According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    netdevsim: zero initialize struct iphdr in dummy sk_buff(CVE-2026-52985)

    drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED(CVE-2026-53285)

    ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options(CVE-2026-53249)

    RDMA: During rereg_mr ensure that REREG_ACCESS is compatible(CVE-2026-52908)

    sctp: disable BH before calling udp_tunnel_xmit_skb()(CVE-2026-53070)

    thermal: core: Fix thermal zone device registration error path(CVE-2026-43332)

    vrf: Fix a potential NPD when removing a port from a VRF(CVE-2026-52925)

    netfilter: nfnetlink_osf: fix out-of-bounds read on option matching(CVE-2026-52999)

    USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()(CVE-2026-53195)

    netfilter: nft_fib: fix stale stack leak via the OIFNAME register(CVE-2026-53134)

    crypto: ccp - copy IV using skcipher ivsize(CVE-2026-53016)

    KVM: x86: Fix shadow paging use-after-free due to unexpected GFN(CVE-2026-46113)

    signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()(CVE-2026-53352)

    netfilter: nf_conntrack_sip: don't use simple_strtoul(CVE-2026-52986)

    inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush(CVE-2026-53175)

    ipc/shm: serialize orphan cleanup with shm_nattch updates(CVE-2026-52930)

    Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow     an attacker to corrupt instructions executed at a different privilege level, potentially resulting in     privilege escalation.(CVE-2025-54518)

    netfilter: x_tables: avoid leaking percpu counter pointers(CVE-2026-53219)

    fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling(CVE-2026-52946)

    net/sched: act_api: use RCU with deferred freeing for action lifecycle(CVE-2026-53264)

    udp: clear skb-dev before running a sockmap verdict(CVE-2026-53184)

    block: add pgmap check to biovec_phys_mergeable(CVE-2026-46115)

    bpf, sockmap: Fix af_unix null-ptr-deref in proto update(CVE-2026-53034)

    nfs: return EISDIR on nfs3_proc_create if d_alias is a dir(CVE-2026-43470)

    netfilter: nf_tables: use list_del_rcu for netlink hooks(CVE-2026-46324)

    mm/huge_memory: update file PMD counter before folio_put()(CVE-2026-53189)

    bpf, arm64: Fix off-by-one in check_imm signed range check(CVE-2026-53036)

    fsnotify: fix inode reference leak in fsnotify_recalc_mask()(CVE-2026-52990)

    drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths(CVE-2026-53313)

    macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF(CVE-2026-53013)

    mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison(CVE-2026-53207)

    i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl(CVE-2026-52948)

    USB: serial: omninet: fix memory corruption with small endpoint(CVE-2026-63928)

    netfilter: ip6t_hbh: reject oversized option lists(CVE-2026-52915)

    ice: fix NULL pointer dereference in ice_reset_all_vfs()(CVE-2026-53289)

    sctp: purge outqueue on stale COOKIE-ECHO handling(CVE-2026-52924)

    dm cache: fix dirty mapping checking in passthrough mode switching(CVE-2026-53061)

    md: wake raid456 reshape waiters before suspend(CVE-2026-53123)

    apparmor: fix rlimit for posix cpu timers(CVE-2026-46328)

    KVM: x86: check for nEPT/nNPT in slow flush hypercalls(CVE-2026-46131)

    dm cache policy smq: check allocation under invalidate lock(CVE-2026-53265)

    crypto: af_alg - Cap AEAD AD length to 0x80000000(CVE-2026-52972)

    thunderbolt: Bound root directory content to block size(CVE-2026-53149)

    dm cache: fix null-deref with concurrent writes in passthrough mode(CVE-2026-53064)

    sctp: validate embedded INIT chunk and address list lengths in cookie(CVE-2026-53224)

    mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock(CVE-2026-46121)

    smb/client: fix possible infinite loop and oob read in symlink_data()(CVE-2026-52967)

    ALSA: hda/conexant: Fix missing error check for jack detection(CVE-2026-53291)

    nexthop: fix IPv6 route referencing IPv4 nexthop(CVE-2026-53012)

    mailbox: add sanity check for channel array(CVE-2026-53295)

    USB: serial: cypress_m8: fix memory corruption with small endpoint(CVE-2026-63956)

    bpf: Free reuseport cBPF prog after RCU grace period.(CVE-2026-52910)

    ipv6: sit: reload inner IPv6 header after GSO offloads(CVE-2026-53228)

    crypto: hisilicon/sec2 - prevent req used-after-free for sec(CVE-2026-53055)

    drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()(CVE-2026-53190)

    iommu/vt-d: Fix oops due to out of scope access(CVE-2026-52953)

    netfilter: bridge: make ebt_snat ARP rewrite writable(CVE-2026-53266)

    bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops(CVE-2026-53078)

    thunderbolt: Validate XDomain request packet size before type cast(CVE-2026-53147)

    sched/psi: fix race between file release and pressure write(CVE-2026-52991)

    fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios(CVE-2026-53167)

    hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf(CVE-2026-53199)

    drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()(CVE-2026-53330)

    ipc: limit next_id allocation to the valid ID range(CVE-2026-52923)

    dm cache: fix write hang in passthrough mode(CVE-2026-53063)

    sctp: diag: reject stale associations in dump_one path(CVE-2026-52917)

    bpf: Fix OOB in pcpu_init_value(CVE-2026-53076)

    net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr(CVE-2026-53245)

    sctp: stream: fully roll back denied add-stream state(CVE-2026-52929)

    selinux: allow multiple opens of /sys/fs/selinux/policy(CVE-2026-46302)

    vsock/virtio: fix potential unbounded skb queue(CVE-2026-53132)

    scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf(CVE-2026-63887)

    ipv6: fix possible UAF in icmpv6_rcv()(CVE-2026-53006)

    bpf: Fix NULL deref in map_kptr_match_type for scalar regs(CVE-2026-53032)

    apparmor: Fix  Optimize table creation from possibly unaligned memory(CVE-2026-45893)

    l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()(CVE-2026-53262)

    mm/hugetlb: restore reservation on error in hugetlb folio copy paths(CVE-2026-53154)

    thunderbolt: Reject zero-length property entries in validator(CVE-2026-53150)

    crypto: caam - guard HMAC key hex dumps in hash_digest_key(CVE-2026-46291)

    netfilter: revalidate bridge ports(CVE-2026-53220)

    padata: Put CPU offline callback in ONLINE section to allow failure(CVE-2026-53314)

    USB: serial: keyspan: fix missing indat transfer sanity check(CVE-2026-63900)

    bpf, sockmap: Fix af_unix iter deadlock(CVE-2026-53035)

    drm/amd/display: Clamp VBIOS HDMI retimer register count to array size(CVE-2026-53136)

    scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()(CVE-2026-63888)

    bpf, sockmap: Take state lock for af_unix iter(CVE-2026-53033)

    bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path(CVE-2026-53096)

    bonding: fix type confusion in bond_setup_by_slave()(CVE-2026-43456)

    USB: serial: belkin_sa: validate interrupt status length(CVE-2026-63903)

    netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check(CVE-2026-52998)

    scsi: target: iscsi: Validate CHAP_R length before base64 decode(CVE-2026-63886)

    net: phy: clean the sfp upstream if phy probing fails(CVE-2026-53232)

    netfilter: nf_queue: hold bridge skb-dev while queued(CVE-2026-52912)

    netfilter: nf_conntrack: destroy stale expectfn expectations on unregister(CVE-2026-53349)

    netfilter: nft_exthdr: fix register tracking for F_PRESENT flag(CVE-2026-53218)

    selinux: fix overlayfs mmap() and mprotect() access checks(CVE-2026-46054)

    futex: Prevent lockup in requeue-PI during signal/ timeout wakeup(CVE-2026-52977)

    Arm C1-Ultra, C1-Premium, Neoverse V3  V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1,     Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1  X1C, Cortex-A710, Cortex-A78, A78AE  A78C,     Cortex-A77, Cortex-A76  A76A may allow writes to resources owned by a higher exception     level.(CVE-2025-10263)

    netfilter: nft_tunnel: fix use-after-free on object destroy(CVE-2026-53212)

    io-wq: check that the predecessor is hashed in io_wq_remove_pending()(CVE-2026-46274)

    thunderbolt: Limit XDomain response copy to actual frame size(CVE-2026-53146)

    ipv6: Fix out-of-bound access in fib6_add_rt2node().(CVE-2026-46260)

    sctp: fix uninit-value in __sctp_rcv_asconf_lookup()(CVE-2026-53225)

    fuse: reject fuse_notify() pagecache ops on directories(CVE-2026-53168)

    USB: serial: cypress_m8: validate interrupt packet headers(CVE-2026-63902)

    ACPI: processor: Fix previous acpi_processor_errata_piix4() fix(CVE-2026-23443)

    netfilter: nft_inner: Fix IPv6 inner_thoff desync(CVE-2026-46244)

    af_unix: Drop all SCM attributes for SOCKMAP.(CVE-2026-53005)

    tun: free page on build_skb failure in tun_xdp_one()(CVE-2026-46322)

    netfilter: synproxy: add mutex to guard hook reference counting(CVE-2026-53269)

    udf: reject descriptors with oversized CRC length(CVE-2026-53369)

    ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access(CVE-2026-46094)

    crypto: jitterentropy - replace long-held spinlock with mutex(CVE-2026-52936)

    ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()(CVE-2026-53221)

    zram: fix use-after-free in zram_bvec_write_partial()(CVE-2026-53185)

    af_unix: Reject SIOCATMARK on non-stream sockets(CVE-2026-52928)

    efi: Fix reservation of unaccepted memory table(CVE-2026-45851)

    netfilter: nft_ct: fix missing expect put in obj eval(CVE-2026-52970)

    net/sched: netem: fix queue limit check to include reordered packets(CVE-2026-52984)

    ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()(CVE-2026-45982)

    qed: fix double free in qed_cxt_tables_alloc()(CVE-2026-64118)

    regulator: core: fix locking in regulator_resolve_supply() error path(CVE-2026-46252)

    mm/vmalloc: take vmap_purge_lock in shrinker(CVE-2026-46093)

    netfilter: require Ethernet MAC header before using eth_hdr()(CVE-2026-53131)

    sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing(CVE-2026-53246)

    net: guard timestamp cmsgs to real error queue skbs(CVE-2026-53223)

    quota: Fix race of dquot_scan_active() with quota deactivation(CVE-2026-53050)

    RDMA/umem: Fix truncation for block sizes = 4G(CVE-2026-53133)

    vdpa: use generic driver_override infrastructure(CVE-2026-53118)

    drm/amd/display: Use krealloc_array() in dal_vector_reserve()(CVE-2026-53329)

    io_uring/poll: fix signed comparison in io_poll_get_ownership()(CVE-2026-52933)

    net: gro: don't merge zcopy skbs(CVE-2026-46323)

    netfilter: ebtables: fix OOB read in compat_mtw_from_user(CVE-2026-52927)

    netfilter: conntrack: remove sprintf usage(CVE-2026-53002)

    tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR(CVE-2026-52937)

    dm log: fix out-of-bounds write due to region_count overflow(CVE-2026-53059)

    inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP(CVE-2026-46266)

    netfilter: xt_policy: fix strict mode inbound policy matching(CVE-2026-52920)

    iommu/amd: Fix clone_alias() to use the original device's devid(CVE-2026-53053)

    bpf: Fix stale offload-prog pointer after constant blinding(CVE-2026-53094)

    netlabel: validate unlabeled address and mask attribute lengths(CVE-2026-53238)

    media: videobuf2: Set vma_flags in vb2_dma_sg_mmap(CVE-2026-46312)

    pmdomain: core: Fix detach procedure for virtual devices in genpd(CVE-2026-46292)

    erofs: fix use-after-free on sbi-sync_decompress(CVE-2026-53272)

    audit: fix incorrect inheritable capability in CAPSET records(CVE-2026-53287)

    nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers(CVE-2026-52989)

    ipvs: clear the svc scheduler ptr early on edit(CVE-2026-53270)

    net: pull headers in qdisc_pkt_len_segs_init()(CVE-2026-53091)

    sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks(CVE-2026-53004)

    bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap(CVE-2026-53111)

    ixgbevf: fix use-after-free in VEPA multicast source pruning(CVE-2026-64113)

    netfilter: xtables: restrict several matches to inet family(CVE-2026-53001)

    usb: typec: altmodes/displayport: validate count before reading Status Update VDO(CVE-2026-63961)

    ppp: require CAP_NET_ADMIN in target netns for unattached ioctls(CVE-2026-53075)

    net: tls: fix strparser anchor skb leak on offload RX setup failure(CVE-2026-52974)

    thunderbolt: Clamp XDomain response data copy to allocation size(CVE-2026-53148)

    locking/rtmutex: Skip remove_waiter() when waiter is not enqueued(CVE-2026-53163)

    bpf: Fix ld_{abs,ind} failure path analysis in subprogs(CVE-2026-53090)

    ice: fix double-free of tx_buf skb(CVE-2026-53009)

    net: openvswitch: fix possible kfree_skb of ERR_PTR(CVE-2026-53227)

    xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()(CVE-2026-53239)

    USB: serial: mct_u232: fix missing interrupt-in transfer sanity check(CVE-2026-63897)

    ip6_vti: set netns_immutable on the fallback device.(CVE-2026-52909)

    HID: usbhid: fix deadlock in hid_post_reset()(CVE-2026-53037)

    smb: client: fix potential UAF and double free in smb2_open_file()(CVE-2026-45972)

    bnxt_en: Fix NULL pointer dereference(CVE-2026-53177)

    netfilter: nf_log: validate MAC header was set before dumping it(CVE-2026-52942)

    dm cache policy smq: fix missing locks in invalidating cache blocks(CVE-2026-53062)

    USB: serial: io_ti: fix heap overflow in get_manuf_info()(CVE-2026-53196)

    netfilter: ipset: stop hash:* range iteration at end(CVE-2026-52921)

    bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb(CVE-2026-53074)

    netfilter: conntrack_irc: fix possible out-of-bounds read(CVE-2026-53268)

    drm/amd/display: Bound VBIOS record-chain walk loops(CVE-2026-53138)

    scsi: target: core: Fix integer overflow in UNMAP bounds check(CVE-2026-53021)

    erofs: unify lcn as u64 for 32-bit platforms(CVE-2026-53015)

    dm cache metadata: fix memory leak on metadata abort retry(CVE-2026-53060)

    nfsd: fix posix_acl leak on SETACL decode failure(CVE-2026-53397)

    USB: serial: kl5kusb105: fix bulk-out buffer overflow(CVE-2026-53194)

    net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master(CVE-2026-53069)

    bonding: 3ad: implement proper RCU rules for port-aggregator(CVE-2026-52975)

    scsi: sg: Resolve soft lockup issue when opening /dev/sgX(CVE-2026-53304)

    fs/mbcache: cancel shrink work before destroying the cache(CVE-2026-53129)

    lib/scatterlist: fix length calculations in extract_kvec_to_sg(CVE-2026-46289)

    fuse: re-lock request before replacing page cache folio(CVE-2026-53388)

    neigh: let neigh_xmit take skb ownership(CVE-2026-52981)

    netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase(CVE-2026-52988)

    tcp: restrict SO_ATTACH_FILTER to priv users(CVE-2026-53236)

    netfilter: nft_ct: bail out on template ct in get eval(CVE-2026-53267)

    ipv6: mcast: Fix use-after-free when processing MLD queries(CVE-2026-53275)

    net: skbuff: fix missing zerocopy reference in pskb_carve helpers(CVE-2026-52943)

    net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list(CVE-2026-53230)

    net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure(CVE-2026-53229)

    netfilter: nat: use kfree_rcu to release ops(CVE-2026-53000)

    tcp: secure_seq: add back ports to TS offset(CVE-2026-23247)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786352940 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: serial: imx: fix tx statemachine     deadlock When using the serial port as RS485 port, the tx statemachine is used to control the RTS pin to     drive the RS485 transceiver TX_EN pin. When the TTY port is closed in the middle of a transmission (for     instance during userland application crash), imx_uart_shutdown disables the interface and disables the     Transmission Complete interrupt. afer that, imx_uart_stop_tx bails on an incomplete transmission, to be     retriggered by the TC interrupt. This interrupt is disabled and therefore the tx statemachine never     transitions out of SEND. The statemachine is in deadlock now, and the TX_EN remains low, making the     interface useless. imx_uart_stop_tx now checks for incomplete transmission AND whether TC interrupts are     enabled before bailing to be retriggered. This makes sure the state machine handling is reached, and is     properly set to WAIT_AFTER_SEND. (CVE-2023-52456)

  - In the Linux kernel, the following vulnerability has been resolved: ubi: Fix use-after-free when volume     resizing failed There is an use-after-free problem reported by KASAN:
    ================================================================== BUG: KASAN: use-after-free in     ubi_eba_copy_table+0x11f/0x1c0 [ubi] Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735 CPU: 2     PID: 4735 Comm: ubirsvol Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14 Hardware name: QEMU Standard     PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44     print_report+0x171/0x472 kasan_report+0xad/0x130 ubi_eba_copy_table+0x11f/0x1c0 [ubi]     ubi_resize_volume+0x4f9/0xbc0 [ubi] ubi_cdev_ioctl+0x701/0x1850 [ubi] __x64_sys_ioctl+0x11d/0x170     do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> When ubi_change_vtbl_record()     returns an error in ubi_resize_volume(), new_eba_tbl will be freed on error handing path, but it is     holded by vol->eba_tbl in ubi_eba_replace_table(). It means that the liftcycle of vol->eba_tbl and     vol are different, so when resizing volume in next time, it causing an use-after-free fault. Fix it by     not freeing new_eba_tbl after it replaced in ubi_eba_replace_table(), while will be freed in next volume     resizing. (CVE-2023-53800)

  - In the Linux kernel, the following vulnerability has been resolved: kdb: Fix buffer overflow during tab-     complete Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to     insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer     rather than the destination to strncpy() with predictably horrible results. Most obviously if the command     buffer is already full but cp, the cursor position, is in the middle of the buffer, then we will write     past the end of the supplied buffer. Fix this by replacing the dubious strncpy() calls with     memmove()/memcpy() calls plus explicit boundary checks to make sure we have enough space before we start     moving characters around. (CVE-2024-39480)

  - In the Linux kernel, the following vulnerability has been resolved: Fix userfaultfd_api to return EINVAL     as expected Currently if we request a feature that is not set in the Kernel config we fail silently and     return all the available features. However, the man page indicates we should return an EINVAL. We need to     fix this issue since we can end up with a Kernel warning should a program request the feature     UFFD_FEATURE_WP_UNPOPULATED on a kernel with the config not set with this feature. [ 200.812896] WARNING:
    CPU: 91 PID: 13634 at mm/memory.c:1660 zap_pte_range+0x43d/0x660 [ 200.820738] Modules linked in: [     200.869387] CPU: 91 PID: 13634 Comm: userfaultfd Kdump: loaded Not tainted 6.9.0-rc5+ #8 [ 200.877477]     Hardware name: Dell Inc. PowerEdge R6525/0N7YGH, BIOS 2.7.3 03/30/2022 [ 200.885052] RIP:
    0010:zap_pte_range+0x43d/0x660 (CVE-2024-41027)

  - In the Linux kernel, the following vulnerability has been resolved: mlxsw: core_linecards: Fix double     memory deallocation in case of invalid INI file In case of invalid INI file mlxsw_linecard_types_init()     deallocates memory but doesn't reset pointer to NULL and returns 0. In case of any error occurred after     mlxsw_linecard_types_init() call, mlxsw_linecards_init() calls mlxsw_linecard_types_fini() which performs     memory deallocation again. Add pointer reset to NULL. Found by Linux Verification Center     (linuxtesting.org) with SVACE. (CVE-2024-42138)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786352940 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: serial: imx: fix tx statemachine     deadlock When using the serial port as RS485 port, the tx statemachine is used to control the RTS pin to     drive the RS485 transceiver TX_EN pin. When the TTY port is closed in the middle of a transmission (for     instance during userland application crash), imx_uart_shutdown disables the interface and disables the     Transmission Complete interrupt. afer that, imx_uart_stop_tx bails on an incomplete transmission, to be     retriggered by the TC interrupt. This interrupt is disabled and therefore the tx statemachine never     transitions out of SEND. The statemachine is in deadlock now, and the TX_EN remains low, making the     interface useless. imx_uart_stop_tx now checks for incomplete transmission AND whether TC interrupts are     enabled before bailing to be retriggered. This makes sure the state machine handling is reached, and is     properly set to WAIT_AFTER_SEND. (CVE-2023-52456)

  - In the Linux kernel, the following vulnerability has been resolved: ubi: Fix use-after-free when volume     resizing failed There is an use-after-free problem reported by KASAN:
    ================================================================== BUG: KASAN: use-after-free in     ubi_eba_copy_table+0x11f/0x1c0 [ubi] Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735 CPU: 2     PID: 4735 Comm: ubirsvol Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14 Hardware name: QEMU Standard     PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44     print_report+0x171/0x472 kasan_report+0xad/0x130 ubi_eba_copy_table+0x11f/0x1c0 [ubi]     ubi_resize_volume+0x4f9/0xbc0 [ubi] ubi_cdev_ioctl+0x701/0x1850 [ubi] __x64_sys_ioctl+0x11d/0x170     do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> When ubi_change_vtbl_record()     returns an error in ubi_resize_volume(), new_eba_tbl will be freed on error handing path, but it is     holded by vol->eba_tbl in ubi_eba_replace_table(). It means that the liftcycle of vol->eba_tbl and     vol are different, so when resizing volume in next time, it causing an use-after-free fault. Fix it by     not freeing new_eba_tbl after it replaced in ubi_eba_replace_table(), while will be freed in next volume     resizing. (CVE-2023-53800)

  - In the Linux kernel, the following vulnerability has been resolved: kdb: Fix buffer overflow during tab-     complete Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to     insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer     rather than the destination to strncpy() with predictably horrible results. Most obviously if the command     buffer is already full but cp, the cursor position, is in the middle of the buffer, then we will write     past the end of the supplied buffer. Fix this by replacing the dubious strncpy() calls with     memmove()/memcpy() calls plus explicit boundary checks to make sure we have enough space before we start     moving characters around. (CVE-2024-39480)

  - In the Linux kernel, the following vulnerability has been resolved: Fix userfaultfd_api to return EINVAL     as expected Currently if we request a feature that is not set in the Kernel config we fail silently and     return all the available features. However, the man page indicates we should return an EINVAL. We need to     fix this issue since we can end up with a Kernel warning should a program request the feature     UFFD_FEATURE_WP_UNPOPULATED on a kernel with the config not set with this feature. [ 200.812896] WARNING:
    CPU: 91 PID: 13634 at mm/memory.c:1660 zap_pte_range+0x43d/0x660 [ 200.820738] Modules linked in: [     200.869387] CPU: 91 PID: 13634 Comm: userfaultfd Kdump: loaded Not tainted 6.9.0-rc5+ #8 [ 200.877477]     Hardware name: Dell Inc. PowerEdge R6525/0N7YGH, BIOS 2.7.3 03/30/2022 [ 200.885052] RIP:
    0010:zap_pte_range+0x43d/0x660 (CVE-2024-41027)

  - In the Linux kernel, the following vulnerability has been resolved: mlxsw: core_linecards: Fix double     memory deallocation in case of invalid INI file In case of invalid INI file mlxsw_linecard_types_init()     deallocates memory but doesn't reset pointer to NULL and returns 0. In case of any error occurred after     mlxsw_linecard_types_init() call, mlxsw_linecards_init() calls mlxsw_linecard_types_fini() which performs     memory deallocation again. Add pointer reset to NULL. Found by Linux Verification Center     (linuxtesting.org) with SVACE. (CVE-2024-42138)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access The bounds check for the next     xattr entry in check_xattrs() uses (void *)next >= end, which allows next to point within sizeof(u32)     bytes of end. On the next loop iteration, IS_LAST_ENTRY() reads 4 bytes via *(__u32 *)(entry), which can     overrun the valid xattr region. For example, if next lands at end - 1, the check passes since next < end,     but IS_LAST_ENTRY() reads 4 bytes starting at end - 1, accessing 3 bytes beyond the valid region. Fix this     by changing the check to (void *)next + sizeof(u32) > end, ensuring there is always enough space for the     IS_LAST_ENTRY() read on the subsequent iteration. (CVE-2026-46094)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22099-1 advisory.

    The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
    - CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
    - CVE-2026-23327: cxl/mbox: validate payload size before accessing       contents in cxl_payload_from_user_allowed() (bsc#1260548).
    - CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching     (bsc#1261619).
    - CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
    - CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
    - CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
    - CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
    - CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
    - CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
    - CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
    - CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
    - CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
    - CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register     (bsc#1263058).
    - CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
    - CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
    - CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
    - CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
    - CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
    - CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
    - CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
    - CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
    - CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
    - CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
    - CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize       nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
    - CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
    - CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
    - CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
    - CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
    - CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
    - CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
    - CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
    - CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
    - CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
    - CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies()     (bsc#1264723).
    - CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
    - CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
    - CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
    - CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
    - CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
    - CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).
    - CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).
    - CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).
    - CVE-2026-45898: RDMA/iwcm: Fix workqueue list corruption by removing work_list (bsc#1266888).
    - CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).
    - CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).
    - CVE-2026-45942: ext4: fix e4b bitmap inconsistency reports (bsc#1266914).
    - CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).
    - CVE-2026-45984: gfs2: Fix use-after-free in iomap inline data write path (bsc#1267214).
    - CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
    - CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).
    - CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).
    - CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).
    - CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).
    - CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).
    - CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak     (bsc#1267652).
    - CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).
    - CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).

    The following non security issues were fixed:

    - accel/ivpu: Add bounds checks for firmware log indices (git-fixes).
    - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (git-fixes).
    - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).
    - ALSA: seq: dummy: fix UMP event stack overread (git-fixes).
    - arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).
    - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).
    - Bluetooth: bnep: reject short frames before parsing (git-fixes).
    - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).
    - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync (git-fixes).
    - Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).
    - Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).
    - Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).
    - config: remove DEBUG_FS_DISALLOW_MOUNT
    - debugfs: Remove broken no-mount mode (bsc#1265186).
    - debugfs: Fix default access mode config check (bsc#1265186).
    - debugfs: Remove broken no-mount mode (bsc#1265186).
    - debugfs: Remove redundant access mode checks (bsc#1265186).
    - drm/amd/display: Bound VBIOS record-chain walk loops (git-fixes).
    - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).
    - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).
    - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() (git-fixes).
    - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).
    - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).
    - drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).
    - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).
    - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups (git-fixes).
    - drm/xe: Clear pending_disable before signaling suspend fence (git-fixes).
    - ima: return error early if file xattr cannot be changed (bsc#1261041).
    - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).
    - KVM: arm64: Reassign nested_mmus array behind mmu_lock (git-fixes).
    - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (git-fixes).
    - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (git-fixes).
    - KVM: SEV: Check PSC request indices against the actual size of the buffer (git-fixes).
    - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (git-fixes).
    - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (git-fixes).
    - KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).
    - KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).
    - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (git-fixes).
    - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (git-fixes).
    - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (git-fixes).
    - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (git-fixes).
    - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (git-fixes).
    - KVM: SVM: Convert plain error code numbers to defines (git-fixes).
    - KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC (git-fixes).
    - KVM: SVM: Provide helpers to set the error code (git-fixes).
    - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (git-fixes).
    - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (git-fixes).
    - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (git-fixes).
    - KVM: x86: Move MMIO write tracing into vcpu_mmio_write() (git-fixes).
    - KVM: x86: Open code handling of completed MMIO reads in emulator_read_write() (git-fixes).
    - KVM: x86: Open code read vs. write userspace MMIO exits in emulator_read_write() (git-fixes).
    - KVM: x86: Trace unsatisfied MMIO reads on a per-page basis (git-fixes).
    - KVM: x86: Use local MMIO fragment variable to clean up emulator_read_write() (git-fixes).
    - mmc: core: Fix host controller programming for fixed driver type (git-fixes).
    - mmc: dw_mmc-rockchip: Add missing private data for very old controllers (git-fixes).
    - mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).
    - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).
    - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).
    - mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).
    - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).
    - wifi: nl80211: reject oversized EMA RNR lists (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1753 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    mm/pagewalk: fix race between concurrent split and refault (CVE-2026-31456)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: reject oversized dirents in page cache (CVE-2026-31694)

    In the Linux kernel, the following vulnerability has been resolved:

    net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (CVE-2026-31700)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: validate rec->used in journal-replay file record check (CVE-2026-31716)

    In the Linux kernel, the following vulnerability has been resolved:

    x86: shadow stacks: proper error handling for mmap lock (CVE-2026-43109)

    In the Linux kernel, the following vulnerability has been resolved:

    lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (CVE-2026-43492)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)

    In the Linux kernel, the following vulnerability has been resolved:

    net/rds: reset op_nents when zerocopy page pin fails (CVE-2026-43494)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-43496)

    In the Linux kernel, the following vulnerability has been resolved:

    rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501)

    In the Linux kernel, the following vulnerability has been resolved:

    net/rds: handle zerocopy send cleanup before the message is queued (CVE-2026-43502)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix use-after-free in arena_vm_close on fork (CVE-2026-45837)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (CVE-2026-45987)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix re-decryption of RESPONSE packets (CVE-2026-45988)

    In the Linux kernel, the following vulnerability has been resolved:

    of: unittest: fix use-after-free in testdrv_probe() (CVE-2026-45989)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (CVE-2026-45997)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() (CVE-2026-45999)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (CVE-2026-46000)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: fix a resource leak in xfs_alloc_buftarg() (CVE-2026-46005)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: call sk_data_ready() after listener migration (CVE-2026-46015)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal: core: Fix thermal zone governor cleanup issues (CVE-2026-46021)

    In the Linux kernel, the following vulnerability has been resolved:

    dm mirror: fix integer overflow in create_dirty_log() (CVE-2026-46023)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (CVE-2026-46024)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: authencesn - reject short ahash digests during instance creation (CVE-2026-46033)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: icmp: validate reply type before using icmp_pointers (CVE-2026-46037)

    In the Linux kernel, the following vulnerability has been resolved:

    inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (CVE-2026-46040)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (CVE-2026-46046)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix deadlock with check operation and nowait requests (CVE-2026-46050)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid5: fix soft lockup in retry_aligned_read() (CVE-2026-46051)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: only d_add() negative dentries when they are unhashed (CVE-2026-46052)

    In the Linux kernel, the following vulnerability has been resolved:

    net: rds: fix MR cleanup on copy error (CVE-2026-46053)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: fix deadlock in jbd2_journal_cancel_revoke() (CVE-2026-46061)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs3: fix integer overflow in run_unpack() volume boundary check (CVE-2026-46062)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info (CVE-2026-46065)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid5: validate payload size before accessing journal metadata (CVE-2026-46070)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs3: add buffer boundary checks to run_unpack() (CVE-2026-46072)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: fix the out-of-bounds nameoff handling for trailing dirents (CVE-2026-46078)

    In the Linux kernel, the following vulnerability has been resolved:

    rbd: fix null-ptr-deref when device_add_disk() fails (CVE-2026-46079)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (CVE-2026-46082)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: fix resource leaks on device setup failure

    Make sure to call controller cleanup() if spi_setup() fails whileregistering a device to avoid leaking any     resources allocated bysetup(). (CVE-2026-46083)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mana_ib: Disable RX steering on RSS QP destroy (CVE-2026-46084)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086)

    In the Linux kernel, the following vulnerability has been resolved:

    zram: do not forget to endio for partial discard requests (CVE-2026-46089)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (CVE-2026-46094)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: reject zero shift in nft_bitwise (CVE-2026-46101)

    In the Linux kernel, the following vulnerability has been resolved:

    net: strparser: fix skb_head leak in strp_abort_strp() (CVE-2026-46102)

    In the Linux kernel, the following vulnerability has been resolved:

    eventfs: Hold eventfs_mutex and SRCU when remount walks events (CVE-2026-46106)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-thin: fix metadata refcount underflow (CVE-2026-46107)

    In the Linux kernel, the following vulnerability has been resolved:

    ipmi:si: Return state to normal if message allocation fails (CVE-2026-46108)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113)

    In the Linux kernel, the following vulnerability has been resolved:

    block: add pgmap check to biovec_phys_mergeable (CVE-2026-46115)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Fix slab-out-of-bounds access in auth message processing (CVE-2026-46119)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_gre: Use cached t->net in ip6erspan_changelink(). (CVE-2026-46120)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (CVE-2026-46121)

    In the Linux kernel, the following vulnerability has been resolved:

    isofs: validate block number from NFS file handle in isofs_export_iget (CVE-2026-46124)

    In the Linux kernel, the following vulnerability has been resolved:

    ipmi: Check event message buffer response for bad data (CVE-2026-46128)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix double free in create_space_info() error path (CVE-2026-46129)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: check for nEPT/nNPT in slow flush hypercalls (CVE-2026-46131)

    In the Linux kernel, the following vulnerability has been resolved:

    net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (CVE-2026-46132)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: use kzalloc to zero-initialize security descriptor buffer (CVE-2026-46139)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (CVE-2026-46144)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)

    In the Linux kernel, the following vulnerability has been resolved:

    fanotify: fix false positive on permission events (CVE-2026-46150)

    In the Linux kernel, the following vulnerability has been resolved:

    smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (CVE-2026-46161)

    In the Linux kernel, the following vulnerability has been resolved:

    ice: fix double free in ice_sf_eth_activate() error path (CVE-2026-46162)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: vport: fix self-deadlock on release of tunnel ports (CVE-2026-46165)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix scheduling with atomic in timestamp sockopt (CVE-2026-46168)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (CVE-2026-46172)

    In the Linux kernel, the following vulnerability has been resolved:

    exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (CVE-2026-46174)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176)

    In the Linux kernel, the following vulnerability has been resolved:

    ipmi: Add limits to event and receive message requests (CVE-2026-46177)

    In the Linux kernel, the following vulnerability has been resolved:

    smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)

    In the Linux kernel, the following vulnerability has been resolved:

    mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() (CVE-2026-46190)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: ah: account for ESN high bits in async callbacks (CVE-2026-46193)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: validate dacloffset before building DACL pointers (CVE-2026-46195)

    In the Linux kernel, the following vulnerability has been resolved:

    tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (CVE-2026-46196)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() (CVE-2026-46283)

    In the Linux kernel, the following vulnerability has been resolved:

    lib/scatterlist: fix length calculations in extract_kvec_to_sg (CVE-2026-46289)

    In the Linux kernel, the following vulnerability has been resolved:

    pmdomain: core: Fix detach procedure for virtual devices in genpd (CVE-2026-46292)

    In the Linux kernel, the following vulnerability has been resolved:

    dm: fix a buffer overflow in ioctl processing (CVE-2026-46294)

    In the Linux kernel, the following vulnerability has been resolved:

    isofs: validate Rock Ridge CE continuation extent against volume size (CVE-2026-46303)

    In the Linux kernel, the following vulnerability has been resolved:

    flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)

    In the Linux kernel, the following vulnerability has been resolved:

    ptrace: slightly saner 'get_dumpable()' logic (CVE-2026-46333)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Reject SIOCATMARK on non-stream sockets (CVE-2026-52928)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: reject descriptors with oversized CRC length

    udf_read_tagged() skips CRC verification when descCRCLength +sizeof(struct tag) exceeds the block size.  A     crafted UDF image canset descCRCLength to an oversized value to bypass CRC validationentirely; the     descriptor is then accepted based solely on the 8-bittag checksum, which is trivially recomputable.

    Reject such descriptors instead of silently accepting them.  Alegitimate single-block descriptor should     never have a CRC length thatexceeds the block. (CVE-2026-53369)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786350974 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: isofs: Fix out of bound access for     corrupted isofs image When isofs image is suitably corrupted isofs_read_inode() can read data beyond the     end of buffer. Sanity-check the directory entry length before using it. (CVE-2021-47478)

  - In the Linux kernel, the following vulnerability has been resolved: ubi: Fix race condition between     ctrl_cdev_ioctl and ubi_cdev_ioctl Hulk Robot reported a KASAN report about use-after-free:
    ================================================================== BUG: KASAN: use-after-free in
    __list_del_entry_valid+0x13d/0x160 Read of size 8 at addr ffff888035e37d98 by task ubiattach/1385 [...]     Call Trace: klist_dec_and_del+0xa7/0x4a0 klist_put+0xc7/0x1a0 device_del+0x4d4/0xed0     cdev_device_del+0x1a/0x80 ubi_attach_mtd_dev+0x2951/0x34b0 [ubi] ctrl_cdev_ioctl+0x286/0x2f0 [ubi]     Allocated by task 1414: device_add+0x60a/0x18b0 cdev_device_add+0x103/0x170     ubi_create_volume+0x1118/0x1a10 [ubi] ubi_cdev_ioctl+0xb7f/0x1ba0 [ubi] Freed by task 1385:
    cdev_device_del+0x1a/0x80 ubi_remove_volume+0x438/0x6c0 [ubi] ubi_cdev_ioctl+0xbf4/0x1ba0 [ubi] [...]     ================================================================== The lock held by ctrl_cdev_ioctl is     ubi_devices_mutex, but the lock held by ubi_cdev_ioctl is ubi->device_mutex. Therefore, the two locks can     be concurrent. ctrl_cdev_ioctl contains two operations: ubi_attach and ubi_detach. ubi_detach is bug-free     because it uses reference counting to prevent concurrency. However, uif_init and uif_close in ubi_attach     may race with ubi_cdev_ioctl. uif_init will race with ubi_cdev_ioctl as in the following stack. cpu1 cpu2     cpu3 _______________________|________________________|______________________ ctrl_cdev_ioctl     ubi_attach_mtd_dev uif_init ubi_cdev_ioctl ubi_create_volume cdev_device_add ubi_add_volume // sysfs exist     kill_volumes ubi_cdev_ioctl ubi_remove_volume cdev_device_del // first free ubi_free_volume cdev_del //     double free cdev_device_del And uif_close will race with ubi_cdev_ioctl as in the following stack. cpu1     cpu2 cpu3 _______________________|________________________|______________________ ctrl_cdev_ioctl     ubi_attach_mtd_dev uif_init ubi_cdev_ioctl ubi_create_volume cdev_device_add ubi_debugfs_init_dev //error     goto out_uif; uif_close kill_volumes ubi_cdev_ioctl ubi_remove_volume cdev_device_del // first free     ubi_free_volume // double free The cause of this problem is that commit 714fb87e8bc0 make device     available before it becomes accessible via sysfs. Therefore, we roll back the modification. We will fix     the race condition between ubi device creation and udev by removing ubi_get_device in vol_attribute_show     and dev_attribute_show.This avoids accessing uninitialized ubi_devices[ubi_num]. ubi_get_device is used to     prevent devices from being deleted during sysfs execution. However, now kernfs ensures that devices will     not be deleted before all reference counting are released. The key process is shown in the following     stack. device_del device_remove_attrs device_remove_groups sysfs_remove_groups sysfs_remove_group     remove_files kernfs_remove_by_name kernfs_remove_by_name_ns __kernfs_remove kernfs_drain (CVE-2021-47634)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix memory leak in
    __qlt_24xx_handle_abts() Commit 8f394da36a36 (scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG) made     the __qlt_24xx_handle_abts() function return early if tcm_qla2xxx_find_cmd_by_tag() didn't find a command,     but it missed to clean up the allocated memory for the management command. (CVE-2022-48650)

  - In the Linux kernel, the following vulnerability has been resolved: ubi: ubi_create_volume: Fix use-after-     free when volume creation failed There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s     error handling path: ubi_eba_replace_table(vol, eba_tbl) vol->eba_tbl = tbl out_mapping:
    ubi_eba_destroy_table(eba_tbl) // Free 'eba_tbl' out_unlock: put_device(&vol->dev) vol_release     kfree(tbl->entries) // UAF Fix it by removing redundant 'eba_tbl' releasing. Fetch a reproducer in [Link].
    (CVE-2022-49388)

  - In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3: Fix error handling in     gic_populate_ppi_partitions of_get_child_by_name() returns a node pointer with refcount incremented, we     should use of_node_put() on it when not need anymore. When kcalloc fails, it missing of_node_put() and     results in refcount leak. Fix this by goto out_put_node label. (CVE-2022-49716)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8507-1 advisory.

    It was discovered that some AMD processors did not properly clear data in the floating point divider unit     during speculative execution. A local attacker could use this to expose sensitive information.
    (CVE-2025-54505)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Rados block device (RBD) driver;

    - Compressed RAM block device driver;

    - Character device driver;

    - TPM device driver;

    - Hardware crypto device drivers;

    - EDAC drivers;

    - GPU drivers;

    - Greybus drivers;

    - HID subsystem;

    - Microsoft Hyper-V drivers;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - LED subsystem;

    - Multiple devices driver;

    - Media drivers;

    - IBM Advanced System Management driver;

    - MTD block device drivers;

    - Network drivers;

    - Microsoft Azure Network Adapter (MANA) driver;

    - NTB driver;

    - NVME drivers;

    - Device tree and open firmware driver;

    - PCI subsystem;

    - Remote Processor subsystem;

    - SCSI subsystem;

    - SPI subsystem;

    - Realtek RTL8723BS SDIO drivers;

    - SM750 framebuffer staging driver;

    - Thermal drivers;

    - USB Gadget drivers;

    - USB over IP driver;

    - VFIO drivers;

    - Framebuffer layer;

    - 9P distributed file system;

    - AFS file system;

    - Ceph distributed file system;

    - File systems infrastructure;

    - EROFS file system;

    - Ext4 file system;

    - F2FS file system;

    - FUSE (File system in Userspace);

    - Journaling layer for block devices (JBD2);

    - NILFS2 file system;

    - File system notification infrastructure;

    - NTFS3 file system;

    - OCFS2 file system;

    - SMB network file system;

    - UDF file system;

    - XFS file system;

    - Codetag library;

    - Memory management;

    - Memory Management;

    - KVM subsystem;

    - Tracing infrastructure;

    - User-space API (UAPI);

    - io_uring subsystem;

    - Locking primitives;

    - Timer subsystem;

    - Scatterlist API;

    - Heterogeneous memory management;

    - KASAN memory debugging framework;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - CAIF protocol;

    - CAN network layer;

    - Ceph Core library;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Netfilter;

    - NFC subsystem;

    - Packet sockets;

    - Qualcomm IPC Router (QRTR);

    - RDS protocol;

    - RxRPC session sockets;

    - SMC sockets;

    - Stream parser;

    - Landlock security;

    - SELinux security module;

    - ALSA framework;

    - Generic PCM loopback sound driver;

    - FireWire sound drivers;

    - Creative Sound Blaster X-Fi driver;

    - QCOM ASoC drivers;

    - USB sound devices;

    - Objtool; (CVE-2026-31532, CVE-2026-31574, CVE-2026-31575, CVE-2026-31576, CVE-2026-31577,     CVE-2026-31578, CVE-2026-31579, CVE-2026-31580, CVE-2026-31581, CVE-2026-31582, CVE-2026-31583,     CVE-2026-31584, CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31589,     CVE-2026-31590, CVE-2026-31591, CVE-2026-31592, CVE-2026-31593, CVE-2026-31594, CVE-2026-31595,     CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31600, CVE-2026-31601,     CVE-2026-31602, CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31607,     CVE-2026-31608, CVE-2026-31609, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613,     CVE-2026-31614, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619,     CVE-2026-31620, CVE-2026-31621, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625,     CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31686, CVE-2026-31694,     CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701,     CVE-2026-31702, CVE-2026-31703, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707,     CVE-2026-31708, CVE-2026-31709, CVE-2026-31710, CVE-2026-31711, CVE-2026-31712, CVE-2026-31713,     CVE-2026-31714, CVE-2026-31715, CVE-2026-31716, CVE-2026-31717, CVE-2026-31718, CVE-2026-31719,     CVE-2026-43058, CVE-2026-43071, CVE-2026-43072, CVE-2026-43073, CVE-2026-43348, CVE-2026-43349,     CVE-2026-43350, CVE-2026-43491, CVE-2026-43493, CVE-2026-43499, CVE-2026-43501, CVE-2026-45986,     CVE-2026-45987, CVE-2026-45988, CVE-2026-45989, CVE-2026-45990, CVE-2026-45991, CVE-2026-45994,     CVE-2026-45995, CVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46001, CVE-2026-46002,     CVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007, CVE-2026-46008,     CVE-2026-46009, CVE-2026-46010, CVE-2026-46011, CVE-2026-46012, CVE-2026-46013, CVE-2026-46014,     CVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46020, CVE-2026-46021,     CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46025, CVE-2026-46026, CVE-2026-46027,     CVE-2026-46028, CVE-2026-46029, CVE-2026-46030, CVE-2026-46031, CVE-2026-46032, CVE-2026-46033,     CVE-2026-46034, CVE-2026-46035, CVE-2026-46036, CVE-2026-46037, CVE-2026-46038, CVE-2026-46039,     CVE-2026-46040, CVE-2026-46041, CVE-2026-46042, CVE-2026-46043, CVE-2026-46044, CVE-2026-46045,     CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46052,     CVE-2026-46053, CVE-2026-46054, CVE-2026-46056, CVE-2026-46057, CVE-2026-46058, CVE-2026-46059,     CVE-2026-46060, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063, CVE-2026-46064, CVE-2026-46065,     CVE-2026-46066, CVE-2026-46067, CVE-2026-46068, CVE-2026-46069, CVE-2026-46070, CVE-2026-46071,     CVE-2026-46072, CVE-2026-46073, CVE-2026-46074, CVE-2026-46075, CVE-2026-46076, CVE-2026-46077,     CVE-2026-46078, CVE-2026-46079, CVE-2026-46080, CVE-2026-46081, CVE-2026-46082, CVE-2026-46083,     CVE-2026-46084, CVE-2026-46085, CVE-2026-46086, CVE-2026-46087, CVE-2026-46088, CVE-2026-46089,     CVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46093, CVE-2026-46094, CVE-2026-46095,     CVE-2026-46096, CVE-2026-46097, CVE-2026-46098, CVE-2026-46099, CVE-2026-46100, CVE-2026-46101,     CVE-2026-46102, CVE-2026-46103, CVE-2026-46115, CVE-2026-46119, CVE-2026-46135, CVE-2026-46137,     CVE-2026-46155, CVE-2026-46185, CVE-2026-46195, CVE-2026-46243, CVE-2026-46244, CVE-2026-46276,     CVE-2026-46277, CVE-2026-46278, CVE-2026-46279, CVE-2026-46280, CVE-2026-46281, CVE-2026-46282,     CVE-2026-46283, CVE-2026-46284, CVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46288,     CVE-2026-46289, CVE-2026-46316, CVE-2026-46332, CVE-2026-52904, CVE-2026-52905, CVE-2026-52906,     CVE-2026-52907, CVE-2026-52933)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50372 advisory.

    - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)   {CVE-2026-46331}
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner)  [Orabug: 39668743]     {CVE-2026-46242}
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen)  [Orabug: 39656679]     {CVE-2026-52943}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39548792]     {CVE-2025-10263}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (Ilya Maximets) {CVE-2026-46165}
    - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Ankit Soni)     {CVE-2026-43220}
    - usb: ulpi: fix memory leak on ulpi_register() error paths (Felix Gu) {CVE-2026-46109}
    - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39463671]     {CVE-2026-46243}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug:
    39368826,39441323] {CVE-2026-43503,CVE-2026-46300}
    - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39368826]     {CVE-2026-46300}
    - netfilter: reject zero shift in nft_bitwise (Kai Ma) [Orabug: 39452464] {CVE-2026-46101}
    - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Andrea Mayer) [Orabug: 39452457]     {CVE-2026-46099}
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure (Deepanshu Kartikey) [Orabug: 39452739]     {CVE-2026-46048}
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Greg Kroah-Hartman) [Orabug: 39426003]     {CVE-2026-43501}
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (Takashi Iwai) [Orabug: 39452746]     {CVE-2026-45992}
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xiang Mei) [Orabug: 39205989]     {CVE-2026-31419}
    - crypto: authencesn - reject short ahash digests during instance creation (Yucheng Lu) [Orabug: 39452231]     {CVE-2026-46033}
    - spi: fix resource leaks on device setup failure (Johan Hovold) [Orabug: 39452400] {CVE-2026-46083}
    - net: qrtr: ns: Limit the total number of nodes (Manivannan Sadhasivam) [Orabug: 39452123]     {CVE-2026-46003}
    - net: bridge: use a stable FDB dst snapshot in RCU readers (Zhengchuan Liang) [Orabug: 39452411]     {CVE-2026-46086}
    - net: qrtr: ns: Limit the maximum number of lookups (Manivannan Sadhasivam) [Orabug: 39452207]     {CVE-2026-46026}
    - net: qrtr: ns: Limit the maximum server registration per node (Manivannan Sadhasivam) [Orabug: 39410851]     {CVE-2026-43491}
    - RDMA/mana_ib: Disable RX steering on RSS QP destroy (Long Li) [Orabug: 39452406] {CVE-2026-46084}
    - media: rc: igorplugusb: heed coherency rules (Oliver Neukum) [Orabug: 39452432] {CVE-2026-46091}
    - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (Daniel Hodges) [Orabug: 39452343]     {CVE-2026-46069}
    - thermal: core: Fix thermal zone governor cleanup issues (Rafael J. Wysocki) [Orabug: 39452186]     {CVE-2026-46021}
    - smb: client: validate the whole DACL before rewriting it in cifsacl (Michael Bommarito) [Orabug:
    39300611] {CVE-2026-31709}
    - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (Yang Xiuwei) [Orabug: 39452100]     {CVE-2026-45997}
    - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39425998]     {CVE-2026-43499}
    - ceph: only d_add() negative dentries when they are unhashed (Max Kellermann) [Orabug: 39452291]     {CVE-2026-46052}
    - dm mirror: fix integer overflow in create_dirty_log() (Junrui Luo) [Orabug: 39452196] {CVE-2026-46023}
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (Shuvam Pandey) [Orabug: 39452304]     {CVE-2026-46056}
    - tcp: call sk_data_ready() after listener migration (Zhenzhong Wu) [Orabug: 39452159] {CVE-2026-46015}
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (Chia-Ming Chang) [Orabug:
    39452250] {CVE-2026-46040}
    - md/raid5: validate payload size before accessing journal metadata (Junrui Luo) [Orabug: 39452349]     {CVE-2026-46070}
    - md/raid5: fix soft lockup in retry_aligned_read() (Chia-Ming Chang) [Orabug: 39452287] {CVE-2026-46051}
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (Sohei Koyama) [Orabug: 39452269]     {CVE-2026-46046}
    - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (Deepanshu Kartikey) [Orabug:
    39452442] {CVE-2026-46094}
    - io_uring/poll: fix multishot recv missing EOF on wakeup race (Jens Axboe) {CVE-2026-23473}
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Kevin Cheng) [Orabug: 39452372]     {CVE-2026-46076}
    - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (Kevin Cheng) [Orabug: 39452394] {CVE-2026-46082}
    - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (Yosry Ahmed) [Orabug: 39452061]     {CVE-2026-45987}
    - xfs: fix a resource leak in xfs_alloc_buftarg() (Haoxiang Li) [Orabug: 39452131] {CVE-2026-46005}
    - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (Raphael Zimmer) [Orabug:
    39452201] {CVE-2026-46024}
    - ipv4: icmp: validate reply type before using icmp_pointers (Ruide Cao) [Orabug: 39452243]     {CVE-2026-46037}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Hkbinbin) [Orabug: 39452259]     {CVE-2026-46043}
    - net: qrtr: ns: Free the node during ctrl_cmd_bye() (Manivannan Sadhasivam) [Orabug: 39452246]     {CVE-2026-46038}
    - rxrpc: Fix rxkad crypto unalignment handling (David Howells) [Orabug: 39452728] {CVE-2026-46085}
    - ALSA: caiaq: Handle probe errors properly (Takashi Iwai) [Orabug: 39452126] {CVE-2026-46004}
    - rbd: fix null-ptr-deref when device_add_disk() fails (Dawei Feng) [Orabug: 39452385] {CVE-2026-46079}
    - md/raid10: fix deadlock with check operation and nowait requests (Josh Hunt) [Orabug: 39452284]     {CVE-2026-46050}
    - jbd2: fix deadlock in jbd2_journal_cancel_revoke() (Zhang Yi) [Orabug: 39452318] {CVE-2026-46061}
    - erofs: fix the out-of-bounds nameoff handling for trailing dirents (Gao Xiang) [Orabug: 39452380]     {CVE-2026-46078}
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (Harin Lee) [Orabug: 39452280] {CVE-2026-46049}
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() (Vasiliy Kovalev) [Orabug: 39452119]     {CVE-2026-46002}
    - net: qrtr: ns: Fix use-after-free in driver remove() (Manivannan Sadhasivam) [Orabug: 39452274]     {CVE-2026-46047}
    - net: strparser: fix skb_head leak in strp_abort_strp() (Luxiao Xu) [Orabug: 39452468] {CVE-2026-46102}
    - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (Ziqing Chen)     [Orabug: 39452416] {CVE-2026-46088}
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Herbert Xu) [Orabug: 39410863] {CVE-2026-43493}
    - wifi: rtw88: check for PCI upstream bridge existence (Fedor Pchelkin) [Orabug: 39452437]     {CVE-2026-46092}
    - zram: do not forget to endio for partial discard requests (Sergey Senozhatsky) [Orabug: 39452420]     {CVE-2026-46089}
    - ocfs2: split transactions in dio completion to avoid credit exhaustion (Heming Zhao) [Orabug: 39452388]     {CVE-2026-46080}
    - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (Jesse Zhang) [Orabug: 39167551]     {CVE-2026-23468}
    - padata: Fix pd UAF once and for all (Herbert Xu) [Orabug: 38335055] {CVE-2025-38584}
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (Greg Kroah-Hartman) [Orabug: 39452133]     {CVE-2026-46006}
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (Cassio Gabriel) [Orabug: 39452170]     {CVE-2026-46018}
    - Buffer overflow in drivers/xen/sys-hypervisor.c (Juergen Gross) [Orabug: 39305898] {CVE-2026-31786}
    - xen/privcmd: fix double free via VMA splitting (Juergen Gross) [Orabug: 39305908] {CVE-2026-31787}
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing (Anderson Nascimento) [Orabug:
    39300563] {CVE-2026-31696}
    - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31697}
    - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31698}
    - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31699}
    - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (Bingquan Chen) {CVE-2026-31700}
    - ALSA: caiaq: take a reference on the USB device in create_card() (Berk Cem Goksel) [Orabug: 39300586]     {CVE-2026-31701}
    - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (Michael Bommarito) [Orabug:
    39300607] {CVE-2026-31708}
    - smb: client: require a full NFS mode SID before reading mode bits (Michael Bommarito) [Orabug: 39343707]     {CVE-2026-43350}
    - fuse: reject oversized dirents in page cache (Samuel Page) [Orabug: 39300556] {CVE-2026-31694}
    - mm/pagewalk: fix race between concurrent split and refault (Max Boone) [Orabug: 39250782]     {CVE-2026-31456}
    - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (Felix Fietkau) [Orabug: 39167472]     {CVE-2026-23444}
    - mm/userfaultfd: fix hugetlb fault mutex hash calculation (Jianhui Zhou) [Orabug: 39273453]     {CVE-2026-31575}
    - ipv6: add NULL checks for idev in SRv6 paths (Heminhong) [Orabug: 39167467] {CVE-2026-23442}
    - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline (Joseph Qi) [Orabug: 39331090] {CVE-2026-43075}
    - ocfs2: validate inline data i_size during inode read (Deepanshu Kartikey) [Orabug: 39331097]     {CVE-2026-43076}
    - media: as102: fix to not free memory after the device is registered in as102_usb_probe() (Jeongjun Park)     [Orabug: 39273467] {CVE-2026-31578}
    - bcache: fix cached_dev.sb_bio use-after-free and crash (Mingzhe Zou) [Orabug: 39273481] {CVE-2026-31580}
    - ALSA: 6fire: fix use-after-free on disconnect (Berk Cem Goksel) [Orabug: 39273486] {CVE-2026-31581}
    - media: em28xx: fix use-after-free in em28xx_v4l2_open() (Abhishek Kumar) [Orabug: 39273493]     {CVE-2026-31583}
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (Breno Leitao) [Orabug: 39273507]     {CVE-2026-31586}
    - KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug:
    39273521] {CVE-2026-31588}
    - x86-64: rename misleadingly named '__copy_user_nocache()' function (Linus Torvalds) [Orabug: 39323162]     {CVE-2026-43073}
    - kernel: be more careful about dup_mmap() failures and uprobe registering (Liam R. Howlett)     {CVE-2025-21709}
    - gpiolib: fix race condition for gdev->srcu (Pawel Narewski) [Orabug: 38887677] {CVE-2026-22986}
    - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (Sean Christopherson) [Orabug:
    39273529] {CVE-2026-31590}
    - KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (Sean Christopherson)     [Orabug: 39273553] {CVE-2026-31593}
    - ocfs2: handle invalid dinode in ocfs2_group_extend (Zhengyuan Huang) [Orabug: 39273569] {CVE-2026-31596}
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY (Tejas Bharambe) [Orabug: 39273578]     {CVE-2026-31597}
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273586]     {CVE-2026-31598}
    - dcache: Limit the minimal number of bucket to two (Zhihao Cheng) [Orabug: 39323133] {CVE-2026-43071}
    - ALSA: ctxfi: Limit PTP to a single page (Harin Lee) [Orabug: 39273608] {CVE-2026-31602}
    - wifi: rtw88: fix device leak on probe failure (Johan Hovold) [Orabug: 39273620] {CVE-2026-31604}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
364092	EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-3916)	Nessus	Huawei Local Security Checks	2026/10/8	2026/10/8	high
360481	AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786352940)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/18	high
323086	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:2482-1)	Nessus	SuSE Local Security Checks	2026/6/26	2026/9/29	high
360569	Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786352940)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/18	high
317552	Linux Distros Unpatched Vulnerability : CVE-2026-46094	Nessus	Misc.	2026/5/29	2026/9/29	high
321697	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:22099-1)	Nessus	SuSE Local Security Checks	2026/6/20	2026/6/20	high
316942	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1753)	Nessus	Amazon Linux Local Security Checks	2026/5/27	2026/10/16	high
340680	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-8665-1)	Nessus	Ubuntu Local Security Checks	2026/8/26	2026/8/27	high
360716	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786350974)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	high
316975	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1754)	Nessus	Amazon Linux Local Security Checks	2026/5/27	2026/10/16	high
325421	Ubuntu 26.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8507-1)	Nessus	Ubuntu Local Security Checks	2026/7/7	2026/7/30	low
325292	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50372)	Nessus	Oracle Linux Local Security Checks	2026/7/6	2026/7/8	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

low

high