The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50372 advisory.

    - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)   {CVE-2026-46331}
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner)  [Orabug: 39668743]     {CVE-2026-46242}
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen)  [Orabug: 39656679]     {CVE-2026-52943}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39548792]     {CVE-2025-10263}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (Ilya Maximets) {CVE-2026-46165}
    - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Ankit Soni)     {CVE-2026-43220}
    - usb: ulpi: fix memory leak on ulpi_register() error paths (Felix Gu) {CVE-2026-46109}
    - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39463671]     {CVE-2026-46243}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug:
    39368826,39441323] {CVE-2026-43503,CVE-2026-46300}
    - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39368826]     {CVE-2026-46300}
    - netfilter: reject zero shift in nft_bitwise (Kai Ma) [Orabug: 39452464] {CVE-2026-46101}
    - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Andrea Mayer) [Orabug: 39452457]     {CVE-2026-46099}
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure (Deepanshu Kartikey) [Orabug: 39452739]     {CVE-2026-46048}
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Greg Kroah-Hartman) [Orabug: 39426003]     {CVE-2026-43501}
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (Takashi Iwai) [Orabug: 39452746]     {CVE-2026-45992}
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xiang Mei) [Orabug: 39205989]     {CVE-2026-31419}
    - crypto: authencesn - reject short ahash digests during instance creation (Yucheng Lu) [Orabug: 39452231]     {CVE-2026-46033}
    - spi: fix resource leaks on device setup failure (Johan Hovold) [Orabug: 39452400] {CVE-2026-46083}
    - net: qrtr: ns: Limit the total number of nodes (Manivannan Sadhasivam) [Orabug: 39452123]     {CVE-2026-46003}
    - net: bridge: use a stable FDB dst snapshot in RCU readers (Zhengchuan Liang) [Orabug: 39452411]     {CVE-2026-46086}
    - net: qrtr: ns: Limit the maximum number of lookups (Manivannan Sadhasivam) [Orabug: 39452207]     {CVE-2026-46026}
    - net: qrtr: ns: Limit the maximum server registration per node (Manivannan Sadhasivam) [Orabug: 39410851]     {CVE-2026-43491}
    - RDMA/mana_ib: Disable RX steering on RSS QP destroy (Long Li) [Orabug: 39452406] {CVE-2026-46084}
    - media: rc: igorplugusb: heed coherency rules (Oliver Neukum) [Orabug: 39452432] {CVE-2026-46091}
    - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (Daniel Hodges) [Orabug: 39452343]     {CVE-2026-46069}
    - thermal: core: Fix thermal zone governor cleanup issues (Rafael J. Wysocki) [Orabug: 39452186]     {CVE-2026-46021}
    - smb: client: validate the whole DACL before rewriting it in cifsacl (Michael Bommarito) [Orabug:
    39300611] {CVE-2026-31709}
    - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (Yang Xiuwei) [Orabug: 39452100]     {CVE-2026-45997}
    - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39425998]     {CVE-2026-43499}
    - ceph: only d_add() negative dentries when they are unhashed (Max Kellermann) [Orabug: 39452291]     {CVE-2026-46052}
    - dm mirror: fix integer overflow in create_dirty_log() (Junrui Luo) [Orabug: 39452196] {CVE-2026-46023}
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (Shuvam Pandey) [Orabug: 39452304]     {CVE-2026-46056}
    - tcp: call sk_data_ready() after listener migration (Zhenzhong Wu) [Orabug: 39452159] {CVE-2026-46015}
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (Chia-Ming Chang) [Orabug:
    39452250] {CVE-2026-46040}
    - md/raid5: validate payload size before accessing journal metadata (Junrui Luo) [Orabug: 39452349]     {CVE-2026-46070}
    - md/raid5: fix soft lockup in retry_aligned_read() (Chia-Ming Chang) [Orabug: 39452287] {CVE-2026-46051}
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (Sohei Koyama) [Orabug: 39452269]     {CVE-2026-46046}
    - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (Deepanshu Kartikey) [Orabug:
    39452442] {CVE-2026-46094}
    - io_uring/poll: fix multishot recv missing EOF on wakeup race (Jens Axboe) {CVE-2026-23473}
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Kevin Cheng) [Orabug: 39452372]     {CVE-2026-46076}
    - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (Kevin Cheng) [Orabug: 39452394] {CVE-2026-46082}
    - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (Yosry Ahmed) [Orabug: 39452061]     {CVE-2026-45987}
    - xfs: fix a resource leak in xfs_alloc_buftarg() (Haoxiang Li) [Orabug: 39452131] {CVE-2026-46005}
    - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (Raphael Zimmer) [Orabug:
    39452201] {CVE-2026-46024}
    - ipv4: icmp: validate reply type before using icmp_pointers (Ruide Cao) [Orabug: 39452243]     {CVE-2026-46037}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Hkbinbin) [Orabug: 39452259]     {CVE-2026-46043}
    - net: qrtr: ns: Free the node during ctrl_cmd_bye() (Manivannan Sadhasivam) [Orabug: 39452246]     {CVE-2026-46038}
    - rxrpc: Fix rxkad crypto unalignment handling (David Howells) [Orabug: 39452728] {CVE-2026-46085}
    - ALSA: caiaq: Handle probe errors properly (Takashi Iwai) [Orabug: 39452126] {CVE-2026-46004}
    - rbd: fix null-ptr-deref when device_add_disk() fails (Dawei Feng) [Orabug: 39452385] {CVE-2026-46079}
    - md/raid10: fix deadlock with check operation and nowait requests (Josh Hunt) [Orabug: 39452284]     {CVE-2026-46050}
    - jbd2: fix deadlock in jbd2_journal_cancel_revoke() (Zhang Yi) [Orabug: 39452318] {CVE-2026-46061}
    - erofs: fix the out-of-bounds nameoff handling for trailing dirents (Gao Xiang) [Orabug: 39452380]     {CVE-2026-46078}
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (Harin Lee) [Orabug: 39452280] {CVE-2026-46049}
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() (Vasiliy Kovalev) [Orabug: 39452119]     {CVE-2026-46002}
    - net: qrtr: ns: Fix use-after-free in driver remove() (Manivannan Sadhasivam) [Orabug: 39452274]     {CVE-2026-46047}
    - net: strparser: fix skb_head leak in strp_abort_strp() (Luxiao Xu) [Orabug: 39452468] {CVE-2026-46102}
    - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (Ziqing Chen)     [Orabug: 39452416] {CVE-2026-46088}
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Herbert Xu) [Orabug: 39410863] {CVE-2026-43493}
    - wifi: rtw88: check for PCI upstream bridge existence (Fedor Pchelkin) [Orabug: 39452437]     {CVE-2026-46092}
    - zram: do not forget to endio for partial discard requests (Sergey Senozhatsky) [Orabug: 39452420]     {CVE-2026-46089}
    - ocfs2: split transactions in dio completion to avoid credit exhaustion (Heming Zhao) [Orabug: 39452388]     {CVE-2026-46080}
    - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (Jesse Zhang) [Orabug: 39167551]     {CVE-2026-23468}
    - padata: Fix pd UAF once and for all (Herbert Xu) [Orabug: 38335055] {CVE-2025-38584}
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (Greg Kroah-Hartman) [Orabug: 39452133]     {CVE-2026-46006}
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (Cassio Gabriel) [Orabug: 39452170]     {CVE-2026-46018}
    - Buffer overflow in drivers/xen/sys-hypervisor.c (Juergen Gross) [Orabug: 39305898] {CVE-2026-31786}
    - xen/privcmd: fix double free via VMA splitting (Juergen Gross) [Orabug: 39305908] {CVE-2026-31787}
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing (Anderson Nascimento) [Orabug:
    39300563] {CVE-2026-31696}
    - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31697}
    - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31698}
    - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31699}
    - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (Bingquan Chen) {CVE-2026-31700}
    - ALSA: caiaq: take a reference on the USB device in create_card() (Berk Cem Goksel) [Orabug: 39300586]     {CVE-2026-31701}
    - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (Michael Bommarito) [Orabug:
    39300607] {CVE-2026-31708}
    - smb: client: require a full NFS mode SID before reading mode bits (Michael Bommarito) [Orabug: 39343707]     {CVE-2026-43350}
    - fuse: reject oversized dirents in page cache (Samuel Page) [Orabug: 39300556] {CVE-2026-31694}
    - mm/pagewalk: fix race between concurrent split and refault (Max Boone) [Orabug: 39250782]     {CVE-2026-31456}
    - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (Felix Fietkau) [Orabug: 39167472]     {CVE-2026-23444}
    - mm/userfaultfd: fix hugetlb fault mutex hash calculation (Jianhui Zhou) [Orabug: 39273453]     {CVE-2026-31575}
    - ipv6: add NULL checks for idev in SRv6 paths (Heminhong) [Orabug: 39167467] {CVE-2026-23442}
    - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline (Joseph Qi) [Orabug: 39331090] {CVE-2026-43075}
    - ocfs2: validate inline data i_size during inode read (Deepanshu Kartikey) [Orabug: 39331097]     {CVE-2026-43076}
    - media: as102: fix to not free memory after the device is registered in as102_usb_probe() (Jeongjun Park)     [Orabug: 39273467] {CVE-2026-31578}
    - bcache: fix cached_dev.sb_bio use-after-free and crash (Mingzhe Zou) [Orabug: 39273481] {CVE-2026-31580}
    - ALSA: 6fire: fix use-after-free on disconnect (Berk Cem Goksel) [Orabug: 39273486] {CVE-2026-31581}
    - media: em28xx: fix use-after-free in em28xx_v4l2_open() (Abhishek Kumar) [Orabug: 39273493]     {CVE-2026-31583}
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (Breno Leitao) [Orabug: 39273507]     {CVE-2026-31586}
    - KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug:
    39273521] {CVE-2026-31588}
    - x86-64: rename misleadingly named '__copy_user_nocache()' function (Linus Torvalds) [Orabug: 39323162]     {CVE-2026-43073}
    - kernel: be more careful about dup_mmap() failures and uprobe registering (Liam R. Howlett)     {CVE-2025-21709}
    - gpiolib: fix race condition for gdev->srcu (Pawel Narewski) [Orabug: 38887677] {CVE-2026-22986}
    - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (Sean Christopherson) [Orabug:
    39273529] {CVE-2026-31590}
    - KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (Sean Christopherson)     [Orabug: 39273553] {CVE-2026-31593}
    - ocfs2: handle invalid dinode in ocfs2_group_extend (Zhengyuan Huang) [Orabug: 39273569] {CVE-2026-31596}
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY (Tejas Bharambe) [Orabug: 39273578]     {CVE-2026-31597}
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273586]     {CVE-2026-31598}
    - dcache: Limit the minimal number of bucket to two (Zhihao Cheng) [Orabug: 39323133] {CVE-2026-43071}
    - ALSA: ctxfi: Limit PTP to a single page (Harin Lee) [Orabug: 39273608] {CVE-2026-31602}
    - wifi: rtw88: fix device leak on probe failure (Johan Hovold) [Orabug: 39273620] {CVE-2026-31604}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:51603 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (CVE-2025-40026)

    * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)

    * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)

    * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception     level resources (CVE-2025-10263)

    * kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923)

    * kernel: net: openvswitch: reject oversized nested action attrs (CVE-2026-64531)

    Bug Fix(es) and Enhancement(s):

    * qemu-kvm: error: failed to set MSR 0xc0000102 to 0xff4547ceb1600000 [RHEL.9.2.z] (JIRA:RHEL-126981)

    * [RHEL9.2-z] observe hang with nvme/051 test (JIRA:RHEL-129407)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote SUSE Linux SLES16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22099-1 advisory.

    The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
    - CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
    - CVE-2026-23327: cxl/mbox: validate payload size before accessing       contents in cxl_payload_from_user_allowed() (bsc#1260548).
    - CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching     (bsc#1261619).
    - CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
    - CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
    - CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
    - CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
    - CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
    - CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
    - CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
    - CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
    - CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
    - CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register     (bsc#1263058).
    - CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
    - CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
    - CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
    - CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
    - CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
    - CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
    - CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
    - CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
    - CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
    - CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
    - CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize       nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
    - CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
    - CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
    - CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
    - CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
    - CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
    - CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
    - CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
    - CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
    - CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
    - CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies()     (bsc#1264723).
    - CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
    - CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
    - CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
    - CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
    - CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
    - CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).
    - CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).
    - CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).
    - CVE-2026-45898: RDMA/iwcm: Fix workqueue list corruption by removing work_list (bsc#1266888).
    - CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).
    - CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).
    - CVE-2026-45942: ext4: fix e4b bitmap inconsistency reports (bsc#1266914).
    - CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).
    - CVE-2026-45984: gfs2: Fix use-after-free in iomap inline data write path (bsc#1267214).
    - CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
    - CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).
    - CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).
    - CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).
    - CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).
    - CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).
    - CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak     (bsc#1267652).
    - CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).
    - CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).

    The following non security issues were fixed:

    - accel/ivpu: Add bounds checks for firmware log indices (git-fixes).
    - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (git-fixes).
    - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).
    - ALSA: seq: dummy: fix UMP event stack overread (git-fixes).
    - arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).
    - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).
    - Bluetooth: bnep: reject short frames before parsing (git-fixes).
    - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).
    - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync (git-fixes).
    - Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).
    - Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).
    - Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).
    - config: remove DEBUG_FS_DISALLOW_MOUNT
    - debugfs: Remove broken no-mount mode (bsc#1265186).
    - debugfs: Fix default access mode config check (bsc#1265186).
    - debugfs: Remove broken no-mount mode (bsc#1265186).
    - debugfs: Remove redundant access mode checks (bsc#1265186).
    - drm/amd/display: Bound VBIOS record-chain walk loops (git-fixes).
    - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).
    - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).
    - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() (git-fixes).
    - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).
    - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).
    - drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).
    - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).
    - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups (git-fixes).
    - drm/xe: Clear pending_disable before signaling suspend fence (git-fixes).
    - ima: return error early if file xattr cannot be changed (bsc#1261041).
    - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).
    - KVM: arm64: Reassign nested_mmus array behind mmu_lock (git-fixes).
    - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (git-fixes).
    - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (git-fixes).
    - KVM: SEV: Check PSC request indices against the actual size of the buffer (git-fixes).
    - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (git-fixes).
    - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (git-fixes).
    - KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).
    - KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).
    - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (git-fixes).
    - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (git-fixes).
    - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (git-fixes).
    - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (git-fixes).
    - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (git-fixes).
    - KVM: SVM: Convert plain error code numbers to defines (git-fixes).
    - KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC (git-fixes).
    - KVM: SVM: Provide helpers to set the error code (git-fixes).
    - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (git-fixes).
    - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (git-fixes).
    - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (git-fixes).
    - KVM: x86: Move MMIO write tracing into vcpu_mmio_write() (git-fixes).
    - KVM: x86: Open code handling of completed MMIO reads in emulator_read_write() (git-fixes).
    - KVM: x86: Open code read vs. write userspace MMIO exits in emulator_read_write() (git-fixes).
    - KVM: x86: Trace unsatisfied MMIO reads on a per-page basis (git-fixes).
    - KVM: x86: Use local MMIO fragment variable to clean up emulator_read_write() (git-fixes).
    - mmc: core: Fix host controller programming for fixed driver type (git-fixes).
    - mmc: dw_mmc-rockchip: Add missing private data for very old controllers (git-fixes).
    - mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).
    - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).
    - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).
    - mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).
    - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).
    - wifi: nl80211: reject oversized EMA RNR lists (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:33743 advisory.

    * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216)
      * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)
      * kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189)


    Bug Fix(es) and Enhancement(s):

      * [AlmaLinux 8.10.z] Add an .sbat section to the x86 kernel (JIRA:AlmaLinux-182788)
      * Incorrect message NFS: Server wrote zero bytes is shown in the logs (JIRA:AlmaLinux-147665)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:27789 advisory.

    * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)
      * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
      * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
      * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)
      * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)
      * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)
      * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)
      * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
      * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)
      * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
      * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
      * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)
      * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
      * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)
      * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)
      * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)
      * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)


    Bug Fix(es) and Enhancement(s):

      * AlmaLinux9.4 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-9.8.z]     (JIRA:AlmaLinux-166048)
      * [AlmaLinux 9.8] Hung tasks during both suspend and hibernate operations on systems with Intel E810     NICs [almalinux-9.8.z] (JIRA:AlmaLinux-175699)
      * DPLL: Add support for pin operational state [almalinux-9.8.z] (JIRA:AlmaLinux-175820)
      * DPLL: Add support for fractional frequency offset between pin and device [almalinux-9.8.z]     (JIRA:AlmaLinux-175823)
      * ibmveth Adapter Freeze with Small MSS [almalinux-9.8.z] (JIRA:AlmaLinux-178308)
      * AlmaLinux9.4 - s390/mm: Add missing secure storage access fixups [almalinux-9.8.z]     (JIRA:AlmaLinux-183317)
      * rbd: eliminate a race in lock_dwork draining on unmap [almalinux-9.8.z] (JIRA:AlmaLinux-183130)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:27789 advisory.

    * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)

    * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

    * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)

    * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)

    * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)

    * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)

    * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)

    * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)

    * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)

    * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)

    * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)

    * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)

    * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)

    * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)

    * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)

    * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)

    * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)

    Bug Fix(es) and Enhancement(s):

    * Rocky Linux9.4 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [rhel-9.8.z] (JIRA:Rocky     Linux-166048)

    * [Rocky Linux 9.8] Hung tasks during both suspend and hibernate operations on systems with Intel E810     NICs [rhel-9.8.z] (JIRA:Rocky Linux-175699)

    * DPLL: Add support for pin operational state [rhel-9.8.z] (JIRA:Rocky Linux-175820)

    * DPLL: Add support for fractional frequency offset between pin and device [rhel-9.8.z] (JIRA:Rocky     Linux-175823)

    * ibmveth Adapter Freeze with Small MSS [rhel-9.8.z] (JIRA:Rocky Linux-178308)

    * Rocky Linux9.4 - s390/mm: Add missing secure storage access fixups [rhel-9.8.z] (JIRA:Rocky     Linux-183317)

    * rbd: eliminate a race in lock_dwork draining on unmap [rhel-9.8.z] (JIRA:Rocky Linux-183130)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-27789 advisory.

    - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392]     {CVE-2026-46331}
    - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
    - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102]     {CVE-2026-46135}
    - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158]     {CVE-2026-46117}
    - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
    - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941]     {CVE-2026-43279}
    - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
    - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
    - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
    - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121]     {CVE-2026-46125}
    - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
    - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057]     {CVE-2026-46152}
    - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025]     {CVE-2026-46166}
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359]     {CVE-2026-46056}
    - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506]     {CVE-2026-31669}
    - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525]     {CVE-2026-31474}
    - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot)     [RHEL-172858] {CVE-2026-31772}
    - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}
    - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
    - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539]     {CVE-2026-31508}
    - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408]     {CVE-2026-43501}
    - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
    - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843]     {CVE-2026-43116}
    - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993]     {CVE-2026-43125}
    - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
    - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
    - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot)     [RHEL-165564] {CVE-2026-23216}
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068]     {CVE-2026-31419}
    - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
    - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
    - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471]     {CVE-2026-31613}
    - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216]     {CVE-2026-43190}
    - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
    - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599]     {CVE-2026-43023}
    - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
    - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
    - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
    - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot)     [RHEL-163343] {CVE-2025-38653}
    - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750]     {CVE-2026-43303}
    - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821]     {CVE-2026-31709}
    - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin)     [RHEL-165063] {CVE-2026-31408}
    - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058]     {CVE-2026-43158}
    - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
    - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740]     {CVE-2026-43051}
    - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620]     {CVE-2026-43027}
    - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155]     {CVE-2026-31685}
    - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
    - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
    - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100]     {CVE-2025-71089}
    - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100]     {CVE-2025-71089}
    - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987]     {CVE-2026-23455}
    - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot)     [RHEL-166927] {CVE-2025-68724}
    - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734]     {CVE-2025-68183}
    - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461]     {CVE-2026-23392}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064]     {CVE-2026-46300}
    - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
    - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064]     {CVE-2026-46300}
    - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
    - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
    - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
    - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430]     {CVE-2026-31607}
    - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
325292	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50372)	Nessus	Oracle Linux Local Security Checks	2026/7/6	2026/7/8	high
333284	RHEL 9 : kernel (RHSA-2026:51603)	Nessus	Red Hat Local Security Checks	2026/8/7	2026/8/7	high
337084	Photon OS 5.0: Linux PHSA-2026-5.0-91-0837	Nessus	PhotonOS Local Security Checks	2026/8/18	2026/8/19	high
321697	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:22099-1)	Nessus	SuSE Local Security Checks	2026/6/20	2026/6/20	high
333469	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-3126)	Nessus	Huawei Local Security Checks	2026/8/8	2026/8/10	high
324589	AlmaLinux 8 : kernel (ALSA-2026:33743)	Nessus	Alma Linux Local Security Checks	2026/7/1	2026/7/1	high
322284	AlmaLinux 9 : kernel (ALSA-2026:27789)	Nessus	Alma Linux Local Security Checks	2026/6/24	2026/6/29	high
322776	RockyLinux 9 : kernel (RLSA-2026:27789)	Nessus	Rocky Linux Local Security Checks	2026/6/25	2026/6/29	high
323118	Oracle Linux 9 : kernel (ELSA-2026-27789)	Nessus	Oracle Linux Local Security Checks	2026/6/26	2026/6/26	high
332386	Photon OS 5.0: Linux PHSA-2026-5.0-92-0842	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/8/18	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high