The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-76738 advisory.

    - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot)     [RHEL-271653] {CVE-2026-93288}
    - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698]     {CVE-2026-64024}
    - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645]     {CVE-2026-46275}
    - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot)     [RHEL-232645] {CVE-2026-46275}
    - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227}
    - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972}
    - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773]     {CVE-2026-64132}
    - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657]     {CVE-2026-97417}
    - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063]     {CVE-2026-52972}
    - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003}
    - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469]     {CVE-2026-80775}
    - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778}
    - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758}
    - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469]     {CVE-2026-80776}
    - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658}
    - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476}
    - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792}
    - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924}
    - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922}
    - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288]     {CVE-2026-63984}
    - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393]     {CVE-2026-63920}
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359]     {CVE-2026-64557}
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359]     {CVE-2026-64557}
    - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359]     {CVE-2026-64557}
    - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466]     {CVE-2026-63918}
    - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778]     {CVE-2026-63992}
    - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal)     [RHEL-259564] {CVE-2026-63994}
    - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729]     {CVE-2026-68432}
    - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005]     {CVE-2026-72052}
    - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054]     {CVE-2026-63829}
    - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357}
    - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761]     {CVE-2026-53357}
    - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot)     [RHEL-261255] {CVE-2026-72320}
    - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921}
    - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot)     [RHEL-254525] {CVE-2026-74516}
    - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525]     {CVE-2026-74516}
    - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525]     {CVE-2026-74516}
    - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525]     {CVE-2026-74516}
    - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot)     [RHEL-254525] {CVE-2026-74516}
    - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392]     {CVE-2026-74669}
    - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392]     {CVE-2026-74669}
    - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669}
    - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430]     {CVE-2026-72255}
    - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394]     {CVE-2026-64078}
    - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746}
    - packet: use consistent hard_header_len in non-ring send paths (Toke Hoiland-Jorgensen) [RHEL-244537]     {CVE-2026-74582}
    - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598]     {CVE-2026-45856}
    - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220]     {CVE-2026-45860}
    - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270}
    - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949]     {CVE-2026-63794}
    - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099}
    - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992]     {CVE-2026-64034}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_isn leak     enabling ISN prediction Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-     CPU variable, assuming the value would always be consumed by tcp_conn_request() for the same packet that     wrote it. That assumption is violated by multiple drop paths between the producer     (__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer (tcp_conn_request()): - min_ttl /     min_hopcount check - xfrm policy check - tcp_inbound_hash() MD5/AO mismatch - tcp_filter()     eBPF/SO_ATTACH_FILTER drop - th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN -     psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv() - tcp_checksum_complete() in tcp_v{4,6}_do_rcv() -     tcp_v{4,6}_cookie_check() returning NULL When a packet is dropped on any of these paths, tcp_tw_isn is     left set. The next SYN processed on the same CPU then consumes the non zero value in tcp_conn_request(),     receiving a potentially predictable ISN. This patch moves back tcp_tw_isn to skb->cb[], getting rid of the     per-cpu variable. Note that tcp_v{4,6}_fill_cb() do not set it. Very litle impact on overall code     size/complexity: $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 2/1     up/down: 8/-15 (-7) Function old new delta tcp_v6_rcv 3038 3042 +4 tcp_v4_rcv 3035 3039 +4     tcp_conn_request 2938 2923 -15 Total: Before=24436060, After=24436053, chg -0.00% (CVE-2026-64024)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793866396 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: rv: Use strings in da monitors     tracepoints Using DA monitors tracepoints with KASAN enabled triggers the following warning: BUG: KASAN:
    global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 Read of size 32 at addr     ffffffffaada8980 by task ... Call Trace: <TASK> [...] do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0     ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10 ? trace_event_sncid+0x83/0x200     trace_event_sncid+0x163/0x200 [...] The buggy address belongs to the variable: automaton_snep+0x4e0/0x5e0     This is caused by the tracepoints reading 32 bytes __array instead of __string from the automata     definition. Such strings are literals and reading 32 bytes ends up in out of bound memory accesses (e.g.
    the next automaton's data in this case). The error is harmless as, while printing the string, we stop at     the null terminator, but it should still be fixed. Use the __string facilities while defining the     tracepoints to avoid reading out of bound memory. (CVE-2025-38636)

  - In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN() overflow When     allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to     ULONG_MAX then the ALIGN() can wrap resulting in a corrupted iova. Open code the ALIGN() using     get_add_overflow() to prevent this. This simplifies the checks as we don't need to check for length     earlier either. Consolidate the two copies of this code under a single helper. This bug would allow     userspace to create a mapping that overlaps with some other mapping or a reserved range. (CVE-2025-38688)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL dereference in     ath11k_qmi_m3_load() If ab->fw.m3_data points to data, then fw pointer remains null. Further, if m3_mem is     not allocated, then fw is dereferenced to be passed to ath11k_err function. Replace fw->size by m3_len.
    Found by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2025-39991)

  - In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-     bounds writes in handle_auth_session_key() The len field originates from untrusted network packets.
    Boundary checks have been added to prevent potential out-of-bounds writes when decrypting the connection     secret or processing service tickets. [ idryomov: changelog ] (CVE-2025-68284)

  - In the Linux kernel, the following vulnerability has been resolved: tipc: fix bc_ackers underflow on     duplicate GRP_ACK_MSG The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements bc_ackers on     every inbound group ACK, even when the same member has already acknowledged the current broadcast round.
    Because bc_ackers is a u16, a duplicate ACK received after the last legitimate ACK wraps the counter to     65535. Once wrapped, tipc_group_bc_cong() keeps reporting congestion and later group broadcasts on the     affected socket stay blocked until the group is recreated. Fix this by ignoring duplicate or stale ACKs     before touching bc_acked or bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and prevents     the underflow path. (CVE-2026-31662)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2149:105 advisory.

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)
      * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935)
      * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)
      * kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)
      * kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024)
      * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962)
      * kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974)
      * kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)
      * kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)
      * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509)
      * kernel: Linux kernel: Denial of Service due to incorrect GSO state handling in network fragment     reassembly (CVE-2026-80590)
      * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)
      * kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)
      * kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation ()
      * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260)
      * kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:86033 advisory.

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)

    * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935)

    * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)

    * kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)

    * kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024)

    * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962)

    * kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974)

    * kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)

    * kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)

    * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509)

    * kernel: Linux kernel: Denial of Service due to incorrect GSO state handling in network fragment     reassembly (CVE-2026-80590)

    * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)

    * kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)

    * kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation ()

    * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260)

    * kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999)

    Bug Fix(es) and Enhancement(s):

    * Batch: z-stream xfrm - rhel-9.8.z (NST-Core-26W38) (JIRA:Rocky Linux-256697)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:76738 advisory.

    * kernel: netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860)
      * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
      * kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275)
      * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
      * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
      * kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357)
      * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
      * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
      * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)
      * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)
      * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
      * kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024)
      * kernel: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (CVE-2026-63918)
      * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)
      * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
      * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()     (CVE-2026-63994)
      * kernel: netfilter: x_tables: add and use xtables_unregister_table_exit (CVE-2026-64078)
      * kernel: ipv6: ioam: refresh hdr pointer before ioam6_event() (CVE-2026-64132)
      * kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557)
      * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
      * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476)
      * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
      * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)
      * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
      * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active     (CVE-2026-74516)
      * kernel: packet: use consistent hard_header_len in non-ring send paths ()
      * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)
      * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
      * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
      * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
      * kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)
      * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
      * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
      * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
      * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)
      * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state     (CVE-2026-93288)


    Bug Fix(es) and Enhancement(s):

      * wifi card breaks using FIPS (JIRA:AlmaLinux-257457)
      * AlmaLinux10.0 - kernel: CPU hotplug unsupported by CPUMF [almalinux-10.2.z] (JIRA:AlmaLinux-270888)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:86033 advisory.

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)
      * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935)
      * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)
      * kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)
      * kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024)
      * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962)
      * kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974)
      * kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)
      * kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)
      * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509)
      * kernel: Linux kernel: Denial of Service due to incorrect GSO state handling in network fragment     reassembly (CVE-2026-80590)
      * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)
      * kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)
      * kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation ()
      * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260)
      * kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999)


    Bug Fix(es) and Enhancement(s):

      * Batch: z-stream xfrm - almalinux-9.8.z (NST-Core-26W38) (JIRA:AlmaLinux-256697)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-86033 advisory.

    - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987]     {CVE-2026-99999}
    - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov)     [RHEL-271284] {CVE-2026-89631}
    - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260}
    - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817}
    - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson)     [RHEL-271487] {CVE-2026-89633}
    - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski)     [RHEL-232528] {CVE-2026-64032}
    - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693]     {CVE-2026-64024}
    - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131]     {CVE-2026-64572}
    - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224]     {CVE-2026-80590}
    - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114}
    - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429]     {CVE-2026-63958}
    - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes)     [RHEL-259429] {CVE-2026-63962}
    - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429]     {CVE-2026-63963}
    - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes)     [RHEL-259429] {CVE-2026-63961}
    - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322]     {CVE-2026-63956}
    - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322]     {CVE-2026-63957}
    - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322]     {CVE-2026-63928}
    - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322]     {CVE-2026-63899}
    - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856]     {CVE-2026-31678}
    - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678}
    - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764]     {CVE-2026-63974}
    - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764]     {CVE-2026-63974}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
368019	Oracle Linux 10 : kernel (ELSA-2026-76738)	Nessus	Oracle Linux Local Security Checks	2026/10/20	2026/10/26	high
327964	Linux Distros Unpatched Vulnerability : CVE-2026-64024	Nessus	Misc.	2026/7/20	2026/11/4	critical
350138	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21910-1)	Nessus	SuSE Local Security Checks	2026/9/25	2026/9/28	high
340681	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	2026/8/26	2026/10/14	high
376432	Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793866396)	Nessus	Rocky Linux Local Security Checks	2026/11/5	2026/11/5	high
371944	MiracleLinux 9 : kernel-5.14.0-687.59.1.el9_8 (AXSA:2026-2149:105)	Nessus	Miracle Linux Local Security Checks	2026/10/25	2026/11/2	high
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	2026/9/7	2026/9/24	high
370461	RockyLinux 9 : kernel (RLSA-2026:86033)	Nessus	Rocky Linux Local Security Checks	2026/10/22	2026/11/2	high
367954	AlmaLinux 10 : kernel (ALSA-2026:76738)	Nessus	Alma Linux Local Security Checks	2026/10/20	2026/10/26	high
339766	Photon OS 5.0: Linux PHSA-2026-5.0-91-0973	Nessus	PhotonOS Local Security Checks	2026/8/26	2026/11/2	critical
369982	AlmaLinux 9 : kernel (ALSA-2026:86033)	Nessus	Alma Linux Local Security Checks	2026/10/21	2026/11/6	high
372926	Oracle Linux 9 : kernel (ELSA-2026-86033)	Nessus	Oracle Linux Local Security Checks	2026/10/28	2026/11/2	high
337239	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2057)	Nessus	Amazon Linux Local Security Checks	2026/8/18	2026/9/23	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	2026/8/26	2026/9/23	high

检测

插件搜索

high

critical

high

high

high

high

high

high

high

critical

high

high

high

high