The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2202-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2021-47103: inet: fully convert sk->sk_rx_dst to RCU rules (bsc#1221010).
    - CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
    - CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
    - CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
    - CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
    - CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
    - CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
    - CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
    - CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
    - CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
    - CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
    - CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
    - CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold     (bsc#1261797).
    - CVE-2026-31436: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()     (bsc#1262602).
    - CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).
    - CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer     (bsc#1263095).
    - CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in     l2cap_ecred_data_rcv()       (bsc#1262734).
    - CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).
    - CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263065).
    - CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).
    - CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
    - CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723).
    - CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600).
    - CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).
    - CVE-2026-31656: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170).
    - CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).
    - CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).
    - CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).
    - CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).
    - CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).
    - CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).
    - CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).
    - CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).
    - CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).
    - CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).
    - CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264482).
    - CVE-2026-43126: ALSA: mixer: oss: Add card disconnect checkpoints (bsc#1264634).
    - CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).
    - CVE-2026-43214: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (bsc#1264651).
    - CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).
    - CVE-2026-43334: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (bsc#1265090).
    - CVE-2026-43365: xfs: fix undersized l_iclog_roundoff values (bsc#1265119).
    - CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265126).
    - CVE-2026-43494: net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).
    - CVE-2026-43500: supported.conf: drop rxrpc and af_kfs (bsc#1264450).
    - CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).
    - CVE-2026-46333: ptrace: slightly saner 'get_dumpable()' logic (bsc#1265308).

    The following non security issues were fixed:

    - check-for-config-changes: Exclude CC_MS_EXTENSIONS.
    - check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}.
    - crypto: qat - fix ring to service map for QAT GEN4 (bsc#1258248).
    - crypto: qat - refactor fw config related functions (bsc#1258248).
    - crypto: qat - use masks for AE groups (bsc#1258248).
    - dm init: ensure device probing has finished in dm-mod.waitfor= (git-fixes).
    - mkspec: Add signature to source list only when it exists.
    - net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).
    - net: gro: don't merge zcopy skbs (git-fixes).
    - nvmet-rdma: fix possible bad dereference when freeing rsps (bsc#1260983).
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718).
    - ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718).
    - xfrm: esp: avoid in-place decrypt on shared skb frags.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8497-1 advisory.

    It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer     operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in     the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998,     CVE-2026-46000)

    It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when     handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

    Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when     privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive     information. (CVE-2026-46333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling     AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference     when handling AppArmor notifications. A local attacker could use this to cause a kernel oops.
    (CVE-2026-47327)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when     handling AppArmor notifications. A local attacker could use this to corrupt kernel memory.
    (CVE-2026-47328)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of     AppArmor notification responses. A local attacker could use this to allow crafted responses to be     processed. (CVE-2026-47329)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when     handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data.
    (CVE-2026-47330)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a use- after-free (UAF) bug. A local     attacker could use this to cause memory corruption and, theoretically, arbitrary code execution.
    (CVE-2026-47331)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause information disclosure of     kernel memory. (CVE-2026-47332)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption     and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks     when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock.
    (CVE-2026-47334)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a NULL pointer dereference when handling     AppArmor notifications. A local attacker could use this to cause a kernel panic. (CVE-2026-47335)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 used an uninitialized variable when handling     AppArmor AF_INET/AF_INET6 socket mediation. A local attacker could use this to influence processing of     fine- grained network socket mediation. (CVE-2026-47336)

    Tristan Madani and Trevor Lawrence have each independently discovered that Ubuntu Linux kernel 6.8, 6.17     and 7.0 contained a NULL pointer dereference when handling AppArmor network socket mediation. A local     attacker could use this to cause a kernel oops. (CVE-2026-47337)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - MIPS architecture;

    - PowerPC architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - ACPI drivers;

    - ATM drivers;

    - RNBD block device driver;

    - Ublk userspace block driver;

    - Bus devices;

    - Character device driver;

    - TPM device driver;

    - Clock framework and drivers;

    - Clocksource drivers;

    - CPU idle management framework;

    - Hardware crypto device drivers;

    - DMA engine subsystem;

    - EFI core;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - IIO subsystem;

    - InfiniBand drivers;

    - IOMMU subsystem;

    - Multiple devices driver;

    - Media drivers;

    - Multifunction device drivers;

    - Broadcom VK accelerator driver;

    - MOST (Media Oriented Systems Transport) drivers;

    - MTD block device drivers;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - NTB driver;

    - NVME drivers;

    - PCI subsystem;

    - Performance monitor drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - Power supply drivers;

    - RapidIO drivers;

    - RAS (Reliability, Availability, Serviceability) subsystem;

    - Remote Processor subsystem;

    - RPMSG subsystem;

    - S/390 drivers;

    - SCSI subsystem;

    - MediaTek SoC drivers;

    - Texas Instruments SoC drivers;

    - SPI subsystem;

    - Greybus lights staging drivers;

    - Realtek RTL8723BS SDIO drivers;

    - UFS subsystem;

    - ChipIdea USB driver;

    - DesignWare USB3 driver;

    - USB over IP driver;

    - vDPA drivers;

    - Virtio Host (VHOST) subsystem;

    - Framebuffer layer;

    - BTRFS file system;

    - File systems infrastructure;

    - Ceph distributed file system;

    - Ext4 file system;

    - F2FS file system;

    - FAT file system;

    - GFS2 file system;

    - HFS+ file system;

    - JFS file system;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - OCFS2 file system;

    - Proc file system;

    - Pstore file system;

    - Diskquota system;

    - SMB network file system;

    - XFS file system;

    - Audit subsystem;

    - Memory Management;

    - IPv6 networking;

    - Netfilter;

    - Tracing infrastructure;

    - Kernel kexec() syscall;

    - RCU subsystem;

    - Scheduler infrastructure;

    - Scatterlist API;

    - 9P file system network protocol;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - B.A.T.M.A.N. meshing protocol;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - KCM (Kernel Connection Multiplexor) sockets driver;

    - Multipath TCP;

    - NFC subsystem;

    - RDS protocol;

    - RxRPC session sockets;

    - Network traffic control;

    - SMC sockets;

    - Sun RPC protocol;

    - X.25 network layer;

    - XFRM subsystem;

    - AppArmor security module;

    - Simplified Mandatory Access Control Kernel framework;

    - SOF drivers;

    - USB sound devices; (CVE-2025-40005, CVE-2025-71229, CVE-2025-71231, CVE-2025-71232, CVE-2025-71233,     CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265,     CVE-2025-71266, CVE-2025-71267, CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286,     CVE-2025-71291, CVE-2025-71292, CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304,     CVE-2025-71305, CVE-2026-23100, CVE-2026-23169, CVE-2026-23220, CVE-2026-23221, CVE-2026-23222,     CVE-2026-23228, CVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234, CVE-2026-23235,     CVE-2026-23236, CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243,     CVE-2026-23249, CVE-2026-23266, CVE-2026-23267, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392,     CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31411, CVE-2026-31418,     CVE-2026-31436, CVE-2026-31448, CVE-2026-31478, CVE-2026-31607, CVE-2026-31637, CVE-2026-31649,     CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31676, CVE-2026-31682,     CVE-2026-31685, CVE-2026-31687, CVE-2026-31693, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038,     CVE-2026-43071, CVE-2026-43114, CVE-2026-43117, CVE-2026-43123, CVE-2026-43124, CVE-2026-43128,     CVE-2026-43130, CVE-2026-43132, CVE-2026-43133, CVE-2026-43134, CVE-2026-43135, CVE-2026-43136,     CVE-2026-43137, CVE-2026-43139, CVE-2026-43140, CVE-2026-43141, CVE-2026-43143, CVE-2026-43145,     CVE-2026-43147, CVE-2026-43148, CVE-2026-43149, CVE-2026-43150, CVE-2026-43152, CVE-2026-43153,     CVE-2026-43156, CVE-2026-43157, CVE-2026-43158, CVE-2026-43159, CVE-2026-43163, CVE-2026-43167,     CVE-2026-43168, CVE-2026-43169, CVE-2026-43170, CVE-2026-43171, CVE-2026-43173, CVE-2026-43175,     CVE-2026-43180, CVE-2026-43182, CVE-2026-43183, CVE-2026-43184, CVE-2026-43186, CVE-2026-43187,     CVE-2026-43189, CVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43199, CVE-2026-43200,     CVE-2026-43201, CVE-2026-43202, CVE-2026-43203, CVE-2026-43205, CVE-2026-43206, CVE-2026-43207,     CVE-2026-43209, CVE-2026-43211, CVE-2026-43212, CVE-2026-43214, CVE-2026-43215, CVE-2026-43218,     CVE-2026-43221, CVE-2026-43222, CVE-2026-43223, CVE-2026-43225, CVE-2026-43226, CVE-2026-43227,     CVE-2026-43230, CVE-2026-43231, CVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43238,     CVE-2026-43239, CVE-2026-43241, CVE-2026-43242, CVE-2026-43244, CVE-2026-43246, CVE-2026-43248,     CVE-2026-43249, CVE-2026-43250, CVE-2026-43251, CVE-2026-43253, CVE-2026-43255, CVE-2026-43256,     CVE-2026-43257, CVE-2026-43258, CVE-2026-43261, CVE-2026-43262, CVE-2026-43264, CVE-2026-43266,     CVE-2026-43268, CVE-2026-43269, CVE-2026-43270, CVE-2026-43271, CVE-2026-43273, CVE-2026-43275,     CVE-2026-43277, CVE-2026-43278, CVE-2026-43279, CVE-2026-43283, CVE-2026-43287, CVE-2026-43288,     CVE-2026-43289, CVE-2026-43291, CVE-2026-43295, CVE-2026-43296, CVE-2026-43297, CVE-2026-43300,     CVE-2026-43302, CVE-2026-43304, CVE-2026-43312, CVE-2026-43313, CVE-2026-43314, CVE-2026-43315,     CVE-2026-43316, CVE-2026-43317, CVE-2026-43318, CVE-2026-43319, CVE-2026-43320, CVE-2026-43341,     CVE-2026-43378, CVE-2026-43383, CVE-2026-43384, CVE-2026-43406, CVE-2026-43407, CVE-2026-43414,     CVE-2026-43493, CVE-2026-43494, CVE-2026-43501, CVE-2026-45847, CVE-2026-45848, CVE-2026-45849,     CVE-2026-45851, CVE-2026-45852, CVE-2026-45856, CVE-2026-45857, CVE-2026-45859, CVE-2026-45860,     CVE-2026-45861, CVE-2026-45862, CVE-2026-45864, CVE-2026-45865, CVE-2026-45866, CVE-2026-45867,     CVE-2026-45868, CVE-2026-45869, CVE-2026-45870, CVE-2026-45871, CVE-2026-45872, CVE-2026-45873,     CVE-2026-45875, CVE-2026-45877, CVE-2026-45878, CVE-2026-45879, CVE-2026-45880, CVE-2026-45881,     CVE-2026-45882, CVE-2026-45883, CVE-2026-45884, CVE-2026-45885, CVE-2026-45886, CVE-2026-45890,     CVE-2026-45891, CVE-2026-45893, CVE-2026-45895, CVE-2026-45902, CVE-2026-45904, CVE-2026-45905,     CVE-2026-45910, CVE-2026-45912, CVE-2026-45913, CVE-2026-45914, CVE-2026-45915, CVE-2026-45916,     CVE-2026-45917, CVE-2026-45919, CVE-2026-45921, CVE-2026-45923, CVE-2026-45928, CVE-2026-45935,     CVE-2026-45936, CVE-2026-45938, CVE-2026-45941, CVE-2026-45946, CVE-2026-45947, CVE-2026-45948,     CVE-2026-45954, CVE-2026-45957, CVE-2026-45960, CVE-2026-45962, CVE-2026-45964, CVE-2026-45965,     CVE-2026-45968, CVE-2026-45969, CVE-2026-45970, CVE-2026-45972, CVE-2026-45973, CVE-2026-45974,     CVE-2026-45976, CVE-2026-45978, CVE-2026-45981, CVE-2026-45982, CVE-2026-45983, CVE-2026-45984,     CVE-2026-45988, CVE-2026-46043, CVE-2026-46115, CVE-2026-46119, CVE-2026-46135, CVE-2026-46185,     CVE-2026-46195, CVE-2026-46243, CVE-2026-46244, CVE-2026-46246, CVE-2026-46247, CVE-2026-46249,     CVE-2026-46250, CVE-2026-46251, CVE-2026-46253, CVE-2026-46254, CVE-2026-46255, CVE-2026-46259,     CVE-2026-46260, CVE-2026-46261, CVE-2026-46265, CVE-2026-46266, CVE-2026-46267, CVE-2026-46270,     CVE-2026-46289, CVE-2026-46323, CVE-2026-46328)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2195-1 advisory.

    The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
    - CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache     (bsc#1264013).
    - CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
    - CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
    - CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
    - CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
    - CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
    - CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
    - CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
    - CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
    - CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
    - CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
    - CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
    - CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
    - CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold     (bsc#1261797).
    - CVE-2026-31436: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()     (bsc#1262602).
    - CVE-2026-31470: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (bsc#1262665).
    - CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).
    - CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).
    - CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer     (bsc#1263095).
    - CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in     l2cap_ecred_data_rcv()       (bsc#1262734).
    - CVE-2026-31528: perf: Make sure to use pmu_ctx->pmu for groups (bsc#1263001).
    - CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).
    - CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263065).
    - CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).
    - CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
    - CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723).
    - CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600).
    - CVE-2026-31622: NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (bsc#1263797).
    - CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).
    - CVE-2026-31656: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170).
    - CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).
    - CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).
    - CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).
    - CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).
    - CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).
    - CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).
    - CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).
    - CVE-2026-46331: kernel: net/sched: fix pedit partial COW leading to page cache
    - CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).
    - CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).
    - CVE-2026-43038: ipv6: icmp: clear skb2->cb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).
    - CVE-2026-43044: crypto: caam - fix DMA corruption on long hmac keys (bsc#1264087).
    - CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).
    - CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264482).
    - CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr.
    - CVE-2026-43126: ALSA: mixer: oss: Add card disconnect checkpoints (bsc#1264634).
    - CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).
    - CVE-2026-43214: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (bsc#1264651).
    - CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).
    - CVE-2026-43330: crypto: caam - fix overflow on long hmac keys (bsc#1264801).
    - CVE-2026-43334: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (bsc#1265090).
    - CVE-2026-43365: xfs: fix undersized l_iclog_roundoff values (bsc#1265119).
    - CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116).
    - CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265126).
    - CVE-2026-43494: net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).

    The following non security issues were fixed:

    - btrfs: reject root items with drop_progress and zero drop_level (git-fixes).
    - btrfs: replace BUG() with error handling in __btrfs_balance() (git-fixes).
    - check-for-config-changes: Exclude CC_MS_EXTENSIONS.
    - check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}.
    - dm init: ensure device probing has finished in dm-mod.waitfor= (git-fixes).
    - hv_sock: fix ARM64 support (git-fixes).
    - ice: set max queues in alloc_etherdev_mqs() (git-fixes).
    - kdump, documentation: describe craskernel CMA reservation (jsc#PED-7249).
    - mkspec: Add signature to source list only when it exists.
    - net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).
    - net/sched: fix pedit partial COW leading to page cache corruption (bsc#1265421).
    - net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes).
    - net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).
    - net: mana: Don't overwrite port probe error with add_adev result (git-fixes).
    - net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846).
    - net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes).
    - net: mana: Fix RX skb truesize accounting (bsc#1248754).
    - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown (git-fixes).
    - net: mana: Guard mana_remove against double invocation (git-fixes).
    - net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes).
    - net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes).
    - net: mana: Init gf_stats_work before potential error paths in probe (git-fixes).
    - net: mana: Init link_change_work before potential error paths in probe (git-fixes).
    - net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).
    - net: mana: Set default number of queues to 16 (bsc#1261648).
    - net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).
    - net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes).
    - net: mana: Use pci_name() for debugfs directory naming (git-fixes).
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718).
    - ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718).
    - PCI: hv: Set default NUMA node to 0 for devices without affinity info (git-fixes).
    - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).
    - RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).
    - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).
    - RDMA/mana: Validate rx_hash_key_len (git-fixes).
    - RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (git-fixes).
    - RDMA/mana_ib: Disable RX steering on RSS QP destroy (git-fixes).
    - RDMA/mana_ib: Support memory windows (git-fixes).
    - sched/balancing: Switch the 'DEFINE_SPINLOCK(balancing)' spinlock into an 'atomic_t     sched_balance_running' flag       (bsc#1253754).
    - sched/fair: Change likelyhood of nohz.nr_cpus (bsc#1234634 bsc#1258961).
    - sched/fair: Have SD_SERIALIZE affect newidle balancing (bsc#1253754).
    - sched/fair: Move checking for nohz cpus after time check (bsc#1234634 bsc#1258961).
    - sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead (bsc#1234634 bsc#1258961).
    - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (bsc#1253754).
    - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes).
    - scsi: target: iscsi: validate CHAP_R length before base64 decode (bsc#1265449).
    - tty: tty_io: update timestamps on all device nodes (bsc#1262020).
    - virt: tdx-guest: Return error for GetQuote failures (git-fixes).
    - workqueue: Break up enum definitions and give names to the types (bsc#1260522).
    - workqueue: Clean up enum work_bits and related constants (bsc#1260522).
    - workqueue: Factor out work_grab_pending() from __cancel_work_sync() (bsc#1260522).
    - workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask() (bsc#1260522).
    - workqueue: Implement disable/enable for (delayed) work items (bsc#1260522).
    - workqueue: Introduce work_cancel_flags (bsc#1260522).
    - workqueue: Make @flags handling consistent across set_work_data() and friends (bsc#1260522).
    - workqueue: Preserve OFFQ bits in cancel[_sync] paths (bsc#1260522).
    - workqueue: Rename __cancel_work_timer() to __cancel_timer_sync() (bsc#1260522).
    - workqueue: Reorganize flush and cancel[_sync] functions (bsc#1260522).
    - Xarray: do not return sibling entries from xas_find_marked() (bsc#1263815).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() Add SRCU read-side protection when     reading PDPTR registers in __get_sregs2(). Reading PDPTRs may trigger access to guest memory:
    kvm_pdptr_read() -> svm_cache_reg() -> load_pdptrs() -> kvm_vcpu_read_guest_page() ->     kvm_vcpu_gfn_to_memslot() kvm_vcpu_gfn_to_memslot() dereferences memslots via __kvm_memslots(), which uses     srcu_dereference_check() and requires either kvm->srcu or kvm->slots_lock to be held. Currently only     vcpu->mutex is held, triggering lockdep warning: ============================= WARNING: suspicious RCU     usage in kvm_vcpu_gfn_to_memslot 6.12.59+ #3 Not tainted include/linux/kvm_host.h:1062 suspicious     rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2,     debug_locks = 1 1 lock held by syz.5.1717/15100: #0: ff1100002f4b00b0 (&vcpu->mutex){+.+.}-{3:3}, at:
    kvm_vcpu_ioctl+0x1d5/0x1590 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline]     dump_stack_lvl+0xf0/0x120 lib/dump_stack.c:120 lockdep_rcu_suspicious+0x1e3/0x270     kernel/locking/lockdep.c:6824 __kvm_memslots include/linux/kvm_host.h:1062 [inline] __kvm_memslots     include/linux/kvm_host.h:1059 [inline] kvm_vcpu_memslots include/linux/kvm_host.h:1076 [inline]     kvm_vcpu_gfn_to_memslot+0x518/0x5e0 virt/kvm/kvm_main.c:2617 kvm_vcpu_read_guest_page+0x27/0x50     virt/kvm/kvm_main.c:3302 load_pdptrs+0xff/0x4b0 arch/x86/kvm/x86.c:1065 svm_cache_reg+0x1c9/0x230     arch/x86/kvm/svm/svm.c:1688 kvm_pdptr_read arch/x86/kvm/kvm_cache_regs.h:141 [inline] __get_sregs2     arch/x86/kvm/x86.c:11784 [inline] kvm_arch_vcpu_ioctl+0x3e20/0x4aa0 arch/x86/kvm/x86.c:6279     kvm_vcpu_ioctl+0x856/0x1590 virt/kvm/kvm_main.c:4663 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl     fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:893     do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xbd/0x1d0 arch/x86/entry/common.c:83     entry_SYSCALL_64_after_hwframe+0x77/0x7f Found by Linux Verification Center (linuxtesting.org) with     Syzkaller. (CVE-2026-43214)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8492-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - MIPS architecture;

    - PowerPC architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - ACPI drivers;

    - ATM drivers;

    - RNBD block device driver;

    - Ublk userspace block driver;

    - Bus devices;

    - Character device driver;

    - TPM device driver;

    - Clock framework and drivers;

    - Clocksource drivers;

    - CPU idle management framework;

    - Hardware crypto device drivers;

    - DMA engine subsystem;

    - EFI core;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - IIO subsystem;

    - InfiniBand drivers;

    - IOMMU subsystem;

    - Multiple devices driver;

    - Media drivers;

    - Multifunction device drivers;

    - Broadcom VK accelerator driver;

    - MOST (Media Oriented Systems Transport) drivers;

    - MTD block device drivers;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - NTB driver;

    - NVME drivers;

    - PCI subsystem;

    - Performance monitor drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - Power supply drivers;

    - RapidIO drivers;

    - RAS (Reliability, Availability, Serviceability) subsystem;

    - Remote Processor subsystem;

    - RPMSG subsystem;

    - S/390 drivers;

    - SCSI subsystem;

    - MediaTek SoC drivers;

    - Texas Instruments SoC drivers;

    - SPI subsystem;

    - Greybus lights staging drivers;

    - Realtek RTL8723BS SDIO drivers;

    - UFS subsystem;

    - ChipIdea USB driver;

    - DesignWare USB3 driver;

    - USB over IP driver;

    - vDPA drivers;

    - Virtio Host (VHOST) subsystem;

    - Framebuffer layer;

    - BTRFS file system;

    - File systems infrastructure;

    - Ceph distributed file system;

    - Ext4 file system;

    - F2FS file system;

    - FAT file system;

    - GFS2 file system;

    - HFS+ file system;

    - JFS file system;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - OCFS2 file system;

    - Proc file system;

    - Pstore file system;

    - Diskquota system;

    - SMB network file system;

    - XFS file system;

    - Audit subsystem;

    - Memory Management;

    - IPv6 networking;

    - Netfilter;

    - Tracing infrastructure;

    - Kernel kexec() syscall;

    - RCU subsystem;

    - Scheduler infrastructure;

    - Scatterlist API;

    - 9P file system network protocol;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - B.A.T.M.A.N. meshing protocol;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - KCM (Kernel Connection Multiplexor) sockets driver;

    - Multipath TCP;

    - NFC subsystem;

    - RDS protocol;

    - RxRPC session sockets;

    - Network traffic control;

    - SMC sockets;

    - Sun RPC protocol;

    - X.25 network layer;

    - XFRM subsystem;

    - AppArmor security module;

    - Simplified Mandatory Access Control Kernel framework;

    - SOF drivers;

    - USB sound devices; (CVE-2025-40005, CVE-2025-71229, CVE-2025-71231, CVE-2025-71232, CVE-2025-71233,     CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265,     CVE-2025-71266, CVE-2025-71267, CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286,     CVE-2025-71291, CVE-2025-71292, CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304,     CVE-2025-71305, CVE-2026-23100, CVE-2026-23169, CVE-2026-23220, CVE-2026-23221, CVE-2026-23222,     CVE-2026-23228, CVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234, CVE-2026-23235,     CVE-2026-23236, CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243,     CVE-2026-23249, CVE-2026-23266, CVE-2026-23267, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392,     CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31411, CVE-2026-31418,     CVE-2026-31436, CVE-2026-31448, CVE-2026-31478, CVE-2026-31607, CVE-2026-31637, CVE-2026-31649,     CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31682, CVE-2026-31685,     CVE-2026-31687, CVE-2026-31693, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038, CVE-2026-43071,     CVE-2026-43114, CVE-2026-43117, CVE-2026-43123, CVE-2026-43124, CVE-2026-43128, CVE-2026-43130,     CVE-2026-43132, CVE-2026-43133, CVE-2026-43134, CVE-2026-43135, CVE-2026-43136, CVE-2026-43137,     CVE-2026-43139, CVE-2026-43140, CVE-2026-43141, CVE-2026-43143, CVE-2026-43145, CVE-2026-43147,     CVE-2026-43148, CVE-2026-43149, CVE-2026-43150, CVE-2026-43152, CVE-2026-43153, CVE-2026-43156,     CVE-2026-43157, CVE-2026-43158, CVE-2026-43159, CVE-2026-43163, CVE-2026-43167, CVE-2026-43168,     CVE-2026-43169, CVE-2026-43170, CVE-2026-43171, CVE-2026-43173, CVE-2026-43175, CVE-2026-43180,     CVE-2026-43182, CVE-2026-43183, CVE-2026-43184, CVE-2026-43186, CVE-2026-43187, CVE-2026-43189,     CVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43199, CVE-2026-43200, CVE-2026-43201,     CVE-2026-43202, CVE-2026-43203, CVE-2026-43205, CVE-2026-43206, CVE-2026-43207, CVE-2026-43209,     CVE-2026-43211, CVE-2026-43212, CVE-2026-43214, CVE-2026-43215, CVE-2026-43218, CVE-2026-43221,     CVE-2026-43222, CVE-2026-43223, CVE-2026-43225, CVE-2026-43226, CVE-2026-43227, CVE-2026-43230,     CVE-2026-43231, CVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43238, CVE-2026-43239,     CVE-2026-43241, CVE-2026-43242, CVE-2026-43244, CVE-2026-43246, CVE-2026-43248, CVE-2026-43249,     CVE-2026-43250, CVE-2026-43251, CVE-2026-43253, CVE-2026-43255, CVE-2026-43256, CVE-2026-43257,     CVE-2026-43258, CVE-2026-43261, CVE-2026-43262, CVE-2026-43264, CVE-2026-43266, CVE-2026-43268,     CVE-2026-43269, CVE-2026-43270, CVE-2026-43271, CVE-2026-43273, CVE-2026-43275, CVE-2026-43277,     CVE-2026-43278, CVE-2026-43279, CVE-2026-43283, CVE-2026-43287, CVE-2026-43288, CVE-2026-43289,     CVE-2026-43291, CVE-2026-43295, CVE-2026-43296, CVE-2026-43297, CVE-2026-43300, CVE-2026-43302,     CVE-2026-43304, CVE-2026-43312, CVE-2026-43313, CVE-2026-43314, CVE-2026-43315, CVE-2026-43316,     CVE-2026-43317, CVE-2026-43318, CVE-2026-43319, CVE-2026-43320, CVE-2026-43341, CVE-2026-43378,     CVE-2026-43383, CVE-2026-43384, CVE-2026-43406, CVE-2026-43407, CVE-2026-43414, CVE-2026-43493,     CVE-2026-43501, CVE-2026-45847, CVE-2026-45848, CVE-2026-45849, CVE-2026-45851, CVE-2026-45852,     CVE-2026-45856, CVE-2026-45857, CVE-2026-45859, CVE-2026-45860, CVE-2026-45861, CVE-2026-45862,     CVE-2026-45864, CVE-2026-45865, CVE-2026-45866, CVE-2026-45867, CVE-2026-45868, CVE-2026-45869,     CVE-2026-45870, CVE-2026-45871, CVE-2026-45872, CVE-2026-45873, CVE-2026-45875, CVE-2026-45877,     CVE-2026-45878, CVE-2026-45879, CVE-2026-45880, CVE-2026-45881, CVE-2026-45882, CVE-2026-45883,     CVE-2026-45884, CVE-2026-45885, CVE-2026-45886, CVE-2026-45890, CVE-2026-45891, CVE-2026-45893,     CVE-2026-45895, CVE-2026-45902, CVE-2026-45904, CVE-2026-45905, CVE-2026-45910, CVE-2026-45912,     CVE-2026-45913, CVE-2026-45914, CVE-2026-45915, CVE-2026-45916, CVE-2026-45917, CVE-2026-45919,     CVE-2026-45921, CVE-2026-45923, CVE-2026-45928, CVE-2026-45935, CVE-2026-45936, CVE-2026-45938,     CVE-2026-45941, CVE-2026-45946, CVE-2026-45947, CVE-2026-45948, CVE-2026-45954, CVE-2026-45957,     CVE-2026-45960, CVE-2026-45962, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968, CVE-2026-45969,     CVE-2026-45970, CVE-2026-45972, CVE-2026-45973, CVE-2026-45974, CVE-2026-45976, CVE-2026-45978,     CVE-2026-45981, CVE-2026-45982, CVE-2026-45983, CVE-2026-45984, CVE-2026-45988, CVE-2026-46043,     CVE-2026-46115, CVE-2026-46119, CVE-2026-46135, CVE-2026-46185, CVE-2026-46195, CVE-2026-46243,     CVE-2026-46244, CVE-2026-46246, CVE-2026-46247, CVE-2026-46249, CVE-2026-46250, CVE-2026-46251,     CVE-2026-46253, CVE-2026-46254, CVE-2026-46255, CVE-2026-46259, CVE-2026-46260, CVE-2026-46261,     CVE-2026-46265, CVE-2026-46266, CVE-2026-46267, CVE-2026-46270, CVE-2026-46289, CVE-2026-46328)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50372 advisory.

    - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)   {CVE-2026-46331}
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner)  [Orabug: 39668743]     {CVE-2026-46242}
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen)  [Orabug: 39656679]     {CVE-2026-52943}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39548792]     {CVE-2025-10263}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (Ilya Maximets) {CVE-2026-46165}
    - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Ankit Soni)     {CVE-2026-43220}
    - usb: ulpi: fix memory leak on ulpi_register() error paths (Felix Gu) {CVE-2026-46109}
    - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39463671]     {CVE-2026-46243}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug:
    39368826,39441323] {CVE-2026-43503,CVE-2026-46300}
    - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39368826]     {CVE-2026-46300}
    - netfilter: reject zero shift in nft_bitwise (Kai Ma) [Orabug: 39452464] {CVE-2026-46101}
    - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Andrea Mayer) [Orabug: 39452457]     {CVE-2026-46099}
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure (Deepanshu Kartikey) [Orabug: 39452739]     {CVE-2026-46048}
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Greg Kroah-Hartman) [Orabug: 39426003]     {CVE-2026-43501}
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (Takashi Iwai) [Orabug: 39452746]     {CVE-2026-45992}
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xiang Mei) [Orabug: 39205989]     {CVE-2026-31419}
    - crypto: authencesn - reject short ahash digests during instance creation (Yucheng Lu) [Orabug: 39452231]     {CVE-2026-46033}
    - spi: fix resource leaks on device setup failure (Johan Hovold) [Orabug: 39452400] {CVE-2026-46083}
    - net: qrtr: ns: Limit the total number of nodes (Manivannan Sadhasivam) [Orabug: 39452123]     {CVE-2026-46003}
    - net: bridge: use a stable FDB dst snapshot in RCU readers (Zhengchuan Liang) [Orabug: 39452411]     {CVE-2026-46086}
    - net: qrtr: ns: Limit the maximum number of lookups (Manivannan Sadhasivam) [Orabug: 39452207]     {CVE-2026-46026}
    - net: qrtr: ns: Limit the maximum server registration per node (Manivannan Sadhasivam) [Orabug: 39410851]     {CVE-2026-43491}
    - RDMA/mana_ib: Disable RX steering on RSS QP destroy (Long Li) [Orabug: 39452406] {CVE-2026-46084}
    - media: rc: igorplugusb: heed coherency rules (Oliver Neukum) [Orabug: 39452432] {CVE-2026-46091}
    - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (Daniel Hodges) [Orabug: 39452343]     {CVE-2026-46069}
    - thermal: core: Fix thermal zone governor cleanup issues (Rafael J. Wysocki) [Orabug: 39452186]     {CVE-2026-46021}
    - smb: client: validate the whole DACL before rewriting it in cifsacl (Michael Bommarito) [Orabug:
    39300611] {CVE-2026-31709}
    - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (Yang Xiuwei) [Orabug: 39452100]     {CVE-2026-45997}
    - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39425998]     {CVE-2026-43499}
    - ceph: only d_add() negative dentries when they are unhashed (Max Kellermann) [Orabug: 39452291]     {CVE-2026-46052}
    - dm mirror: fix integer overflow in create_dirty_log() (Junrui Luo) [Orabug: 39452196] {CVE-2026-46023}
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (Shuvam Pandey) [Orabug: 39452304]     {CVE-2026-46056}
    - tcp: call sk_data_ready() after listener migration (Zhenzhong Wu) [Orabug: 39452159] {CVE-2026-46015}
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (Chia-Ming Chang) [Orabug:
    39452250] {CVE-2026-46040}
    - md/raid5: validate payload size before accessing journal metadata (Junrui Luo) [Orabug: 39452349]     {CVE-2026-46070}
    - md/raid5: fix soft lockup in retry_aligned_read() (Chia-Ming Chang) [Orabug: 39452287] {CVE-2026-46051}
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (Sohei Koyama) [Orabug: 39452269]     {CVE-2026-46046}
    - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (Deepanshu Kartikey) [Orabug:
    39452442] {CVE-2026-46094}
    - io_uring/poll: fix multishot recv missing EOF on wakeup race (Jens Axboe) {CVE-2026-23473}
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Kevin Cheng) [Orabug: 39452372]     {CVE-2026-46076}
    - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (Kevin Cheng) [Orabug: 39452394] {CVE-2026-46082}
    - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (Yosry Ahmed) [Orabug: 39452061]     {CVE-2026-45987}
    - xfs: fix a resource leak in xfs_alloc_buftarg() (Haoxiang Li) [Orabug: 39452131] {CVE-2026-46005}
    - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (Raphael Zimmer) [Orabug:
    39452201] {CVE-2026-46024}
    - ipv4: icmp: validate reply type before using icmp_pointers (Ruide Cao) [Orabug: 39452243]     {CVE-2026-46037}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Hkbinbin) [Orabug: 39452259]     {CVE-2026-46043}
    - net: qrtr: ns: Free the node during ctrl_cmd_bye() (Manivannan Sadhasivam) [Orabug: 39452246]     {CVE-2026-46038}
    - rxrpc: Fix rxkad crypto unalignment handling (David Howells) [Orabug: 39452728] {CVE-2026-46085}
    - ALSA: caiaq: Handle probe errors properly (Takashi Iwai) [Orabug: 39452126] {CVE-2026-46004}
    - rbd: fix null-ptr-deref when device_add_disk() fails (Dawei Feng) [Orabug: 39452385] {CVE-2026-46079}
    - md/raid10: fix deadlock with check operation and nowait requests (Josh Hunt) [Orabug: 39452284]     {CVE-2026-46050}
    - jbd2: fix deadlock in jbd2_journal_cancel_revoke() (Zhang Yi) [Orabug: 39452318] {CVE-2026-46061}
    - erofs: fix the out-of-bounds nameoff handling for trailing dirents (Gao Xiang) [Orabug: 39452380]     {CVE-2026-46078}
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (Harin Lee) [Orabug: 39452280] {CVE-2026-46049}
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() (Vasiliy Kovalev) [Orabug: 39452119]     {CVE-2026-46002}
    - net: qrtr: ns: Fix use-after-free in driver remove() (Manivannan Sadhasivam) [Orabug: 39452274]     {CVE-2026-46047}
    - net: strparser: fix skb_head leak in strp_abort_strp() (Luxiao Xu) [Orabug: 39452468] {CVE-2026-46102}
    - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (Ziqing Chen)     [Orabug: 39452416] {CVE-2026-46088}
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Herbert Xu) [Orabug: 39410863] {CVE-2026-43493}
    - wifi: rtw88: check for PCI upstream bridge existence (Fedor Pchelkin) [Orabug: 39452437]     {CVE-2026-46092}
    - zram: do not forget to endio for partial discard requests (Sergey Senozhatsky) [Orabug: 39452420]     {CVE-2026-46089}
    - ocfs2: split transactions in dio completion to avoid credit exhaustion (Heming Zhao) [Orabug: 39452388]     {CVE-2026-46080}
    - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (Jesse Zhang) [Orabug: 39167551]     {CVE-2026-23468}
    - padata: Fix pd UAF once and for all (Herbert Xu) [Orabug: 38335055] {CVE-2025-38584}
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (Greg Kroah-Hartman) [Orabug: 39452133]     {CVE-2026-46006}
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (Cassio Gabriel) [Orabug: 39452170]     {CVE-2026-46018}
    - Buffer overflow in drivers/xen/sys-hypervisor.c (Juergen Gross) [Orabug: 39305898] {CVE-2026-31786}
    - xen/privcmd: fix double free via VMA splitting (Juergen Gross) [Orabug: 39305908] {CVE-2026-31787}
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing (Anderson Nascimento) [Orabug:
    39300563] {CVE-2026-31696}
    - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31697}
    - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31698}
    - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31699}
    - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (Bingquan Chen) {CVE-2026-31700}
    - ALSA: caiaq: take a reference on the USB device in create_card() (Berk Cem Goksel) [Orabug: 39300586]     {CVE-2026-31701}
    - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (Michael Bommarito) [Orabug:
    39300607] {CVE-2026-31708}
    - smb: client: require a full NFS mode SID before reading mode bits (Michael Bommarito) [Orabug: 39343707]     {CVE-2026-43350}
    - fuse: reject oversized dirents in page cache (Samuel Page) [Orabug: 39300556] {CVE-2026-31694}
    - mm/pagewalk: fix race between concurrent split and refault (Max Boone) [Orabug: 39250782]     {CVE-2026-31456}
    - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (Felix Fietkau) [Orabug: 39167472]     {CVE-2026-23444}
    - mm/userfaultfd: fix hugetlb fault mutex hash calculation (Jianhui Zhou) [Orabug: 39273453]     {CVE-2026-31575}
    - ipv6: add NULL checks for idev in SRv6 paths (Heminhong) [Orabug: 39167467] {CVE-2026-23442}
    - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline (Joseph Qi) [Orabug: 39331090] {CVE-2026-43075}
    - ocfs2: validate inline data i_size during inode read (Deepanshu Kartikey) [Orabug: 39331097]     {CVE-2026-43076}
    - media: as102: fix to not free memory after the device is registered in as102_usb_probe() (Jeongjun Park)     [Orabug: 39273467] {CVE-2026-31578}
    - bcache: fix cached_dev.sb_bio use-after-free and crash (Mingzhe Zou) [Orabug: 39273481] {CVE-2026-31580}
    - ALSA: 6fire: fix use-after-free on disconnect (Berk Cem Goksel) [Orabug: 39273486] {CVE-2026-31581}
    - media: em28xx: fix use-after-free in em28xx_v4l2_open() (Abhishek Kumar) [Orabug: 39273493]     {CVE-2026-31583}
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (Breno Leitao) [Orabug: 39273507]     {CVE-2026-31586}
    - KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug:
    39273521] {CVE-2026-31588}
    - x86-64: rename misleadingly named '__copy_user_nocache()' function (Linus Torvalds) [Orabug: 39323162]     {CVE-2026-43073}
    - kernel: be more careful about dup_mmap() failures and uprobe registering (Liam R. Howlett)     {CVE-2025-21709}
    - gpiolib: fix race condition for gdev->srcu (Pawel Narewski) [Orabug: 38887677] {CVE-2026-22986}
    - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (Sean Christopherson) [Orabug:
    39273529] {CVE-2026-31590}
    - KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (Sean Christopherson)     [Orabug: 39273553] {CVE-2026-31593}
    - ocfs2: handle invalid dinode in ocfs2_group_extend (Zhengyuan Huang) [Orabug: 39273569] {CVE-2026-31596}
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY (Tejas Bharambe) [Orabug: 39273578]     {CVE-2026-31597}
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273586]     {CVE-2026-31598}
    - dcache: Limit the minimal number of bucket to two (Zhihao Cheng) [Orabug: 39323133] {CVE-2026-43071}
    - ALSA: ctxfi: Limit PTP to a single page (Harin Lee) [Orabug: 39273608] {CVE-2026-31602}
    - wifi: rtw88: fix device leak on probe failure (Johan Hovold) [Orabug: 39273620] {CVE-2026-31604}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()(CVE-2026-31586)

    e1000/e1000e: Fix leak in DMA error cleanup(CVE-2026-43445)

    futex: Clear stale exiting pointer in futex_lock_pi() retry path(CVE-2026-31555)

    kexec: derive purgatory entry from symbol(CVE-2026-43289)

    nvme-pci: Fix race bug in nvme_poll_irqdisable()(CVE-2026-43448)

    ext4: avoid infinite loops caused by residual data(CVE-2026-31448)

    mm/userfaultfd: fix hugetlb fault mutex hash calculation(CVE-2026-31575)

    netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()(CVE-2026-31674)

    net: skbuff: propagate shared-frag marker through frag-transfer helpers(CVE-2026-43503)

    crypto: af-alg - fix NULL pointer dereference in scatterwalk(CVE-2026-43043)

    net: bonding: fix NULL deref in bond_debug_rlb_hash_show(CVE-2026-31546)

    drm/ioc32: stop speculation on the drm_compat_ioctl path(CVE-2026-31781)

    ext4: always drain queued discard work in ext4_mb_release()(CVE-2026-43065)

    netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()(CVE-2026-23458)

    x86/platform/uv: Handle deconfigured sockets(CVE-2026-31542)

    USB: core: Limit the length of unkillable synchronous timeouts(CVE-2026-43428)

    cifs: some missing initializations on replay(CVE-2026-31693)

    serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN(CVE-2026-23472)

    EDAC/mc: Fix error path ordering in edac_mc_alloc()(CVE-2026-31689)

    module: Fix kernel panic when a symbol st_shndx is out of bounds(CVE-2026-31521)

    can: gw: fix OOB heap access in cgw_csum_crc8_rel()(CVE-2026-31570)

    ext4: publish jinode after initialization(CVE-2026-31450)

    netfilter: xt_multiport: validate range encoding in checkentry(CVE-2026-31681)

    usb: xhci: Prevent interrupt storm on host controller error (HCE)(CVE-2026-43488)

    netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()(CVE-2026-23457)

    ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio(CVE-2026-31451)

    crypto: caam - fix DMA corruption on long hmac keys(CVE-2026-43044)

    scsi: qla2xxx: Completely fix fcport double free(CVE-2026-43414)

    ext4: reject mount if bigalloc with s_first_data_block != 0(CVE-2026-31447)

    net: ipv6: flowlabel: defer exclusive option free until RCU teardown(CVE-2026-31680)

    spi: use generic driver_override infrastructure(CVE-2026-31487)

    HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure(CVE-2026-43049)

    dmaengine: idxd: Fix not releasing workqueue on .release()(CVE-2026-43064)

    usb: gadget: f_ecm: Fix net_device lifecycle with device_move(CVE-2026-31725)

    crypto: atmel-sha204a - Fix OOM -gt;tfm_count leak(CVE-2026-31391)

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()(CVE-2026-23455)

    scsi: hisi_sas: Fix NULL pointer exception during user_scan()(CVE-2026-43413)

    x86/apic: Disable x2apic on resume if the kernel expects so(CVE-2026-43363)

    netfilter: nf_conntrack_expect: use expect-gt;helper(CVE-2026-31414)

    nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set(CVE-2026-43449)

    HID: core: Mitigate potential OOB by removing bogus memset()(CVE-2026-43048)

    mfd: core: Add locking around #39;mfd_of_node_list#39;(CVE-2026-43143)

    scsi: target: tcm_loop: Drain commands in target_reset handler(CVE-2026-43054)

    ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()(CVE-2026-43313)

    netfilter: nft_ct: fix use-after-free in timeout object destroy(CVE-2026-31665)

    lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()(CVE-2026-43492)

    xfrm: clear trailing padding in build_polexpire()(CVE-2026-31664)

    perf/x86/intel/uncore: Skip discovery table for offline dies(CVE-2026-43079)

    usb: dwc3: gadget: Move vbus draw to workqueue context(CVE-2026-43170)

    net: fix fanout UAF in packet_release() via NETDEV_UP race(CVE-2026-31504)

    usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop(CVE-2026-31728)

    netfilter: ip6t_eui64: reject invalid MAC header for all packets(CVE-2026-31685)

    perf/x86/intel/uncore: Fix die ID init and look up bugs(CVE-2026-43344)

    udp: Fix wildcard bind conflict check when using hash2(CVE-2026-31503)

    net/sched: sch_netem: fix out-of-bounds access in packet corruption(CVE-2026-31675)

    ext4: validate p_idx bounds in ext4_ext_correct_indexes(CVE-2026-31449)

    xfrm: prevent policy_hthresh.work from racing with netns teardown(CVE-2026-31516)

    f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()(CVE-2026-31702)

    KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()(CVE-2026-43265)

    ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()(CVE-2026-43068)

    cifs: Fix locking usage for tcon fields(CVE-2026-43215)

    dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()(CVE-2026-31436)

    fbcon: check return value of con2fb_acquire_newinfo()(CVE-2026-43123)

    xfs: close crash window in attr dabtree inactivation(CVE-2026-43053)

    HID: alps: fix NULL pointer dereference in alps_raw_event()(CVE-2026-31625)

    netfilter: nf_conntrack_expect: skip expectations in other netns via proc(CVE-2026-31496)

    xfs: save ailp before dropping the AIL lock in push callbacks(CVE-2026-31454)

    KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-gt;lock(CVE-2026-31592)

    KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION(CVE-2026-31590)

    net: ethernet: xscale: Check for PTP support properly(CVE-2026-43173)

    HID: magicmouse: Do not crash on missing msc-gt;input(CVE-2026-43140)

    smb: client: fix OOB reads parsing symlink error response(CVE-2026-31613)

    net/sched: cls_flow: fix NULL pointer dereference on shared blocks(CVE-2026-31422)

    xfrm: hold dev ref until after transport_finish NF_HOOK(CVE-2026-31663)

    bpf: Fix regsafe() for pointers to packet(CVE-2026-43030)

    xfs: avoid dereferencing log items after push callbacks(CVE-2026-31453)

    smb: client: prevent races in -gt;query_interfaces()(CVE-2026-43239)

    kprobes: avoid crash when rmmod/insmod after ftrace killed(CVE-2026-43409)

    xfs: fix undersized l_iclog_roundoff values(CVE-2026-43365)

    ixgbevf: add missing negotiate_features op to Hyper-V ops table(CVE-2026-43094)

    arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults(CVE-2026-43486)

    arm64: Add support for TSV110 Spectre-BHB mitigation(CVE-2026-43261)

    KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()(CVE-2026-43214)

    can: raw: fix ro-gt;uniq use-after-free in raw_rcv()(CVE-2026-31532)

    ptrace: slightly saner #39;get_dumpable()#39; logic(CVE-2026-46333)

    openvswitch: validate MPLS set/set_masked payload length(CVE-2026-31679)

    smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path(CVE-2026-31708)

    af_unix: read UNIX_DIAG_VFS data under unix_state_lock(CVE-2026-31673)

    esp: fix skb leak with espintcp and async crypto(CVE-2026-31518)

    smb: client: fix off-by-8 bounds check in check_wsl_eas()(CVE-2026-31614)

    af_key: validate families in pfkey_send_migrate()(CVE-2026-31515)

    USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts(CVE-2026-43429)

    bpf: Fix incorrect pruning due to atomic fetch precision tracking(CVE-2026-43009)

    xfs: stop reclaim before pushing AIL during unmount(CVE-2026-31455)

    netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP(CVE-2026-31424)

    ext4: convert inline data to extents when truncate exceeds inline size(CVE-2026-31452)

    HID: multitouch: Check to ensure report responses match the request(CVE-2026-43047)

    HID: core: clamp report_size in s32ton() to avoid undefined shift(CVE-2026-31624)

    EFI/CPER: don#39;t dump the entire memory region(CVE-2026-43171)

    pstore: ram_core: fix incorrect success return when vmap() fails(CVE-2026-43124)

    xfrm_user: fix info leak in build_report()(CVE-2026-31671)

    KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated(CVE-2026-43483)

    dcache: Limit the minimal number of bucket to two(CVE-2026-43071)

    netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case(CVE-2026-23456)

    dm: clear cloned request bio pointer when last clone bio completes(CVE-2026-43278)

    net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption(CVE-2026-31533)

    netfilter: ipset: drop logically empty buckets in mtype_del(CVE-2026-31418)

    bridge: br_nd_send: linearize skb before parsing ND options(CVE-2026-31682)

    x86/CPU: Fix FPDSS on Zen1(CVE-2026-31628)

    ext4: fix use-after-free in update_super_work when racing with umount(CVE-2026-31446)

    nvmet: move async event work off nvmet-wq(CVE-2026-31557)

    bpf: Reject sleepable kprobe_multi programs at attach time(CVE-2026-43010)

    ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()(CVE-2026-31531)

    hwmon: (pmbus/core) Protect regulator operations with mutex(CVE-2026-31486)

    iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()(CVE-2026-31505)

    bpf: reject direct access to nullable PTR_TO_BUF pointers(CVE-2026-43333)

    netfilter: ctnetlink: use netlink policy range checks(CVE-2026-31495)

    nfsd: fix heap overflow in NFSv4.0 LOCK replay cache(CVE-2026-31402)

    virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false(CVE-2026-31469)

    nvme-pci: ensure we#39;re polling a polled queue(CVE-2026-31523)

    nvdimm/bus: Fix potential use after free in asynchronous initialization(CVE-2026-31399)

    net: bonding: fix use-after-free in bond_xmit_broadcast()(CVE-2026-31419)

    mm/damon/sysfs: check contexts-gt;nr before accessing contexts_arr[0](CVE-2026-31458)

    ipv6: avoid overflows in ip6_datagram_send_ctl()(CVE-2026-31415)

    openvswitch: defer tunnel netdev_put to RCU release(CVE-2026-31678)

    mmc: vub300: fix NULL-deref on disconnect(CVE-2026-31651)

    net: openvswitch: Avoid releasing netdev before teardown completes(CVE-2026-31508)

    netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD(CVE-2026-31428)

    perf: Make sure to use pmu_ctx-gt;pmu for groups(CVE-2026-31528)

    netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp(CVE-2026-31427)

    netfilter: nfnetlink_log: account for netlink header size(CVE-2026-31416)

    X.509: Fix out-of-bounds access when parsing extensions(CVE-2026-31430)

    HID: apple: avoid memory leak in apple_report_fixup()(CVE-2026-31520)

    driver core: platform: use generic driver_override infrastructure(CVE-2026-31527)

    crypto: af_alg - limit RX SG extraction by receive buffer budget(CVE-2026-31677)

    HID: magicmouse: avoid memory leak in magicmouse_report_fixup()(CVE-2026-31522)

    bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing(CVE-2026-23383)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
318286	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:2202-1)	Nessus	SuSE Local Security Checks	2026/6/3	2026/9/18	medium
325012	Ubuntu 22.04 LTS / 24.04 LTS : Linux kernel (Low Latency) vulnerabilities (USN-8497-1)	Nessus	Ubuntu Local Security Checks	2026/7/3	2026/7/6	high
318287	SUSE SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:2195-1)	Nessus	SuSE Local Security Checks	2026/6/3	2026/9/29	high
312878	Linux Distros Unpatched Vulnerability : CVE-2026-43214	Nessus	Misc.	2026/5/7	2026/9/30	high
324048	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:2238-1)	Nessus	SuSE Local Security Checks	2026/7/1	2026/9/29	high
337084	Photon OS 5.0: Linux PHSA-2026-5.0-91-0837	Nessus	PhotonOS Local Security Checks	2026/8/18	2026/8/25	high
325011	Ubuntu 22.04 LTS / 24.04 LTS : Linux kernel vulnerabilities (USN-8492-1)	Nessus	Ubuntu Local Security Checks	2026/7/3	2026/7/30	high
305231	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1543)	Nessus	Amazon Linux Local Security Checks	2026/4/7	2026/6/17	high
325292	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50372)	Nessus	Oracle Linux Local Security Checks	2026/7/6	2026/7/8	high
332914	EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-2930)	Nessus	Huawei Local Security Checks	2026/8/6	2026/10/15	high

检测

插件搜索

medium

high

high

high

high

high

high

high

high

high