The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787307395 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: ftrace: Clean up hash direct_functions     on register failures We see the following GPF when register_ftrace_direct fails: [ ] general protection     fault, probably for non-canonical address \ 0x200000000000010: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI     [...] [ ] RIP: 0010:ftrace_find_rec_direct+0x53/0x70 [ ] Code: 48 c1 e0 03 48 03 42 08 48 8b 10 31 c0 48     85 d2 74 [...] [ ] RSP: 0018:ffffc9000138bc10 EFLAGS: 00010206 [ ] RAX: 0000000000000000 RBX:
    ffffffff813e0df0 RCX: 000000000000003b [ ] RDX: 0200000000000000 RSI: 000000000000000c RDI:
    ffffffff813e0df0 [ ] RBP: ffffffffa00a3000 R08: ffffffff81180ce0 R09: 0000000000000001 [ ] R10:
    ffffc9000138bc18 R11: 0000000000000001 R12: ffffffff813e0df0 [ ] R13: ffffffff813e0df0 R14:
    ffff888171b56400 R15: 0000000000000000 [ ] FS: 00007fa9420c7780(0000) GS:ffff888ff6a00000(0000)     knlGS:000000000 [ ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ ] CR2: 000000000770d000 CR3:
    0000000107d50003 CR4: 0000000000370ee0 [ ] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
    0000000000000000 [ ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ ] Call Trace: [ ]     <TASK> [ ] register_ftrace_direct+0x54/0x290 [ ] ? render_sigset_t+0xa0/0xa0 [ ]     bpf_trampoline_update+0x3f5/0x4a0 [ ] ? 0xffffffffa00a3000 [ ] bpf_trampoline_link_prog+0xa9/0x140 [ ]     bpf_tracing_prog_attach+0x1dc/0x450 [ ] bpf_raw_tracepoint_open+0x9a/0x1e0 [ ] ? find_held_lock+0x2d/0x90     [ ] ? lock_release+0x150/0x430 [ ] __sys_bpf+0xbd6/0x2700 [ ] ? lock_is_held_type+0xd8/0x130 [ ]
    __x64_sys_bpf+0x1c/0x20 [ ] do_syscall_64+0x3a/0x80 [ ] entry_SYSCALL_64_after_hwframe+0x44/0xae [ ] RIP:
    0033:0x7fa9421defa9 [ ] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 9 f8 [...] [ ] RSP:
    002b:00007ffed743bd78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ ] RAX: ffffffffffffffda RBX:
    00000000069d2480 RCX: 00007fa9421defa9 [ ] RDX: 0000000000000078 RSI: 00007ffed743bd80 RDI:
    0000000000000011 [ ] RBP: 00007ffed743be00 R08: 0000000000bb7270 R09: 0000000000000000 [ ] R10:
    00000000069da210 R11: 0000000000000246 R12: 0000000000000001 [ ] R13: 00007ffed743c4b0 R14:
    00000000069d2480 R15: 0000000000000001 [ ] </TASK> [ ] Modules linked in: klp_vm(OK) [ ] ---[ end trace     0000000000000000 ]--- One way to trigger this is: 1. load a livepatch that patches kernel function xxx; 2.
    run bpftrace -e 'kfunc:xxx {}', this will fail (expected for now); 3. repeat #2 => gpf. This is because     the entry is added to direct_functions, but not removed. Fix this by remove the entry from     direct_functions when register_ftrace_direct fails. Also remove the last trailing space from ftrace.c, so     we don't have to worry about it anymore. (CVE-2022-49402)

  - In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3: Fix refcount leak in     gic_populate_ppi_partitions of_find_node_by_phandle() returns a node pointer with refcount incremented, we     should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
    (CVE-2022-49715)

  - In the Linux kernel, the following vulnerability has been resolved: cpufreq: CPPC: Add u64 casts to avoid     overflowing The fields of the _CPC object are unsigned 32-bits values. To avoid overflows while using
    _CPC's values, add 'u64' casts. (CVE-2022-49750)

  - In the Linux kernel, the following vulnerability has been resolved: net: stream: purge sk_error_queue in     sk_stream_kill_queues() Changheon Lee reported TCP socket leaks, with a nice repro. It seems we leak TCP     sockets with the following sequence: 1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket. Each ACK will     cook an skb put in error queue, from __skb_tstamp_tx(). __skb_tstamp_tx() is using skb_clone(), unless     SOF_TIMESTAMPING_OPT_TSONLY was also requested. 2) If the application is also using MSG_ZEROCOPY, then we     put in the error queue cloned skbs that had a struct ubuf_info attached to them. Whenever an struct     ubuf_info is allocated, sock_zerocopy_alloc() does a sock_hold(). As long as the cloned skbs are still in     sk_error_queue, socket refcount is kept elevated. 3) Application closes the socket, while error queue is     not empty. Since tcp_close() no longer purges the socket error queue, we might end up with a TCP socket     with at least one skb in error queue keeping the socket alive forever. This bug can be (ab)used to consume     all kernel memory and freeze the host. We need to purge the error queue, with proper synchronization     against concurrent writers. (CVE-2022-50838)

  - In the Linux kernel, the following vulnerability has been resolved: bpf: Add preempt_count_{sub,add} into     btf id deny list The recursion check in __bpf_prog_enter* and __bpf_prog_exit* leave     preempt_count_{sub,add} unprotected. When attaching trampoline to them we get panic as follows, [     867.843050] BUG: TASK stack guard page was hit at 0000000009d325cf (stack is     0000000046a46a15..00000000537e7b28) [ 867.843064] stack guard page: 0000 [#1] PREEMPT SMP NOPTI [     867.843067] CPU: 8 PID: 11009 Comm: trace Kdump: loaded Not tainted 6.2.0+ #4 [ 867.843100] Call Trace: [     867.843101] <TASK> [ 867.843104] asm_exc_int3+0x3a/0x40 [ 867.843108] RIP: 0010:preempt_count_sub+0x1/0xa0     [ 867.843135] __bpf_prog_enter_recur+0x17/0x90 [ 867.843148] bpf_trampoline_6442468108_0+0x2e/0x1000 [     867.843154] ? preempt_count_sub+0x1/0xa0 [ 867.843157] preempt_count_sub+0x5/0xa0 [ 867.843159] ?     migrate_enable+0xac/0xf0 [ 867.843164] __bpf_prog_exit_recur+0x2d/0x40 [ 867.843168]     bpf_trampoline_6442468108_0+0x55/0x1000 ... [ 867.843788] preempt_count_sub+0x5/0xa0 [ 867.843793] ?     migrate_enable+0xac/0xf0 [ 867.843829] __bpf_prog_exit_recur+0x2d/0x40 [ 867.843837] BUG: IRQ stack guard     page was hit at 0000000099bd8228 (stack is 00000000b23e2bc4..000000006d95af35) [ 867.843841] BUG: IRQ     stack guard page was hit at 000000005ae07924 (stack is 00000000ffd69623..0000000014eb594c) [ 867.843843]     BUG: IRQ stack guard page was hit at 00000000028320f0 (stack is 00000000034b6438..0000000078d1bcec) [     867.843842] bpf_trampoline_6442468108_0+0x55/0x1000 ... That is because in __bpf_prog_exit_recur, the     preempt_count_{sub,add} are called after prog->active is decreased. Fixing this by adding these two     functions into btf ids deny list. (CVE-2023-54086)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
343617	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-3270)	Nessus	Huawei Local Security Checks	2026/9/8	2026/9/23	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	2026/8/26	2026/9/23	high
347900	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:4254-1)	Nessus	SuSE Local Security Checks	2026/9/18	2026/9/29	high
361223	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787307395)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	medium

检测

插件搜索

high

high

high

medium