An update of the linux package has been released.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789898700 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: ceph: fix possible deadlock when     holding Fwb to get inline_data 1, mount with wsync. 2, create a file with O_RDWR, and the request was sent     to mds.0: ceph_atomic_open()--> ceph_mdsc_do_request(openc) finish_open(file, dentry, ceph_open)-->     ceph_open()--> ceph_init_file()--> ceph_init_file_info()--> ceph_uninline_data()--> { ... if     (inline_version == 1 || /* initial version, no data */ inline_version == CEPH_INLINE_NONE) goto     out_unlock; ... } The inline_version will be 1, which is the initial version for the new create file. And     here the ci->i_inline_version will keep with 1, it's buggy. 3, buffer write to the file immediately:
    ceph_write_iter()--> ceph_get_caps(file, need=Fw, want=Fb, ...); generic_perform_write()-->     a_ops->write_begin()--> ceph_write_begin()--> netfs_write_begin()--> netfs_begin_read()-->     netfs_rreq_submit_slice()--> netfs_read_from_server()--> rreq->netfs_ops->issue_read()-->     ceph_netfs_issue_read()--> { ... if (ci->i_inline_version != CEPH_INLINE_NONE &&     ceph_netfs_issue_op_inline(subreq)) return; ... } ceph_put_cap_refs(ci, Fwb); The     ceph_netfs_issue_op_inline() will send a getattr(Fsr) request to mds.1. 4, then the mds.1 will request the     rd lock for CInode::filelock from the auth mds.0, the mds.0 will do the CInode::filelock state transation     from excl --> sync, but it need to revoke the Fxwb caps back from the clients. While the kernel client has     aleady held the Fwb caps and waiting for the getattr(Fsr). It's deadlock! URL:
    https://tracker.ceph.com/issues/55377 (CVE-2022-49296)

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix reading strings from     synthetic events The follow commands caused a crash: # cd /sys/kernel/tracing # echo 's:open char file[]'     > dynamic_events # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' >     events/syscalls/sys_enter_openat/trigger' # echo 1 > events/synthetic/open/enable BOOM! The problem is     that the synthetic event field char file[] will read the value given to it as a string without any     memory checks to make sure the address is valid. The above example will pass in the user space address and     the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an     oops when accessing user space addresses. Use the helper functions from trace_kprobe and trace_eprobe that     can read strings safely (and actually succeed when the address is from user space and the memory is mapped     in). Now the above can show: packagekitd-1721 [000] ...2. 104.597170: open:
    file=/usr/lib/rpm/fileattrs/cmake.attr in:imjournal-978 [006] ...2. 104.599642: open:
    file=/var/lib/rsyslog/imjournal.state.tmp packagekitd-1721 [000] ...2. 104.626308: open:
    file=/usr/lib/rpm/fileattrs/debuginfo.attr (CVE-2022-50255)

  - In the Linux kernel, the following vulnerability has been resolved: hwrng: core - Fix page fault dead lock     on mmap-ed hwrng There is a dead-lock in the hwrng device read path. This triggers when the user reads     from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive     read which then dead-locks. Fix this by using a stack buffer when calling copy_to_user. (CVE-2023-52615)

  - In the Linux kernel, the following vulnerability has been resolved: fscache: Use wait_on_bit() to wait for     the freeing of relinquished volume The freeing of relinquished volume will wake up the pending volume     acquisition by using wake_up_bit(), however it is mismatched with wait_var_event() used in     fscache_wait_on_volume_collision() and it will never wake up the waiter in the wait-queue because these     two functions operate on different wait-queues. According to the implementation in     fscache_wait_on_volume_collision(), if the wake-up of pending acquisition is delayed longer than 20     seconds (e.g., due to the delay of on-demand fd closing), the first wait_var_event_timeout() will timeout     and the following wait_var_event() will hang forever as shown below: FS-Cache: Potential volume collision     new=00000024 old=00000022 ...... INFO: task mount:1148 blocked for more than 122 seconds. Not tainted     6.1.0-rc6+ #1 task:mount state:D stack:0 pid:1148 ppid:1 Call Trace: <TASK> __schedule+0x2f6/0xb80     schedule+0x67/0xe0 fscache_wait_on_volume_collision.cold+0x80/0x82 __fscache_acquire_volume+0x40d/0x4e0     erofs_fscache_register_volume+0x51/0xe0 [erofs] erofs_fscache_register_fs+0x19c/0x240 [erofs]     erofs_fc_fill_super+0x746/0xaf0 [erofs] vfs_get_super+0x7d/0x100 get_tree_nodev+0x16/0x20     erofs_fc_get_tree+0x20/0x30 [erofs] vfs_get_tree+0x24/0xb0 path_mount+0x2fa/0xa90 do_mount+0x7c/0xa0
    __x64_sys_mount+0x8b/0xe0 do_syscall_64+0x30/0x60 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Considering     that wake_up_bit() is more selective, so fix it by using wait_on_bit() instead of wait_var_event() to wait     for the freeing of relinquished volume. In addition because waitqueue_active() is used in wake_up_bit()     and clear_bit() doesn't imply any memory barrier, use clear_and_wake_up_bit() to add the missing memory     barrier between cursor->flags and waitqueue_active(). (CVE-2023-52982)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix iso_conn related     locking and validity issues sk->sk_state indicates whether iso_pi(sk)->conn is valid. Operations that     check/update sk_state and access conn should hold lock_sock, otherwise they can race. The order of taking     locks is hci_dev_lock > lock_sock > iso_conn_lock, which is how it is in connect/disconnect_cfm ->     iso_conn_del -> iso_chan_del. Fix locking in iso_connect_cis/bis and sendmsg/recvmsg to take lock_sock     around updating sk_state and conn. iso_conn_del must not occur during iso_connect_cis/bis, as it frees the     iso_conn. Hold hdev->lock longer to prevent that. This should not reintroduce the issue fixed in commit     241f51931c35 (Bluetooth: ISO: Avoid circular locking dependency), since the we acquire locks in order.
    We retain the fix in iso_sock_connect to release lock_sock before iso_connect_* acquires hdev->lock.
    Similarly for commit 6a5ad251b7cd (Bluetooth: ISO: Fix possible circular locking dependency). We retain     the fix in iso_conn_ready to not acquire iso_conn_lock before lock_sock. iso_conn_add shall return     iso_conn with valid hcon. Make it so also when reusing an old CIS connection waiting for disconnect     timeout (see __iso_sock_close where conn->hcon is set to NULL). Trace with iso_conn_del after iso_chan_add     in iso_connect_cis: =============================================================== iso_sock_create:771:
    sock 00000000be9b69b7 iso_sock_init:693: sk 000000004dff667e iso_sock_bind:827: sk 000000004dff667e     70:1a:b8:98:ff:a2 type 1 iso_sock_setsockopt:1289: sk 000000004dff667e iso_sock_setsockopt:1289: sk     000000004dff667e iso_sock_setsockopt:1289: sk 000000004dff667e iso_sock_connect:875: sk 000000004dff667e     iso_connect_cis:353: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7e:da hci_get_route:1199: 70:1a:b8:98:ff:a2 ->     28:3d:c2:4a:7e:da hci_conn_add:1005: hci0 dst 28:3d:c2:4a:7e:da iso_conn_add:140: hcon 000000007b65d182     conn 00000000daf8625e __iso_chan_add:214: conn 00000000daf8625e iso_connect_cfm:1700: hcon     000000007b65d182 bdaddr 28:3d:c2:4a:7e:da status 12 iso_conn_del:187: hcon 000000007b65d182 conn     00000000daf8625e, err 16 iso_sock_clear_timer:117: sock 000000004dff667e state 3 <Note: sk_state is     BT_BOUND (3), so iso_connect_cis is still running at this point> iso_chan_del:153: sk 000000004dff667e,     conn 00000000daf8625e, err 16 hci_conn_del:1151: hci0 hcon 000000007b65d182 handle 65535     hci_conn_unlink:1102: hci0: hcon 000000007b65d182 hci_chan_list_flush:2780: hcon 000000007b65d182     iso_sock_getsockopt:1376: sk 000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk     000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e     iso_sock_getsockopt:1376: sk 000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk     000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e iso_sock_shutdown:1434:
    sock 00000000be9b69b7, sk 000000004dff667e, how 1 __iso_sock_close:632: sk 000000004dff667e state 5 socket     00000000be9b69b7 <Note: sk_state is BT_CONNECT (5), even though iso_chan_del sets BT_CLOSED (6). Only     iso_connect_cis sets it to BT_CONNECT, so it must be that iso_chan_del occurred between iso_chan_add and     end of iso_connect_cis.> BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD     8000000006467067 P4D 8000000006467067 PUD 3f5f067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI Hardware name:
    QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 RIP: 0010:__iso_sock_close     (net/bluetooth/iso.c:664) bluetooth =============================================================== Trace     with iso_conn_del before iso_chan_add in iso_connect_cis:
    =============================================================== iso_connect_cis:356: 70:1a:b8:98:ff:a2 ->     28:3d:c2:4a:7e:da ... iso_conn_add:140: hcon 0000000093bc551f conn 00000000768ae504 hci_dev_put:1487: hci0     orig refcnt 21 hci_event_packet:7607: hci0: e ---truncated--- (CVE-2023-54164)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4660-1 advisory.

    The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues:

    The following security issues were fixed:

    - CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
    - CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
    - CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
    - CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).
    - CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
    - CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).
    - CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
    - CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
    - CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).
    - CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
    - CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).
    - CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()     (bsc#1274037).
    - CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).
    - CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).
    - CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
    - CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
    - CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
    - CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
    - CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).
    - CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
    - CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
    - CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
    - CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
    - CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
    - CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
    - CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
    - CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
    - CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
    - CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink     (bsc#1277574).
    - CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
    - CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).
    - CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
    - CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
    - CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).
    - CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
    - CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
    - CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
    - CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).
    - CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).
    - CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
    - CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108).
    - CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring     qlen       (bsc#1276519).
    - CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
    - CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
    - CVE-2026-74356: vhost: move smp_rmb() into vhost_get_avail_idx() (bsc#1278063).
    - CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070).
    - CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).
    - CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
    - CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).
    - CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).
    - CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).
    - CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).
    - CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
    - CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
    - CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341).
    - CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).
    - CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).
    - CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).
    - CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).
    - CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).
    - CVE-2026-74541: Bluetooth: ISO: clear iso_data always when detaching conn from hcon (bsc#1275694).
    - CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).
    - CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
    - CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).
    - CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
    - CVE-2026-74608: smb: client: Fix use-after-free in cifs_try_adding_channels() (bsc#1277796).
    - CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906).
    - CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).
    - CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).
    - CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
    - CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).
    - CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).
    - CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers     (bsc#1277626).
    - CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in     smc_llc_event_handler()       (bsc#1276572).
    - CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).
    - CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).
    - CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).
    - CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
    - CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).
    - CVE-2026-80580: fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294).
    - CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335).
    - CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).
    - CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink (bsc#1277837).
    - CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).
    - CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).
    - CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).
    - CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).
    - CVE-2026-80799: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (bsc#1279811).
    - CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).
    - CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).
    - CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).
    - CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).
    - CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422).
    - CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).
    - CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).
    - CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
    - CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).
    - CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).
    - CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).
    - CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).
    - CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).
    - CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727).
    - CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).
    - CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).
    - CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).
    - CVE-2026-89636: smb: client: clear ce->tgthint in free_tgts() (bsc#1281042).
    - CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions     (bsc#1281046).
    - CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).
    - CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).
    - CVE-2026-89899: media: cec: disable delayed work before freeing an interrupted transmit (bsc#1281383).
    - CVE-2026-89931: KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (bsc#1281427).
    - CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).
    - CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).
    - CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop     (bsc#1281397).
    - CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).
    - CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).
    - CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()     (bsc#1281680).
    - CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).
    - CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).
    - CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).
    - CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).
    - CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).
    - CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).
    - CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).

    The following non security issues were fixed:

    - Also reflect disabled BATMAN in supported.conf.
    - Disable CONFIG_BATMAN_ADV (jsc#PED-16892).
    - Disable CONFIG_CAN (jsc#PED-16993).
    - Fif selftests build failure caused by jsc#PED-16401 backport (bsc#1281927).
    - RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).
    - arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).
    - arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).
    - arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).
    - arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).
    - arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).
    - arm64: percpu: Fix this_cpu_write() casting (git-fixes).
    - compiler_types: Introduce __flex_counter() and family (bsc#1280139).
    - default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).
    - docs: tls: document TLS1.3 key updates (bsc#1267564 jsc#PED-16401).
    - firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).
    - i2c: core: fix irq domain leak on adapter registration failure (git-fixes).
    - kabi: tls add counters for rekey (bsc#1267564 jsc#PED-16401).
    - kernel-binary.spec.in: Fix syntax error.
    - net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).
    - net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).
    - net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).
    - net: tls: Pass union tls_crypto_context pointer to memzero_explicit (bsc#1267564 jsc#PED-16401).
    - perf: Reject exited events as group leaders (git-fixes).
    - selftests: tls: add getsockopt test (bsc#1267564 jsc#PED-16401).
    - selftests: tls: add key_generation argument to tls_crypto_info_init (bsc#1267564 jsc#PED-16401).
    - selftests: tls: add rekey tests (bsc#1267564 jsc#PED-16401).
    - slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139).
    - slab: Introduce kmalloc_flex() and family (bsc#1280139).
    - slab: Introduce kmalloc_obj() and family (bsc#1280139).
    - slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).
    - smb: client: harden DFS cache against invalid target hints (git-fixes).
    - tls: add counters for rekey (bsc#1267564 jsc#PED-16401).
    - tls: block decryption when a rekey is pending (bsc#1267564 jsc#PED-16401).
    - tls: implement rekey for TLS1.3 (bsc#1267564 jsc#PED-16401).
    - tls: skip setting sk_write_space on rekey (bsc#1267564 jsc#PED-16401).
    - x86/mm: Fix pmd_modify() dropping the dirty bit (bsc#1275455).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate packets beyond     GRO_LEGACY_MAX_SIZE (64KB), BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP (with     sufficient MAC header room to insert the temporary HBH jumbo header). However, commit b1a78b9b9886 (net:
    add support for ipv4 big tcp) loosened the check in skb_gro_receive(), leading to several issues: 1.
    skb_gro_receive() checked skb_headroom(p) instead of the actual space before the MAC header     (p->mac_header). Because skb_headroom(p) includes mac_len, crafted frames (e.g. injected via AF_PACKET)     can pass the check with p->mac_header < 8 bytes. When ipv6_gro_complete() inserts the temporary HBH jumbo     header, the memmove() starts before skb->head, causing an out-of-bounds write and wrapping     skb->mac_header. 2. It allowed non-IP protocols such as software VLAN (ETH_P_8021Q / ETH_P_8021AD) to     aggregate beyond 64KB because p->protocol != ETH_P_IPV6 was true. 3. It checked p->encapsulation instead     of NAPI_GRO_CB(skb)->encap_mark, allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate beyond     64KB. Fix skb_gro_receive() to strictly enforce: - NAPI_GRO_CB(skb)->proto == IPPROTO_TCP - Not     encapsulated (!NAPI_GRO_CB(skb)->encap_mark && !p->encapsulation) - Protocol must be either ETH_P_IP or     ETH_P_IPV6 - If ETH_P_IPV6, p->mac_header must be at least sizeof(struct hop_jumbo_hdr) Returning -E2BIG     from skb_gro_receive() ensures that packets which cannot become BIG TCP are cleanly flushed at <= 64KB and     delivered intact without dropping. This issue does not exist in mainline (7.0+) because the subsystem was     rewritten in commit 81be30c1f5f2 (net/ipv6: Drop HBH for BIG TCP on RX side), making this fix relevant     only for older stable branches like 6.18.y. (CVE-2026-80725)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
375011	Photon OS 5.0: Linux PHSA-2026-5.0-91-0999	Nessus	PhotonOS Local Security Checks	2026/11/2	2026/11/2	high
360912	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1789898700)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	high
366039	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4660-1)	Nessus	SuSE Local Security Checks	2026/10/15	2026/10/15	high
341561	Linux Distros Unpatched Vulnerability : CVE-2026-80725	Nessus	Misc.	2026/8/29	2026/11/7	critical

检测

插件搜索

high

high

high

critical