The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2722-1 advisory.

    The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
    - CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
    - CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
    - CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
    - CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
    - CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
    - CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
    - CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
    - CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
    - CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
    - CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
    - CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
    - CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
    - CVE-2026-31592: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock (bsc#1263123).
    - CVE-2026-31593: KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU     (bsc#1263124).
    - CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).
    - CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
    - CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
    - CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
    - CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
    - CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
    - CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).
    - CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).
    - CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
    - CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
    - CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an     info-leak (bsc#1263996).
    - CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).
    - CVE-2026-43049: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure     (bsc#1264080).
    - CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).
    - CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).
    - CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).
    - CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).
    - CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev->req_status (bsc#1264561).
    - CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).
    - CVE-2026-43171: EFI/CPER: do not dump the entire memory region (bsc#1264549).
    - CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).
    - CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).
    - CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
    - CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).
    - CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).
    - CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).
    - CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).
    - CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).
    - CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).
    - CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).
    - CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).
    - CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).
    - CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).
    - CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).
    - CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).
    - CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).
    - CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).
    - CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found     (bsc#1266922).
    - CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).
    - CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).
    - CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).
    - CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).
    - CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621).
    - CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).
    - CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).
    - CVE-2026-46162: ice: fix double free in ice_sf_eth_activate() error path (bsc#1266840).
    - CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).
    - CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).
    - CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat()     (bsc#1267685).
    - CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1267651).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8492-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - MIPS architecture;

    - PowerPC architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - ACPI drivers;

    - ATM drivers;

    - RNBD block device driver;

    - Ublk userspace block driver;

    - Bus devices;

    - Character device driver;

    - TPM device driver;

    - Clock framework and drivers;

    - Clocksource drivers;

    - CPU idle management framework;

    - Hardware crypto device drivers;

    - DMA engine subsystem;

    - EFI core;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - IIO subsystem;

    - InfiniBand drivers;

    - IOMMU subsystem;

    - Multiple devices driver;

    - Media drivers;

    - Multifunction device drivers;

    - Broadcom VK accelerator driver;

    - MOST (Media Oriented Systems Transport) drivers;

    - MTD block device drivers;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - NTB driver;

    - NVME drivers;

    - PCI subsystem;

    - Performance monitor drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - Power supply drivers;

    - RapidIO drivers;

    - RAS (Reliability, Availability, Serviceability) subsystem;

    - Remote Processor subsystem;

    - RPMSG subsystem;

    - S/390 drivers;

    - SCSI subsystem;

    - MediaTek SoC drivers;

    - Texas Instruments SoC drivers;

    - SPI subsystem;

    - Greybus lights staging drivers;

    - Realtek RTL8723BS SDIO drivers;

    - UFS subsystem;

    - ChipIdea USB driver;

    - DesignWare USB3 driver;

    - USB over IP driver;

    - vDPA drivers;

    - Virtio Host (VHOST) subsystem;

    - Framebuffer layer;

    - BTRFS file system;

    - File systems infrastructure;

    - Ceph distributed file system;

    - Ext4 file system;

    - F2FS file system;

    - FAT file system;

    - GFS2 file system;

    - HFS+ file system;

    - JFS file system;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - OCFS2 file system;

    - Proc file system;

    - Pstore file system;

    - Diskquota system;

    - SMB network file system;

    - XFS file system;

    - Audit subsystem;

    - Memory Management;

    - IPv6 networking;

    - Netfilter;

    - Tracing infrastructure;

    - Kernel kexec() syscall;

    - RCU subsystem;

    - Scheduler infrastructure;

    - Scatterlist API;

    - 9P file system network protocol;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - B.A.T.M.A.N. meshing protocol;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - KCM (Kernel Connection Multiplexor) sockets driver;

    - Multipath TCP;

    - NFC subsystem;

    - RDS protocol;

    - RxRPC session sockets;

    - Network traffic control;

    - SMC sockets;

    - Sun RPC protocol;

    - X.25 network layer;

    - XFRM subsystem;

    - AppArmor security module;

    - Simplified Mandatory Access Control Kernel framework;

    - SOF drivers;

    - USB sound devices; (CVE-2025-40005, CVE-2025-71229, CVE-2025-71231, CVE-2025-71232, CVE-2025-71233,     CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265,     CVE-2025-71266, CVE-2025-71267, CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286,     CVE-2025-71291, CVE-2025-71292, CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304,     CVE-2025-71305, CVE-2026-23100, CVE-2026-23169, CVE-2026-23220, CVE-2026-23221, CVE-2026-23222,     CVE-2026-23228, CVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234, CVE-2026-23235,     CVE-2026-23236, CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243,     CVE-2026-23249, CVE-2026-23266, CVE-2026-23267, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392,     CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31411, CVE-2026-31418,     CVE-2026-31436, CVE-2026-31448, CVE-2026-31478, CVE-2026-31607, CVE-2026-31637, CVE-2026-31649,     CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31682, CVE-2026-31685,     CVE-2026-31687, CVE-2026-31693, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038, CVE-2026-43071,     CVE-2026-43114, CVE-2026-43117, CVE-2026-43123, CVE-2026-43124, CVE-2026-43128, CVE-2026-43130,     CVE-2026-43132, CVE-2026-43133, CVE-2026-43134, CVE-2026-43135, CVE-2026-43136, CVE-2026-43137,     CVE-2026-43139, CVE-2026-43140, CVE-2026-43141, CVE-2026-43143, CVE-2026-43145, CVE-2026-43147,     CVE-2026-43148, CVE-2026-43149, CVE-2026-43150, CVE-2026-43152, CVE-2026-43153, CVE-2026-43156,     CVE-2026-43157, CVE-2026-43158, CVE-2026-43159, CVE-2026-43163, CVE-2026-43167, CVE-2026-43168,     CVE-2026-43169, CVE-2026-43170, CVE-2026-43171, CVE-2026-43173, CVE-2026-43175, CVE-2026-43180,     CVE-2026-43182, CVE-2026-43183, CVE-2026-43184, CVE-2026-43186, CVE-2026-43187, CVE-2026-43189,     CVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43199, CVE-2026-43200, CVE-2026-43201,     CVE-2026-43202, CVE-2026-43203, CVE-2026-43205, CVE-2026-43206, CVE-2026-43207, CVE-2026-43209,     CVE-2026-43211, CVE-2026-43212, CVE-2026-43214, CVE-2026-43215, CVE-2026-43218, CVE-2026-43221,     CVE-2026-43222, CVE-2026-43223, CVE-2026-43225, CVE-2026-43226, CVE-2026-43227, CVE-2026-43230,     CVE-2026-43231, CVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43238, CVE-2026-43239,     CVE-2026-43241, CVE-2026-43242, CVE-2026-43244, CVE-2026-43246, CVE-2026-43248, CVE-2026-43249,     CVE-2026-43250, CVE-2026-43251, CVE-2026-43253, CVE-2026-43255, CVE-2026-43256, CVE-2026-43257,     CVE-2026-43258, CVE-2026-43261, CVE-2026-43262, CVE-2026-43264, CVE-2026-43266, CVE-2026-43268,     CVE-2026-43269, CVE-2026-43270, CVE-2026-43271, CVE-2026-43273, CVE-2026-43275, CVE-2026-43277,     CVE-2026-43278, CVE-2026-43279, CVE-2026-43283, CVE-2026-43287, CVE-2026-43288, CVE-2026-43289,     CVE-2026-43291, CVE-2026-43295, CVE-2026-43296, CVE-2026-43297, CVE-2026-43300, CVE-2026-43302,     CVE-2026-43304, CVE-2026-43312, CVE-2026-43313, CVE-2026-43314, CVE-2026-43315, CVE-2026-43316,     CVE-2026-43317, CVE-2026-43318, CVE-2026-43319, CVE-2026-43320, CVE-2026-43341, CVE-2026-43378,     CVE-2026-43383, CVE-2026-43384, CVE-2026-43406, CVE-2026-43407, CVE-2026-43414, CVE-2026-43493,     CVE-2026-43501, CVE-2026-45847, CVE-2026-45848, CVE-2026-45849, CVE-2026-45851, CVE-2026-45852,     CVE-2026-45856, CVE-2026-45857, CVE-2026-45859, CVE-2026-45860, CVE-2026-45861, CVE-2026-45862,     CVE-2026-45864, CVE-2026-45865, CVE-2026-45866, CVE-2026-45867, CVE-2026-45868, CVE-2026-45869,     CVE-2026-45870, CVE-2026-45871, CVE-2026-45872, CVE-2026-45873, CVE-2026-45875, CVE-2026-45877,     CVE-2026-45878, CVE-2026-45879, CVE-2026-45880, CVE-2026-45881, CVE-2026-45882, CVE-2026-45883,     CVE-2026-45884, CVE-2026-45885, CVE-2026-45886, CVE-2026-45890, CVE-2026-45891, CVE-2026-45893,     CVE-2026-45895, CVE-2026-45902, CVE-2026-45904, CVE-2026-45905, CVE-2026-45910, CVE-2026-45912,     CVE-2026-45913, CVE-2026-45914, CVE-2026-45915, CVE-2026-45916, CVE-2026-45917, CVE-2026-45919,     CVE-2026-45921, CVE-2026-45923, CVE-2026-45928, CVE-2026-45935, CVE-2026-45936, CVE-2026-45938,     CVE-2026-45941, CVE-2026-45946, CVE-2026-45947, CVE-2026-45948, CVE-2026-45954, CVE-2026-45957,     CVE-2026-45960, CVE-2026-45962, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968, CVE-2026-45969,     CVE-2026-45970, CVE-2026-45972, CVE-2026-45973, CVE-2026-45974, CVE-2026-45976, CVE-2026-45978,     CVE-2026-45981, CVE-2026-45982, CVE-2026-45983, CVE-2026-45984, CVE-2026-45988, CVE-2026-46043,     CVE-2026-46115, CVE-2026-46119, CVE-2026-46135, CVE-2026-46185, CVE-2026-46195, CVE-2026-46243,     CVE-2026-46244, CVE-2026-46246, CVE-2026-46247, CVE-2026-46249, CVE-2026-46250, CVE-2026-46251,     CVE-2026-46253, CVE-2026-46254, CVE-2026-46255, CVE-2026-46259, CVE-2026-46260, CVE-2026-46261,     CVE-2026-46265, CVE-2026-46266, CVE-2026-46267, CVE-2026-46270, CVE-2026-46289, CVE-2026-46328)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787305050 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: l2tp: prevent possible tunnel refcount     underflow When a session is created, it sets a backpointer to its tunnel. When the session refcount drops     to 0, l2tp_session_free drops the tunnel refcount if session->tunnel is non-NULL. However, session->tunnel     is set in l2tp_session_create, before the tunnel refcount is incremented by l2tp_session_register, which     leaves a small window where session->tunnel is non-NULL when the tunnel refcount hasn't been bumped.
    Moving the assignment to l2tp_session_register is trivial but l2tp_session_create calls     l2tp_session_set_header_len which uses session->tunnel to get the tunnel's encap. Add an encap arg to     l2tp_session_set_header_len to avoid using session->tunnel. If l2tpv3 sessions have colliding IDs, it is     possible for l2tp_v3_session_get to race with l2tp_session_register and fetch a session which doesn't yet     have session->tunnel set. Add a check for this case. (CVE-2024-49940)

  - In the Linux kernel, the following vulnerability has been resolved: mm/thp: fix deferred split unqueue     naming and locking Recent changes are putting more pressure on THP deferred split queues: under load     revealing long-standing races, causing list_del corruptions, Bad page states and worse (I keep BUGs in     both of those, so usually don't get to see how badly they end up without). The relevant recent changes     being 6.8's mTHP, 6.10's mTHP swapout, and 6.12's mTHP swapin, improved swap allocation, and underused THP     splitting. Before fixing locking: rename misleading folio_undo_large_rmappable(), which does not undo     large_rmappable, to folio_unqueue_deferred_split(), which is what it does. But that and its out-of-line
    __callee are mm internals of very limited usability: add comment and WARN_ON_ONCEs to check usage; and     return a bool to say if a deferred split was unqueued, which can then be used in WARN_ON_ONCEs around     safety checks (sparing callers the arcane conditionals in __folio_unqueue_deferred_split()). Just omit the     folio_unqueue_deferred_split() from free_unref_folios(), all of whose callers now call it beforehand (and     if any forget then bad_page() will tell) - except for its caller put_pages_list(), which itself no longer     has any callers (and will be deleted separately). Swapout: mem_cgroup_swapout() has been resetting     folio->memcg_data 0 without checking and unqueueing a THP folio from deferred split list; which is     unfortunate, since the split_queue_lock depends on the memcg (when memcg is enabled); so swapout has been     unqueueing such THPs later, when freeing the folio, using the pgdat's lock instead: potentially corrupting     the memcg's list. __remove_mapping() has frozen refcount to 0 here, so no problem with calling     folio_unqueue_deferred_split() before resetting memcg_data. That goes back to 5.4 commit 87eaceb3faa5     (mm: thp: make deferred split shrinker memcg aware): which included a check on swapcache before adding     to deferred queue, but no check on deferred queue before adding THP to swapcache. That worked fine with     the usual sequence of events in reclaim (though there were a couple of rare ways in which a THP on     deferred queue could have been swapped out), but 6.12 commit dafff3f4c850 (mm: split underused THPs)     avoids splitting underused THPs in reclaim, which makes swapcache THPs on deferred queue commonplace. Keep     the check on swapcache before adding to deferred queue? Yes: it is no longer essential, but preserves the     existing behaviour, and is likely to be a worthwhile optimization (vmstat showed much more traffic on the     queue under swapping load if the check was removed); update its comment. Memcg-v1 move (deprecated):
    mem_cgroup_move_account() has been changing folio->memcg_data without checking and unqueueing a THP folio     from the deferred list, sometimes corrupting from memcg's list, like swapout. Refcount is non-zero here,     so folio_unqueue_deferred_split() can only be used in a WARN_ON_ONCE to validate the fix, which must be     done earlier: mem_cgroup_move_charge_pte_range() first try to split the THP (splitting of course     unqueues), or skip it if that fails. Not ideal, but moving charge has been requested, and khugepaged     should repair the THP later: nobody wants new custom unqueueing code just for this deprecated case. The     87eaceb3faa5 commit did have the code to move from one deferred list to another (but was not conscious of     its unsafety while refcount non-0); but that was removed by 5.6 commit fac0516b5534 (mm: thp: don't need     care deferred split queue in memcg charge move path), which argued that the existence of a PMD mapping     guarantees that the THP cannot be on a deferred list. As above, false in rare cases, and now commonly     false. Backport to 6.11 should be straightforward. Earlier backports must take care that other
    _deferred_list fixes and dependencies are included. There is not a strong case for backports, but they can     fix cornercases. (CVE-2024-53079)

  - In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: reallocate buf lists on     upgrade IORING_REGISTER_PBUF_RING can reuse an old struct io_buffer_list if it was created for legacy     selected buffer and has been emptied. It violates the requirement that most of the field should stay     stable after publish. Always reallocate it instead. (CVE-2025-21836)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Add sanity checks on     rdev validity There is a possibility that ulp_irq_stop and ulp_irq_start callbacks will be called when the     device is in detached state. This can cause a crash due to NULL pointer dereference as the rdev is already     freed. (CVE-2025-21901)

  - In the Linux kernel, the following vulnerability has been resolved: cpufreq/amd-pstate: Add missing NULL     ptr check in amd_pstate_update Check if policy is NULL before dereferencing it in amd_pstate_update.
    (CVE-2025-23137)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()(CVE-2026-31586)

    e1000/e1000e: Fix leak in DMA error cleanup(CVE-2026-43445)

    futex: Clear stale exiting pointer in futex_lock_pi() retry path(CVE-2026-31555)

    kexec: derive purgatory entry from symbol(CVE-2026-43289)

    nvme-pci: Fix race bug in nvme_poll_irqdisable()(CVE-2026-43448)

    ext4: avoid infinite loops caused by residual data(CVE-2026-31448)

    mm/userfaultfd: fix hugetlb fault mutex hash calculation(CVE-2026-31575)

    netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()(CVE-2026-31674)

    net: skbuff: propagate shared-frag marker through frag-transfer helpers(CVE-2026-43503)

    crypto: af-alg - fix NULL pointer dereference in scatterwalk(CVE-2026-43043)

    net: bonding: fix NULL deref in bond_debug_rlb_hash_show(CVE-2026-31546)

    drm/ioc32: stop speculation on the drm_compat_ioctl path(CVE-2026-31781)

    ext4: always drain queued discard work in ext4_mb_release()(CVE-2026-43065)

    netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()(CVE-2026-23458)

    x86/platform/uv: Handle deconfigured sockets(CVE-2026-31542)

    USB: core: Limit the length of unkillable synchronous timeouts(CVE-2026-43428)

    cifs: some missing initializations on replay(CVE-2026-31693)

    serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN(CVE-2026-23472)

    EDAC/mc: Fix error path ordering in edac_mc_alloc()(CVE-2026-31689)

    module: Fix kernel panic when a symbol st_shndx is out of bounds(CVE-2026-31521)

    can: gw: fix OOB heap access in cgw_csum_crc8_rel()(CVE-2026-31570)

    ext4: publish jinode after initialization(CVE-2026-31450)

    netfilter: xt_multiport: validate range encoding in checkentry(CVE-2026-31681)

    usb: xhci: Prevent interrupt storm on host controller error (HCE)(CVE-2026-43488)

    netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()(CVE-2026-23457)

    ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio(CVE-2026-31451)

    crypto: caam - fix DMA corruption on long hmac keys(CVE-2026-43044)

    scsi: qla2xxx: Completely fix fcport double free(CVE-2026-43414)

    ext4: reject mount if bigalloc with s_first_data_block != 0(CVE-2026-31447)

    net: ipv6: flowlabel: defer exclusive option free until RCU teardown(CVE-2026-31680)

    spi: use generic driver_override infrastructure(CVE-2026-31487)

    HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure(CVE-2026-43049)

    dmaengine: idxd: Fix not releasing workqueue on .release()(CVE-2026-43064)

    usb: gadget: f_ecm: Fix net_device lifecycle with device_move(CVE-2026-31725)

    crypto: atmel-sha204a - Fix OOM -gt;tfm_count leak(CVE-2026-31391)

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()(CVE-2026-23455)

    scsi: hisi_sas: Fix NULL pointer exception during user_scan()(CVE-2026-43413)

    x86/apic: Disable x2apic on resume if the kernel expects so(CVE-2026-43363)

    netfilter: nf_conntrack_expect: use expect-gt;helper(CVE-2026-31414)

    nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set(CVE-2026-43449)

    HID: core: Mitigate potential OOB by removing bogus memset()(CVE-2026-43048)

    mfd: core: Add locking around #39;mfd_of_node_list#39;(CVE-2026-43143)

    scsi: target: tcm_loop: Drain commands in target_reset handler(CVE-2026-43054)

    ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()(CVE-2026-43313)

    netfilter: nft_ct: fix use-after-free in timeout object destroy(CVE-2026-31665)

    lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()(CVE-2026-43492)

    xfrm: clear trailing padding in build_polexpire()(CVE-2026-31664)

    perf/x86/intel/uncore: Skip discovery table for offline dies(CVE-2026-43079)

    usb: dwc3: gadget: Move vbus draw to workqueue context(CVE-2026-43170)

    net: fix fanout UAF in packet_release() via NETDEV_UP race(CVE-2026-31504)

    usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop(CVE-2026-31728)

    netfilter: ip6t_eui64: reject invalid MAC header for all packets(CVE-2026-31685)

    perf/x86/intel/uncore: Fix die ID init and look up bugs(CVE-2026-43344)

    udp: Fix wildcard bind conflict check when using hash2(CVE-2026-31503)

    net/sched: sch_netem: fix out-of-bounds access in packet corruption(CVE-2026-31675)

    ext4: validate p_idx bounds in ext4_ext_correct_indexes(CVE-2026-31449)

    xfrm: prevent policy_hthresh.work from racing with netns teardown(CVE-2026-31516)

    f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()(CVE-2026-31702)

    KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()(CVE-2026-43265)

    ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()(CVE-2026-43068)

    cifs: Fix locking usage for tcon fields(CVE-2026-43215)

    dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()(CVE-2026-31436)

    fbcon: check return value of con2fb_acquire_newinfo()(CVE-2026-43123)

    xfs: close crash window in attr dabtree inactivation(CVE-2026-43053)

    HID: alps: fix NULL pointer dereference in alps_raw_event()(CVE-2026-31625)

    netfilter: nf_conntrack_expect: skip expectations in other netns via proc(CVE-2026-31496)

    xfs: save ailp before dropping the AIL lock in push callbacks(CVE-2026-31454)

    KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-gt;lock(CVE-2026-31592)

    KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION(CVE-2026-31590)

    net: ethernet: xscale: Check for PTP support properly(CVE-2026-43173)

    HID: magicmouse: Do not crash on missing msc-gt;input(CVE-2026-43140)

    smb: client: fix OOB reads parsing symlink error response(CVE-2026-31613)

    net/sched: cls_flow: fix NULL pointer dereference on shared blocks(CVE-2026-31422)

    xfrm: hold dev ref until after transport_finish NF_HOOK(CVE-2026-31663)

    bpf: Fix regsafe() for pointers to packet(CVE-2026-43030)

    xfs: avoid dereferencing log items after push callbacks(CVE-2026-31453)

    smb: client: prevent races in -gt;query_interfaces()(CVE-2026-43239)

    kprobes: avoid crash when rmmod/insmod after ftrace killed(CVE-2026-43409)

    xfs: fix undersized l_iclog_roundoff values(CVE-2026-43365)

    ixgbevf: add missing negotiate_features op to Hyper-V ops table(CVE-2026-43094)

    arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults(CVE-2026-43486)

    arm64: Add support for TSV110 Spectre-BHB mitigation(CVE-2026-43261)

    KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()(CVE-2026-43214)

    can: raw: fix ro-gt;uniq use-after-free in raw_rcv()(CVE-2026-31532)

    ptrace: slightly saner #39;get_dumpable()#39; logic(CVE-2026-46333)

    openvswitch: validate MPLS set/set_masked payload length(CVE-2026-31679)

    smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path(CVE-2026-31708)

    af_unix: read UNIX_DIAG_VFS data under unix_state_lock(CVE-2026-31673)

    esp: fix skb leak with espintcp and async crypto(CVE-2026-31518)

    smb: client: fix off-by-8 bounds check in check_wsl_eas()(CVE-2026-31614)

    af_key: validate families in pfkey_send_migrate()(CVE-2026-31515)

    USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts(CVE-2026-43429)

    bpf: Fix incorrect pruning due to atomic fetch precision tracking(CVE-2026-43009)

    xfs: stop reclaim before pushing AIL during unmount(CVE-2026-31455)

    netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP(CVE-2026-31424)

    ext4: convert inline data to extents when truncate exceeds inline size(CVE-2026-31452)

    HID: multitouch: Check to ensure report responses match the request(CVE-2026-43047)

    HID: core: clamp report_size in s32ton() to avoid undefined shift(CVE-2026-31624)

    EFI/CPER: don#39;t dump the entire memory region(CVE-2026-43171)

    pstore: ram_core: fix incorrect success return when vmap() fails(CVE-2026-43124)

    xfrm_user: fix info leak in build_report()(CVE-2026-31671)

    KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated(CVE-2026-43483)

    dcache: Limit the minimal number of bucket to two(CVE-2026-43071)

    netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case(CVE-2026-23456)

    dm: clear cloned request bio pointer when last clone bio completes(CVE-2026-43278)

    net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption(CVE-2026-31533)

    netfilter: ipset: drop logically empty buckets in mtype_del(CVE-2026-31418)

    bridge: br_nd_send: linearize skb before parsing ND options(CVE-2026-31682)

    x86/CPU: Fix FPDSS on Zen1(CVE-2026-31628)

    ext4: fix use-after-free in update_super_work when racing with umount(CVE-2026-31446)

    nvmet: move async event work off nvmet-wq(CVE-2026-31557)

    bpf: Reject sleepable kprobe_multi programs at attach time(CVE-2026-43010)

    ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()(CVE-2026-31531)

    hwmon: (pmbus/core) Protect regulator operations with mutex(CVE-2026-31486)

    iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()(CVE-2026-31505)

    bpf: reject direct access to nullable PTR_TO_BUF pointers(CVE-2026-43333)

    netfilter: ctnetlink: use netlink policy range checks(CVE-2026-31495)

    nfsd: fix heap overflow in NFSv4.0 LOCK replay cache(CVE-2026-31402)

    virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false(CVE-2026-31469)

    nvme-pci: ensure we#39;re polling a polled queue(CVE-2026-31523)

    nvdimm/bus: Fix potential use after free in asynchronous initialization(CVE-2026-31399)

    net: bonding: fix use-after-free in bond_xmit_broadcast()(CVE-2026-31419)

    mm/damon/sysfs: check contexts-gt;nr before accessing contexts_arr[0](CVE-2026-31458)

    ipv6: avoid overflows in ip6_datagram_send_ctl()(CVE-2026-31415)

    openvswitch: defer tunnel netdev_put to RCU release(CVE-2026-31678)

    mmc: vub300: fix NULL-deref on disconnect(CVE-2026-31651)

    net: openvswitch: Avoid releasing netdev before teardown completes(CVE-2026-31508)

    netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD(CVE-2026-31428)

    perf: Make sure to use pmu_ctx-gt;pmu for groups(CVE-2026-31528)

    netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp(CVE-2026-31427)

    netfilter: nfnetlink_log: account for netlink header size(CVE-2026-31416)

    X.509: Fix out-of-bounds access when parsing extensions(CVE-2026-31430)

    HID: apple: avoid memory leak in apple_report_fixup()(CVE-2026-31520)

    driver core: platform: use generic driver_override infrastructure(CVE-2026-31527)

    crypto: af_alg - limit RX SG extraction by receive buffer budget(CVE-2026-31677)

    HID: magicmouse: avoid memory leak in magicmouse_report_fixup()(CVE-2026-31522)

    bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing(CVE-2026-23383)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50372 advisory.

    - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)   {CVE-2026-46331}
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner)  [Orabug: 39668743]     {CVE-2026-46242}
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen)  [Orabug: 39656679]     {CVE-2026-52943}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39548792]     {CVE-2025-10263}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (Ilya Maximets) {CVE-2026-46165}
    - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Ankit Soni)     {CVE-2026-43220}
    - usb: ulpi: fix memory leak on ulpi_register() error paths (Felix Gu) {CVE-2026-46109}
    - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39463671]     {CVE-2026-46243}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug:
    39368826,39441323] {CVE-2026-43503,CVE-2026-46300}
    - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39368826]     {CVE-2026-46300}
    - netfilter: reject zero shift in nft_bitwise (Kai Ma) [Orabug: 39452464] {CVE-2026-46101}
    - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Andrea Mayer) [Orabug: 39452457]     {CVE-2026-46099}
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure (Deepanshu Kartikey) [Orabug: 39452739]     {CVE-2026-46048}
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Greg Kroah-Hartman) [Orabug: 39426003]     {CVE-2026-43501}
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (Takashi Iwai) [Orabug: 39452746]     {CVE-2026-45992}
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xiang Mei) [Orabug: 39205989]     {CVE-2026-31419}
    - crypto: authencesn - reject short ahash digests during instance creation (Yucheng Lu) [Orabug: 39452231]     {CVE-2026-46033}
    - spi: fix resource leaks on device setup failure (Johan Hovold) [Orabug: 39452400] {CVE-2026-46083}
    - net: qrtr: ns: Limit the total number of nodes (Manivannan Sadhasivam) [Orabug: 39452123]     {CVE-2026-46003}
    - net: bridge: use a stable FDB dst snapshot in RCU readers (Zhengchuan Liang) [Orabug: 39452411]     {CVE-2026-46086}
    - net: qrtr: ns: Limit the maximum number of lookups (Manivannan Sadhasivam) [Orabug: 39452207]     {CVE-2026-46026}
    - net: qrtr: ns: Limit the maximum server registration per node (Manivannan Sadhasivam) [Orabug: 39410851]     {CVE-2026-43491}
    - RDMA/mana_ib: Disable RX steering on RSS QP destroy (Long Li) [Orabug: 39452406] {CVE-2026-46084}
    - media: rc: igorplugusb: heed coherency rules (Oliver Neukum) [Orabug: 39452432] {CVE-2026-46091}
    - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (Daniel Hodges) [Orabug: 39452343]     {CVE-2026-46069}
    - thermal: core: Fix thermal zone governor cleanup issues (Rafael J. Wysocki) [Orabug: 39452186]     {CVE-2026-46021}
    - smb: client: validate the whole DACL before rewriting it in cifsacl (Michael Bommarito) [Orabug:
    39300611] {CVE-2026-31709}
    - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (Yang Xiuwei) [Orabug: 39452100]     {CVE-2026-45997}
    - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39425998]     {CVE-2026-43499}
    - ceph: only d_add() negative dentries when they are unhashed (Max Kellermann) [Orabug: 39452291]     {CVE-2026-46052}
    - dm mirror: fix integer overflow in create_dirty_log() (Junrui Luo) [Orabug: 39452196] {CVE-2026-46023}
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (Shuvam Pandey) [Orabug: 39452304]     {CVE-2026-46056}
    - tcp: call sk_data_ready() after listener migration (Zhenzhong Wu) [Orabug: 39452159] {CVE-2026-46015}
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (Chia-Ming Chang) [Orabug:
    39452250] {CVE-2026-46040}
    - md/raid5: validate payload size before accessing journal metadata (Junrui Luo) [Orabug: 39452349]     {CVE-2026-46070}
    - md/raid5: fix soft lockup in retry_aligned_read() (Chia-Ming Chang) [Orabug: 39452287] {CVE-2026-46051}
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (Sohei Koyama) [Orabug: 39452269]     {CVE-2026-46046}
    - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (Deepanshu Kartikey) [Orabug:
    39452442] {CVE-2026-46094}
    - io_uring/poll: fix multishot recv missing EOF on wakeup race (Jens Axboe) {CVE-2026-23473}
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Kevin Cheng) [Orabug: 39452372]     {CVE-2026-46076}
    - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (Kevin Cheng) [Orabug: 39452394] {CVE-2026-46082}
    - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (Yosry Ahmed) [Orabug: 39452061]     {CVE-2026-45987}
    - xfs: fix a resource leak in xfs_alloc_buftarg() (Haoxiang Li) [Orabug: 39452131] {CVE-2026-46005}
    - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (Raphael Zimmer) [Orabug:
    39452201] {CVE-2026-46024}
    - ipv4: icmp: validate reply type before using icmp_pointers (Ruide Cao) [Orabug: 39452243]     {CVE-2026-46037}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Hkbinbin) [Orabug: 39452259]     {CVE-2026-46043}
    - net: qrtr: ns: Free the node during ctrl_cmd_bye() (Manivannan Sadhasivam) [Orabug: 39452246]     {CVE-2026-46038}
    - rxrpc: Fix rxkad crypto unalignment handling (David Howells) [Orabug: 39452728] {CVE-2026-46085}
    - ALSA: caiaq: Handle probe errors properly (Takashi Iwai) [Orabug: 39452126] {CVE-2026-46004}
    - rbd: fix null-ptr-deref when device_add_disk() fails (Dawei Feng) [Orabug: 39452385] {CVE-2026-46079}
    - md/raid10: fix deadlock with check operation and nowait requests (Josh Hunt) [Orabug: 39452284]     {CVE-2026-46050}
    - jbd2: fix deadlock in jbd2_journal_cancel_revoke() (Zhang Yi) [Orabug: 39452318] {CVE-2026-46061}
    - erofs: fix the out-of-bounds nameoff handling for trailing dirents (Gao Xiang) [Orabug: 39452380]     {CVE-2026-46078}
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (Harin Lee) [Orabug: 39452280] {CVE-2026-46049}
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() (Vasiliy Kovalev) [Orabug: 39452119]     {CVE-2026-46002}
    - net: qrtr: ns: Fix use-after-free in driver remove() (Manivannan Sadhasivam) [Orabug: 39452274]     {CVE-2026-46047}
    - net: strparser: fix skb_head leak in strp_abort_strp() (Luxiao Xu) [Orabug: 39452468] {CVE-2026-46102}
    - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (Ziqing Chen)     [Orabug: 39452416] {CVE-2026-46088}
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Herbert Xu) [Orabug: 39410863] {CVE-2026-43493}
    - wifi: rtw88: check for PCI upstream bridge existence (Fedor Pchelkin) [Orabug: 39452437]     {CVE-2026-46092}
    - zram: do not forget to endio for partial discard requests (Sergey Senozhatsky) [Orabug: 39452420]     {CVE-2026-46089}
    - ocfs2: split transactions in dio completion to avoid credit exhaustion (Heming Zhao) [Orabug: 39452388]     {CVE-2026-46080}
    - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (Jesse Zhang) [Orabug: 39167551]     {CVE-2026-23468}
    - padata: Fix pd UAF once and for all (Herbert Xu) [Orabug: 38335055] {CVE-2025-38584}
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (Greg Kroah-Hartman) [Orabug: 39452133]     {CVE-2026-46006}
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (Cassio Gabriel) [Orabug: 39452170]     {CVE-2026-46018}
    - Buffer overflow in drivers/xen/sys-hypervisor.c (Juergen Gross) [Orabug: 39305898] {CVE-2026-31786}
    - xen/privcmd: fix double free via VMA splitting (Juergen Gross) [Orabug: 39305908] {CVE-2026-31787}
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing (Anderson Nascimento) [Orabug:
    39300563] {CVE-2026-31696}
    - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31697}
    - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31698}
    - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31699}
    - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (Bingquan Chen) {CVE-2026-31700}
    - ALSA: caiaq: take a reference on the USB device in create_card() (Berk Cem Goksel) [Orabug: 39300586]     {CVE-2026-31701}
    - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (Michael Bommarito) [Orabug:
    39300607] {CVE-2026-31708}
    - smb: client: require a full NFS mode SID before reading mode bits (Michael Bommarito) [Orabug: 39343707]     {CVE-2026-43350}
    - fuse: reject oversized dirents in page cache (Samuel Page) [Orabug: 39300556] {CVE-2026-31694}
    - mm/pagewalk: fix race between concurrent split and refault (Max Boone) [Orabug: 39250782]     {CVE-2026-31456}
    - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (Felix Fietkau) [Orabug: 39167472]     {CVE-2026-23444}
    - mm/userfaultfd: fix hugetlb fault mutex hash calculation (Jianhui Zhou) [Orabug: 39273453]     {CVE-2026-31575}
    - ipv6: add NULL checks for idev in SRv6 paths (Heminhong) [Orabug: 39167467] {CVE-2026-23442}
    - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline (Joseph Qi) [Orabug: 39331090] {CVE-2026-43075}
    - ocfs2: validate inline data i_size during inode read (Deepanshu Kartikey) [Orabug: 39331097]     {CVE-2026-43076}
    - media: as102: fix to not free memory after the device is registered in as102_usb_probe() (Jeongjun Park)     [Orabug: 39273467] {CVE-2026-31578}
    - bcache: fix cached_dev.sb_bio use-after-free and crash (Mingzhe Zou) [Orabug: 39273481] {CVE-2026-31580}
    - ALSA: 6fire: fix use-after-free on disconnect (Berk Cem Goksel) [Orabug: 39273486] {CVE-2026-31581}
    - media: em28xx: fix use-after-free in em28xx_v4l2_open() (Abhishek Kumar) [Orabug: 39273493]     {CVE-2026-31583}
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (Breno Leitao) [Orabug: 39273507]     {CVE-2026-31586}
    - KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug:
    39273521] {CVE-2026-31588}
    - x86-64: rename misleadingly named '__copy_user_nocache()' function (Linus Torvalds) [Orabug: 39323162]     {CVE-2026-43073}
    - kernel: be more careful about dup_mmap() failures and uprobe registering (Liam R. Howlett)     {CVE-2025-21709}
    - gpiolib: fix race condition for gdev->srcu (Pawel Narewski) [Orabug: 38887677] {CVE-2026-22986}
    - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (Sean Christopherson) [Orabug:
    39273529] {CVE-2026-31590}
    - KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (Sean Christopherson)     [Orabug: 39273553] {CVE-2026-31593}
    - ocfs2: handle invalid dinode in ocfs2_group_extend (Zhengyuan Huang) [Orabug: 39273569] {CVE-2026-31596}
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY (Tejas Bharambe) [Orabug: 39273578]     {CVE-2026-31597}
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273586]     {CVE-2026-31598}
    - dcache: Limit the minimal number of bucket to two (Zhihao Cheng) [Orabug: 39323133] {CVE-2026-43071}
    - ALSA: ctxfi: Limit PTP to a single page (Harin Lee) [Orabug: 39273608] {CVE-2026-31602}
    - wifi: rtw88: fix device leak on probe failure (Johan Hovold) [Orabug: 39273620] {CVE-2026-31604}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
324872	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:2722-1)	Nessus	SuSE Local Security Checks	2026/7/2	2026/9/29	high
325011	Ubuntu 22.04 LTS / 24.04 LTS : Linux kernel vulnerabilities (USN-8492-1)	Nessus	Ubuntu Local Security Checks	2026/7/3	2026/7/30	high
305231	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1543)	Nessus	Amazon Linux Local Security Checks	2026/4/7	2026/6/17	high
352240	Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787305050)	Nessus	Rocky Linux Local Security Checks	2026/9/30	2026/9/30	high
332914	EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-2930)	Nessus	Huawei Local Security Checks	2026/8/6	2026/10/1	high
325292	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50372)	Nessus	Oracle Linux Local Security Checks	2026/7/6	2026/7/8	high

检测

插件搜索

high

high

high

high

high

high