

    uacce: implement mremap in uacce_vm_ops to return -EPERM(CVE-2026-23056)

    macvlan: fix error recovery in macvlan_common_newlink()(CVE-2026-23209)

    regmap: Fix race condition in hwspinlock irqsave routine(CVE-2026-23071)

    net/sched: Enforce that teql can only be used as root qdisc(CVE-2026-23074)

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()(CVE-2026-23216)

    net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag(CVE-2026-23105)

    nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()(CVE-2026-23179)

    scsi: qla2xxx: Delay module unload while fabric scan in progress(CVE-2025-71235)

    tracing: Add recursion protection in kernel stack trace recording(CVE-2026-23138)

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()(CVE-2026-23193)

    bonding: annotate data-races around slave-gt;last_rx(CVE-2026-23212)

    be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list(CVE-2026-23084)

    net/sched: cls_u32: use skb_header_pointer_careful()(CVE-2026-23204)

    scsi: qla2xxx: Validate sp before freeing associated memory(CVE-2025-71236)

    nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec(CVE-2026-23112)

    scsi: qla2xxx: Free sp in error path to fix system crash(CVE-2025-71232)

    net: fix segmentation of forwarding fraglist GRO(CVE-2026-23154)

    crypto: authencesn - reject too-short AAD (assoclenlt;8) to match ESP/ESN spec(CVE-2026-23060)

    l2tp: avoid one data-race in l2tp_tunnel_del_work()(CVE-2026-23120)

    KVM: Don#39;t clobber irqfd routing type when deassigning irqfd(CVE-2026-23198)

    netdevsim: fix a race issue related to the operation on bpf_bound_progs list(CVE-2026-23126)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    iommu/sva: invalidate stale IOTLB entries for kernel address space(CVE-2025-71202)

    iommu: disable SVA when CONFIG_X86 is set(CVE-2025-71089)

    tls: Fix race condition in tls_sw_cancel_work_tx()(CVE-2026-23240)

    apparmor: replace recursive profile removal with iterative approach(CVE-2026-23404)

    macvlan: observe an RCU grace period in macvlan_common_newlink() error path(CVE-2026-23273)

    mm/hugetlb: fix hugetlb_pmd_shared()(CVE-2026-23100)

    leds: led-class: Only Add LED to leds_list when it is fully ready(CVE-2026-23101)

    smb: client: Don#39;t log plaintext credentials in cifs_set_cifscreds(CVE-2026-23303)

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit(CVE-2026-23277)

    crypto: algif_aead - Revert to operating out-of-place(CVE-2026-31431)

    netfilter: xt_CT: drop pending enqueued packets on template removal(CVE-2026-23391)

    apparmor: validate DFA start states are in bounds in unpack_pdb(CVE-2026-23269)

    net: usb: kaweth: validate USB endpoints(CVE-2026-23312)

    NFSD: Defer sub-object cleanup in export put callbacks(CVE-2026-31404)

    apparmor: fix side-effect bug in match_char() macro usage(CVE-2026-23406)

    nfnetlink_osf: validate individual option lengths in fingerprints(CVE-2026-23397)

    crypto: virtio - Add spinlock protection with virtqueue notification(CVE-2026-23229)

    Squashfs: check metadata block offset is within range(CVE-2026-23388)

    net: add xmit recursion limit to tunnel xmit functions(CVE-2026-23276)

    RDMA/umad: Reject negative data_len in ib_umad_write(CVE-2026-23243)

    net: annotate data-races around sk-gt;sk_{data_ready,write_space}(CVE-2026-23302)

    drm/vmwgfx: Return the correct value in vmw_translate_ptr functions(CVE-2026-23317)

    net: usb: kalmia: validate USB endpoints(CVE-2026-23365)

    tcp: secure_seq: add back ports to TS offset(CVE-2026-23247)

    net: usb: pegasus: validate USB endpoints(CVE-2026-23290)

    bonding: provide a net pointer to __skb_flow_dissect()(CVE-2026-23119)

    nvme-fc: release admin tagset if init fails(CVE-2026-23261)

    sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT(CVE-2026-23125)

    icmp: fix NULL pointer dereference in icmp_tag_validation()(CVE-2026-23398)

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23293)

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels(CVE-2026-23274)

    vsock/virtio: fix potential underflow in virtio_transport_get_credit()(CVE-2026-23069)

    platform/x86: classmate-laptop: Add missing NULL pointer checks(CVE-2026-23237)

    ipv6: add NULL checks for idev in SRv6 paths(CVE-2026-23442)

    scsi: qla2xxx: Fix bsg_done() causing double free(CVE-2025-71238)

    vsock/virtio: cap TX credit to local buffer size(CVE-2026-23086)

    sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting(CVE-2026-23371)

    apparmor: fix race on rawdata dereference(CVE-2026-23410)

    apparmor: Fix double free of ns_name in aa_replace_profiles()(CVE-2026-23408)

    apparmor: fix race between freeing data and fs accessing it(CVE-2026-23411)

    netfilter: nf_tables: unconditionally bump set-gt;nelems before insertion(CVE-2026-23272)

    apparmor: fix differential encoding verification(CVE-2026-23409)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    scsi: target: Fix recursive locking in __configfs_open_file()(CVE-2026-23292)

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase(CVE-2026-23351)

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop(CVE-2026-23300)

    apparmor: fix: limit the number of levels of policy namespaces(CVE-2026-23405)

    perf: Fix __perf_event_overflow() vs perf_remove_from_context() race(CVE-2026-23271)

    blktrace: fix __this_cpu_read/write in preemptible context(CVE-2026-23374)

    apparmor: fix unprivileged local user can do privileged policy management(CVE-2026-23268)

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()(CVE-2026-23304)

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()(CVE-2026-23407)

    ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref(CVE-2026-23145)

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen(CVE-2026-23253)

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock(CVE-2026-23368)

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23381)

    apparmor: fix memory leak in verify_header(CVE-2026-23403)

    x86/efi: defer freeing of boot services memory(CVE-2026-23352)

    net: add proper RCU protection to /proc/net/ptype(CVE-2026-23255)

    ice: Fix memory leak in ice_set_ringparam()(CVE-2026-23389)

    bonding: limit BOND_MODE_8023AD to Ethernet devices(CVE-2026-23099)

    uacce: ensure safe queue release with state management(CVE-2026-23063)

    uacce: implement mremap in uacce_vm_ops to return -EPERM(CVE-2026-23056)

    macvlan: fix error recovery in macvlan_common_newlink()(CVE-2026-23209)

    regmap: Fix race condition in hwspinlock irqsave routine(CVE-2026-23071)

    net/sched: Enforce that teql can only be used as root qdisc(CVE-2026-23074)

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()(CVE-2026-23216)

    net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag(CVE-2026-23105)

    nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()(CVE-2026-23179)

    scsi: qla2xxx: Delay module unload while fabric scan in progress(CVE-2025-71235)

    tracing: Add recursion protection in kernel stack trace recording(CVE-2026-23138)

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()(CVE-2026-23193)

    bonding: annotate data-races around slave-gt;last_rx(CVE-2026-23212)

    be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list(CVE-2026-23084)

    net/sched: cls_u32: use skb_header_pointer_careful()(CVE-2026-23204)

    scsi: qla2xxx: Validate sp before freeing associated memory(CVE-2025-71236)

    nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec(CVE-2026-23112)

    scsi: qla2xxx: Free sp in error path to fix system crash(CVE-2025-71232)

    net: fix segmentation of forwarding fraglist GRO(CVE-2026-23154)

    crypto: authencesn - reject too-short AAD (assoclenlt;8) to match ESP/ESN spec(CVE-2026-23060)

    l2tp: avoid one data-race in l2tp_tunnel_del_work()(CVE-2026-23120)

    KVM: Don#39;t clobber irqfd routing type when deassigning irqfd(CVE-2026-23198)

    netdevsim: fix a race issue related to the operation on bpf_bound_progs list(CVE-2026-23126)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    Input: alps - fix use-after-free bugs caused by dev3_register_work(CVE-2025-68822)

    ext4: reject mount if bigalloc with s_first_data_block != 0(CVE-2026-31447)

    tls: Fix race condition in tls_sw_cancel_work_tx()(CVE-2026-23240)

    apparmor: replace recursive profile removal with iterative approach(CVE-2026-23404)

    ethtool: Avoid overflowing userspace buffer on stats query(CVE-2025-68795)

    ipv6: avoid overflows in ip6_datagram_send_ctl()(CVE-2026-31415)

    ceph: add a bunch of missing ceph_path_info initializers(CVE-2026-43408)

    netfilter: nf_conntrack_helper: pass helper to expect cleanup(CVE-2026-43027)

    netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()(CVE-2026-23457)

    PM: runtime: Fix a race condition related to device removal(CVE-2026-23452)

    net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()(CVE-2026-31423)

    mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()(CVE-2026-31586)

    drm/ioc32: stop speculation on the drm_compat_ioctl path(CVE-2026-31781)

    module: Fix kernel panic when a symbol st_shndx is out of bounds(CVE-2026-31521)

    serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN(CVE-2026-23472)

    net/tcp-md5: Fix MAC comparison to be constant-time(CVE-2026-43383)

    ext4: avoid infinite loops caused by residual data(CVE-2026-31448)

    smb: client: Don#39;t log plaintext credentials in cifs_set_cifscreds(CVE-2026-23303)

    dmaengine: idxd: Fix memory leak when a wq is reset(CVE-2026-31441)

    bridge: br_nd_send: linearize skb before parsing ND options(CVE-2026-31682)

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit(CVE-2026-23277)

    crypto: af_alg - limit RX SG extraction by receive buffer budget(CVE-2026-31677)

    netfilter: xt_CT: drop pending enqueued packets on template removal(CVE-2026-23391)

    apparmor: validate DFA start states are in bounds in unpack_pdb(CVE-2026-23269)

    net: bonding: fix use-after-free in bond_xmit_broadcast()(CVE-2026-31419)

    NFSD: Hold net reference for the lifetime of /proc/fs     fs/exports fd(CVE-2026-31403)

    ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()(CVE-2026-31531)

    netfilter: ipset: drop logically empty buckets in mtype_del(CVE-2026-31418)

    dcache: Limit the minimal number of bucket to two(CVE-2026-43071)

    HID: multitouch: Check to ensure report responses match the request(CVE-2026-43047)

    smb: client: fix krb5 mount with username option(CVE-2026-31392)

    net: usb: kaweth: validate USB endpoints(CVE-2026-23312)

    net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check(CVE-2026-23448)

    nvmet: move async event work off nvmet-wq(CVE-2026-31557)

    NFSD: Defer sub-object cleanup in export put callbacks(CVE-2026-31404)

    apparmor: fix side-effect bug in match_char() macro usage(CVE-2026-23406)

    nfnetlink_osf: validate individual option lengths in fingerprints(CVE-2026-23397)

    Squashfs: check metadata block offset is within range(CVE-2026-23388)

    net: add xmit recursion limit to tunnel xmit functions(CVE-2026-23276)

    libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()(CVE-2026-43407)

    xfs: fix undersized l_iclog_roundoff values(CVE-2026-43365)

    ixgbevf: add missing negotiate_features op to Hyper-V ops table(CVE-2026-43094)

    drm/vmwgfx: Return the correct value in vmw_translate_ptr functions(CVE-2026-23317)

    af_unix: read UNIX_DIAG_VFS data under unix_state_lock(CVE-2026-31673)

    af_key: validate families in pfkey_send_migrate()(CVE-2026-31515)

    smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path(CVE-2026-31708)

    usb: cdns3: gadget: fix NULL pointer dereference in ep_queue(CVE-2026-31755)

    netfilter: nfnetlink_log: account for netlink header size(CVE-2026-31416)

    sunrpc: fix cache_request leak in cache_release(CVE-2026-31400)

    dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()(CVE-2026-31436)

    net: usb: kalmia: validate USB endpoints(CVE-2026-23365)

    ptrace: slightly saner #39;get_dumpable()#39; logic(CVE-2026-46333)

    net: usb: pegasus: validate USB endpoints(CVE-2026-23290)

    bonding: provide a net pointer to __skb_flow_dissect()(CVE-2026-23119)

    KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION(CVE-2026-31590)

    nvme-fc: release admin tagset if init fails(CVE-2026-23261)

    icmp: fix NULL pointer dereference in icmp_tag_validation()(CVE-2026-23398)

    netfilter: nft_ct: fix use-after-free in timeout object destroy(CVE-2026-31665)

    net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback(CVE-2026-43057)

    netfilter: nf_conntrack_expect: skip expectations in other netns via proc(CVE-2026-31496)

    HID: alps: fix NULL pointer dereference in alps_raw_event()(CVE-2026-31625)

    net: usb: pegasus: enable basic endpoint checking(CVE-2026-43156)

    udp: Fix wildcard bind conflict check when using hash2(CVE-2026-31503)

    net/sched: sch_netem: fix out-of-bounds access in packet corruption(CVE-2026-31675)

    net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check(CVE-2026-23447)

    netfilter: ip6t_eui64: reject invalid MAC header for all packets(CVE-2026-31685)

    net: openvswitch: Avoid releasing netdev before teardown completes(CVE-2026-31508)

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23293)

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels(CVE-2026-23274)

    HID: core: Mitigate potential OOB by removing bogus memset()(CVE-2026-43048)

    x86/CPU/AMD: Add RDSEED fix for Zen5(CVE-2025-68313)

    net: ipv6: flowlabel: defer exclusive option free until RCU teardown(CVE-2026-31680)

    mmc: vub300: fix NULL-deref on disconnect(CVE-2026-31651)

    ipv6: add NULL checks for idev in SRv6 paths(CVE-2026-23442)

    openvswitch: defer tunnel netdev_put to RCU release(CVE-2026-31678)

    x86/apic: Disable x2apic on resume if the kernel expects so(CVE-2026-43363)

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()(CVE-2026-23455)

    virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false(CVE-2026-31469)

    netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()(CVE-2026-23458)

    net: consume xmit errors of GSO frames(CVE-2026-43194)

    dmaengine: idxd: Fix not releasing workqueue on .release()(CVE-2026-43064)

    nvdimm/bus: Fix potential use after free in asynchronous initialization(CVE-2026-31399)

    nfsd: fix heap overflow in NFSv4.0 LOCK replay cache(CVE-2026-31402)

    ext4: publish jinode after initialization(CVE-2026-31450)

    net/sched: teql: Fix double-free in teql_master_xmit(CVE-2026-23449)

    media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex(CVE-2026-31473)

    ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()(CVE-2026-31426)

    crypto: af-alg - fix NULL pointer dereference in scatterwalk(CVE-2026-43043)

    netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()(CVE-2026-31674)

    sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting(CVE-2026-23371)

    apparmor: fix race on rawdata dereference(CVE-2026-23410)

    apparmor: Fix double free of ns_name in aa_replace_profiles()(CVE-2026-23408)

    e1000/e1000e: Fix leak in DMA error cleanup(CVE-2026-43445)

    futex: Clear stale exiting pointer in futex_lock_pi() retry path(CVE-2026-31555)

    apparmor: fix race between freeing data and fs accessing it(CVE-2026-23411)

    netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case(CVE-2026-23456)

    driver core: platform: use generic driver_override infrastructure(CVE-2026-31527)

    xfs: stop reclaim before pushing AIL during unmount(CVE-2026-31455)

    netfilter: nf_tables: unconditionally bump set-gt;nelems before insertion(CVE-2026-23272)

    ceph: supply snapshot context in ceph_zero_partial_object()(CVE-2026-43273)

    ext4: convert inline data to extents when truncate exceeds inline size(CVE-2026-31452)

    apparmor: fix differential encoding verification(CVE-2026-23409)

    HID: core: clamp report_size in s32ton() to avoid undefined shift(CVE-2026-31624)

    EFI/CPER: don#39;t dump the entire memory region(CVE-2026-43171)

    pstore: ram_core: fix incorrect success return when vmap() fails(CVE-2026-43124)

    USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts(CVE-2026-43429)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    scsi: target: Fix recursive locking in __configfs_open_file()(CVE-2026-23292)

    netfilter: ctnetlink: use netlink policy range checks(CVE-2026-31495)

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase(CVE-2026-23351)

    kprobes: avoid crash when rmmod/insmod after ftrace killed(CVE-2026-43409)

    xfs: avoid dereferencing log items after push callbacks(CVE-2026-31453)

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop(CVE-2026-23300)

    netfilter: x_tables: ensure names are nul-terminated(CVE-2026-43028)

    apparmor: fix: limit the number of levels of policy namespaces(CVE-2026-23405)

    net/sched: cls_fw: fix NULL pointer dereference on shared blocks(CVE-2026-31421)

    openvswitch: validate MPLS set/set_masked payload length(CVE-2026-31679)

    perf: Fix __perf_event_overflow() vs perf_remove_from_context() race(CVE-2026-23271)

    bpf: Fix regsafe() for pointers to packet(CVE-2026-43030)

    tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG(CVE-2026-31662)

    net/sched: cls_flow: fix NULL pointer dereference on shared blocks(CVE-2026-31422)

    KVM: x86: Use scratch field in MMIO fragment to hold small write values(CVE-2026-31588)

    PCI: Fix pci_slot_trylock() error handling(CVE-2026-43211)

    net: rfkill: prevent unlimited numbers of rfkill events from being created(CVE-2026-31670)

    apparmor: fix unprivileged local user can do privileged policy management(CVE-2026-23268)

    comedi: dt2815: add hardware detection to prevent crash(CVE-2026-31751)

    netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp(CVE-2026-31427)

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()(CVE-2026-23304)

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()(CVE-2026-23407)

    xfs: save ailp before dropping the AIL lock in push callbacks(CVE-2026-31454)

    ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()(CVE-2026-43068)

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen(CVE-2026-23253)

    ext4: validate p_idx bounds in ext4_ext_correct_indexes(CVE-2026-31449)

    netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD(CVE-2026-31428)

    xfrm: prevent policy_hthresh.work from racing with netns teardown(CVE-2026-31516)

    media: dvb-net: fix OOB access in ULE extension header tables(CVE-2026-31405)

    perf/x86/intel/uncore: Fix die ID init and look up bugs(CVE-2026-43344)

    crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption(CVE-2026-43033)

    powerpc, perf: Check that current-gt;mm is alive before getting user callchain(CVE-2026-43416)

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock(CVE-2026-23368)

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23381)

    perf/x86/intel/uncore: Skip discovery table for offline dies(CVE-2026-43079)

    apparmor: fix memory leak in verify_header(CVE-2026-23403)

    nvme-pci: ensure we#39;re polling a polled queue(CVE-2026-31523)

    xfrm: clear trailing padding in build_polexpire()(CVE-2026-31664)

    x86/efi: defer freeing of boot services memory(CVE-2026-23352)

    netfilter: nf_conntrack_expect: use expect-gt;helper(CVE-2026-31414)

    net: add proper RCU protection to /proc     et/ptype(CVE-2026-23255)

    ice: Fix memory leak in ice_set_ringparam()(CVE-2026-23389)

    usb: typec: ucsi: validate connector number in ucsi_notify_common()(CVE-2026-31729)

    ipv6: icmp: clear skb2-gt;cb[] in ip6_err_gen_icmpv6_unreach()(CVE-2026-43038)

    netfilter: nf_conntrack_h323: fix OOB read in decode_choice()(CVE-2026-43233)

    net: skbuff: propagate shared-frag marker through frag-transfer helpers(CVE-2026-43503)

    mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()(CVE-2026-43281)

    netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()(CVE-2026-43453)

    xfs: fix freemap adjustments when adding xattrs to leaf blocks(CVE-2026-43158)

    xfs: delete attr leaf freemap entries when empty(CVE-2026-43187)

    netfilter: x_tables: guard option walkers against 1-byte tail reads(CVE-2026-43452)

    crypto: pcrypt - Fix handling of MAY_BACKLOG requests(CVE-2026-43493)

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()(CVE-2026-43450)

    usb: ulpi: fix double free in ulpi_register_interface() error path(CVE-2026-31759)

    net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-     leak(CVE-2026-43040)

    ip6_tunnel: clear skb2-gt;cb[] in ip4ip6_err()(CVE-2026-43037)

    net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode(CVE-2026-43180)

    usb: usbtmc: Flush anchored URBs in usbtmc_release(CVE-2026-31758)

    netfilter: nft_ct: drop pending enqueued packets on removal(CVE-2026-43060)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Input: alps - fix use-after-free bugs caused by dev3_register_work(CVE-2025-68822)

    ext4: reject mount if bigalloc with s_first_data_block != 0(CVE-2026-31447)

    tls: Fix race condition in tls_sw_cancel_work_tx()(CVE-2026-23240)

    apparmor: replace recursive profile removal with iterative approach(CVE-2026-23404)

    ethtool: Avoid overflowing userspace buffer on stats query(CVE-2025-68795)

    ipv6: avoid overflows in ip6_datagram_send_ctl()(CVE-2026-31415)

    ceph: add a bunch of missing ceph_path_info initializers(CVE-2026-43408)

    netfilter: nf_conntrack_helper: pass helper to expect cleanup(CVE-2026-43027)

    netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()(CVE-2026-23457)

    PM: runtime: Fix a race condition related to device removal(CVE-2026-23452)

    net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()(CVE-2026-31423)

    mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()(CVE-2026-31586)

    drm/ioc32: stop speculation on the drm_compat_ioctl path(CVE-2026-31781)

    module: Fix kernel panic when a symbol st_shndx is out of bounds(CVE-2026-31521)

    serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN(CVE-2026-23472)

    net/tcp-md5: Fix MAC comparison to be constant-time(CVE-2026-43383)

    ext4: avoid infinite loops caused by residual data(CVE-2026-31448)

    smb: client: Don#39;t log plaintext credentials in cifs_set_cifscreds(CVE-2026-23303)

    dmaengine: idxd: Fix memory leak when a wq is reset(CVE-2026-31441)

    bridge: br_nd_send: linearize skb before parsing ND options(CVE-2026-31682)

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit(CVE-2026-23277)

    crypto: af_alg - limit RX SG extraction by receive buffer budget(CVE-2026-31677)

    netfilter: xt_CT: drop pending enqueued packets on template removal(CVE-2026-23391)

    apparmor: validate DFA start states are in bounds in unpack_pdb(CVE-2026-23269)

    net: bonding: fix use-after-free in bond_xmit_broadcast()(CVE-2026-31419)

    NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd(CVE-2026-31403)

    ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()(CVE-2026-31531)

    netfilter: ipset: drop logically empty buckets in mtype_del(CVE-2026-31418)

    dcache: Limit the minimal number of bucket to two(CVE-2026-43071)

    HID: multitouch: Check to ensure report responses match the request(CVE-2026-43047)

    smb: client: fix krb5 mount with username option(CVE-2026-31392)

    net: usb: kaweth: validate USB endpoints(CVE-2026-23312)

    net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check(CVE-2026-23448)

    nvmet: move async event work off nvmet-wq(CVE-2026-31557)

    NFSD: Defer sub-object cleanup in export put callbacks(CVE-2026-31404)

    apparmor: fix side-effect bug in match_char() macro usage(CVE-2026-23406)

    nfnetlink_osf: validate individual option lengths in fingerprints(CVE-2026-23397)

    Squashfs: check metadata block offset is within range(CVE-2026-23388)

    net: add xmit recursion limit to tunnel xmit functions(CVE-2026-23276)

    libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()(CVE-2026-43407)

    xfs: fix undersized l_iclog_roundoff values(CVE-2026-43365)

    ixgbevf: add missing negotiate_features op to Hyper-V ops table(CVE-2026-43094)

    drm/vmwgfx: Return the correct value in vmw_translate_ptr functions(CVE-2026-23317)

    af_unix: read UNIX_DIAG_VFS data under unix_state_lock(CVE-2026-31673)

    af_key: validate families in pfkey_send_migrate()(CVE-2026-31515)

    smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path(CVE-2026-31708)

    usb: cdns3: gadget: fix NULL pointer dereference in ep_queue(CVE-2026-31755)

    netfilter: nfnetlink_log: account for netlink header size(CVE-2026-31416)

    sunrpc: fix cache_request leak in cache_release(CVE-2026-31400)

    dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()(CVE-2026-31436)

    net: usb: kalmia: validate USB endpoints(CVE-2026-23365)

    ptrace: slightly saner #39;get_dumpable()#39; logic(CVE-2026-46333)

    net: usb: pegasus: validate USB endpoints(CVE-2026-23290)

    bonding: provide a net pointer to __skb_flow_dissect()(CVE-2026-23119)

    KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION(CVE-2026-31590)

    nvme-fc: release admin tagset if init fails(CVE-2026-23261)

    icmp: fix NULL pointer dereference in icmp_tag_validation()(CVE-2026-23398)

    netfilter: nft_ct: fix use-after-free in timeout object destroy(CVE-2026-31665)

    net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback(CVE-2026-43057)

    netfilter: nf_conntrack_expect: skip expectations in other netns via proc(CVE-2026-31496)

    HID: alps: fix NULL pointer dereference in alps_raw_event()(CVE-2026-31625)

    net: usb: pegasus: enable basic endpoint checking(CVE-2026-43156)

    udp: Fix wildcard bind conflict check when using hash2(CVE-2026-31503)

    net/sched: sch_netem: fix out-of-bounds access in packet corruption(CVE-2026-31675)

    net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check(CVE-2026-23447)

    netfilter: ip6t_eui64: reject invalid MAC header for all packets(CVE-2026-31685)

    net: openvswitch: Avoid releasing netdev before teardown completes(CVE-2026-31508)

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23293)

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels(CVE-2026-23274)

    HID: core: Mitigate potential OOB by removing bogus memset()(CVE-2026-43048)

    x86/CPU/AMD: Add RDSEED fix for Zen5(CVE-2025-68313)

    net: ipv6: flowlabel: defer exclusive option free until RCU teardown(CVE-2026-31680)

    mmc: vub300: fix NULL-deref on disconnect(CVE-2026-31651)

    ipv6: add NULL checks for idev in SRv6 paths(CVE-2026-23442)

    openvswitch: defer tunnel netdev_put to RCU release(CVE-2026-31678)

    x86/apic: Disable x2apic on resume if the kernel expects so(CVE-2026-43363)

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()(CVE-2026-23455)

    virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false(CVE-2026-31469)

    netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()(CVE-2026-23458)

    net: consume xmit errors of GSO frames(CVE-2026-43194)

    dmaengine: idxd: Fix not releasing workqueue on .release()(CVE-2026-43064)

    nvdimm/bus: Fix potential use after free in asynchronous initialization(CVE-2026-31399)

    nfsd: fix heap overflow in NFSv4.0 LOCK replay cache(CVE-2026-31402)

    ext4: publish jinode after initialization(CVE-2026-31450)

    net/sched: teql: Fix double-free in teql_master_xmit(CVE-2026-23449)

    media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex(CVE-2026-31473)

    ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()(CVE-2026-31426)

    crypto: af-alg - fix NULL pointer dereference in scatterwalk(CVE-2026-43043)

    netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()(CVE-2026-31674)

    sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting(CVE-2026-23371)

    apparmor: fix race on rawdata dereference(CVE-2026-23410)

    apparmor: Fix double free of ns_name in aa_replace_profiles()(CVE-2026-23408)

    e1000/e1000e: Fix leak in DMA error cleanup(CVE-2026-43445)

    futex: Clear stale exiting pointer in futex_lock_pi() retry path(CVE-2026-31555)

    apparmor: fix race between freeing data and fs accessing it(CVE-2026-23411)

    netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case(CVE-2026-23456)

    driver core: platform: use generic driver_override infrastructure(CVE-2026-31527)

    xfs: stop reclaim before pushing AIL during unmount(CVE-2026-31455)

    netfilter: nf_tables: unconditionally bump set-gt;nelems before insertion(CVE-2026-23272)

    ceph: supply snapshot context in ceph_zero_partial_object()(CVE-2026-43273)

    ext4: convert inline data to extents when truncate exceeds inline size(CVE-2026-31452)

    apparmor: fix differential encoding verification(CVE-2026-23409)

    HID: core: clamp report_size in s32ton() to avoid undefined shift(CVE-2026-31624)

    EFI/CPER: don#39;t dump the entire memory region(CVE-2026-43171)

    pstore: ram_core: fix incorrect success return when vmap() fails(CVE-2026-43124)

    USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts(CVE-2026-43429)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    scsi: target: Fix recursive locking in __configfs_open_file()(CVE-2026-23292)

    netfilter: ctnetlink: use netlink policy range checks(CVE-2026-31495)

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase(CVE-2026-23351)

    kprobes: avoid crash when rmmod/insmod after ftrace killed(CVE-2026-43409)

    xfs: avoid dereferencing log items after push callbacks(CVE-2026-31453)

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop(CVE-2026-23300)

    netfilter: x_tables: ensure names are nul-terminated(CVE-2026-43028)

    apparmor: fix: limit the number of levels of policy namespaces(CVE-2026-23405)

    net/sched: cls_fw: fix NULL pointer dereference on shared blocks(CVE-2026-31421)

    openvswitch: validate MPLS set/set_masked payload length(CVE-2026-31679)

    perf: Fix __perf_event_overflow() vs perf_remove_from_context() race(CVE-2026-23271)

    bpf: Fix regsafe() for pointers to packet(CVE-2026-43030)

    tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG(CVE-2026-31662)

    net/sched: cls_flow: fix NULL pointer dereference on shared blocks(CVE-2026-31422)

    KVM: x86: Use scratch field in MMIO fragment to hold small write values(CVE-2026-31588)

    PCI: Fix pci_slot_trylock() error handling(CVE-2026-43211)

    net: rfkill: prevent unlimited numbers of rfkill events from being created(CVE-2026-31670)

    apparmor: fix unprivileged local user can do privileged policy management(CVE-2026-23268)

    comedi: dt2815: add hardware detection to prevent crash(CVE-2026-31751)

    netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp(CVE-2026-31427)

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()(CVE-2026-23304)

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()(CVE-2026-23407)

    xfs: save ailp before dropping the AIL lock in push callbacks(CVE-2026-31454)

    ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()(CVE-2026-43068)

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen(CVE-2026-23253)

    ext4: validate p_idx bounds in ext4_ext_correct_indexes(CVE-2026-31449)

    netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD(CVE-2026-31428)

    xfrm: prevent policy_hthresh.work from racing with netns teardown(CVE-2026-31516)

    media: dvb-net: fix OOB access in ULE extension header tables(CVE-2026-31405)

    perf/x86/intel/uncore: Fix die ID init and look up bugs(CVE-2026-43344)

    crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption(CVE-2026-43033)

    powerpc, perf: Check that current-gt;mm is alive before getting user callchain(CVE-2026-43416)

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock(CVE-2026-23368)

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23381)

    perf/x86/intel/uncore: Skip discovery table for offline dies(CVE-2026-43079)

    apparmor: fix memory leak in verify_header(CVE-2026-23403)

    nvme-pci: ensure we#39;re polling a polled queue(CVE-2026-31523)

    xfrm: clear trailing padding in build_polexpire()(CVE-2026-31664)

    x86/efi: defer freeing of boot services memory(CVE-2026-23352)

    netfilter: nf_conntrack_expect: use expect-gt;helper(CVE-2026-31414)

    net: add proper RCU protection to /proc/net/ptype(CVE-2026-23255)

    ice: Fix memory leak in ice_set_ringparam()(CVE-2026-23389)

    usb: typec: ucsi: validate connector number in ucsi_notify_common()(CVE-2026-31729)

    ipv6: icmp: clear skb2-gt;cb[] in ip6_err_gen_icmpv6_unreach()(CVE-2026-43038)

    netfilter: nf_conntrack_h323: fix OOB read in decode_choice()(CVE-2026-43233)

    net: skbuff: propagate shared-frag marker through frag-transfer helpers(CVE-2026-43503)

    mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()(CVE-2026-43281)

    netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()(CVE-2026-43453)

    xfs: fix freemap adjustments when adding xattrs to leaf blocks(CVE-2026-43158)

    xfs: delete attr leaf freemap entries when empty(CVE-2026-43187)

    netfilter: x_tables: guard option walkers against 1-byte tail reads(CVE-2026-43452)

    crypto: pcrypt - Fix handling of MAY_BACKLOG requests(CVE-2026-43493)

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()(CVE-2026-43450)

    usb: ulpi: fix double free in ulpi_register_interface() error path(CVE-2026-31759)

    net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-     leak(CVE-2026-43040)

    ip6_tunnel: clear skb2-gt;cb[] in ip4ip6_err()(CVE-2026-43037)

    net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode(CVE-2026-43180)

    usb: usbtmc: Flush anchored URBs in usbtmc_release(CVE-2026-31758)

    netfilter: nft_ct: drop pending enqueued packets on removal(CVE-2026-43060)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50372 advisory.

    - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)   {CVE-2026-46331}
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner)  [Orabug: 39668743]     {CVE-2026-46242}
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen)  [Orabug: 39656679]     {CVE-2026-52943}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39548792]     {CVE-2025-10263}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (Ilya Maximets) {CVE-2026-46165}
    - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Ankit Soni)     {CVE-2026-43220}
    - usb: ulpi: fix memory leak on ulpi_register() error paths (Felix Gu) {CVE-2026-46109}
    - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39463671]     {CVE-2026-46243}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug:
    39368826,39441323] {CVE-2026-43503,CVE-2026-46300}
    - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39368826]     {CVE-2026-46300}
    - netfilter: reject zero shift in nft_bitwise (Kai Ma) [Orabug: 39452464] {CVE-2026-46101}
    - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Andrea Mayer) [Orabug: 39452457]     {CVE-2026-46099}
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure (Deepanshu Kartikey) [Orabug: 39452739]     {CVE-2026-46048}
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Greg Kroah-Hartman) [Orabug: 39426003]     {CVE-2026-43501}
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (Takashi Iwai) [Orabug: 39452746]     {CVE-2026-45992}
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xiang Mei) [Orabug: 39205989]     {CVE-2026-31419}
    - crypto: authencesn - reject short ahash digests during instance creation (Yucheng Lu) [Orabug: 39452231]     {CVE-2026-46033}
    - spi: fix resource leaks on device setup failure (Johan Hovold) [Orabug: 39452400] {CVE-2026-46083}
    - net: qrtr: ns: Limit the total number of nodes (Manivannan Sadhasivam) [Orabug: 39452123]     {CVE-2026-46003}
    - net: bridge: use a stable FDB dst snapshot in RCU readers (Zhengchuan Liang) [Orabug: 39452411]     {CVE-2026-46086}
    - net: qrtr: ns: Limit the maximum number of lookups (Manivannan Sadhasivam) [Orabug: 39452207]     {CVE-2026-46026}
    - net: qrtr: ns: Limit the maximum server registration per node (Manivannan Sadhasivam) [Orabug: 39410851]     {CVE-2026-43491}
    - RDMA/mana_ib: Disable RX steering on RSS QP destroy (Long Li) [Orabug: 39452406] {CVE-2026-46084}
    - media: rc: igorplugusb: heed coherency rules (Oliver Neukum) [Orabug: 39452432] {CVE-2026-46091}
    - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (Daniel Hodges) [Orabug: 39452343]     {CVE-2026-46069}
    - thermal: core: Fix thermal zone governor cleanup issues (Rafael J. Wysocki) [Orabug: 39452186]     {CVE-2026-46021}
    - smb: client: validate the whole DACL before rewriting it in cifsacl (Michael Bommarito) [Orabug:
    39300611] {CVE-2026-31709}
    - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (Yang Xiuwei) [Orabug: 39452100]     {CVE-2026-45997}
    - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39425998]     {CVE-2026-43499}
    - ceph: only d_add() negative dentries when they are unhashed (Max Kellermann) [Orabug: 39452291]     {CVE-2026-46052}
    - dm mirror: fix integer overflow in create_dirty_log() (Junrui Luo) [Orabug: 39452196] {CVE-2026-46023}
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (Shuvam Pandey) [Orabug: 39452304]     {CVE-2026-46056}
    - tcp: call sk_data_ready() after listener migration (Zhenzhong Wu) [Orabug: 39452159] {CVE-2026-46015}
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (Chia-Ming Chang) [Orabug:
    39452250] {CVE-2026-46040}
    - md/raid5: validate payload size before accessing journal metadata (Junrui Luo) [Orabug: 39452349]     {CVE-2026-46070}
    - md/raid5: fix soft lockup in retry_aligned_read() (Chia-Ming Chang) [Orabug: 39452287] {CVE-2026-46051}
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (Sohei Koyama) [Orabug: 39452269]     {CVE-2026-46046}
    - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (Deepanshu Kartikey) [Orabug:
    39452442] {CVE-2026-46094}
    - io_uring/poll: fix multishot recv missing EOF on wakeup race (Jens Axboe) {CVE-2026-23473}
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Kevin Cheng) [Orabug: 39452372]     {CVE-2026-46076}
    - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (Kevin Cheng) [Orabug: 39452394] {CVE-2026-46082}
    - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (Yosry Ahmed) [Orabug: 39452061]     {CVE-2026-45987}
    - xfs: fix a resource leak in xfs_alloc_buftarg() (Haoxiang Li) [Orabug: 39452131] {CVE-2026-46005}
    - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (Raphael Zimmer) [Orabug:
    39452201] {CVE-2026-46024}
    - ipv4: icmp: validate reply type before using icmp_pointers (Ruide Cao) [Orabug: 39452243]     {CVE-2026-46037}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Hkbinbin) [Orabug: 39452259]     {CVE-2026-46043}
    - net: qrtr: ns: Free the node during ctrl_cmd_bye() (Manivannan Sadhasivam) [Orabug: 39452246]     {CVE-2026-46038}
    - rxrpc: Fix rxkad crypto unalignment handling (David Howells) [Orabug: 39452728] {CVE-2026-46085}
    - ALSA: caiaq: Handle probe errors properly (Takashi Iwai) [Orabug: 39452126] {CVE-2026-46004}
    - rbd: fix null-ptr-deref when device_add_disk() fails (Dawei Feng) [Orabug: 39452385] {CVE-2026-46079}
    - md/raid10: fix deadlock with check operation and nowait requests (Josh Hunt) [Orabug: 39452284]     {CVE-2026-46050}
    - jbd2: fix deadlock in jbd2_journal_cancel_revoke() (Zhang Yi) [Orabug: 39452318] {CVE-2026-46061}
    - erofs: fix the out-of-bounds nameoff handling for trailing dirents (Gao Xiang) [Orabug: 39452380]     {CVE-2026-46078}
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (Harin Lee) [Orabug: 39452280] {CVE-2026-46049}
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() (Vasiliy Kovalev) [Orabug: 39452119]     {CVE-2026-46002}
    - net: qrtr: ns: Fix use-after-free in driver remove() (Manivannan Sadhasivam) [Orabug: 39452274]     {CVE-2026-46047}
    - net: strparser: fix skb_head leak in strp_abort_strp() (Luxiao Xu) [Orabug: 39452468] {CVE-2026-46102}
    - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (Ziqing Chen)     [Orabug: 39452416] {CVE-2026-46088}
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Herbert Xu) [Orabug: 39410863] {CVE-2026-43493}
    - wifi: rtw88: check for PCI upstream bridge existence (Fedor Pchelkin) [Orabug: 39452437]     {CVE-2026-46092}
    - zram: do not forget to endio for partial discard requests (Sergey Senozhatsky) [Orabug: 39452420]     {CVE-2026-46089}
    - ocfs2: split transactions in dio completion to avoid credit exhaustion (Heming Zhao) [Orabug: 39452388]     {CVE-2026-46080}
    - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (Jesse Zhang) [Orabug: 39167551]     {CVE-2026-23468}
    - padata: Fix pd UAF once and for all (Herbert Xu) [Orabug: 38335055] {CVE-2025-38584}
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (Greg Kroah-Hartman) [Orabug: 39452133]     {CVE-2026-46006}
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (Cassio Gabriel) [Orabug: 39452170]     {CVE-2026-46018}
    - Buffer overflow in drivers/xen/sys-hypervisor.c (Juergen Gross) [Orabug: 39305898] {CVE-2026-31786}
    - xen/privcmd: fix double free via VMA splitting (Juergen Gross) [Orabug: 39305908] {CVE-2026-31787}
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing (Anderson Nascimento) [Orabug:
    39300563] {CVE-2026-31696}
    - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31697}
    - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31698}
    - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31699}
    - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (Bingquan Chen) {CVE-2026-31700}
    - ALSA: caiaq: take a reference on the USB device in create_card() (Berk Cem Goksel) [Orabug: 39300586]     {CVE-2026-31701}
    - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (Michael Bommarito) [Orabug:
    39300607] {CVE-2026-31708}
    - smb: client: require a full NFS mode SID before reading mode bits (Michael Bommarito) [Orabug: 39343707]     {CVE-2026-43350}
    - fuse: reject oversized dirents in page cache (Samuel Page) [Orabug: 39300556] {CVE-2026-31694}
    - mm/pagewalk: fix race between concurrent split and refault (Max Boone) [Orabug: 39250782]     {CVE-2026-31456}
    - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (Felix Fietkau) [Orabug: 39167472]     {CVE-2026-23444}
    - mm/userfaultfd: fix hugetlb fault mutex hash calculation (Jianhui Zhou) [Orabug: 39273453]     {CVE-2026-31575}
    - ipv6: add NULL checks for idev in SRv6 paths (Heminhong) [Orabug: 39167467] {CVE-2026-23442}
    - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline (Joseph Qi) [Orabug: 39331090] {CVE-2026-43075}
    - ocfs2: validate inline data i_size during inode read (Deepanshu Kartikey) [Orabug: 39331097]     {CVE-2026-43076}
    - media: as102: fix to not free memory after the device is registered in as102_usb_probe() (Jeongjun Park)     [Orabug: 39273467] {CVE-2026-31578}
    - bcache: fix cached_dev.sb_bio use-after-free and crash (Mingzhe Zou) [Orabug: 39273481] {CVE-2026-31580}
    - ALSA: 6fire: fix use-after-free on disconnect (Berk Cem Goksel) [Orabug: 39273486] {CVE-2026-31581}
    - media: em28xx: fix use-after-free in em28xx_v4l2_open() (Abhishek Kumar) [Orabug: 39273493]     {CVE-2026-31583}
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (Breno Leitao) [Orabug: 39273507]     {CVE-2026-31586}
    - KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug:
    39273521] {CVE-2026-31588}
    - x86-64: rename misleadingly named '__copy_user_nocache()' function (Linus Torvalds) [Orabug: 39323162]     {CVE-2026-43073}
    - kernel: be more careful about dup_mmap() failures and uprobe registering (Liam R. Howlett)     {CVE-2025-21709}
    - gpiolib: fix race condition for gdev->srcu (Pawel Narewski) [Orabug: 38887677] {CVE-2026-22986}
    - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (Sean Christopherson) [Orabug:
    39273529] {CVE-2026-31590}
    - KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (Sean Christopherson)     [Orabug: 39273553] {CVE-2026-31593}
    - ocfs2: handle invalid dinode in ocfs2_group_extend (Zhengyuan Huang) [Orabug: 39273569] {CVE-2026-31596}
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY (Tejas Bharambe) [Orabug: 39273578]     {CVE-2026-31597}
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273586]     {CVE-2026-31598}
    - dcache: Limit the minimal number of bucket to two (Zhihao Cheng) [Orabug: 39323133] {CVE-2026-43071}
    - ALSA: ctxfi: Limit PTP to a single page (Harin Lee) [Orabug: 39273608] {CVE-2026-31602}
    - wifi: rtw88: fix device leak on probe failure (Johan Hovold) [Orabug: 39273620] {CVE-2026-31604}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs When shrinking the number of     real tx queues, netif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush qdiscs for queues     which will no longer be used. qdisc_reset_all_tx_gt() currently serializes qdisc_reset() with     qdisc_lock(). However, for lockless qdiscs, the dequeue path is serialized by qdisc_run_begin/end() using     qdisc->seqlock instead, so qdisc_reset() can run concurrently with __qdisc_run() and free skbs while they     are still being dequeued, leading to UAF. This can easily be reproduced on e.g. virtio-net by imposing     heavy traffic while frequently changing the number of queue pairs: iperf3 -ub0 -c $peer -t 0 & while :; do     ethtool -L eth0 combined 1 ethtool -L eth0 combined 2 done With KASAN enabled, this leads to reports like:
    BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760 ... Call Trace: <TASK> ...
    __qdisc_run+0x133f/0x1760 __dev_queue_xmit+0x248f/0x3550 ip_finish_output2+0xa42/0x2110     ip_output+0x1a7/0x410 ip_send_skb+0x2e6/0x480 udp_send_skb+0xb0a/0x1590 udp_sendmsg+0x13c9/0x1fc0 ...
    </TASK> Allocated by task 1270 on cpu 5 at 44.558414s: ... alloc_skb_with_frags+0x84/0x7c0     sock_alloc_send_pskb+0x69a/0x830 __ip_append_data+0x1b86/0x48c0 ip_make_skb+0x1e8/0x2b0     udp_sendmsg+0x13a6/0x1fc0 ... Freed by task 1306 on cpu 3 at 44.558445s: ... kmem_cache_free+0x117/0x5e0     pfifo_fast_reset+0x14d/0x580 qdisc_reset+0x9e/0x5f0 netif_set_real_num_tx_queues+0x303/0x840     virtnet_set_channels+0x1bf/0x260 [virtio_net] ethnl_set_channels+0x684/0xae0     ethnl_default_set_doit+0x31a/0x890 ... Serialize qdisc_reset_all_tx_gt() against the lockless dequeue path     by taking qdisc->seqlock for TCQ_F_NOLOCK qdiscs, matching the serialization model already used by     dev_reset_queue(). Additionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state reflects an     empty queue, avoiding needless re-scheduling. (CVE-2026-23340)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
320254	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-2336)	Nessus	Huawei Local Security Checks	2026/6/10	2026/6/11	high
320255	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-2293)	Nessus	Huawei Local Security Checks	2026/6/10	2026/6/11	high
320742	EulerOS Virtualization 2.13.0 : kernel (EulerOS-SA-2026-2400)	Nessus	Huawei Local Security Checks	2026/6/12	2026/6/15	high
324048	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2238-1)	Nessus	SuSE Local Security Checks	2026/7/1	2026/7/3	high
321988	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-123 (ALASKERNEL-5.10-2026-123)	Nessus	Amazon Linux Local Security Checks	2026/6/22	2026/7/31	high
328635	EulerOS Virtualization 2.12.0 : kernel (EulerOS-SA-2026-2776)	Nessus	Huawei Local Security Checks	2026/7/21	2026/7/22	high
329326	Photon OS 5.0: Linux PHSA-2026-5.0-0926	Nessus	PhotonOS Local Security Checks	2026/7/24	2026/7/28	high
311340	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1596)	Nessus	Amazon Linux Local Security Checks	2026/4/30	2026/6/17	high
318240	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:21860-1)	Nessus	SuSE Local Security Checks	2026/6/2	2026/6/9	high
319659	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:21845-1)	Nessus	SuSE Local Security Checks	2026/6/8	2026/6/9	high
326126	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-2595)	Nessus	Huawei Local Security Checks	2026/7/10	2026/7/13	high
320698	EulerOS Virtualization 2.13.1 : kernel (EulerOS-SA-2026-2371)	Nessus	Huawei Local Security Checks	2026/6/12	2026/6/15	high
325292	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50372)	Nessus	Oracle Linux Local Security Checks	2026/7/6	2026/7/8	high
303686	Linux Distros Unpatched Vulnerability : CVE-2026-23340	Nessus	Misc.	2026/3/25	2026/8/1	high
305231	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1543)	Nessus	Amazon Linux Local Security Checks	2026/4/7	2026/6/17	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high